Vulnerability database

10,137 results · page 34 of 203

• Aug 6, 2026Author PHP Object Injection in Jeg Kit for Elementor <= 3.2.10 versions.CVE-2026-65549 · WordPress plugins & themes · reported by PatchstackHigh 7.2

  Author PHP Object Injection in Jeg Kit for Elementor <= 3.2.10 versions.

  Affected

  up to 3.2.10

  What to do

  Affects up to 3.2.10. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 6, 2026Unauthenticated SQL Injection in Qode Tours <= 3.1.3.1 versions.CVE-2026-65546 · WordPress plugins & themes · reported by PatchstackCritical 9.3

  Unauthenticated SQL Injection in Qode Tours <= 3.1.3.1 versions.

  Affected

  up to 3.1.3.1

  What to do

  Affects up to 3.1.3.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 6, 2026Unauthenticated Cross Site Scripting (XSS) in AI Engine <= 3.6.8 versions.CVE-2026-65545 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in AI Engine <= 3.6.8 versions.

  Affected

  up to 3.6.8

  What to do

  Affects up to 3.6.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 6, 2026Unauthenticated Cross Site Scripting (XSS) in Super Socializer <= 7.14.5 versions.CVE-2026-65544 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in Super Socializer <= 7.14.5 versions.

  Affected

  up to 7.14.5

  What to do

  Affects up to 7.14.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 6, 2026Unauthenticated Broken Authentication in Super Socializer <= 7.14.5 versions.CVE-2026-65542 · WordPress plugins & themes · reported by PatchstackHigh 8.8

  Unauthenticated Broken Authentication in Super Socializer <= 7.14.5 versions.

  Affected

  up to 7.14.5

  What to do

  Affects up to 7.14.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 6, 2026Unauthenticated Broken Access Control in Staff Training <= 1.0.7 versions.CVE-2026-65541 · WordPress plugins & themes · reported by PatchstackHigh 7.3

  Unauthenticated Broken Access Control in Staff Training <= 1.0.7 versions.

  Affected

  up to 1.0.7

  What to do

  Affects up to 1.0.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 6, 2026Unauthenticated Insecure Direct Object References (IDOR) in Formidable Forms Signature Online Contract Automation <= 2.0.1 versions.CVE-2026-65523 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Unauthenticated Insecure Direct Object References (IDOR) in Formidable Forms Signature Online Contract Automation <= 2.0.1 versions.

  Affected

  up to 2.0.1

  What to do

  Affects up to 2.0.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 6, 2026Unauthenticated SQL Injection in WP OAuth Server <= 6.2.0 versions.CVE-2026-65520 · WordPress plugins & themes · reported by PatchstackCritical 9.3

  Unauthenticated SQL Injection in WP OAuth Server <= 6.2.0 versions.

  Affected

  up to 6.2.0

  What to do

  Affects up to 6.2.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 6, 2026Unauthenticated Cross Site Scripting (XSS) in Easy PayPal Buy Now Button <= 2.0.4 versions.CVE-2026-65517 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in Easy PayPal Buy Now Button <= 2.0.4 versions.

  Affected

  up to 2.0.4

  What to do

  Affects up to 2.0.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 6, 2026Unauthenticated Cross Site Scripting (XSS) in AffiliateWP <= 2.35.0 versions.CVE-2026-65515 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in AffiliateWP <= 2.35.0 versions.

  Affected

  up to 2.35.0

  What to do

  Affects up to 2.35.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 6, 2026Unauthenticated Cross Site Scripting (XSS) in Simply Schedule Appointments <= 1.6.12.10 versions.CVE-2026-65513 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in Simply Schedule Appointments <= 1.6.12.10 versions.

  Affected

  up to 1.6.12.10

  What to do

  Affects up to 1.6.12.10. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 6, 2026Unauthenticated Cross Site Scripting (XSS) in wpDataTables <= 7.5.1 versions.CVE-2026-65509 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in wpDataTables <= 7.5.1 versions.

