Updated 5 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

344new WordPress flaws this week

390,080entries in the database

1,025 results · page 4 of 21

Jul 9, 2026Block, Suspend, Report for BuddyPress: Stored Cross-Site ScriptingCVE-2026-4653 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Block, Suspend, Report for BuddyPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'link' parameter in versions up to and including 3.6.4. This is due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with subscriber-level access and above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Block, Suspend, Report for BuddyPress
Affected
up to 3.6.4
What to do
Affects up to 3.6.4. Update Block, Suspend, Report for BuddyPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 8, 2026Blocksy Companion Pro: Unauthenticated arbitrary file uploadCVE-2026-58480 · WordPress plugins & themes · reported by VulnCheckCritical 9.2
Blocksy Companion Pro plugin for WordPress before 2.1.47 contains an unauthenticated arbitrary file upload vulnerability that allows attackers to upload executable files by bypassing extension validation in the save_attachments function exposed through the Advanced Reviews feature. Attackers can exploit the Custom Fonts extension's flawed strpos() substring check by uploading double-extension filenames such as shell.woff2.php, causing the validation to pass on the substring match while the web server executes the file as PHP, achieving remote code execution.
Product
Blocksy Companion Pro
Fixed in
2.1.47
What to do
Update Blocksy Companion Pro to 2.1.47 or newer.
Full record and what to do →NVD record patchstack.com wordpress.org
Jul 8, 2026Nexter Blocks – Gutenberg Blocks, Page Builder & AI Website Builder: Stored Cross-Site ScriptingCVE-2026-6740 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Nexter Blocks – Gutenberg Blocks, Page Builder & AI Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'commentIcon' parameter in all versions up to, and including, 4.7.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Nexter Blocks – Gutenberg Blocks, Page Builder & AI Website Builder
Affected
up to 4.7.4
What to do
Affects up to 4.7.4. Update Nexter Blocks – Gutenberg Blocks, Page Builder & AI Website Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jul 3, 2026GenerateBlocks: Stored Cross-Site ScriptingCVE-2026-9756 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The GenerateBlocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Headline Block 'linkMetaFieldType' Dynamic Link Attribute in all versions up to, and including, 2.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. A contributor-level attacker can store a JavaScript payload in their own profile description (allowlisted by get_safe_user_meta_keys()) and prepend 'javascript:' via the linkMetaFieldType attribute, creating a fully attacker-controlled href that executes when any user, including an administrator, clicks the rendered headline link.
Product
GenerateBlocks
Affected
up to 2.2.1
What to do
Affects up to 2.2.1. Update GenerateBlocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 2, 2026Unauthenticated Remote Code Execution (RCE) in Blocksy Companion Pro <= 2.1.46 versions.CVE-2026-57624 · WordPress plugins & themes · reported by PatchstackCritical 10
Unauthenticated Remote Code Execution (RCE) in Blocksy Companion Pro <= 2.1.46 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jul 2, 2026JetFormBuilder — Dynamic Blocks Form Builder: Authorization bypassCVE-2026-13459 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.6.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to retrieve every distinct value stored under any arbitrary wp_postmeta key on the site — including WooCommerce billing PII such as _billing_email, _billing_phone, and _billing_address fields, order totals, attachment paths, and any third-party plugin credentials or tokens stored in post meta — provided at least one published JetFormBuilder form with a get_from_db generator field exists on the site. Exploitation requires that the target site has at least one published jet-form-builder post containing a field whose generator_function is set to get_from_db; an attacker must supply a matching form ID, field name, and generator ID in the request, but all of these can be discovered by browsing the site's public forms.
Product
JetFormBuilder — Dynamic Blocks Form Builder
Affected
up to 3.6.3
What to do
Affects up to 3.6.3. Update JetFormBuilder — Dynamic Blocks Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 1, 2026Qi Blocks: Insecure Direct Object ReferenceCVE-2026-10096 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Qi Blocks plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.4.9 via the 'page_id' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with author-level access and above, to modify the stored Qi Blocks styles of arbitrary posts, templates, or widgets they do not own — including site-wide surfaces via the reserved 'template' and 'widget' page_id values — enabling unauthorized frontend defacement, content hiding, and degradation of any page on the site. The endpoint's permission_callback checks only the generic edit_posts and publish_posts capabilities, meaning any user with the built-in Author role satisfies the check regardless of post ownership.
