Updated 9 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

526new WordPress flaws this week

391,181entries in the database

951 results · page 4 of 20

Jul 27, 2026Events Calendar: Does not perform an authorization check on one of its Event Aggregator import REST API routes and skips an integrity check for a particular status valueCVE-2026-13390 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Events Calendar WordPress plugin before 6.16.5.1 does not perform an authorization check on one of its Event Aggregator import REST API routes and skips an integrity check for a particular status value, allowing unauthenticated attackers to mark existing import records as failed and to store arbitrary content in a hidden comment record.
Product
Events Calendar
Fixed in
6.16.5.1
What to do
Update Events Calendar to 6.16.5.1 or newer.
Full record and what to do →NVD record wpscan.com
Jul 24, 2026Open User Map – Interactive Leaflet Maps: Stored Cross-Site ScriptingCVE-2026-15755 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Open User Map – Interactive Leaflet Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and including, 1.4.45 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The attack does not require post publication; a Contributor submitting a post for pending review is sufficient, as the payload executes when an Administrator opens the pending-review preview.
Product
Open User Map – Interactive Leaflet Maps
Affected
up to 1.4.45
What to do
Affects up to 1.4.45. Update Open User Map – Interactive Leaflet Maps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 24, 2026MapSVG: Stored Cross-Site ScriptingCVE-2025-9205 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The MapSVG plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 8.14.0. This is due to insufficient input sanitization and output escaping on user supplied attributes within the map options. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
MapSVG
Affected
up to 8.14.0
What to do
Affects up to 8.14.0. Update MapSVG to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 23, 2026Administrator Arbitrary File Upload in MapSVG <= 8.14.0 versions.CVE-2026-65455 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Administrator Arbitrary File Upload in MapSVG <= 8.14.0 versions.
Affected
up to 8.14.0
What to do
Affects up to 8.14.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 23, 2026Contributor SQL Injection in MapSVG <= 8.14.0 versions.CVE-2026-65451 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Contributor SQL Injection in MapSVG <= 8.14.0 versions.
Affected
up to 8.14.0
What to do
Affects up to 8.14.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 23, 2026Contributor SQL Injection in MapSVG <= 8.14.0 versions.CVE-2026-65450 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Contributor SQL Injection in MapSVG <= 8.14.0 versions.
Affected
up to 8.14.0
What to do
Affects up to 8.14.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 23, 2026Contributor Cross Site Scripting (XSS) in MapSVG <= 8.14.0 versions.CVE-2026-65449 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Cross Site Scripting (XSS) in MapSVG <= 8.14.0 versions.
Affected
up to 8.14.0
What to do
Affects up to 8.14.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 23, 2026Unauthenticated SQL Injection in MapSVG <= 8.14.0 versions.CVE-2026-59526 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in MapSVG <= 8.14.0 versions.
Affected
up to 8.14.0
What to do
Affects up to 8.14.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 23, 2026Unauthenticated Cross Site Scripting (XSS) in WP Google Maps Pro <= 10.1.02 versions.CVE-2026-57767 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in WP Google Maps Pro <= 10.1.02 versions.
Affected
up to 10.1.02
What to do
Affects up to 10.1.02. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 23, 2026Unauthenticated Broken Access Control in WP Go Maps <= 10.1.04 versions.CVE-2026-25466 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Broken Access Control in WP Go Maps <= 10.1.04 versions.
Affected
up to 10.1.04
What to do
Affects up to 10.1.04. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 23, 2026Administrator Cross Site Scripting (XSS) in Photo Gallery by Supsystic <= 1.16.3 versions.CVE-2026-24628 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Administrator Cross Site Scripting (XSS) in Photo Gallery by Supsystic <= 1.16.3 versions.
