Updated 3 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

35added in the last 30 days

575new WordPress flaws this week

391,358entries in the database

12,389 results · page 40 of 248

May 20, 2026Cost of Goods by PixelYourSite: Stored Cross-Site ScriptingCVE-2026-7613 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Cost of Goods by PixelYourSite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'csvdata[0][cost_of_goods_value]' parameter in versions up to, and including, 1.2.12 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Cost of Goods by PixelYourSite
Affected
up to 1.2.12
What to do
Affects up to 1.2.12. Update Cost of Goods by PixelYourSite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record pixelyoursite.com wordfence.com
May 20, 2026Visualizer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-24573 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeisle Visualizer allows Stored XSS. This issue affects Visualizer: from n/a before 4.0.0.
Product
Visualizer
Fixed in
4.0.0
What to do
Update Visualizer to 4.0.0 or newer.
Full record and what to do →NVD record patchstack.com
May 20, 2026Anomify AI – Anomaly Detection and Alerting: Cross-Site Request Forgery (CSRF) leading to Stored Cross-Site Scripting (XSS)CVE-2026-6405 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Anomify AI – Anomaly Detection and Alerting plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) leading to Stored Cross-Site Scripting (XSS) in versions up to and including 0.3.6. This is due to missing nonce verification on the settings page handler and insufficient output escaping in the admin_options.php template. The settings form includes no wp_nonce_field() and the handler performs no check_admin_referer() check, meaning any cross-origin POST can modify plugin settings. The API key field is sanitized only with sanitize_text_field(), which strips HTML tags but does not encode double-quote characters; the value is then rendered into an HTML attribute via bare echo without esc_attr(), allowing a double-quote attribute-escape payload to survive both sanitization and storage. This makes it possible for unauthenticated attackers to inject arbitrary web scripts by tricking a logged-in administrator into visiting a malicious page that submits a forged request, storing the payload in the database and causing it to execute in the administrator's browser whenever the plugin settings page is visited.
Product
Anomify AI – Anomaly Detection and Alerting
Affected
up to 0.3.6
What to do
Affects up to 0.3.6. Update Anomify AI – Anomaly Detection and Alerting to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 20, 2026AI Chatbot & Workflow Automation by AIWU: Stored Cross-Site ScriptingCVE-2026-2955 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The AI Chatbot & Workflow Automation by AIWU plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'X-Forwarded-For' header in versions up to, and including, 1.4.14 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. NOTE: Practical exploitation is constrained due to a 20-character storage limit.
Product
AI Chatbot & Workflow Automation by AIWU
Affected
up to 1.4.14
What to do
Affects up to 1.4.14. Update AI Chatbot & Workflow Automation by AIWU to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 19, 2026Correct Prices: Reflected Cross-Site ScriptingCVE-2026-8627 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Correct Prices plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the $_SERVER['PHP_SELF'] variable in versions up to and including 1.0. This is due to the correct_prices_page() function echoing $_SERVER['PHP_SELF'] into a form's action attribute without any input sanitization or output escaping (such as esc_url() or esc_attr()). Because PHP_SELF reflects attacker-controlled path-info appended to the script URL, an attacker can break out of the attribute and inject arbitrary markup. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a specially crafted link.
Product
Correct Prices
Affected
up to 1.0
What to do
Affects up to 1.0. Update Correct Prices to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 19, 2026SponsorMe: Reflected Cross-Site ScriptingCVE-2026-8626 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The SponsorMe plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via PHP_SELF Parameter in all versions up to, and including, 0.5.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. The PHP_SELF value is reflected in two separate locations within the vulnerable function — a form action attribute and an anchor href attribute — both of which can be exploited by appending a crafted payload to the wp-admin/admin.php URL path.
Product
SponsorMe
Affected
up to 0.5.2
What to do
Affects up to 0.5.2. Update SponsorMe to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 19, 2026LJ comments import: reloaded: Reflected Cross-Site ScriptingCVE-2026-8624 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The LJ comments import: reloaded plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via PHP_SELF Parameter in all versions up to, and including, 0.97.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. The vulnerability arises specifically because PHP_SELF includes attacker-controllable PATH_INFO appended to the script name, and there are two distinct unsanitized echo points for this value in the same function.