  Affected

  up to 7.5.1

  What to do

  Affects up to 7.5.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 6, 2026Unauthenticated SQL Injection in Simply Schedule Appointments <= 1.6.12.10 versions.CVE-2026-65508 · WordPress plugins & themes · reported by PatchstackCritical 9.3

  Unauthenticated SQL Injection in Simply Schedule Appointments <= 1.6.12.10 versions.

  Affected

  up to 1.6.12.10

  What to do

  Affects up to 1.6.12.10. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 6, 2026Unauthenticated Privilege Escalation in AIWU <= 1.5.6 versions.CVE-2026-65507 · WordPress plugins & themes · reported by PatchstackCritical 9.8

  Unauthenticated Privilege Escalation in AIWU <= 1.5.6 versions.

  Affected

  up to 1.5.6

  What to do

  Affects up to 1.5.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 6, 2026Unauthenticated Broken Access Control in BOX NOW Delivery Croatia <= 3.3.0 versions.CVE-2026-65504 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Unauthenticated Broken Access Control in BOX NOW Delivery Croatia <= 3.3.0 versions.

  Affected

  up to 3.3.0

  What to do

  Affects up to 3.3.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 6, 2026Unauthenticated Bypass Vulnerability in Element Pack Elementor Addons <= 8.7.13 versions.CVE-2026-65502 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Unauthenticated Bypass Vulnerability in Element Pack Elementor Addons <= 8.7.13 versions.

  Affected

  up to 8.7.13

  What to do

  Affects up to 8.7.13. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 6, 2026Unauthenticated Cross Site Scripting (XSS) in SiteGuard WP Plugin <= 1.8.6 versions.CVE-2026-61982 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in SiteGuard WP Plugin <= 1.8.6 versions.

  Affected

  up to 1.8.6

  What to do

  Affects up to 1.8.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 6, 2026Unauthenticated Cross Site Scripting (XSS) in Ninja Tables <= 5.2.9 versions.CVE-2026-61964 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in Ninja Tables <= 5.2.9 versions.

  Affected

  up to 5.2.9

  What to do

  Affects up to 5.2.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 6, 2026Unauthenticated Cross Site Scripting (XSS) in Media LIbrary Assistant <= 3.38 versions.CVE-2026-61963 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in Media LIbrary Assistant <= 3.38 versions.

  Affected

  up to 3.38

  What to do

  Affects up to 3.38. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 6, 2026Unauthenticated Cross Site Scripting (XSS) in EmbedPress <= 4.5.6 versions.CVE-2026-61961 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in EmbedPress <= 4.5.6 versions.

  Affected

  up to 4.5.6

  What to do

  Affects up to 4.5.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 6, 2026Unauthenticated Broken Access Control in SureCart <= 4.6.2 versions.CVE-2026-32548 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Unauthenticated Broken Access Control in SureCart <= 4.6.2 versions.

  Affected

  up to 4.6.2

  What to do

  Affects up to 4.6.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 6, 2026Unauthenticated Bypass Vulnerability in CAPTCHA 4WP <= 7.6.0 versions.CVE-2026-32469 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Unauthenticated Bypass Vulnerability in CAPTCHA 4WP <= 7.6.0 versions.

  Affected

  up to 7.6.0

  What to do

  Affects up to 7.6.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 6, 2026Unauthenticated Insecure Direct Object References (IDOR) in Mercado Pago payments for WooCommerce <= 8.9.0 versions.CVE-2026-28180 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Unauthenticated Insecure Direct Object References (IDOR) in Mercado Pago payments for WooCommerce <= 8.9.0 versions.

  Affected

  up to 8.9.0

  What to do

  Affects up to 8.9.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 6, 2026Unauthenticated Cross Site Request Forgery (CSRF) in Tracking Code Manager <= 2.6.0 versions.CVE-2026-28172 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Request Forgery (CSRF) in Tracking Code Manager <= 2.6.0 versions.

