Vulnerability database

15,357 results · page 32 of 308

• Aug 13, 2026Unauthenticated Cross Site Scripting (XSS) in Smart Online Order for Clover <= 1.6.1 versions.CVE-2026-66700 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in Smart Online Order for Clover <= 1.6.1 versions.

  Affected

  up to 1.6.1

  What to do

  Affects up to 1.6.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 13, 2026Unauthenticated Cross Site Scripting (XSS) in SureDash <= 1.10.1 versions.CVE-2026-66698 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in SureDash <= 1.10.1 versions.

  Affected

  up to 1.10.1

  What to do

  Affects up to 1.10.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 13, 2026Unauthenticated Cross Site Scripting (XSS) in Colissimo Officiel : Méthodes de livraison pour WooCommerce <= 2.10.0 versions.CVE-2026-66697 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in Colissimo Officiel : Méthodes de livraison pour WooCommerce <= 2.10.0 versions.

  Affected

  up to 2.10.0

  What to do

  Affects up to 2.10.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 13, 2026Customer Cross Site Scripting (XSS) in WpBookingly <= 1.3.2 versions.CVE-2026-66687 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Customer Cross Site Scripting (XSS) in WpBookingly <= 1.3.2 versions.

  Affected

  up to 1.3.2

  What to do

  Affects up to 1.3.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 13, 2026Unauthenticated Cross Site Scripting (XSS) in MultiParcels Shipping For WooCommerce <= 1.30.36 versions.CVE-2026-66655 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in MultiParcels Shipping For WooCommerce <= 1.30.36 versions.

  Affected

  up to 1.30.36

  What to do

  Affects up to 1.30.36. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 13, 2026Subscriber Cross Site Scripting (XSS) in Accordion <= 3.0.6 versions.CVE-2026-66471 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Subscriber Cross Site Scripting (XSS) in Accordion <= 3.0.6 versions.

  Affected

  up to 3.0.6

  What to do

  Affects up to 3.0.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 13, 2026Unauthenticated Cross Site Scripting (XSS) in Local Delivery Drivers for WooCommerce <= 3.0.0 versions.CVE-2026-66468 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in Local Delivery Drivers for WooCommerce <= 3.0.0 versions.

  Affected

  up to 3.0.0

  What to do

  Affects up to 3.0.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 13, 2026Subscriber Cross Site Scripting (XSS) in FluentCommunity <= 2.7.5 versions.CVE-2026-66467 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Subscriber Cross Site Scripting (XSS) in FluentCommunity <= 2.7.5 versions.

  Affected

  up to 2.7.5

  What to do

  Affects up to 2.7.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 13, 2026Subscriber Cross Site Scripting (XSS) in AfterShip Tracking <= 1.18.1 versions.CVE-2026-66460 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Subscriber Cross Site Scripting (XSS) in AfterShip Tracking <= 1.18.1 versions.

  Affected

  up to 1.18.1

  What to do

  Affects up to 1.18.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 13, 2026Subscriber Cross Site Scripting (XSS) in Profile Extra Fields by BestWebSoft <= 1.3.4 versions.CVE-2026-66456 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Subscriber Cross Site Scripting (XSS) in Profile Extra Fields by BestWebSoft <= 1.3.4 versions.

  Affected

  up to 1.3.4

  What to do

  Affects up to 1.3.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 13, 2026Unauthenticated Cross Site Scripting (XSS) in Geo Mashup <= 1.13.18 versions.CVE-2026-66449 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in Geo Mashup <= 1.13.18 versions.

  Affected

  up to 1.13.18

  What to do

  Affects up to 1.13.18. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 13, 2026Unauthenticated Cross Site Scripting (XSS) in Visitor Traffic Real Time Statistics Pro <= 11.10 versions.CVE-2026-66429 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in Visitor Traffic Real Time Statistics Pro <= 11.10 versions.