Product
LJ comments import: reloaded
Affected
up to 0.97.1
What to do
Affects up to 0.97.1. Update LJ comments import: reloaded to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 19, 2026Faces of Users: Stored Cross-Site ScriptingCVE-2026-8038 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Faces of Users plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'default' shortcode attribute in the 'facesofusers' shortcode in all versions up to, and including, 0.0.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Faces of Users
Affected
up to 0.0.3
What to do
Affects up to 0.0.3. Update Faces of Users to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 19, 2026VatanSMS WP SMS: Reflected Cross-Site ScriptingCVE-2026-7462 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The VatanSMS WP SMS plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `page` parameter in all versions up to, and including, 1.01. This is due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick an administrator into performing an action such as clicking on a link.
Product
VatanSMS WP SMS
Affected
up to 1.01
What to do
Affects up to 1.01. Update VatanSMS WP SMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 19, 2026Logo Manager For Enamad: Stored Cross-Site ScriptingCVE-2026-6549 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Logo Manager For Enamad plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'title' attribute of the `vc_enamad_namad`, `vc_enamad_shamed`, and `vc_enamad_custom` shortcodes in all versions up to, and including, 0.7.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Logo Manager For Enamad
Affected
up to 0.7.4
What to do
Affects up to 0.7.4. Update Logo Manager For Enamad to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 19, 2026Anomify AI – Anomaly Detection and Alerting: Stored Cross-Site ScriptingCVE-2026-6404 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Anomify AI – Anomaly Detection and Alerting plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'anomify_api_key' parameter in versions up to and including 0.3.6. This is due to insufficient input sanitization and missing output escaping: the plugin applies sanitize_text_field() to the Metric Data Key input before saving it via update_option(), but sanitize_text_field() strips HTML tags without encoding double-quote characters, and the value is then echoed directly into an HTML attribute context (value="...") without esc_attr(). This makes it possible for authenticated attackers with administrator-level access to inject arbitrary web scripts that execute whenever a user visits the plugin's settings page.
Product
Anomify AI – Anomaly Detection and Alerting
Affected
up to 0.3.6
What to do
Affects up to 0.3.6. Update Anomify AI – Anomaly Detection and Alerting to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 19, 2026General Options: Stored Cross-Site ScriptingCVE-2026-6399 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The General Options plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 1.1.0. This is due to the use of sanitize_text_field() for output escaping in the Contact Number (ad_contact_number) field — a function that strips HTML tags but does not encode double-quote characters to their HTML entity equivalent ("). When the stored value is echoed inside a double-quoted HTML attribute (value="..."), an attacker-supplied double-quote character breaks out of the attribute context. Even with WordPress's wp_magic_quotes mechanism (which prefixes quotes with a backslash), the resulting \" sequence is NOT treated as an escaped quote by HTML parsers — the backslash is rendered as a literal character and the bare double-quote still closes the attribute. This makes it possible for authenticated attackers with Administrator-level access and above to inject arbitrary web scripts in the admin settings page that will execute whenever any administrator visits the General Options settings page.
Product
General Options
Affected
up to 1.1.0
What to do
Affects up to 1.1.0. Update General Options to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 19, 2026Sticky: Stored Cross-Site ScriptingCVE-2026-6397 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Sticky plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `cvmh-sticky` shortcode `readmoretext` attribute in versions up to and including 2.5.6. This is due to insufficient input sanitization and output escaping in the `cvmh_sticky_front_render()` function — the `readmoretext` attribute value is passed through `apply_filters()` and directly concatenated into the HTML output without any escaping function such as `esc_html()`. This makes it possible for authenticated attackers with Contributor-level access and above to inject arbitrary web scripts in pages that will execute whenever a user accesses a page containing the injected shortcode.