Affected
up to 1.16.3
What to do
Affects up to 1.16.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 23, 2026WP Encryption – One Click Free SSL Certificate & SSL / HTTPS Redirect, Security & SSL Scan: Directory TraversalCVE-2026-15786 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The WP Encryption – One Click Free SSL Certificate & SSL / HTTPS Redirect, Security & SSL Scan plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 7.8.6.6 via the 'imploded' parameter parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. Although file write content is passed through esc_html(), which encodes angle brackets and prevents direct PHP execution, plaintext configuration files such as .htaccess are fully writable and exploitable for denial-of-service or redirect attacks. This is only exploitable when the premium version of the software is enabled and active.
Product
WP Encryption – One Click Free SSL Certificate & SSL / HTTPS Redirect, Security & SSL Scan
Affected
up to 7.8.6.6
What to do
Affects up to 7.8.6.6. Update WP Encryption – One Click Free SSL Certificate & SSL / HTTPS Redirect, Security & SSL Scan to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 21, 2026MapSVG: Arbitrary file uploadsCVE-2026-1771 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The MapSVG plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the SVGFile constructor in all versions up to, and including, 8.14.0 This is due to an incorrect conditional check that prevents file validation from taking place. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
MapSVG
Affected
up to 8.14.0
What to do
Affects up to 8.14.0. Update MapSVG to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 20, 2026Tag Groups is the Advanced Way to Display Your Taxonomy Terms: Does not properly escape one of its AJAX parameters before reflecting it in the response body served with an HTML content typeCVE-2026-9833 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Tag Groups is the Advanced Way to Display Your Taxonomy Terms WordPress plugin before 2.2.0 does not properly escape one of its AJAX parameters before reflecting it in the response body served with an HTML content type, allowing unauthenticated attackers to execute arbitrary JavaScript in the browser of a logged-in user with `edit_pages` capability (Editor or higher) who is tricked into following a crafted link.
Product
Tag Groups is the Advanced Way to Display Your Taxonomy Terms
Fixed in
2.2.0
What to do
Update Tag Groups is the Advanced Way to Display Your Taxonomy Terms to 2.2.0 or newer.
Full record and what to do →NVD record wpscan.com
Jul 17, 2026HubSpot All-In-One Marketing – Forms, Popups, Live Chat: Sensitive Information ExposureCVE-2026-9656 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The HubSpot All-In-One Marketing – Forms, Popups, Live Chat plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 11.3.62 via the wp_localize_script() / window.leadinConfig JavaScript object. This makes it possible for authenticated attackers, with contributor-level access and above, to extract the site's plaintext HubSpot OAuth refresh token exposed via the window.leadinConfig JavaScript object, which can then be used to access or modify data in the connected HubSpot tenant. Although the refresh token is stored at rest with AES-256-CTR encryption, decryption occurs server-side before the plaintext value is passed to wp_localize_script(), rendering the at-rest encryption ineffective against this exposure path.
Product
HubSpot All-In-One Marketing – Forms, Popups, Live Chat
Affected
up to 11.3.62
What to do
Affects up to 11.3.62. Update HubSpot All-In-One Marketing – Forms, Popups, Live Chat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 17, 2026WPS Bookings for WooCommerce: Does not verify that a booking order belongs to the requesting user before cancelling itCVE-2026-12393 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WPS Bookings for WooCommerce WordPress plugin before 3.11.7 does not verify that a booking order belongs to the requesting user before cancelling it, allowing any authenticated user, such as a Subscriber or Customer, to cancel and void other customers' booking orders.
Product
WPS Bookings for WooCommerce
Fixed in
3.11.7
What to do
Update WPS Bookings for WooCommerce to 3.11.7 or newer.
Full record and what to do →NVD record wpscan.com
Jul 16, 2026WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell: Privilege EscalationCVE-2026-15103 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell plugin for WordPress is vulnerable to Privilege Escalation via arbitrary option update in all versions up to, and including, 3.12.8. This is due to the `update_settings()` REST callback failing to validate the `group_id` path parameter against an allowlist of permitted option names before passing it directly to `get_option()` and `update_option()`, allowing the built-in `wp_user_roles` option — which satisfies the route's loose `[\w-]+` regex — to be targeted. This makes it possible for authenticated attackers with the `wpf_manage_funnels` capability and above to elevate their privileges to administrator by writing a crafted role definition containing arbitrary capabilities into the `wp_user_roles` option, thereby granting any WordPress role full site administrator access. The `wpf_manage_funnels` capability is typically assigned to the Funnel Manager custom role created by the plugin, meaning this role is the minimum required to exploit the vulnerability.