  Affected

  up to 11.10

  What to do

  Affects up to 11.10. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 13, 2026Unauthenticated Cross Site Scripting (XSS) in WP-Stats <= 2.56 versions.CVE-2026-66426 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in WP-Stats <= 2.56 versions.

  Affected

  up to 2.56

  What to do

  Affects up to 2.56. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 13, 2026Unauthenticated Cross Site Scripting (XSS) in Agrion <= 1.0.0 versions.CVE-2026-65580 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in Agrion <= 1.0.0 versions.

  Affected

  up to 1.0.0

  What to do

  Affects up to 1.0.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 13, 2026Unauthenticated Cross Site Scripting (XSS) in Mang Board WP <= 2.3.4 versions.CVE-2026-61974 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in Mang Board WP <= 2.3.4 versions.

  Affected

  up to 2.3.4

  What to do

  Affects up to 2.3.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 13, 2026Unauthenticated Cross Site Scripting (XSS) in GeekyBot <= 1.2.6 versions.CVE-2026-61965 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in GeekyBot <= 1.2.6 versions.

  Affected

  up to 1.2.6

  What to do

  Affects up to 1.2.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 13, 2026Unauthenticated Cross Site Scripting (XSS) in WP Full Stripe Free <= 8.5.0 versions.CVE-2026-61960 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in WP Full Stripe Free <= 8.5.0 versions.

  Affected

  up to 8.5.0

  What to do

  Affects up to 8.5.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 13, 2026Unauthenticated Cross Site Scripting (XSS) in Knowledge Base for Documentation, FAQs with AI Assistance <= 17.211.0 versions.CVE-2026-28187 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in Knowledge Base for Documentation, FAQs with AI Assistance <= 17.211.0 versions.

  Affected

  up to 17.211.0

  What to do

  Affects up to 17.211.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 13, 2026Subscriber Cross Site Scripting (XSS) in AcyMailing SMTP Newsletter <= 10.11.1 versions.CVE-2026-28182 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Subscriber Cross Site Scripting (XSS) in AcyMailing SMTP Newsletter <= 10.11.1 versions.

  Affected

  up to 10.11.1

  What to do

  Affects up to 10.11.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 13, 2026Unauthenticated Cross Site Scripting (XSS) in Visitors Traffic Real Time Statistics <= 8.11 versions.CVE-2026-28175 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in Visitors Traffic Real Time Statistics <= 8.11 versions.

  Affected

  up to 8.11

  What to do

  Affects up to 8.11. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 13, 2026Unauthenticated Cross Site Scripting (XSS) in Blog Floating Button <= 1.4.20 versions.CVE-2026-28170 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in Blog Floating Button <= 1.4.20 versions.

  Affected

  up to 1.4.20

  What to do

  Affects up to 1.4.20. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 13, 2026Unauthenticated Cross Site Scripting (XSS) in Do Lasso <= 358 versions.CVE-2026-28158 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in Do Lasso <= 358 versions.

  Affected

  up to 358

  What to do

  Affects up to 358. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 13, 2026Unauthenticated Cross Site Scripting (XSS) in Business Directory <= 6.4.25 versions.CVE-2026-28004 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in Business Directory <= 6.4.25 versions.

  Affected

  up to 6.4.25

  What to do

  Affects up to 6.4.25. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 13, 2026Unauthenticated Cross Site Scripting (XSS) in Maspik – Spam blacklist <= 2.9.1 versions.CVE-2026-28003 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in Maspik – Spam blacklist <= 2.9.1 versions.

  Affected

  up to 2.9.1

  What to do

  Affects up to 2.9.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 13, 2026Unauthenticated Cross Site Scripting (XSS) in Welcart e-Commerce <= 2.11.31 versions.CVE-2026-27539 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in Welcart e-Commerce <= 2.11.31 versions.