Product
Sticky
Affected
up to 2.5.6
What to do
Affects up to 2.5.6. Update Sticky to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 19, 2026Word 2 Cash: Cross-Site Request Forgery leading to Stored Cross-Site ScriptingCVE-2026-6395 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Word 2 Cash plugin for WordPress is vulnerable to Cross-Site Request Forgery leading to Stored Cross-Site Scripting in versions up to and including 0.9.2. This is due to the complete absence of nonce verification on the settings save handler in the w2c_admin() function, combined with missing input sanitization before storage and missing output escaping when rendering the stored value. The w2c-definitions POST parameter is saved raw via update_option() and later echoed without escaping inside a <textarea> element. This makes it possible for unauthenticated attackers to forge a request on behalf of a logged-in administrator, storing arbitrary JavaScript payloads that execute in the WordPress admin panel whenever the settings page is visited.
Product
Word 2 Cash
Affected
up to 0.9.2
What to do
Affects up to 0.9.2. Update Word 2 Cash to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 19, 2026Sentence To SEO (keywords, description and tags): Cross-Site Request ForgeryCVE-2026-6391 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Sentence To SEO (keywords, description and tags) plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing or incorrect nonce validation on the create_admin_page() function. This makes it possible for unauthenticated attackers to inject malicious web scripts and update plugin settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Sentence To SEO (keywords, description and tags)
Affected
up to 1.0
What to do
Affects up to 1.0. Update Sentence To SEO (keywords, description and tags) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 19, 2026診断ジェネレータ作成プラグイン (Diagnosis Generator): Stored Cross-Site ScriptingCVE-2026-5293 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The 診断ジェネレータ作成プラグイン (Diagnosis Generator) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'js' parameter in versions up to and including 1.4.16. This is due to missing authorization checks and insufficient input sanitization in the themeFunc() function. The function is hooked to 'admin_init' and processes theme update requests without verifying user capabilities, allowing any authenticated user (including subscribers) to save malicious JavaScript to theme files. Additionally, the save() function uses stripslashes() which removes WordPress's magic quotes protection. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in theme files that will execute whenever a user accesses a page containing the diagnosis form shortcode.
Product
診断ジェネレータ作成プラグイン (Diagnosis Generator)
Affected
up to 1.4.16
What to do
Affects up to 1.4.16. Update 診断ジェネレータ作成プラグイン (Diagnosis Generator) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 18, 2026Autoptimize WordPress plugin before 3.1.15, Clearfy Cache WordPress plugin before 2.4.2, Speed Optimizer: Are vulnerable to unauthenticated Stored Cross-Site Scripting (XSS) due to a predictable replacement hash used durCVE-2026-3220 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Autoptimize WordPress plugin before 3.1.15, Clearfy Cache WordPress plugin before 2.4.2, Speed Optimizer WordPress plugin before 7.7.9 are vulnerable to unauthenticated Stored Cross-Site Scripting (XSS) due to a predictable replacement hash used during the HTML minification process and abusing a regular expression. This allows an attacker to inject arbitrary HTML attributes in the final HTML output by anticipating the placeholder format.
Product
Autoptimize WordPress plugin before 3.1.15, Clearfy Cache WordPress plugin before 2.4.2, Speed Optimizer
Fixed in
3.1.15
What to do
Update Autoptimize WordPress plugin before 3.1.15, Clearfy Cache WordPress plugin before 2.4.2, Speed Optimizer to 3.1.15 or newer.
Full record and what to do →NVD record wpscan.com
May 16, 2026WP Learn Manager 1.1.2 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts through the `fieldCVE-2021-47975 · WordPress plugins & themes · reported by VulnCheckMedium 5.1
WP Learn Manager 1.1.2 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts through the `fieldtitle` parameter. Attackers can submit POST requests to the jslm_fieldordering page with XSS payloads in the fieldtitle field to execute arbitrary JavaScript when administrators view the field ordering interface.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record wordpress.org wplearnmanager.com
May 16, 2026Cookie Law Bar 1.2.1 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts by submitting unsanitiCVE-2021-47957 · WordPress plugins & themes · reported by VulnCheckMedium 5.1
Cookie Law Bar 1.2.1 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts by submitting unsanitized input to the Bar Message field. Attackers can inject script payloads through the plugin settings page that execute in the browsers of all WordPress users viewing the site, enabling cookie theft and sensitive data exfiltration.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record wordpress.org cookielawinfo.com
May 16, 2026the Brand component that: WordPress Theme Wibar 1.1.8 contains a stored cross-site scriptingCVE-2020-37235 · WordPress plugins & themes · reported by VulnCheckMedium 5.1
WordPress Theme Wibar 1.1.8 contains a stored cross-site scripting vulnerability in the Brand component that allows authenticated users to inject malicious scripts by manipulating the Logo URL parameter. Attackers with editor, administrator, contributor, or author privileges can inject base64-encoded script payloads through the ftc_brand_url input field to execute arbitrary JavaScript when users visit the brand page.