Product
Qi Blocks
Affected
up to 1.4.9
What to do
Affects up to 1.4.9. Update Qi Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 1, 2026Kadence Blocks – Gutenberg Blocks for Page Builder Features: Insecure Direct Object ReferenceCVE-2026-12904 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Kadence Blocks – Gutenberg Blocks for Page Builder Features plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to and including 3.7.7. This is due to a mismatch between the object used for authorization and the object actually accessed in the Optimize_Rest_Controller's create_item(), get_item(), delete_item(), and bulk_delete_items() endpoints — authorization is checked via current_user_can('edit_post'/'delete_post', $post_id) against the user-supplied post_id, while the storage layer keys analysis records on sha256($post_path) from a separately supplied, attacker-controlled post_path parameter, with no enforcement that post_path corresponds to post_id. This makes it possible for authenticated attackers, with Contributor-level access and above, to read or delete optimizer analysis records belonging to posts owned by other users by submitting their own post_id (which passes the capability check) together with the victim post's path.
Product
Kadence Blocks – Gutenberg Blocks for Page Builder Features
Affected
up to 3.7.7
What to do
Affects up to 3.7.7. Update Kadence Blocks – Gutenberg Blocks for Page Builder Features to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 1, 2026Kadence Blocks — Page Builder Toolkit for Gutenberg Editor: Authorization bypassCVE-2026-12902 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Kadence Blocks — Page Builder Toolkit for Gutenberg Editor plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.7.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to create arbitrary Media Library attachments by downloading remote images to the site's uploads directory via wp_upload_bits() and wp_insert_attachment(), bypassing the upload_files capability boundary.
Product
Kadence Blocks — Page Builder Toolkit for Gutenberg Editor
Affected
up to 3.7.7
What to do
Affects up to 3.7.7. Update Kadence Blocks — Page Builder Toolkit for Gutenberg Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 27, 2026Gutenverse – WordPress Blocks, Page Builder & Site Editor: Stored Cross-Site ScriptingCVE-2026-12399 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Gutenverse – WordPress Blocks, Page Builder & Site Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.8.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with editor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
Gutenverse – WordPress Blocks, Page Builder & Site Editor
Affected
up to 3.8.0
What to do
Affects up to 3.8.0. Update Gutenverse – WordPress Blocks, Page Builder & Site Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 26, 2026Contributor Cross Site Scripting (XSS) in Magazine Blocks <= 1.8.3 versions.CVE-2026-57650 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Cross Site Scripting (XSS) in Magazine Blocks <= 1.8.3 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jun 26, 2026Unauthenticated Insecure Direct Object References (IDOR) in Blocksy Companion Pro <= 2.1.46 versions.CVE-2026-57630 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Insecure Direct Object References (IDOR) in Blocksy Companion Pro <= 2.1.46 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jun 26, 2026Contributor Remote Code Execution (RCE) in Blocksy Companion Pro <= 2.1.45 versions.CVE-2026-57315 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Contributor Remote Code Execution (RCE) in Blocksy Companion Pro <= 2.1.45 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jun 26, 2026Unauthenticated Broken Access Control in MailChimp Block <= 1.1.15 versions.CVE-2026-56063 · WordPress plugins & themes · reported by PatchstackHigh 8.3
Unauthenticated Broken Access Control in MailChimp Block <= 1.1.15 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jun 25, 2026InPost PL: Does not verify that the request originates from the legitimate buyer before allowing the WooCommerce order parcel-locker destination to be updatedCVE-2026-9702 · WordPress plugins & themes · reported by WPScanHigh 7.5
The InPost PL WordPress plugin before 1.9.1 does not verify that the request originates from the legitimate buyer before allowing the WooCommerce order parcel-locker destination to be updated, allowing unauthenticated attackers to silently redirect the shipping destination of any pending or processing order on the site.
