Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
19,374 results · page 41 of 388
Aug 12, 2026Eventin: Does not properly restrict access to stored customer recordsCVE-2026-13168 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Eventin WordPress plugin before 4.1.20 does not properly restrict access to stored customer records, allowing users with contributor-level access and above to read other customers' personal data such as names and email addresses.
- Product
- Eventin
- Fixed in
- 4.1.20
- What to do
- Update Eventin to 4.1.20 or newer.
Aug 12, 2026LearnPress: Does not verify that a user is enrolled in a course before processing AI-assistant requests against that course's lesson contentCVE-2026-12976 · WordPress plugins & themes · reported by WPScanMedium 6.5
The LearnPress WordPress plugin before 4.4.4 does not verify that a user is enrolled in a course before processing AI-assistant requests against that course's lesson content, allowing any authenticated user such as a subscriber to obtain material from paid courses they have not enrolled in.
- Product
- LearnPress
- Fixed in
- 4.4.4
- What to do
- Update LearnPress to 4.4.4 or newer.
Aug 11, 2026Genkit does not properly validate host request headers.CVE-2026-67179 · Other software · genkit-ai · reported by 9119a7d8-5eab-497f-8521-727c672e3725High 7.8
Genkit does not properly validate host request headers. Any host on the developer's network, and any website the developer visits (via DNS rebinding), can reach POST /api/runAction on the Dev UI server (default port 4000) and execute any registered Genkit action and read the result. Fixed on 2026-06-18.
- Product
- genkit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2026The NewNotebook API does not sufficiently sanitize its parameters allowing an authenticated user with NOTEBOOK_EDIT permission to write the notebook record outsCVE-2026-18640 · Other software · Rapid7 · reported by cve@rapid7.comHigh 7.1
The NewNotebook API does not sufficiently sanitize its parameters allowing an authenticated user with NOTEBOOK_EDIT permission to write the notebook record outside the org's data store directory. The file written must have an extension of ".json.db" but can otherwise overwrite other metadata files (such as ACL records, hunts etc). This can corrupt these files and cause data corruption.
- Product
- Velociraptor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2026n8n before 1.123.67, 2.x before 2.31.5, and 2.32.x before 2.32.1 contain a type confusion vulnerability in the Send Email node, which does not enforce that its CVE-2026-72766 · Other software · n8n-io · reported by VulnCheckHigh 8.2
n8n before 1.123.67, 2.x before 2.31.5, and 2.32.x before 2.32.1 contain a type confusion vulnerability in the Send Email node, which does not enforce that its message fields are strings. A crafted non-string value supplied from a workflow expression into the text or HTML body field can be interpreted by the underlying mail library (Nodemailer) as a file path or URL, allowing arbitrary local file disclosure and server-side request forgery (SSRF). Exploitation requires a pre-existing active workflow with an unauthenticated webhook, valid SMTP credentials configured on the node, and untrusted input mapped directly into the body field; this is not a default configuration.
- Product
- n8n
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Aug 11, 2026Ray Enterprise Translation: Does not perform any capability or nonce checks on one of its AJAX actionsCVE-2026-14549 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Ray Enterprise Translation WordPress plugin through 1.7.3 does not perform any capability or nonce checks on one of its AJAX actions, allowing any authenticated user, including Subscribers, to add or delete the site's configured languages.
- Product
- Ray Enterprise Translation
- Affected
- up to 1.7.3
- What to do
- Affects up to 1.7.3. Update Ray Enterprise Translation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 11, 2026Ray Enterprise Translation: Does not perform any capability or nonce checks on one of its AJAX actionsCVE-2026-14548 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Ray Enterprise Translation WordPress plugin through 1.7.3 does not perform any capability or nonce checks on one of its AJAX actions, allowing any authenticated user, including Subscribers, to overwrite the administrator-configured translation API token with an arbitrary value.
- Product
- Ray Enterprise Translation
- Affected
- up to 1.7.3
- What to do
- Affects up to 1.7.3. Update Ray Enterprise Translation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 10, 2026SAP Approuter does not sufficiently sanitize certain request headers before forwarding traffic to internal components.CVE-2026-66778 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 5.3
SAP Approuter does not sufficiently sanitize certain request headers before forwarding traffic to internal components. An unauthenticated attacker could send a specially crafted request to obtain limited unauthorized access to information. This results in a low impact on confidentiality. There is no impact on integrity and availability.
- Product
- SAP Business AI Platform (Approuter)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2026SAP Approuter does not sufficiently validate certain incoming requests before forwarding them to backend destinations.CVE-2026-66777 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 5.9
SAP Approuter does not sufficiently validate certain incoming requests before forwarding them to backend destinations. Due to the complexity of the required conditions, an attacker with low privileges could send specially crafted requests to bypass authorization checks and reach protected resources beyond their assigned scope. Successful exploitation could allow the attacker to read sensitive data and perform limited modifications on protected resources, resulting in a high impact on confidentiality and a low impact on integrity. There is no impact on availability.
- Product
- SAP Business AI Platform (Approuter)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2026SAP Approuter does not consistently enforce integrity verification on certain session-related request headers under specific conditions.CVE-2026-66776 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 5.9
SAP Approuter does not consistently enforce integrity verification on certain session-related request headers under specific conditions. An attacker with low privileges could send a specially crafted request that bypasses the integrity check and loads another user's session context. Successful exploitation requires the attacker to have previously observed matching session values out-of-band, which makes the attack complex to execute. This could result in a high impact on confidentiality and a low impact on integrity. There is no impact on availability.