Product
WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell
Affected
up to 3.12.8
What to do
Affects up to 3.12.8. Update WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 13, 2026Loops & Logic: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-57391 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tangible Loops & Logic tangible-loops-and-logic allows Stored XSS.This issue affects Loops & Logic: from n/a through <= 4.2.3.
Product
Loops & Logic
Affected
up to 4.2.3
What to do
Affects up to 4.2.3. Update Loops & Logic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 11, 2026PDF Invoices & Packing Slips for WooCommerce: Insecure Direct Object ReferenceCVE-2026-13116 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.14.0 via the generate_document_shortcode due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with contributor-level access and above, to mint publicly accessible, session-free download links for arbitrary third-party orders, exposing customer names, billing and shipping addresses, email addresses, phone numbers, order and invoice numbers, line items, totals, payment details, and customer notes contained in those orders' invoices and packing slips. Exploitation requires the plugin's Document link access type setting to be configured to 'full'; with the default 'logged_in' value, generated URLs are signed with a per-session nonce rather than the order_key, making the shortcode path unexploitable for unauthorized access to third-party orders.
Product
PDF Invoices & Packing Slips for WooCommerce
Affected
up to 5.14.0
What to do
Affects up to 5.14.0. Update PDF Invoices & Packing Slips for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 9, 2026Backup and Staging by WP Time Capsule: Sensitive Information ExposureCVE-2026-8996 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Backup and Staging by WP Time Capsule plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.22.26 via the download_recent_decrypted_file_wptc. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract download the most recently admin-decrypted SQL database backup, which typically contains password hashes, user credentials, and other sensitive site configuration data stored in the 'recent_decrypted_file' option. Exploitation requires that an administrator has previously performed a decrypt action, causing the decrypted SQL backup file to exist in the plugin's upload directory; without this prior admin action, there is no file to serve.
Product
Backup and Staging by WP Time Capsule
Affected
up to 1.22.26
What to do
Affects up to 1.22.26. Update Backup and Staging by WP Time Capsule to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 9, 2026WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell: Local File InclusionCVE-2026-13080 · WordPress plugins & themes · reported by WordfenceMedium 6.6
The WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.12.7 via the 'logKey' parameter parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.
Product
WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell
Affected
up to 3.12.7
What to do
Affects up to 3.12.7. Update WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 9, 2026Memberships and User Profiles for WooCommerce – ProfileGrid WooCommerce Integration: Unauthorized plugin installation and activationCVE-2026-11359 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Memberships and User Profiles for WooCommerce – ProfileGrid WooCommerce Integration plugin for WordPress is vulnerable to unauthorized plugin installation and activation in versions up to, and including, 3.4. This is due to a missing capability check and missing nonce validation on the pg_install_profilegrid() AJAX handler registered via wp_ajax_pg_install_profilegrid. This makes it possible for authenticated attackers, with Subscriber-level access and above, to install and activate the ProfileGrid plugin from wordpress.
Product
Memberships and User Profiles for WooCommerce – ProfileGrid WooCommerce Integration
Affected
up to 3.4
What to do
Affects up to 3.4. Update Memberships and User Profiles for WooCommerce – ProfileGrid WooCommerce Integration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 8, 2026WCFM Membership – WooCommerce Memberships for Multivendor Marketplace: Insecure Direct Object ReferenceCVE-2026-3688 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The WCFM Membership – WooCommerce Memberships for Multivendor Marketplace plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.11.10. This is due to the 'wcfmvm_membership_change' AJAX action not validating user permission to modify other users. This makes it possible for authenticated attackers, with vendor level access and above, to change any user's role to 'wcfm_vendor' by changing their membership plan.