  Affected

  up to 2.11.31

  What to do

  Affects up to 2.11.31. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 13, 2026Unauthenticated Cross Site Scripting (XSS) in Popup by Supsystic <= 1.11.2 versions.CVE-2026-27537 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Unauthenticated Cross Site Scripting (XSS) in Popup by Supsystic <= 1.11.2 versions.

  Affected

  up to 1.11.2

  What to do

  Affects up to 1.11.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 13, 2026Unauthenticated Cross Site Scripting (XSS) in MailChimp Subscribe Forms <= 4.3.3 versions.CVE-2026-27536 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in MailChimp Subscribe Forms <= 4.3.3 versions.

  Affected

  up to 4.3.3

  What to do

  Affects up to 4.3.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 13, 2026PPWP – Password Protect Pages: Stored Cross-Site ScriptingCVE-2026-3639 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The PPWP – Password Protect Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `ppwp` shortcode attributes in all versions up to, and including, 1.9.21 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

  Product

  PPWP – Password Protect Pages

  Affected

  up to 1.9.21

  What to do

  Affects up to 1.9.21. Update PPWP – Password Protect Pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Aug 13, 2026Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder: Stored Cross-Site ScriptingCVE-2026-18146 · WordPress plugins & themes · reported by WordfenceHigh 7.2

  The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Notification Smartcode Values in all versions up to, and including, 6.2.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute in the browser of an administrator (or any user with the Fluent Forms entry-viewing capability) when they view the form's entry Submission Logs in the WordPress admin dashboard. Exploitation requires that a site administrator or Fluent Forms manager has configured an email notification whose subject or static (direct) Send To value references an attacker-influenced Smartcode such as an input_password field value, a cookie value, or submission.response.

  Product

  Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder

  Affected

  up to 6.2.11

  What to do

  Affects up to 6.2.11. Update Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Aug 12, 2026Payment Gateway for PayPal on WooCommerce: Does not verify that payment actually succeeded before completing an order in its PayPal return handler: it reads attacker-controlled parametersCVE-2026-16621 · WordPress plugins & themes · reported by WPScanMedium 5.3

  The Payment Gateway for PayPal on WooCommerce WordPress plugin before 9.2.1 does not verify that payment actually succeeded before completing an order in its PayPal return handler: it reads attacker-controlled parameters, performs no amount comparison and no order-ownership check, and completes the order even when the server-side gateway verification fails, allowing an unauthenticated attacker to mark arbitrary orders as paid without paying.

  Product

  Payment Gateway for PayPal on WooCommerce

  Fixed in

  9.2.1

  What to do

  Update Payment Gateway for PayPal on WooCommerce to 9.2.1 or newer.

  Full record and what to do →NVD recordwpscan.com

• Aug 12, 2026Royal Addons for Elementor: Does not validate a widget setting used to build an HTML tag before outputting itCVE-2026-19217 · WordPress plugins & themes · reported by WPScanMedium 5.4

  The Royal Addons for Elementor WordPress plugin before 1.7.1065 does not validate a widget setting used to build an HTML tag before outputting it, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks.

  Product

  Royal Addons for Elementor

  Fixed in

  1.7.1065

  What to do

  Update Royal Addons for Elementor to 1.7.1065 or newer.

  Full record and what to do →NVD recordwpscan.com

• Aug 12, 2026WP Photo Album Plus: Does not perform any capability or nonce check on one of its public endpoint actions and builds an option name from a client-supplied value without restricting it to its own optionsCVE-2026-18049 · WordPress plugins & themes · reported by WPScanHigh 7.5

  The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not perform any capability or nonce check on one of its public endpoint actions and builds an option name from a client-supplied value without restricting it to its own options, allowing unauthenticated users to read the value of other autoloaded options whose names end in a matching suffix.

  Product

  WP Photo Album Plus

  Fixed in

  9.2.07.002

  What to do

  Update WP Photo Album Plus to 9.2.07.002 or newer.