Product
InPost PL
Fixed in
1.9.1
What to do
Update InPost PL to 1.9.1 or newer.
Full record and what to do →NVD record wpscan.com
Jun 25, 2026Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns: Stored Cross-Site ScriptingCVE-2026-10833 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'configurablePrefix' Block Attribute in all versions up to, and including, 6.1.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns
Affected
up to 6.1.4
What to do
Affects up to 6.1.4. Update Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 24, 2026MIR blocks and shortcodes: Stored Cross-Site ScriptingCVE-2026-8896 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The MIR blocks and shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'title' attribute (and other attributes such as 'ready_animation_text') of the 'msc_stats' shortcode in versions up to, and including, 1.0.0. This is due to insufficient input sanitization and output escaping on user supplied shortcode attributes inside the msc_stats() rendering function. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
MIR blocks and shortcodes
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update MIR blocks and shortcodes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 19, 2026Blocksy Companion: Stored Cross-Site ScriptingCVE-2026-12430 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Blocksy Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.1.45 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with editor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
Blocksy Companion
Affected
up to 2.1.45
What to do
Affects up to 2.1.45. Update Blocksy Companion to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 19, 2026BetterDocs - Knowledge Base Docs & FAQ Solution for Elementor & Block Editor: Stored Cross-Site ScriptingCVE-2026-12157 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The BetterDocs - Knowledge Base Docs & FAQ Solution for Elementor & Block Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the blockId attribute of the betterdocs/category-slate-layout Gutenberg block in versions up to, and including, 4.5.3. This is due to insufficient input sanitization and output escaping in the CategorySlateLayout::render() method, which echoes the blockId block attribute directly into an HTML class attribute without esc_attr(). This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
BetterDocs - Knowledge Base Docs & FAQ Solution for Elementor & Block Editor
Affected
up to 4.5.3
What to do
Affects up to 4.5.3. Update BetterDocs - Knowledge Base Docs & FAQ Solution for Elementor & Block Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 18, 2026Services Section Block – Showcase Service Details in Grid or Columns: Stored Cross-Site ScriptingCVE-2026-11402 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Services Section Block – Showcase Service Details in Grid or Columns plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'link' Block Attribute in all versions up to, and including, 1.4.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload persists inside HTML comments in post_content, bypassing wp_kses_post sanitization at save time, and executes via both the primary service link anchor and a secondary title-wrapped anchor when the linkIn option is set to 'title'.
Product
Services Section Block – Showcase Service Details in Grid or Columns
Affected
up to 1.4.4
What to do
Affects up to 1.4.4. Update Services Section Block – Showcase Service Details in Grid or Columns to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 18, 2026Kadence Blocks — Page Builder Toolkit for Gutenberg Editor: Sensitive Information ExposureCVE-2026-11357 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Kadence Blocks — Page Builder Toolkit for Gutenberg Editor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.7.5 via the editor_assets_variables. This makes it possible for authenticated attackers, with contributor-level access and above, to extract the site's connected Kadence account license key, license owner email, api_key, api_email, and license domain from the browser console by inspecting window.kadence_blocks_params.proData. Exploitation requires only that an administrator has previously connected a valid Kadence license; the full credential bundle is then readable by any Contributor-level user from the block editor client context without any server-side request manipulation.
Product
Kadence Blocks — Page Builder Toolkit for Gutenberg Editor
Affected
up to 3.7.5
What to do
Affects up to 3.7.5. Update Kadence Blocks — Page Builder Toolkit for Gutenberg Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 17, 2026WP Travel Gutenberg Blocks: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-54808 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP Travel WP Travel Gutenberg Blocks allows Blind SQL Injection. This issue affects WP Travel Gutenberg Blocks: from n/a through 3.9.4.
Product
WP Travel Gutenberg Blocks
Affected
up to 3.9.4
What to do
Affects up to 3.9.4. Update WP Travel Gutenberg Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 17, 2026Contributor Remote Code Execution (RCE) in Blocksy Companion Pro <= 2.1.37 versions.CVE-2026-40783 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Contributor Remote Code Execution (RCE) in Blocksy Companion Pro <= 2.1.37 versions.