Product
the Brand component that
What to do
Update the Brand component that to the newest version.
Full record and what to do →NVD record demo.themeftc.com themeforest.net
May 16, 2026WordPress Plugin Buddypress 6.2.0 contains a persistent cross-site scripting vulnerability that allows authenticated attackers with moderator privileges to injeCVE-2020-37233 · WordPress plugins & themes · reported by VulnCheckMedium 5.1
WordPress Plugin Buddypress 6.2.0 contains a persistent cross-site scripting vulnerability that allows authenticated attackers with moderator privileges to inject malicious script code through the figure parameter in wp:html blocks. Attackers can inject iframe elements with event handlers like onload that execute when administrators or privileged users preview or view the affected page content, enabling session hijacking and persistent phishing attacks.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record wordpress.org exploit-db.com
May 15, 2026Advanced Custom Fields: Font Awesome: Stored Cross-Site ScriptingCVE-2026-6415 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Advanced Custom Fields: Font Awesome plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 5.0.2. This is due to insufficient input validation of JSON field values and unsafe client-side HTML construction in the update_preview() JavaScript function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Advanced Custom Fields: Font Awesome
Affected
up to 5.0.2
What to do
Affects up to 5.0.2. Update Advanced Custom Fields: Font Awesome to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 15, 2026The7: Stored Cross-Site ScriptingCVE-2026-6646 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The The7 theme for WordPress is vulnerable to Stored Cross-Site Scripting via the 'dt_default_button' shortcode in all versions up to, and including, 14.3.2. This is due to insufficient input sanitization and output escaping on the 'title' component of the 'link' shortcode parameter. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
The7
Affected
up to 14.3.2
What to do
Affects up to 14.3.2. Update The7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 14, 2026Royal Elementor Addons and Templates: Stored Cross-Site ScriptingCVE-2026-6504 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'title_tag' parameter in all versions up to, and including, 1.7.1058 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Royal Elementor Addons and Templates
Affected
up to 1.7.1058
What to do
Affects up to 1.7.1058. Update Royal Elementor Addons and Templates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 14, 2026CC Child Pages: Stored Cross-Site ScriptingCVE-2026-6174 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The CC Child Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'more' parameter in all versions up to, and including, 2.1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
CC Child Pages
Affected
up to 2.1.1
What to do
Affects up to 2.1.1. Update CC Child Pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 14, 2026Meta Field Block: Stored Cross-Site ScriptingCVE-2026-6252 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Meta Field Block plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tagName' block attribute in all versions up to, and including, 1.5.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Meta Field Block
Affected
up to 1.5.2
What to do
Affects up to 1.5.2. Update Meta Field Block to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 14, 2026ManageWP Worker: Stored Cross-Site ScriptingCVE-2026-3718 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The ManageWP Worker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'MWP-Key-Name' HTTP request header in all versions up to, and including, 4.9.31. This is due to insufficient input sanitization and output escaping of attacker-controlled header values. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever an administrator visits the plugin's connection management page with debug parameters.