  Full record and what to do →NVD recordwpscan.com

• Aug 12, 2026WP Photo Album Plus: Does not sanitise and escape a parameter before reflecting it into an inline script blockCVE-2026-17013 · WordPress plugins & themes · reported by WPScanMedium 6.1

  The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not sanitise and escape a parameter before reflecting it into an inline script block, which could allow unauthenticated attackers to perform Reflected Cross-Site Scripting attacks against anyone who is tricked into opening a crafted link to a page displaying one of its galleries.

  Product

  WP Photo Album Plus

  Fixed in

  9.2.07.002

  What to do

  Update WP Photo Album Plus to 9.2.07.002 or newer.

  Full record and what to do →NVD recordwpscan.com

• Aug 12, 2026Wallet for WooCommerce: Does not verify the amount actually collected for a wallet top-up before crediting the walletCVE-2026-16538 · WordPress plugins & themes · reported by WPScanCritical 9.1

  The Wallet for WooCommerce WordPress plugin before 1.6.10 does not verify the amount actually collected for a wallet top-up before crediting the wallet, allowing customers to top up their wallet balance for less than its value.

  Product

  Wallet for WooCommerce

  Fixed in

  1.6.10

  What to do

  Update Wallet for WooCommerce to 1.6.10 or newer.

  Full record and what to do →NVD recordwpscan.com

• Aug 12, 2026PowerPress Podcasting plugin by Blubrry: Does not validate one of its Podcast Episode URL settings before performing a server-side request with itCVE-2026-16294 · WordPress plugins & themes · reported by WPScanHigh 7.1

  The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.17.1 does not validate one of its Podcast Episode URL settings before performing a server-side request with it, allowing users with a role as low as Contributor to perform Server-Side Request Forgery attacks that can target internal services.

  Product

  PowerPress Podcasting plugin by Blubrry

  Fixed in

  11.17.1

  What to do

  Update PowerPress Podcasting plugin by Blubrry to 11.17.1 or newer.

  Full record and what to do →NVD recordwpscan.com

• Aug 12, 2026Welcart e-Commerce: Does not sanitise or escape a product field before outputting it on the product pagesCVE-2026-16066 · WordPress plugins & themes · reported by WPScanMedium 5.4

  The Welcart e-Commerce WordPress plugin before 2.11.34 does not sanitise or escape a product field before outputting it on the product pages, allowing users with the Author role and above to inject arbitrary web scripts that execute in the browser of any visitor viewing the product page.

  Product

  Welcart e-Commerce

  Fixed in

  2.11.34

  What to do

  Update Welcart e-Commerce to 2.11.34 or newer.

  Full record and what to do →NVD recordwpscan.com

• Aug 12, 2026Cookie Consent: Does not correctly enforce its intended administrator-only capability check on its consent-settings REST routesCVE-2026-15388 · WordPress plugins & themes · reported by WPScanMedium 4.3

  The Cookie Consent WordPress plugin before 0.0.10 does not correctly enforce its intended administrator-only capability check on its consent-settings REST routes, so they fall back to an authentication-only gate, allowing any authenticated user such as a subscriber to update the Cookie Consent WordPress plugin before 0.0.10's consent settings and, on sites connected to the vendor's paid plan, read stored visitor consent logs.

  Product

  Cookie Consent

  Fixed in

  0.0.10

  What to do

  Update Cookie Consent to 0.0.10 or newer.

  Full record and what to do →NVD recordwpscan.com

• Aug 12, 2026KiviCare: Does not verify that the requesting user owns the records being accessedCVE-2026-13612 · WordPress plugins & themes · reported by WPScanMedium 4.3

  The KiviCare WordPress plugin before 4.5.2 does not verify that the requesting user owns the records being accessed, allowing authenticated patient-level users to read other patients' bills, invoices and appointment details.

  Product

  KiviCare

  Fixed in

  4.5.2

  What to do

  Update KiviCare to 4.5.2 or newer.