Product
WCFM Membership – WooCommerce Memberships for Multivendor Marketplace
Affected
up to 2.11.10
What to do
Affects up to 2.11.10. Update WCFM Membership – WooCommerce Memberships for Multivendor Marketplace to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jul 7, 2026WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell: Remote Code ExecutionCVE-2026-14345 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 3.12.7 via the 'postData' parameter parameter. This is due to unsanitized write of attacker-controlled postData values into a PHP-includeable .log file combined with the use of include_once to render that file in wpfnl_show_log. This makes it possible for unauthenticated attackers to execute code on the server. Exploitation requires that the Log Settings "Enable Logs" toggle is on and that an administrator subsequently opens the polluted log file via the plugin's Log Settings View UI; however, the nonce required to reach the optin endpoint is publicly emitted on every funnel step page, so the injection step itself is fully unauthenticated.
Product
WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell
Affected
up to 3.12.7
What to do
Affects up to 3.12.7. Update WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 2, 2026Unauthenticated Cross Site Scripting (XSS) in Google Maps CP <= 1.2.5 versions.CVE-2026-57670 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Google Maps CP <= 1.2.5 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jul 2, 2026Unauthenticated Broken Authentication in ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce <= 2.2.0 versions.CVE-2026-57352 · WordPress plugins & themes · reported by PatchstackMedium 4.8
Unauthenticated Broken Authentication in ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce <= 2.2.0 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jul 1, 2026Advanced Form Integration — Connect Forms to 200+ Apps: Does not restrict the WordPress role assignedCVE-2026-11794 · WordPress plugins & themes · reported by WPScanHigh 8.1
The Advanced Form Integration — Connect Forms to 200+ Apps WordPress plugin before 2.1.1 does not restrict the WordPress role assigned when it creates a user from a public form submission, allowing unauthenticated visitors to create an administrator account when an active integration maps the user role to a public form field. This requires a specific, non-default multi-Advanced Form Integration — Connect Forms to 200+ Apps WordPress plugin before 2.1.1 configuration.
Product
Advanced Form Integration — Connect Forms to 200+ Apps
Fixed in
2.1.1
What to do
Update Advanced Form Integration — Connect Forms to 200+ Apps to 2.1.1 or newer.
Full record and what to do →NVD record wpscan.com
Jun 30, 2026ProfileGrid – User Profiles, Groups and Communities: Privilege escalationCVE-2026-12073 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 5.9.9.5. This is due to the plugin not validating a `user_login` on registration forms that don't contain this parameter, and not properly handling the error messages. This makes it possible for unauthenticated attackers to change email address of user account with ID=1 (usually an administrator), and leverage that to reset the user's password and gain access to their account.
Product
ProfileGrid – User Profiles, Groups and Communities
Affected
up to 5.9.9.5
What to do
Affects up to 5.9.9.5. Update ProfileGrid – User Profiles, Groups and Communities to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 26, 2026CodePeople Post Map for Google Maps: Stored Cross-Site ScriptingCVE-2026-13335 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The CodePeople Post Map for Google Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'cpm_point' Post Meta in all versions up to, and including, 1.2.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
CodePeople Post Map for Google Maps
Affected
up to 1.2.6
What to do
Affects up to 1.2.6. Update CodePeople Post Map for Google Maps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 26, 2026Unauthenticated Cross Site Request Forgery (CSRF) in Paid Memberships Pro - Add Member From Admin <= 0.7.2 versions.CVE-2026-57659 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Unauthenticated Cross Site Request Forgery (CSRF) in Paid Memberships Pro - Add Member From Admin <= 0.7.2 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jun 26, 2026Unauthenticated Cross Site Scripting (XSS) in MapPress Maps for WordPress <= 2.97.3 versions.CVE-2026-56011 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in MapPress Maps for WordPress <= 2.97.3 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jun 26, 2026Unauthenticated Broken Access Control in Syncee Premium Dropshipping & Wholesale <= 1.0.27 versions.CVE-2026-54846 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in Syncee Premium Dropshipping & Wholesale <= 1.0.27 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jun 26, 2026Unauthenticated Sensitive Data Exposure in Trinity Backup – Backup, Migrate, Restore, Clone & Schedule Backups <= 2.0.9 versions.CVE-2026-54839 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Sensitive Data Exposure in Trinity Backup – Backup, Migrate, Restore, Clone & Schedule Backups <= 2.0.9 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jun 26, 2026The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin CVE-2026-1869 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin for WordPress is vulnerable to unauthorized modification of data due to missing validation checks in the confirm_payment() function in all versions up to, and including, 5.2.0. This makes it possible for unauthenticated attackers to bypass payment processing and activate paid memberships.