  Affected

  up to 2.6.0

  What to do

  Affects up to 2.6.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 6, 2026Unauthenticated Sensitive Data Exposure in YITH WooCommerce Zoom Magnifier <= 2.52.0 versions.CVE-2026-28169 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Unauthenticated Sensitive Data Exposure in YITH WooCommerce Zoom Magnifier <= 2.52.0 versions.

  Affected

  up to 2.52.0

  What to do

  Affects up to 2.52.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 6, 2026Unauthenticated Cross Site Scripting (XSS) in Forminator <= 1.56.0 versions.CVE-2026-28143 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in Forminator <= 1.56.0 versions.

  Affected

  up to 1.56.0

  What to do

  Affects up to 1.56.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 6, 2026Unauthenticated Cross Site Scripting (XSS) in NextGEN Gallery <= 4.2.3 versions.CVE-2026-28141 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in NextGEN Gallery <= 4.2.3 versions.

  Affected

  up to 4.2.3

  What to do

  Affects up to 4.2.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 6, 2026Unauthenticated Broken Access Control in JetFormBuilder <= 3.6.4.1 versions.CVE-2026-28140 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Unauthenticated Broken Access Control in JetFormBuilder <= 3.6.4.1 versions.

  Affected

  up to 3.6.4.1

  What to do

  Affects up to 3.6.4.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 6, 2026Unauthenticated PHP Object Injection in Ajax Search Lite <= 4.14.4 versions.CVE-2026-28139 · WordPress plugins & themes · reported by PatchstackCritical 9.8

  Unauthenticated PHP Object Injection in Ajax Search Lite <= 4.14.4 versions.

  Affected

  up to 4.14.4

  What to do

  Affects up to 4.14.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 6, 2026Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.13.1 versions.CVE-2026-28082 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.13.1 versions.

  Affected

  up to 3.8.13.1

  What to do

  Affects up to 3.8.13.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 6, 2026Unauthenticated Privilege Escalation in Kadence WooCommerce Email Designer <= 1.5.19 versions.CVE-2026-28005 · WordPress plugins & themes · reported by PatchstackCritical 9.8

  Unauthenticated Privilege Escalation in Kadence WooCommerce Email Designer <= 1.5.19 versions.

  Affected

  up to 1.5.19

  What to do

  Affects up to 1.5.19. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 6, 2026Unauthenticated Broken Access Control in Ultimate Store Kit Elementor Addons <= 3.0.5 versions.CVE-2026-25403 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Unauthenticated Broken Access Control in Ultimate Store Kit Elementor Addons <= 3.0.5 versions.

  Affected

  up to 3.0.5

  What to do

  Affects up to 3.0.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 6, 2026Breakdance: Missing AuthorizationCVE-2026-65551 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Missing Authorization vulnerability in Soflyy Breakdance allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Breakdance: from n/a before 2.7.

  Product

  Breakdance

  Fixed in

  2.7

  What to do

  Update Breakdance to 2.7 or newer.

  Full record and what to do →NVD recordpatchstack.com

• Aug 6, 2026Ad Inserter – Ad Manager & AdSense Ads: Authorization bypassCVE-2026-11983 · WordPress plugins & themes · reported by WordfenceMedium 5.3

  The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.8.16 due to a missing capability check in the `ai_ajax` function. This makes it possible for unauthenticated attackers to view the contents of ad blocks that an administrator has restricted to administrator-only visibility.

  Product

  Ad Inserter – Ad Manager & AdSense Ads

  Affected

  up to 2.8.16

  What to do

  Affects up to 2.8.16. Update Ad Inserter – Ad Manager & AdSense Ads to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Aug 6, 2026Accelerate: Unauthorized modification of dataCVE-2025-9266 · WordPress plugins & themes · reported by WordfenceMedium 4.3

  The Accelerate theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the enqueue_scripts() function in all versions up to, and including, 1.5.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to install and activate the ThemeGrill Demo Importer plugin.