  Full record and what to do →NVD recordwpscan.com

• Aug 12, 2026Eventin: Does not properly restrict access to individual order recordsCVE-2026-13177 · WordPress plugins & themes · reported by WPScanMedium 4.3

  The Eventin WordPress plugin before 4.1.20 does not properly restrict access to individual order records, allowing users with contributor-level access and above to read other customers' order data including personal information by iterating order identifiers.

  Product

  Eventin

  Fixed in

  4.1.20

  What to do

  Update Eventin to 4.1.20 or newer.

  Full record and what to do →NVD recordwpscan.com

• Aug 12, 2026Eventin: Does not perform an authorization check on its waiting-list registration handlerCVE-2026-13171 · WordPress plugins & themes · reported by WPScanHigh 8.2

  The Eventin WordPress plugin before 4.1.20 does not perform an authorization check on its waiting-list registration handler, allowing unauthenticated users to create WordPress user accounts for arbitrary email addresses and inject order records.

  Product

  Eventin

  Fixed in

  4.1.20

  What to do

  Update Eventin to 4.1.20 or newer.

  Full record and what to do →NVD recordwpscan.com

• Aug 12, 2026Eventin: Does not properly restrict access to stored customer recordsCVE-2026-13168 · WordPress plugins & themes · reported by WPScanMedium 6.5

  The Eventin WordPress plugin before 4.1.20 does not properly restrict access to stored customer records, allowing users with contributor-level access and above to read other customers' personal data such as names and email addresses.

  Product

  Eventin

  Fixed in

  4.1.20

  What to do

  Update Eventin to 4.1.20 or newer.

  Full record and what to do →NVD recordwpscan.com

• Aug 11, 2026GeoDirectory – WP Business Directory Plugin and Classified Listings Directory: Arbitrary file deletionCVE-2026-19091 · WordPress plugins & themes · reported by WordfenceHigh 8.1

  The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_revision function in all versions up to, and including, 2.8.169. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). By placing post_type=attachment exclusively in the query string to bypass the consistency check, an attacker can convert an auto-draft GeoDirectory listing into a WordPress attachment with attacker-controlled file paths injected into attachment metadata, which the delete_revision handler then dereferences and unlinks without any post-type or path validation.

  Product

  GeoDirectory – WP Business Directory Plugin and Classified Listings Directory

  Affected

  up to 2.8.169

  What to do

  Affects up to 2.8.169. Update GeoDirectory – WP Business Directory Plugin and Classified Listings Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordgithub.comgithub.com

• Aug 11, 2026AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for: Authorization bypassCVE-2026-15426 · WordPress plugins & themes · reported by WordfenceHigh 8.8

  The AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 10.11.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to overwrite the BCC field of the acy_notification_cms notification template, causing subsequent WordPress password-reset emails — including those targeting administrator accounts — to be silently copied to an attacker-controlled address, enabling account takeover via the captured reset link. Successful exploitation requires the site administrator to have enabled the "Send website emails with AcyMailing" option, which routes WordPress core notification emails through AcyMailing's templating system.

  Product

  AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for

  Affected

  up to 10.11.1

  What to do

  Affects up to 10.11.1. Update AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Aug 11, 2026Kirki – Freeform Page Builder, Website Builder & Customizer: Stored Cross-Site ScriptingCVE-2026-16974 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the post_meta Shortcode in all versions up to, and including, 6.2.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

  Product

  Kirki – Freeform Page Builder, Website Builder & Customizer

  Affected

  up to 6.2.0

  What to do

  Affects up to 6.2.0. Update Kirki – Freeform Page Builder, Website Builder & Customizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com

• Aug 10, 2026RSS Aggregator by Feedzy: Does not verify that the requesting user owns or is allowed to edit the import job named in the requestCVE-2026-18934 · WordPress plugins & themes · reported by WPScanMedium 5.5

  The RSS Aggregator by Feedzy WordPress plugin before 5.2.6 does not verify that the requesting user owns or is allowed to edit the import job named in the request, allowing users with author-level access and above to permanently delete the posts created by another user's import job, reset its deduplication and scheduling state, disable it, or clear its error log. One of the affected actions performs no object-type check either, so arbitrary posts and pages can also be unpublished regardless of who owns them.