Product
ManageWP Worker
Affected
up to 4.9.31
What to do
Affects up to 4.9.31. Update ManageWP Worker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 14, 2026Bold Page Builder: Stored Cross-Site ScriptingCVE-2026-3694 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'text' attribute of the bt_bb_button shortcode in all versions up to, and including, 5.6.8. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Bold Page Builder
Affected
up to 5.6.8
What to do
Affects up to 5.6.8. Update Bold Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 14, 2026GLS Shipping for WooCommerce: Reflected Cross-Site ScriptingCVE-2026-6417 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The GLS Shipping for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'failed_orders' parameter in all versions up to, and including, 1.4.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
GLS Shipping for WooCommerce
Affected
up to 1.4.0
What to do
Affects up to 1.4.0. Update GLS Shipping for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 14, 2026The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce: Stored cross-site scriptingCVE-2026-5243 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to stored cross-site scripting via the `menu_hover_click` parameter of the Navigation Menu Lite widget in all versions up to, and including, 6.4.11 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce
Affected
up to 6.4.11
What to do
Affects up to 6.4.11. Update The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 14, 2026MapGeo – Interactive Geo Maps: Reflected Cross-Site ScriptingCVE-2025-15345 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The MapGeo – Interactive Geo Maps plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'map' parameter in the display-map shortcode in all versions up to, and including, 1.6.27 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
MapGeo – Interactive Geo Maps
Affected
up to 1.6.27
What to do
Affects up to 1.6.27. Update MapGeo – Interactive Geo Maps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org research.cleantalk.org
May 14, 2026Envira Gallery Lite: Stored Cross-Site ScriptingCVE-2026-5361 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Envira Gallery Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the REST API in versions up to and including 1.12.4. This is due to insufficient input sanitization in the update_gallery_data() function and improper output escaping in the gallery_init() function. The sanitize_config_values() function only sanitizes the justified_gallery_theme and justified_row_height parameters, but does not sanitize the arrows parameter. When the arrows value is output in the inline JavaScript configuration, it uses esc_attr() which is designed for HTML attribute contexts, not JavaScript contexts, allowing JavaScript expression injection. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Envira Gallery Lite
Affected
up to 1.12.4
What to do
Affects up to 1.12.4. Update Envira Gallery Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 13, 2026Powie's WHOIS Domain Check 0.9.31 contains a persistent cross-site scripting vulnerability that allows authenticated attackers to inject arbitrary JavaScript byCVE-2020-37225 · WordPress plugins & themes · reported by VulnCheckMedium 5.1
Powie's WHOIS Domain Check 0.9.31 contains a persistent cross-site scripting vulnerability that allows authenticated attackers to inject arbitrary JavaScript by exploiting unsanitized input fields in plugin settings. Attackers can submit malicious payloads through textarea and input elements in the pwhois_settings.php configuration page to execute JavaScript in the admin context and escalate privileges.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record blog.haao.sh powie.de
May 13, 2026WOOF Products Filter for WooCommerce 1.2.3 contains a persistent cross-site scripting vulnerability that allows authenticated attackers to inject malicious scriCVE-2020-37174 · WordPress plugins & themes · reported by VulnCheckMedium 4.8
WOOF Products Filter for WooCommerce 1.2.3 contains a persistent cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts by entering XSS payloads in design tab textfields. Attackers can inject JavaScript code through fields like 'Text for block toggle' and 'Custom front css styles' that executes on frontend pages when saved, affecting all site visitors.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record products-filter.com wordpress.org
May 13, 2026Custom Twitter Feeds: Stored Cross-Site ScriptingCVE-2026-6177 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Custom Twitter Feeds plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 2.5.4. This is due to insufficient output escaping in the CTF_Display_Elements::get_post_text() function when rendering cached tweet text. The plugin's ctf_get_more_posts AJAX action is available to unauthenticated users and directly outputs cached tweet data through nl2br() without HTML escaping. When an attacker can get malicious content into cached tweet data (either by tweeting content that gets cached by the site's feed configuration, or through other vulnerabilities), the malicious HTML/JavaScript is executed when the unauthenticated endpoint is accessed. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses the affected endpoint.