Affected
up to 2.1.37
What to do
Affects up to 2.1.37. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 17, 2026Unauthenticated SQL Injection in Blocksy Companion Pro < 2.1.29 versions.CVE-2026-39596 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in Blocksy Companion Pro < 2.1.29 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jun 16, 2026Static Block: Insecure Direct Object ReferenceCVE-2026-10780 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Static Block plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.2. This is due to the static_block_content() shortcode handler retrieving a post via get_post() using an attacker-supplied 'id' attribute and outputting its post_content without verifying the post's status (private, draft, pending) or the requesting user's capability to view it. This makes it possible for authenticated attackers, with contributor-level access and above, to read the contents of arbitrary posts, including private and draft static blocks (and any other post type) created by administrators, by embedding the [static_block_content id="X"] shortcode in their own content and previewing it.
Product
Static Block
Affected
up to 2.2
What to do
Affects up to 2.2. Update Static Block to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 15, 2026Contributor Privilege Escalation in B Blocks <= 2.0.31 versions.CVE-2026-39579 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Contributor Privilege Escalation in B Blocks <= 2.0.31 versions.
Affected
up to 2.0.31
What to do
Affects up to 2.0.31. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 12, 2026Secure Copy Content Protection and Content Locking: Does not sanitise and escape some of its settingsCVE-2026-9269 · WordPress plugins & themes · reported by WPScanLow 3.5
The Secure Copy Content Protection and Content Locking WordPress plugin before 5.1.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Secure Copy Content Protection and Content Locking
Fixed in
5.1.5
What to do
Update Secure Copy Content Protection and Content Locking to 5.1.5 or newer.
Full record and what to do →NVD record wpscan.com
Jun 9, 2026Blocksy: PHP Object Injection leading to Remote Code ExecutionCVE-2026-8365 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Blocksy theme for WordPress is vulnerable to PHP Object Injection leading to Remote Code Execution via the 'blocksy_meta' REST API field and the V200 database migration in versions up to and including 2.1.35. This is due to insufficient input sanitization in the blocksy_sanitize_post_meta_options() function, which only blocks values containing '<' or '>' and does not prevent serialized PHP object strings from being stored in post meta, combined with the SearchReplacer::run_recursively() function unconditionally deserializing all string values via @unserialize() during migration without restricting allowed classes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject a serialized Blocksy\RaiiPattern object into post meta that, when the V200 migration runs on an upgraded site, is deserialized and triggers RaiiPattern::__destruct(), which executes arbitrary PHP callables via call_user_func().
Product
Blocksy
Affected
up to 2.1.35
What to do
Affects up to 2.1.35. Update Blocksy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themes.trac.wordpress.org themes.trac.wordpress.org
Jun 9, 2026Custom Block Builder: Does not consistently check the unfiltered_html capability across all paths that write to its block template code fieldsCVE-2026-8981 · WordPress plugins & themes · reported by WPScanLow 3.5
The Custom Block Builder WordPress plugin before 4.3.0 does not consistently check the unfiltered_html capability across all paths that write to its block template code fields, allowing administrators on multisite installations (or single-site installs with DISALLOW_UNFILTERED_HTML defined) to inject arbitrary JavaScript that executes for any visitor of pages embedding the affected block.
Product
Custom Block Builder
Fixed in
4.3.0
What to do
Update Custom Block Builder to 4.3.0 or newer.
Full record and what to do →NVD record wpscan.com
Jun 8, 2026Recipe Card Blocks Lite: Stored Cross-Site ScriptingCVE-2026-3011 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Recipe Card Blocks Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the recipe block's 'summary' and 'notes' attributes in all versions up to, and including, 3.4.13. This is due to the 'WPZOOM_Helpers::deserialize_block_attributes' method converting unicode-encoded sequences back into HTML characters after sanitization has already been applied. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that execute whenever a user accesses the published post or the print view of an injected recipe.