  Product

  Accelerate

  Affected

  up to 1.5.3

  What to do

  Affects up to 1.5.3. Update Accelerate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordthemes.trac.wordpress.orgwordfence.com

• Aug 6, 2026Events Manager: Does not perform any authorization check on a REST route that serves temporarily stored file uploadsCVE-2026-18050 · WordPress plugins & themes · reported by WPScanHigh 7.5

  The Events Manager WordPress plugin before 7.4 does not perform any authorization check on a REST route that serves temporarily stored file uploads, allowing unauthenticated users to retrieve another user's in-progress upload when its temporary identifier is known. The identifier is high-entropy, is disclosed only to the uploader, and the file is removed on submission or by a scheduled cleanup, so a cross-user read is not achievable by guessing alone.

  Product

  Events Manager

  Fixed in

  7.4

  What to do

  Update Events Manager to 7.4 or newer.

  Full record and what to do →NVD recordwpscan.com

• Aug 6, 2026Stripe Payment Forms by WP Full Pay: Does not verify that the caller owns the Stripe payment intent referenced by two unauthenticated payment-form AJAX actionsCVE-2026-16734 · WordPress plugins & themes · reported by WPScanHigh 7.5

  The Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.2 does not verify that the caller owns the Stripe payment intent referenced by two unauthenticated payment-form AJAX actions, allowing an unauthenticated visitor — using a nonce that is embedded in every public page containing a payment form — to change the amount of a payment intent that the Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.2 then updates server-side through the Stripe API with the store's secret key. An ownership check added in 8.5.0 was applied to only one payment-intent handler, leaving the pricing-recalculation and payment-intent-update actions unprotected against amount manipulation.

  Product

  Stripe Payment Forms by WP Full Pay

  Fixed in

  8.5.2

  What to do

  Update Stripe Payment Forms by WP Full Pay to 8.5.2 or newer.

  Full record and what to do →NVD recordwpscan.com

• Aug 6, 2026ProfileGrid: Does not perform authorization checks before returning a group's member listCVE-2026-16290 · WordPress plugins & themes · reported by WPScanMedium 5.3

  The ProfileGrid WordPress plugin before 6.0.0.0 does not perform authorization checks before returning a group's member list, and registers the handler for unauthenticated users, allowing any unauthenticated visitor to disclose the members and their identifiers of any group, including private or closed ones, bypassing the ProfileGrid WordPress plugin before 6.0.0.0's member-visibility setting.

  Product

  ProfileGrid

  Fixed in

  6.0.0.0

  What to do

  Update ProfileGrid to 6.0.0.0 or newer.

  Full record and what to do →NVD recordwpscan.com

• Aug 6, 2026Newsletters: Does not authenticate or validate a bounce-processing request before fetching a user-supplied URL on the server sideCVE-2026-16268 · WordPress plugins & themes · reported by WPScanHigh 8.2

  The Newsletters WordPress plugin before 4.16 does not authenticate or validate a bounce-processing request before fetching a user-supplied URL on the server side, allowing unauthenticated attackers to make the site issue requests to arbitrary internal or external hosts.

  Product

  Newsletters

  Fixed in

  4.16

  What to do

  Update Newsletters to 4.16 or newer.

  Full record and what to do →NVD recordwpscan.com

• Aug 6, 2026Drag and Drop Multiple File Upload for WooCommerce: Does not prevent unauthenticated users from obtaining a valid nonce that is the only control gating its file-deletion routineCVE-2026-16054 · WordPress plugins & themes · reported by WPScanCritical 9.1

  The Drag and Drop Multiple File Upload for WooCommerce WordPress plugin before 1.1.8 does not prevent unauthenticated users from obtaining a valid nonce that is the only control gating its file-deletion routine, allowing anonymous attackers to delete files staged in its upload directory and irreversibly destroy customers' pending order attachments.

  Product

  Drag and Drop Multiple File Upload for WooCommerce

  Fixed in

  1.1.8

  What to do

  Update Drag and Drop Multiple File Upload for WooCommerce to 1.1.8 or newer.