Product
Custom Twitter Feeds
Affected
up to 2.5.4
What to do
Affects up to 2.5.4. Update Custom Twitter Feeds to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 13, 2026Snow Monkey Blocks: Stored Cross-Site ScriptingCVE-2026-3004 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Snow Monkey Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘data-slick' attribute in all versions up to, and including, 24.1.11 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Snow Monkey Blocks
Affected
up to 24.1.11
What to do
Affects up to 24.1.11. Update Snow Monkey Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 13, 2026WPC Badge Management for WooCommerce: Stored Cross-Site ScriptingCVE-2025-14767 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The WPC Badge Management for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'text' attribute of the `wpcbm_best_seller` shortcode in all versions up to, and including, 3.1.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WPC Badge Management for WooCommerce
Affected
up to 3.1.6
What to do
Affects up to 3.1.6. Update WPC Badge Management for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 13, 2026Cost of Goods: Product Cost & Profit Calculator for WooCommerce: Stored Cross-Site ScriptingCVE-2026-6962 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Cost of Goods: Product Cost & Profit Calculator for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'alg_wc_cog_product_cost' and 'alg_wc_cog_product_profit' shortcodes in all versions up to, and including, 4.1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Cost of Goods: Product Cost & Profit Calculator for WooCommerce
Affected
up to 4.1.0
What to do
Affects up to 4.1.0. Update Cost of Goods: Product Cost & Profit Calculator for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 13, 2026Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder: Stored Cross-Site ScriptingCVE-2026-6828 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'permission_message' parameter in all versions up to, and including, 6.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder
Affected
up to 6.2.1
What to do
Affects up to 6.2.1. Update Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 13, 2026Broadstreet: Stored Cross-Site ScriptingCVE-2025-9989 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Broadstreet plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.53.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
Broadstreet
Affected
up to 1.53.1
What to do
Affects up to 1.53.1. Update Broadstreet to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 12, 2026Continually: Stored Cross-Site ScriptingCVE-2026-6813 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Continually plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 4.3.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
Continually
Affected
up to 4.3.1
What to do
Affects up to 4.3.1. Update Continually to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 12, 2026FastBots: Stored Cross-Site ScriptingCVE-2026-6800 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The FastBots plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.0.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
FastBots
Affected
up to 1.0.12
What to do
Affects up to 1.0.12. Update FastBots to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 12, 2026Bootstrap Shortcode: Stored Cross-Site ScriptingCVE-2026-7661 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Bootstrap Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `box` shortcode in all versions up to, and including, 1.0. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Bootstrap Shortcode
Affected
up to 1.0
What to do
Affects up to 1.0. Update Bootstrap Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
May 12, 2026Advanced Social Media Icons: Stored Cross-Site ScriptingCVE-2026-7659 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Advanced Social Media Icons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `social` shortcode in all versions up to, and including, 1.2. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Advanced Social Media Icons
Affected
up to 1.2
What to do
Affects up to 1.2. Update Advanced Social Media Icons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 12, 2026WP Google Maps Integration: Reflected Cross-Site ScriptingCVE-2026-7464 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WP Google Maps Integration plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `page` parameter in all versions up to, and including, 1.2. This is due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick an administrator into performing an action such as clicking on a link.
Product
WP Google Maps Integration
Affected
up to 1.2
What to do
Affects up to 1.2. Update WP Google Maps Integration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 12, 2026AzonPost: Reflected Cross-Site ScriptingCVE-2026-7437 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The AzonPost plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `editpos_hidden` parameter in all versions up to, and including, 1.3. This is due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick an administrator into performing an action such as clicking on a link.
Product
AzonPost
Affected
up to 1.3
What to do
Affects up to 1.3. Update AzonPost to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 12, 2026Shortcodely: Stored Cross-Site ScriptingCVE-2026-6913 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Shortcodely plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'widget_area' parameter in all versions up to, and including, 1.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Shortcodely
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update Shortcodely to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 12, 2026Pricing Tables for WP: Reflected Cross-Site ScriptingCVE-2026-6808 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Pricing Tables for WP plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and including, 1.1.0. This is due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick an administrator into performing an action such as clicking on a link.
Product
Pricing Tables for WP
Affected
up to 1.1.0
What to do
Affects up to 1.1.0. Update Pricing Tables for WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 12, 2026LifePress: Stored Cross-Site ScriptingCVE-2026-6690 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The LifePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'n' parameter of the lp_update_mds AJAX action in all versions up to, and including, 2.2.2. This is due to the `wp_ajax_nopriv_lp_update_mds` action being registered without nonce verification or capability checks, combined with insufficient input sanitization and output escaping when the series name is rendered in the admin settings page. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
LifePress
Affected
up to 2.2.2
What to do
Affects up to 2.2.2. Update LifePress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 12, 2026Credits Shortcode: Stored Cross-Site ScriptingCVE-2026-6256 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Credits Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'link' attribute of the 'credits' shortcode in all versions up to, and including, 1.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Credits Shortcode
Affected
up to 1.2
What to do
Affects up to 1.2. Update Credits Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.