Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
8,914 results · page 32 of 179
Feb 16, 2026RegistrationMagic: Does not have proper capability checksCVE-2026-0929 · WordPress plugins & themes · reported by WPScanMedium 4.3
The RegistrationMagic WordPress plugin before 6.0.7.2 does not have proper capability checks, allowing subscribers and above to create forms on the site.
- Product
- RegistrationMagic
- Fixed in
- 6.0.7.2
- What to do
- Update RegistrationMagic to 6.0.7.2 or newer.
Feb 3, 2026Unicamp: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-25027 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove Unicamp unicamp allows PHP Local File Inclusion.This issue affects Unicamp: from n/a through <= 2.7.1.
- Product
- Unicamp
- Affected
- up to 2.7.1
- What to do
- Affects up to 2.7.1. Update Unicamp to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 3, 2026KiviCare: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-25022 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Iqonic Design KiviCare kivicare-clinic-management-system allows Blind SQL Injection.This issue affects KiviCare: from n/a through <= 3.6.16.
- Product
- KiviCare
- Affected
- up to 3.6.16
- What to do
- Affects up to 3.6.16. Update KiviCare to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 3, 2026The Events Calendar Shortcode & Block: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-24988 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brian Hogg The Events Calendar Shortcode & Block the-events-calendar-shortcode allows Stored XSS.This issue affects The Events Calendar Shortcode & Block: from n/a through <= 3.1.1.
- Product
- The Events Calendar Shortcode & Block
- Affected
- up to 3.1.1
- What to do
- Affects up to 3.1.1. Update The Events Calendar Shortcode & Block to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 3, 2026JetElements For Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-24958 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetElements For Elementor jet-elements allows DOM-Based XSS.This issue affects JetElements For Elementor: from n/a through <= 2.7.12.2.
- Product
- JetElements For Elementor
- Affected
- up to 2.7.12.2
- What to do
- Affects up to 2.7.12.2. Update JetElements For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 3, 2026Seriously Simple Podcasting: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-24952 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Craig Hewitt Seriously Simple Podcasting seriously-simple-podcasting allows Stored XSS.This issue affects Seriously Simple Podcasting: from n/a through <= 3.14.1.
- Product
- Seriously Simple Podcasting
- Affected
- up to 3.14.1
- What to do
- Affects up to 3.14.1. Update Seriously Simple Podcasting to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 3, 2026Better Search: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-24938 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ajay Better Search better-search allows Stored XSS.This issue affects Better Search: from n/a through <= 4.2.1.
- Product
- Better Search
- Affected
- up to 4.2.1
- What to do
- Affects up to 4.2.1. Update Better Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 2, 2026Spirit Framework: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2024-54263 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Talemy Spirit Framework allows PHP Local File Inclusion.This issue affects Spirit Framework: from n/a through 1.2.13.
- Product
- Spirit Framework
- Affected
- up to 1.2.13
- What to do
- Affects up to 1.2.13. Update Spirit Framework to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 2, 2026User Profile Builder: Does not have a proper password reset processCVE-2025-15030 · WordPress plugins & themes · reported by WPScanCritical 9.8
The User Profile Builder WordPress plugin before 3.15.2 does not have a proper password reset process, allowing a few unauthenticated requests to reset the password of any user by knowing their username, such as administrator ones, and therefore gain access to their account
- Product
- User Profile Builder
- Fixed in
- 3.15.2
- What to do
- Update User Profile Builder to 3.15.2 or newer.
Jan 29, 2026Custom Login Page Customizer: Does not have a proper password reset processCVE-2025-14975 · WordPress plugins & themes · reported by WPScanHigh 8.1
The Custom Login Page Customizer WordPress plugin before 2.5.4 does not have a proper password reset process, allowing a few unauthenticated requests to reset the password of any user by knowing their username, such as administrator ones, and therefore gain access to their account
- Product
- Custom Login Page Customizer
- Fixed in
- 2.5.4
- What to do
- Update Custom Login Page Customizer to 2.5.4 or newer.
Jan 28, 2026User Activity Log: Does not properly handle failed login attempts in some casesCVE-2025-13471 · WordPress plugins & themes · reported by WPScanMedium 5.3
The User Activity Log WordPress plugin through 2.2 does not properly handle failed login attempts in some cases, allowing unauthenticated users to set arbitrary options to 1 (for example to enable User Registration when it has been turned off)
- Product
- User Activity Log
- Affected
- up to 2.2
- What to do
- Affects up to 2.2. Update User Activity Log to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2026EduBlink Core: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-24635 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in DevsBlink EduBlink Core edublink-core allows PHP Local File Inclusion.This issue affects EduBlink Core: from n/a through <= 2.0.7.