  Full record and what to do →NVD recordwpscan.com

• Aug 6, 2026Google Authenticator: Does not verify a CSRF nonceCVE-2026-14204 · WordPress plugins & themes · reported by WPScanMedium 6.5

  The Google Authenticator WordPress plugin before 0.56 does not verify a CSRF nonce when saving its two-factor setup, allowing attackers to trick a logged-in user into overwriting their own 2FA secret with an attacker-controlled value, which enables two-factor authentication and locks the victim out of their account.

  Product

  Google Authenticator

  Fixed in

  0.56

  What to do

  Update Google Authenticator to 0.56 or newer.

  Full record and what to do →NVD recordwpscan.com

• Aug 6, 2026SEO Redirection: Does not perform a capability check in one of its authenticated AJAX actionsCVE-2026-13703 · WordPress plugins & themes · reported by WPScanMedium 5.4

  The SEO Redirection Plugin WordPress plugin before 9.19 does not perform a capability check in one of its authenticated AJAX actions, allowing any logged-in user such as a subscriber to read the site's configured 301 redirect rules, including their source and destination URLs.

  Product

  SEO Redirection

  Fixed in

  9.19

  What to do

  Update SEO Redirection to 9.19 or newer.

  Full record and what to do →NVD recordwpscan.com

• Aug 6, 2026EONSR AEO Agent: Does not perform any authorisation check on one of its REST API routes and disables HTML sanitisation before saving the postCVE-2026-11588 · WordPress plugins & themes · reported by WPScanMedium 6.1

  The EONSR AEO Agent WordPress plugin through 3.7.9 does not perform any authorisation check on one of its REST API routes and disables HTML sanitisation before saving the post, allowing unauthenticated attackers to create administrator-attributed published posts containing arbitrary web scripts that execute in the browser of any visitor, including administrators (Stored XSS).

  Product

  EONSR AEO Agent

  Affected

  up to 3.7.9

  What to do

  Affects up to 3.7.9. Update EONSR AEO Agent to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordwpscan.com

• Aug 6, 2026Nexter Blocks: Does not sanitize uploaded SVG files and allows SVG uploads for any user able to upload files (Author by default)CVE-2025-15678 · WordPress plugins & themes · reported by WPScanMedium 6.1

  The Nexter Blocks WordPress plugin before 5.0.2 does not sanitize uploaded SVG files and allows SVG uploads for any user able to upload files (Author by default), allowing them to upload a file containing malicious JavaScript that executes when the file is accessed, leading to Stored Cross-Site Scripting.

  Product

  Nexter Blocks

  Fixed in

  5.0.2

  What to do

  Update Nexter Blocks to 5.0.2 or newer.

  Full record and what to do →NVD recordwpscan.com

• Aug 6, 2026WPMU DEV Dashboard: Authentication BypassCVE-2026-15459 · WordPress plugins & themes · reported by WordfenceHigh 8.1

  The WPMU DEV Dashboard plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.0.0. On sites not yet connected to the WPMU DEV Hub — the default state after installation — the site API key that keys the WDP-AUTH request signature is empty, making the signature verified by validate_hash() trivially forgeable; version 5.0.0 additionally removed the replay check in validate_nonce(), and the remote handler is bound to the public init hook with no capability check. This makes it possible for unauthenticated attackers to invoke privileged Hub actions — including installing and activating a plugin from an attacker-supplied URL (resulting in remote code execution), deleting plugins and themes, upgrading WordPress core, or logging in as an administrator via SSO. Sites connected to a WPMU DEV account, which have a non-empty 64-character API key, are not affected.