Product
Recipe Card Blocks Lite
Affected
up to 3.4.13
What to do
Affects up to 3.4.13. Update Recipe Card Blocks Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 4, 2026Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns: Server-Side Request ForgeryCVE-2026-10586 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 6.1.3 via the `save_ai_generated_image()` function. This makes it possible for authenticated attackers, with Author-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
Product
Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns
Affected
up to 6.1.3
What to do
Affects up to 6.1.3. Update Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 30, 2026Spectra Gutenberg Blocks – Website Builder for the Block Editor: Remote Code ExecutionCVE-2026-7465 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Spectra Gutenberg Blocks – Website Builder for the Block Editor plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.19.25. This makes it possible for authenticated attackers, with Contributor-level access and above, to execute code on the server. Exploitation requires a two-block payload embedded in post content: the first block registers a fake uagb/-prefixed block type with an attacker-specified render_callback, and the second block of the same fake type triggers invocation of that callback via call_user_func() during sequential block rendering in the same page request.
Product
Spectra Gutenberg Blocks – Website Builder for the Block Editor
Affected
up to 2.19.25
What to do
Affects up to 2.19.25. Update Spectra Gutenberg Blocks – Website Builder for the Block Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 28, 2026GutenBee – Gutenberg Blocks: Arbitrary File UploadCVE-2026-9227 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The GutenBee – Gutenberg Blocks plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.20.1 via the gutenbee_file_and_ext_json function. This is due to a flawed strpos() substring check that only verifies whether the filename contains the string '.json' rather than confirming the filename ends with a .json extension, allowing double-extension filenames like shell.json.php to bypass validation. This makes it possible for authenticated attackers, with author-level access and above, to upload files that may be executable, which makes remote code execution possible.
Product
GutenBee – Gutenberg Blocks
Affected
up to 2.20.1
What to do
Affects up to 2.20.1. Update GutenBee – Gutenberg Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
May 28, 2026Meta Field Block: Insecure Direct Object ReferenceCVE-2026-3173 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Meta Field Block plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.5.1. This is due to the plugin allowing users to specify arbitrary object IDs and object types via block attributes without validating whether the authenticated user has permission to access the requested object's metadata. This makes it possible for authenticated attackers, with Contributor-level access and above, to read arbitrary user meta, post meta, and term meta data from any object in the database. On sites using plugins that store sensitive data in meta fields (e.g., WooCommerce billing/shipping information), this could lead to the exposure of Personally Identifiable Information (PII) including names, email addresses, phone numbers, and physical addresses.
Product
Meta Field Block
Affected
up to 1.5.1
What to do
Affects up to 1.5.1. Update Meta Field Block to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 27, 2026Advanced IP Blocker: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-42739 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in IniLerm Advanced IP Blocker advanced-ip-blocker allows DOM-Based XSS.This issue affects Advanced IP Blocker: from n/a through <= 8.10.7.
Product
Advanced IP Blocker
Affected
up to 8.10.7
What to do
Affects up to 8.10.7. Update Advanced IP Blocker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 27, 2026GenerateBlocks: Insertion of Sensitive Information Into Sent DataCVE-2026-48877 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Insertion of Sensitive Information Into Sent Data vulnerability in Tom GenerateBlocks allows Retrieve Embedded Sensitive Data. This issue affects GenerateBlocks: from n/a through 2.1.0.
Product
GenerateBlocks
Affected
up to 2.1.0
What to do
Affects up to 2.1.0. Update GenerateBlocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 27, 2026Splide Carousel Block: Stored Cross-Site ScriptingCVE-2026-9022 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Splide Carousel Block plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'url' Block Attribute in all versions up to, and including, 1.7.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload must be published before it executes for site visitors, which requires an editor or administrator to approve and publish the contributor's post.