- Product
- EduBlink Core
- Affected
- up to 2.0.7
- What to do
- Affects up to 2.0.7. Update EduBlink Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2026Delay Redirects: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-24632 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jagdish1o1 Delay Redirects delay-redirects allows DOM-Based XSS.This issue affects Delay Redirects: from n/a through <= 1.0.0.
- Product
- Delay Redirects
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Delay Redirects to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2026Stylish Cost Calculator: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-24630 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Design Stylish Cost Calculator stylish-cost-calculator allows Stored XSS.This issue affects Stylish Cost Calculator: from n/a through <= 8.2.9.
- Product
- Stylish Cost Calculator
- Affected
- up to 8.2.9
- What to do
- Affects up to 8.2.9. Update Stylish Cost Calculator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2026Web Accessibility with Max Access: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-24629 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ability, Inc Web Accessibility with Max Access accessibility-toolbar allows Stored XSS.This issue affects Web Accessibility with Max Access: from n/a through <= 2.1.0.
- Product
- Web Accessibility with Max Access
- Affected
- up to 2.1.0
- What to do
- Affects up to 2.1.0. Update Web Accessibility with Max Access to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2026Logo Slider: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-24626 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LogicHunt Logo Slider logo-slider-wp allows Stored XSS.This issue affects Logo Slider: from n/a through <= 5.1.1.
- Product
- Logo Slider
- Affected
- up to 5.1.1
- What to do
- Affects up to 5.1.1. Update Logo Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2026Neoforum: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-24624 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in saeros1984 Neoforum neoforum allows Blind SQL Injection.This issue affects Neoforum: from n/a through <= 1.0.
- Product
- Neoforum
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Neoforum to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2026Neoforum: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-24623 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in saeros1984 Neoforum neoforum allows Reflected XSS.This issue affects Neoforum: from n/a through <= 1.0.
- Product
- Neoforum
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Neoforum to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2026Terms descriptions: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-24621 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vladimir Statsenko Terms descriptions terms-descriptions allows DOM-Based XSS.This issue affects Terms descriptions: from n/a through <= 3.4.9.
- Product
- Terms descriptions
- Affected
- up to 3.4.9
- What to do
- Affects up to 3.4.9. Update Terms descriptions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2026Landing Page Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-24620 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PluginOps Landing Page Builder page-builder-add allows Stored XSS.This issue affects Landing Page Builder: from n/a through <= 1.5.3.4.
- Product
- Landing Page Builder
- Affected
- up to 1.5.3.4
- What to do
- Affects up to 1.5.3.4. Update Landing Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2026Easy Modal: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-24617 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Daniel Iser Easy Modal easy-modal allows Stored XSS.This issue affects Easy Modal: from n/a through <= 2.1.0.
- Product
- Easy Modal
- Affected
- up to 2.1.0
- What to do
- Affects up to 2.1.0. Update Easy Modal to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2026Flex QR Code Generator: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-24614 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Devsbrain Flex QR Code Generator flex-qr-code-generator allows DOM-Based XSS.This issue affects Flex QR Code Generator: from n/a through <= 1.2.10.
- Product
- Flex QR Code Generator
- Affected
- up to 1.2.10
- What to do
- Affects up to 1.2.10. Update Flex QR Code Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2026Laurent: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-24609 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Elated-Themes Laurent laurent allows PHP Local File Inclusion.This issue affects Laurent: from n/a through <= 3.1.
- Product
- Laurent
- Affected
- up to 3.1
- What to do
- Affects up to 3.1. Update Laurent to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2026Laurent Core: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-24608 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Elated-Themes Laurent Core laurent-core allows PHP Local File Inclusion.This issue affects Laurent Core: from n/a through <= 2.4.1.
- Product
- Laurent Core
- Affected
- up to 2.4.1
- What to do
- Affects up to 2.4.1. Update Laurent Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2026Penci Pay Writer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-24601 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PenciDesign Penci Pay Writer penci-pay-writer allows Stored XSS.This issue affects Penci Pay Writer: from n/a through <= 1.5.