Affected
up to 5.2.0
What to do
Affects up to 5.2.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 23, 2026ProfileGrid – User Profiles, Groups and Communities: Stored Cross-Site ScriptingCVE-2026-4610 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'pm_author_message' parameter in the pm_send_message_to_author function in all versions up to, and including, 5.9.9.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerability was partially patched in version 5.9.8.5.
Product
ProfileGrid – User Profiles, Groups and Communities
Affected
up to 5.9.9.2
What to do
Affects up to 5.9.9.2. Update ProfileGrid – User Profiles, Groups and Communities to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 20, 2026WordPress Time Capsule Plugin 1.21.16 contains an authentication bypass vulnerability that allows unauthenticated attackers to gain administrative access by senCVE-2020-37255 · WordPress plugins & themes · reported by VulnCheckHigh 8.7
WordPress Time Capsule Plugin 1.21.16 contains an authentication bypass vulnerability that allows unauthenticated attackers to gain administrative access by sending a crafted POST request with the IWP_JSON_PREFIX header. Attackers can exploit this flaw to obtain valid administrator session cookies and access the WordPress dashboard without providing credentials.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record wptimecapsule.com exploit-db.com
Jun 19, 2026WP Go Maps – Most Popular Map: Authorization bypassCVE-2026-12238 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WP Go Maps – Most Popular Map Plugin plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 10.1.01. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to create arbitrary records in plugin database tables (maps, markers, circles, polygons, polylines, rectangles, and point labels) by supplying a WPGMZA-namespaced CRUD-backed class name via the phpClass parameter. The namespace validation check (requiring the 'WPGMZA' prefix) does not prevent exploitation because classes such as WPGMZA\Map and WPGMZA\Marker satisfy it while still triggering an INSERT into the corresponding plugin table before the route rejects the request.
Product
WP Go Maps – Most Popular Map
Affected
up to 10.1.01
What to do
Affects up to 10.1.01. Update WP Go Maps – Most Popular Map to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 18, 2026FireBox Popups – Increase Sales and Grow Your Email List: Sensitive Information ExposureCVE-2026-12120 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The FireBox Popups – Increase Sales and Grow Your Email List plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.1.7 via the 'form_id' parameter. This makes it possible for unauthenticated attackers to extract download a full CSV export of all form submissions — including any personally identifiable information submitted by users — for any arbitrary form_id.
Product
FireBox Popups – Increase Sales and Grow Your Email List
Affected
up to 3.1.7
What to do
Affects up to 3.1.7. Update FireBox Popups – Increase Sales and Grow Your Email List to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 17, 2026Unauthenticated Broken Authentication in WooCommerce Dropshipping <= 5.2.4 versions.CVE-2026-49071 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Broken Authentication in WooCommerce Dropshipping <= 5.2.4 versions.
Affected
up to 5.2.4
What to do
Affects up to 5.2.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 17, 2026Unauthenticated Local File Inclusion in Tipsy <= 1.1 versions.CVE-2025-69173 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Local File Inclusion in Tipsy <= 1.1 versions.
Affected
up to 1.1
What to do
Affects up to 1.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 15, 2026Unauthenticated Broken Authentication in Upsell Order Bump Offer for WooCommerce <= 3.1.4 versions.CVE-2026-49110 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Authentication in Upsell Order Bump Offer for WooCommerce <= 3.1.4 versions.