Product
Splide Carousel Block
Affected
up to 1.7.1
What to do
Affects up to 1.7.1. Update Splide Carousel Block to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 22, 2026WP Blockade: Reflected Cross-Site ScriptingCVE-2026-3481 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WP Blockade plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'shortcode' parameter in all versions up to and including 0.9.14. This is due to insufficient input sanitization and output escaping in the render_shortcode_preview() function. The function receives user input from $_GET['shortcode'], passes it through stripslashes() without any sanitization, and then outputs it directly via echo do_shortcode($shortcode) on line 393. When the input is not a valid WordPress shortcode (e.g., an HTML tag with JavaScript event handlers), do_shortcode() returns it unchanged, and it is reflected into the page without escaping. The endpoint is registered via admin_post_ (not admin_post_nopriv_), meaning it requires the user to be logged in with at minimum a Subscriber-level account. There is no nonce verification or additional capability check. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute if they can successfully trick a user into performing an action such as clicking a link.
Product
WP Blockade
Affected
up to 0.9.14
What to do
Affects up to 0.9.14. Update WP Blockade to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 19, 2026Nexa Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE: Server-Side Request Forgery (SSRF)CVE-2026-6394 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Nexa Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress is vulnerable to Server-Side Request Forgery (SSRF) in versions up to and including 1.1.1. This is due to the import_demo() function accepting a user-supplied URL in the demo_json_file POST parameter and passing it directly to wp_remote_get() without any URL validation or restriction against internal or private network destinations. The nexa_blocks_nonce required for the AJAX action is publicly exposed in the HTML source of any frontend page where the plugin is active via wp_localize_script on the enqueue_block_assets hook, effectively making the nonce available to all visitors and bypassing any intended authentication barrier. This makes it possible for unauthenticated attackers to make server-side HTTP requests to arbitrary internal or external destinations, potentially exposing internal services, cloud metadata endpoints such as the AWS instance metadata service, localhost services, and other resources not intended to be publicly accessible. A secondary SSRF vector also exists whereby image URLs extracted from the attacker-controlled JSON response are subsequently fetched via a secon
Product
Nexa Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE
Affected
up to 1.1.1
What to do
Affects up to 1.1.1. Update Nexa Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 14, 2026Meta Field Block: Stored Cross-Site ScriptingCVE-2026-6252 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Meta Field Block plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tagName' block attribute in all versions up to, and including, 1.5.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Meta Field Block
Affected
up to 1.5.2
What to do
Affects up to 1.5.2. Update Meta Field Block to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 13, 2026Snow Monkey Blocks: Stored Cross-Site ScriptingCVE-2026-3004 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Snow Monkey Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘data-slick' attribute in all versions up to, and including, 24.1.11 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Snow Monkey Blocks
Affected
up to 24.1.11
What to do
Affects up to 24.1.11. Update Snow Monkey Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 12, 2026scratchblocks for WP: Stored Cross-Site ScriptingCVE-2026-6247 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The scratchblocks for WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'element' attribute of the 'scratchblocks' shortcode in all versions up to, and including, 1.0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
scratchblocks for WP
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update scratchblocks for WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 10, 2026WordPress Plugin IP2Location Country Blocker 2.26.7 contains a stored cross-site scripting vulnerability that allows authenticated users to inject arbitrary JavCVE-2022-50961 · WordPress plugins & themes · reported by VulnCheckMedium 5.1
WordPress Plugin IP2Location Country Blocker 2.26.7 contains a stored cross-site scripting vulnerability that allows authenticated users to inject arbitrary JavaScript code through the Frontend Settings interface. Attackers can inject malicious scripts in the URL field of the Display page settings that execute when administrators or other authenticated users visit the plugin settings page.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record wordpress.org exploit-db.com
May 5, 2026GenerateBlocks: Insecure Direct Object ReferenceCVE-2026-3454 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The GenerateBlocks plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.2.0. This is due to missing object-level authorization checks in the /wp-json/generateblocks/v1/dynamic-tag-replacements REST endpoint. The endpoint only verifies that the user has the edit_posts capability but does not verify the user has permission to access the specific post or its associated data referenced by attacker-controlled id parameters in dynamic tag content. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive information from arbitrary posts including author email addresses and non-protected post meta values by crafting dynamic tag payloads such as {{post_meta id:<target>|key:<meta_key>}} and {{post_title id:<target>|link:author_email}}.