- Product
- Penci Pay Writer
- Affected
- up to 1.5
- What to do
- Affects up to 1.5. Update Penci Pay Writer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2026Penci Review: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-24600 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PenciDesign Penci Review penci-review allows Stored XSS.This issue affects Penci Review: from n/a through <= 3.5.
- Product
- Penci Review
- Affected
- up to 3.5
- What to do
- Affects up to 3.5. Update Penci Review to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2026Livemesh Addons for WPBakery Page Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-24594 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in livemesh Livemesh Addons for WPBakery Page Builder addons-for-visual-composer allows Stored XSS.This issue affects Livemesh Addons for WPBakery Page Builder: from n/a through <= 3.9.4.
- Product
- Livemesh Addons for WPBakery Page Builder
- Affected
- up to 3.9.4
- What to do
- Affects up to 3.9.4. Update Livemesh Addons for WPBakery Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2026Turn Yoast SEO FAQ Block to Accordion: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-24591 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in yasir129 Turn Yoast SEO FAQ Block to Accordion faq-schema-block-to-accordion allows Stored XSS.This issue affects Turn Yoast SEO FAQ Block to Accordion: from n/a through <= 1.0.6.
- Product
- Turn Yoast SEO FAQ Block to Accordion
- Affected
- up to 1.0.6
- What to do
- Affects up to 1.0.6. Update Turn Yoast SEO FAQ Block to Accordion to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2026Tutor LMS BunnyNet Integration: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-24584 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum Tutor LMS BunnyNet Integration tutor-lms-bunnynet-integration allows DOM-Based XSS.This issue affects Tutor LMS BunnyNet Integration: from n/a through <= 1.0.0.
- Product
- Tutor LMS BunnyNet Integration
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Tutor LMS BunnyNet Integration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2026UX Flat: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-24576 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in COP UX Flat ux-flat allows Stored XSS.This issue affects UX Flat: from n/a through <= 5.4.0.
- Product
- UX Flat
- Affected
- up to 5.4.0
- What to do
- Affects up to 5.4.0. Update UX Flat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2026Nelio Content: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-24572 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Nelio Software Nelio Content nelio-content allows Blind SQL Injection.This issue affects Nelio Content: from n/a through <= 4.2.0.
- Product
- Nelio Content
- Affected
- up to 4.2.0
- What to do
- Affects up to 4.2.0. Update Nelio Content to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2026Textmetrics: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)CVE-2026-24564 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Israpil Textmetrics webtexttool allows Code Injection.This issue affects Textmetrics: from n/a through <= 3.6.5.
- Product
- Textmetrics
- Affected
- up to 3.6.5
- What to do
- Affects up to 3.6.5. Update Textmetrics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2026ABG Rich Pins: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-24558 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in antoniobg ABG Rich Pins abg-rich-pins allows Stored XSS.This issue affects ABG Rich Pins: from n/a through <= 1.1.
- Product
- ABG Rich Pins
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update ABG Rich Pins to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2026ArtPlacer Widget: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-24555 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in artplacer ArtPlacer Widget artplacer-widget allows Stored XSS.This issue affects ArtPlacer Widget: from n/a through <= 2.23.2.
- Product
- ArtPlacer Widget
- Affected
- up to 2.23.2
- What to do
- Affects up to 2.23.2. Update ArtPlacer Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2026Blockons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-24550 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kaira Blockons blockons allows Stored XSS.This issue affects Blockons: from n/a through <= 1.2.19.
- Product
- Blockons
- Affected
- up to 1.2.19
- What to do
- Affects up to 1.2.19. Update Blockons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2026Omnipress: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-24538 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in omnipressteam Omnipress omnipress allows PHP Local File Inclusion.This issue affects Omnipress: from n/a through <= 1.6.7.
- Product
- Omnipress
- Affected
- up to 1.6.7
- What to do
- Affects up to 1.6.7. Update Omnipress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2026Prowess: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-24531 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Select-Themes Prowess prowess allows PHP Local File Inclusion.This issue affects Prowess: from n/a through <= 2.3.
- Product
- Prowess
- Affected
- up to 2.3
- What to do
- Affects up to 2.3. Update Prowess to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2026Nova Blocks: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-24528 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pixelgrade Nova Blocks nova-blocks allows DOM-Based XSS.This issue affects Nova Blocks: from n/a through <= 2.1.9.