Affected
up to 3.1.4
What to do
Affects up to 3.1.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 15, 2026Unauthenticated Sensitive Data Exposure in WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels <= 4.9.4 versions.CVE-2026-49056 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Sensitive Data Exposure in WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels <= 4.9.4 versions.
Affected
up to 4.9.4
What to do
Affects up to 4.9.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 15, 2026Subscriber Arbitrary File Upload in WpStream < 4.11.2 versions.CVE-2026-39527 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Subscriber Arbitrary File Upload in WpStream < 4.11.2 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jun 15, 2026Unauthenticated SQL Injection in WP Maps <= 4.9.1 versions.CVE-2026-39492 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in WP Maps <= 4.9.1 versions.
Affected
up to 4.9.1
What to do
Affects up to 4.9.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 15, 2026Shop manager PHP Object Injection in WooCommerce PDF Invoices & Packing Slips < 5.9.0 versions.CVE-2026-39472 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Shop manager PHP Object Injection in WooCommerce PDF Invoices & Packing Slips < 5.9.0 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jun 15, 2026WP MAPS PRO: Registers an unauthenticated AJAX action whichCVE-2026-8935 · WordPress plugins & themes · reported by WPScanCritical 9.8
The WP MAPS PRO WordPress plugin before 6.1.1 registers an unauthenticated AJAX action which, given a valid nonce that is publicly emitted on any frontend page enqueuing its map script, unconditionally creates an administrator account and returns a magic-login URL granting interactive admin access.
Product
WP MAPS PRO
Fixed in
6.1.1
What to do
Update WP MAPS PRO to 6.1.1 or newer.
Full record and what to do →NVD record wpscan.com
Jun 15, 2026WP Go Maps: Does not perform any approval-state filtering on its public single-marker REST endpointCVE-2026-8386 · WordPress plugins & themes · reported by WPScanMedium 5.3
The WP Go Maps WordPress plugin before 10.0.10 does not perform any approval-state filtering on its public single-marker REST endpoint, allowing unauthenticated users to retrieve marker records that an administrator has not yet approved for public display, including any PII placed in the address and description fields and the marker's geographic coordinates.
Product
WP Go Maps
Fixed in
10.0.10
What to do
Update WP Go Maps to 10.0.10 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 15, 2026WP Go Maps: Does not properly enforce the marker approval filter on the admin-ajax fallback for its datatables routeCVE-2026-8385 · WordPress plugins & themes · reported by WPScanMedium 5.3
The WP Go Maps WordPress plugin before 10.0.10 does not properly enforce the marker approval filter on the admin-ajax fallback for its datatables route, allowing unauthenticated visitors to retrieve marker records that the site owner has not approved for public display, including their title, category, address and description fields.
Product
WP Go Maps
Fixed in
10.0.10
What to do
Update WP Go Maps to 10.0.10 or newer.
Full record and what to do →NVD record wpscan.com
Jun 9, 2026Wow Viral Signups 2.1 WordPress plugin contains an SQL injection vulnerability that allows unauthenticated attackers to extract database information by exploitiCVE-2017-20245 · WordPress plugins & themes · reported by VulnCheckHigh 8.8
Wow Viral Signups 2.1 WordPress plugin contains an SQL injection vulnerability that allows unauthenticated attackers to extract database information by exploiting the unescaped 'idsignup' POST parameter. Attackers can send crafted requests to the admin-ajax.php endpoint with malicious SQL payloads in the 'idsignup' parameter to read arbitrary data from the database.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record wow-company.com tad.group
Jun 6, 2026WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters: Stored Cross-Site ScriptingCVE-2026-9594 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'location_messages' parameter in all versions up to, and including, 4.9.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the attacker to hold the custom wpgmp_manage_location capability, which is granted to administrators by default but can be assigned to lower-privileged roles via the plugin's Permissions screen.
Product
WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters
Affected
up to 4.9.4
What to do
Affects up to 4.9.4. Update WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.