  Product

  WPMU DEV Dashboard

  Affected

  up to 5.0.0

  What to do

  Affects up to 5.0.0. Update WPMU DEV Dashboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordwpmudev.comwordfence.com

• Aug 5, 2026wiseCampaign – WooCommerce Conversions Made Easy: Unauthorized modification and disclosure of dataCVE-2026-7529 · WordPress plugins & themes · reported by WordfenceHigh 7.5

  The wiseCampaign – WooCommerce Conversions Made Easy plugin for WordPress is vulnerable to unauthorized modification and disclosure of data due to every one of its REST API endpoints being registered with `permission_callback => '__return_true'` in all versions up to, and including, 1.1.16. This makes it possible for unauthenticated attackers to read and modify the plugin's banner, stockbar, and core settings — including saving/updating banner records, toggling stockbar/feature flags, changing the active banner, and uploading background-image files via wp_handle_upload() — without any nonce or capability check.

  Product

  wiseCampaign – WooCommerce Conversions Made Easy

  Affected

  up to 1.1.16

  What to do

  Affects up to 1.1.16. Update wiseCampaign – WooCommerce Conversions Made Easy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Aug 5, 2026Udimi Tools: Unauthorized modification of dataCVE-2026-7456 · WordPress plugins & themes · reported by WordfenceMedium 6.5

  The Udimi Tools plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `ajax_disconnect()` function in all versions up to, and including, 3.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete the plugin's six configuration options — including the API key, connected Udimi user email, and tracking-script payload — effectively disconnecting the site from the configured Udimi account. The companion `ajax_connect()` handler is missing the same checks, allowing the same low-privilege attackers to overwrite those options with an attacker-supplied API key.

  Product

  Udimi Tools

  Affected

  up to 3.2

  What to do

  Affects up to 3.2. Update Udimi Tools to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Aug 5, 2026Layouts for WPBakery: Unauthorized actionsCVE-2026-7726 · WordPress plugins & themes · reported by WordfenceMedium 6.5

  The Layouts for WPBakery plugin for WordPress is vulnerable to unauthorized actions due to a missing capability check on the `Layouts_WPB_Remote::template_sync()` callback registered via `wp_ajax_nopriv_handle_sync` in all versions up to, and including, 1.1.3. This makes it possible for unauthenticated attackers to force the WordPress server to issue outbound HTTP requests to the plugin vendor's external API (`https://www.layoutsforwpbakery.com/wp-json/layoutsforwpbakery/v1/{templates,categories}`) and to write the JSON-decoded responses verbatim into the site's `wp_options` table via `set_transient()` — at any rate the attacker chooses, with no nonce verification, capability check, or rate limiting.

  Product

  Layouts for WPBakery

  Affected

  up to 1.1.3

  What to do

  Affects up to 1.1.3. Update Layouts for WPBakery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Aug 5, 2026MailChimp Forms by MailMunch: Unauthorized modification of dataCVE-2026-7520 · WordPress plugins & themes · reported by WordfenceHigh 8.1

  The MailChimp Forms by MailMunch plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `sign_in()` and `sign_up()` AJAX handlers in all versions up to, and including, 3.2.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to relink the site's MailMunch integration to an attacker-controlled MailMunch account by submitting attacker-supplied credentials. Once relinked, all subscriber data captured by the plugin's forms is delivered to the attacker, and the forms/landing pages rendered on the site are pulled from the attacker's MailMunch account.

  Product

  MailChimp Forms by MailMunch

  Affected

  up to 3.2.7

  What to do

  Affects up to 3.2.7. Update MailChimp Forms by MailMunch to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Aug 5, 2026Xpro Addons: Unauthorized creation of dataCVE-2026-7105 · WordPress plugins & themes · reported by WordfenceMedium 4.3

  The Xpro Addons plugin for WordPress is vulnerable to unauthorized creation of data due to a missing capability check on the `get_menu_content_editor()` function in all versions up to, and including, 1.5.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create arbitrary published posts of the `xpro_content` custom post type with attacker-controlled titles. The created posts are publicly queryable on the front-end, enabling content injection, SEO spam, and database pollution.

  Product

  Xpro Addons

  Affected

  up to 1.5.1

  What to do

  Affects up to 1.5.1. Update Xpro Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.