- Product
- Nova Blocks
- Affected
- up to 2.1.9
- What to do
- Affects up to 2.1.9. Update Nova Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2026Email Inquiry & Cart Options for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-24526 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Steve Truman Email Inquiry & Cart Options for WooCommerce woocommerce-email-inquiry-cart-options allows DOM-Based XSS.This issue affects Email Inquiry & Cart Options for WooCommerce: from n/a through <= 3.5.0.
- Product
- Email Inquiry & Cart Options for WooCommerce
- Affected
- up to 3.5.0
- What to do
- Affects up to 3.5.0. Update Email Inquiry & Cart Options for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Kentha Elementor Widgets: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-24390 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in QantumThemes Kentha Elementor Widgets kentha-elementor allows PHP Local File Inclusion.This issue affects Kentha Elementor Widgets: from n/a through < 3.1.
- Product
- Kentha Elementor Widgets
- What to do
- Update Kentha Elementor Widgets to the newest version.
Jan 22, 2026Gallery PhotoBlocks: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-24389 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Gallery PhotoBlocks photoblocks-grid-gallery allows DOM-Based XSS.This issue affects Gallery PhotoBlocks: from n/a through <= 1.3.2.
- Product
- Gallery PhotoBlocks
- Affected
- up to 1.3.2
- What to do
- Affects up to 1.3.2. Update Gallery PhotoBlocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026B Slider: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-24383 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins B Slider b-slider allows DOM-Based XSS.This issue affects B Slider: from n/a through <= 2.0.6.
- Product
- B Slider
- Affected
- up to 2.0.6
- What to do
- Affects up to 2.0.6. Update B Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Traveler: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-24367 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in shinetheme Traveler traveler allows Blind SQL Injection.This issue affects Traveler: from n/a through < 3.2.8.
- Product
- Traveler
- What to do
- Update Traveler to the newest version.
Jan 22, 2026LearnPress – Course Review: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-24361 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThimPress LearnPress – Course Review learnpress-course-review allows Stored XSS.This issue affects LearnPress – Course Review: from n/a through <= 4.1.9.
- Product
- LearnPress – Course Review
- Affected
- up to 4.1.9
- What to do
- Affects up to 4.1.9. Update LearnPress – Course Review to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Houzez Theme - Functionality: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-24355 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in favethemes Houzez Theme - Functionality houzez-theme-functionality allows Stored XSS.This issue affects Houzez Theme - Functionality: from n/a through <= 4.2.6.
- Product
- Houzez Theme - Functionality
- Affected
- up to 4.2.6
- What to do
- Affects up to 4.2.6. Update Houzez Theme - Functionality to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Penci Shortcodes & Performance: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-24354 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PenciDesign Penci Shortcodes & Performance penci-shortcodes allows DOM-Based XSS.This issue affects Penci Shortcodes & Performance: from n/a through <= 6.1.
- Product
- Penci Shortcodes & Performance
- Affected
- up to 6.1
- What to do
- Affects up to 6.1. Update Penci Shortcodes & Performance to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Gyan Elements: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-23978 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Softwebmedia Gyan Elements gyan-elements allows PHP Local File Inclusion.This issue affects Gyan Elements: from n/a through <= 2.2.1.
- Product
- Gyan Elements
- Affected
- up to 2.2.1
- What to do
- Affects up to 2.2.1. Update Gyan Elements to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Modula Image Gallery: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-23976 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Modula Image Gallery modula-best-grid-gallery allows Stored XSS.This issue affects Modula Image Gallery: from n/a through <= 2.13.4.
- Product
- Modula Image Gallery
- Affected
- up to 2.13.4
- What to do
- Affects up to 2.13.4. Update Modula Image Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Golo: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-23975 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in uxper Golo golo allows PHP Local File Inclusion.This issue affects Golo: from n/a through < 1.7.5.
- Product
- Golo
- What to do
- Update Golo to the newest version.
Jan 22, 2026FireStorm Professional Real Estate: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-22470 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in FireStorm Plugins FireStorm Professional Real Estate fs-real-estate-plugin allows Blind SQL Injection.This issue affects FireStorm Professional Real Estate: from n/a through <= 2.7.11.
- Product
- FireStorm Professional Real Estate
- Affected
- up to 2.7.11
- What to do
- Affects up to 2.7.11. Update FireStorm Professional Real Estate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.