Product
GenerateBlocks
Affected
up to 2.2.0
What to do
Affects up to 2.2.0. Update GenerateBlocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 5, 2026Gutenverse – Ultimate WordPress FSE Blocks Addons & Ecosystem: Server-Side Request ForgeryCVE-2026-2948 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Gutenverse – Ultimate WordPress FSE Blocks Addons & Ecosystem plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including, 3.5.3 via the import_images() function. This makes it possible for authenticated attackers, with contributor-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
Product
Gutenverse – Ultimate WordPress FSE Blocks Addons & Ecosystem
Affected
up to 3.5.3
What to do
Affects up to 3.5.3. Update Gutenverse – Ultimate WordPress FSE Blocks Addons & Ecosystem to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 4, 2026Gutenverse – Ultimate WordPress FSE Blocks Addons & Ecosystem: Stored Cross-Site ScriptingCVE-2026-2868 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Gutenverse – Ultimate WordPress FSE Blocks Addons & Ecosystem plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'separatorIconSVG' parameter in versions up to, and including, 3.5.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Gutenverse – Ultimate WordPress FSE Blocks Addons & Ecosystem
Affected
up to 3.5.3
What to do
Affects up to 3.5.3. Update Gutenverse – Ultimate WordPress FSE Blocks Addons & Ecosystem to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 2, 2026Widget Options – Advanced Conditional Visibility for Gutenberg Blocks & Classic Widgets: Remote Code ExecutionCVE-2026-2052 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Widget Options – Advanced Conditional Visibility for Gutenberg Blocks & Classic Widgets plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.2.2 via the Display Logic feature. This is due to the plugin using eval() on user-supplied Display Logic expressions with an insufficient blocklist/allowlist that can be bypassed using array_map with string concatenation, combined with a lack of authorization enforcement on the extended_widget_opts_block attribute. This makes it possible for authenticated attackers, with Contributor-level access and above, to execute code on the server. The vulnerability was partially patched in version 4.2.0.
Product
Widget Options – Advanced Conditional Visibility for Gutenberg Blocks & Classic Widgets
Affected
up to 4.2.2
What to do
Affects up to 4.2.2. Update Widget Options – Advanced Conditional Visibility for Gutenberg Blocks & Classic Widgets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 2, 2026Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates: Stored Cross-Site ScriptingCVE-2026-4658 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the className, classHook, and blockId attributes in the Add to Cart block (essential-blocks/add-to-cart) in all versions up to, and including, 6.0.4. This is due to insufficient output escaping in the render_callback() function where these attributes are placed into class and data-id HTML attributes using raw sprintf() and implode() without esc_attr() escaping. While the outer wrapper div uses get_block_wrapper_attributes() which properly escapes, the inner divs do not. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates
Affected
up to 6.0.4
What to do
Affects up to 6.0.4. Update Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 2, 2026Maxi Blocks: Stored Cross-Site ScriptingCVE-2026-6378 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Maxi Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `/wp-json/maxi-blocks/v1.0/style-card` REST API endpoint in all versions up to, and including, 2.1.9 due to insufficient input sanitization and output escaping of the `sc_styles` parameter. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts that execute on every page where the plugin's style card styles are loaded, including across the entire WordPress admin panel.
Product
Maxi Blocks
Affected
up to 2.1.9
What to do
Affects up to 2.1.9. Update Maxi Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Apr 30, 2026Otter Blocks: Purchase Verification BypassCVE-2026-2892 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Otter Blocks plugin for WordPress is vulnerable to Purchase Verification Bypass in all versions up to, and including, 3.1.4. This is due to the 'get_customer_data' method relying on an unsigned 'o_stripe_data' cookie to determine Stripe product ownership for unauthenticated users. The 'check_purchase' method trusts this cookie data without performing server-side verification against the Stripe API for one-time 'payment' mode purchases. This makes it possible for unauthenticated attackers to bypass Stripe purchase-gated content visibility conditions by forging the 'o_stripe_data' cookie with a target product ID, which is publicly exposed in the checkout block's HTML source.
Product
Otter Blocks
Affected
up to 3.1.4
What to do
Affects up to 3.1.4. Update Otter Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.