  Product

  RSS Aggregator by Feedzy

  Fixed in

  5.2.6

  What to do

  Update RSS Aggregator by Feedzy to 5.2.6 or newer.

  Full record and what to do →NVD recordwpscan.com

• Aug 10, 2026Saitama Addon Pack: Does not sanitise and escape certain post metadata values before outputting themCVE-2026-17010 · WordPress plugins & themes · reported by WPScanMedium 5.4

  The Saitama Addon Pack WordPress plugin through 1.0.8 does not sanitise and escape certain post metadata values before outputting them, allowing users with contributor-level access and above to inject stored Cross-Site Scripting payloads that execute in the browser of a higher-privileged user who reviews the content.

  Product

  Saitama Addon Pack

  Affected

  up to 1.0.8

  What to do

  Affects up to 1.0.8. Update Saitama Addon Pack to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordwpscan.com

• Aug 10, 2026MotoPress Hotel Booking: Does not verify record ownership before updating customer recordsCVE-2026-15238 · WordPress plugins & themes · reported by WPScanMedium 5.4

  The MotoPress Hotel Booking WordPress plugin before 6.2.3 does not verify record ownership before updating customer records, allowing any authenticated user with a low-privileged account (Subscriber and above) to modify or overwrite the personal data of any customer by supplying an arbitrary identifier.

  Product

  MotoPress Hotel Booking

  Fixed in

  6.2.3

  What to do

  Update MotoPress Hotel Booking to 6.2.3 or newer.

  Full record and what to do →NVD recordwpscan.com

• Aug 10, 2026s2Member: Does not escape several shortcode attributes before outputting them inside an inline script contextCVE-2026-15047 · WordPress plugins & themes · reported by WPScanMedium 6.8

  The s2Member WordPress plugin before 260805 does not escape several shortcode attributes before outputting them inside an inline script context, allowing users with contributor-level access to inject arbitrary JavaScript that executes when a viewer opens the post (stored XSS).

  Product

  s2Member

  Fixed in

  260805

  What to do

  Update s2Member to 260805 or newer.

  Full record and what to do →NVD recordwpscan.com

• Aug 10, 2026Customer Reviews for WooCommerce: Does not perform nonce or capability checks on several settings-related AJAX actionsCVE-2026-14941 · WordPress plugins & themes · reported by WPScanMedium 5.4

  The Customer Reviews for WooCommerce WordPress plugin before 5.116.0 does not perform nonce or capability checks on several settings-related AJAX actions, allowing users with minimal permissions such as Subscribers to invoke administrative settings handlers, update Customer Reviews for WooCommerce WordPress plugin before 5.116.0 options, and disclose store configuration.

  Product

  Customer Reviews for WooCommerce

  Fixed in

  5.116.0

  What to do

  Update Customer Reviews for WooCommerce to 5.116.0 or newer.

  Full record and what to do →NVD recordwpscan.com

• Aug 10, 2026Podcast Player: Does not validate the destination of a server-side request built from user-supplied inputCVE-2026-14860 · WordPress plugins & themes · reported by WPScanMedium 5.3

  The Podcast Player WordPress plugin before 8.3.1 does not validate the destination of a server-side request built from user-supplied input, allowing unauthenticated attackers to make the server issue requests to arbitrary hosts and read back responses that parse as RSS/XML.

  Product

  Podcast Player

  Fixed in

  8.3.1

  What to do

  Update Podcast Player to 8.3.1 or newer.

  Full record and what to do →NVD recordwpscan.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.