- Product
- SAP Business AI Platform (Approuter)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2026SAP Approuter does not enforce cross-site request forgery protection on the authentication flow by default.CVE-2026-66775 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 4.3
SAP Approuter does not enforce cross-site request forgery protection on the authentication flow by default. An unauthenticated attacker could craft a malicious link and trick a victim into following it. Successful exploitation could allow the attacker to bind the victim's session to an attacker-controlled identity, resulting in a low impact on integrity. There is no impact on confidentiality and availability.
- Product
- SAP Business AI Platform (Approuter)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2026SAP Approuter does not consistently handle certain error conditions.CVE-2026-66774 · Network & remote access · SAP_SE · reported by cna@sap.comLow 3.7
SAP Approuter does not consistently handle certain error conditions. An attacker with low privileges could exploit this under a non-default configuration. Successful exploitation is highly complex, as it depends on conditions outside the attacker's control. This could result in a low impact on availability. There is no impact on confidentiality and integrity.
- Product
- SAP Business AI Platform (Approuter)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2026SAP BusinessObjects Business Intelligence Platform (Admin Tools) does not perform sufficient authorization check on certain administrative functionality.CVE-2026-66772 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 4.3
SAP BusinessObjects Business Intelligence Platform (Admin Tools) does not perform sufficient authorization check on certain administrative functionality. An attacker authenticated as a non-administrative user could bypass this restriction to gain limited information about affected functionality. This results in a low impact on confidentiality. There is no impact on integrity and availability.
- Product
- SAP BusinessObjects Business Intelligence Platform (Admin Tools)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2026Reprocess Bank Statement Items in SAP S/4HANA does not perform the necessary authorization checks for authenticated users, allowing them to use rules that have CVE-2026-66764 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 4.3
Reprocess Bank Statement Items in SAP S/4HANA does not perform the necessary authorization checks for authenticated users, allowing them to use rules that have not been shared with them, resulting in privilege escalation.This vulnerability has a low impact on confidentiality, with no impact on integrity and availability of the application
- Product
- SAP S/4 HANA (Reprocess Bank Statement Items)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2026SAP Approuter does not enforce sufficient flow control in certain functionality.CVE-2026-66761 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 4.3
SAP Approuter does not enforce sufficient flow control in certain functionality. An attacker with low privileges could send high volumes of data without consuming responses, causing unbounded memory growth. This results in a low impact on availability. There is no impact on confidentiality and integrity.
- Product
- SAP Business AI Platform (Approuter)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2026SAP Approuter does not correctly validate client certificates in certain callback flows.CVE-2026-66760 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 6.4
SAP Approuter does not correctly validate client certificates in certain callback flows. An attacker with low privileges, holding a certificate from the same trusted authority with matching subject values, could bypass the identity check. This complexity makes the attack difficult to execute. Successful exploitation could allow impersonation of a trusted internal component, resulting in a high impact on integrity and a low impact on confidentiality and availability.
- Product
- SAP Business AI Platform (Approuter)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2026SAP Manufacturing Integration and Intelligence (MII) does not perform necessary authorization check on certain application function, allowing a low-privileged aCVE-2026-58244 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 4.3
SAP Manufacturing Integration and Intelligence (MII) does not perform necessary authorization check on certain application function, allowing a low-privileged authenticated attacker to access information that should be restricted to privileged users. Successful exploitation could allow the attacker to access the users account information in the application, which could be leveraged to facilitate further attacks against the identified user accounts. This vulnerability results in low impact on confidentiality of the data, with no impact on the integrity and availability
- Product
- SAP Manufacturing Integration and Intelligence
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2026SAP ABAP Development Tools does not perform necessary authorization checks for certain functionality, allowing an attacker with low privileges to execute unauthCVE-2026-58243 · Network & remote access · SAP_SE · reported by cna@sap.comHigh 8.8
SAP ABAP Development Tools does not perform necessary authorization checks for certain functionality, allowing an attacker with low privileges to execute unauthorized database operations against SAP NetWeaver AS ABAP. Successful exploitation could allow the attacker to read sensitive data, modify application data, and disrupt access for legitimate users, resulting in high impact on confidentiality, integrity, and availability.
- Product
- SAP ABAP Developer Tools
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2026SAP Approuter does not sufficiently validate tenant context in inbound requests.CVE-2026-58239 · Network & remote access · SAP_SE · reported by cna@sap.comLow 3.7
SAP Approuter does not sufficiently validate tenant context in inbound requests. An unauthenticated attacker could send specially crafted requests to spoof the tenant context under conditions not fully within their control. Successful exploitation could allow limited access to another tenant's information, resulting in a low impact on confidentiality. There is no impact on integrity and availability.
- Product
- SAP Business AI Platform (Approuter)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2026SAP Approuter does not sufficiently handle certain requests under specific conditions.CVE-2026-58238 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 5.9
SAP Approuter does not sufficiently handle certain requests under specific conditions. An unauthenticated attacker could send specially crafted input that causes the component to crash and restart. Successful exploitation requires specific runtime conditions to be met, making the attack complex to execute. This results in a high impact on availability. There is no impact on confidentiality and integrity.
- Product
- SAP Business AI Platform (Approuter)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2026WebSocket of SAP Approuter does not perform sufficient authorization checks in certain functionality.CVE-2026-58237 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 5.9
WebSocket of SAP Approuter does not perform sufficient authorization checks in certain functionality. An attacker with low privileges could exploit this to access restricted functionality. Successful exploitation could allow the attacker to read sensitive information and perform limited modifications, resulting in a high impact on confidentiality and a low impact on integrity. There is no impact on availability.
- Product
- SAP Business AI Platform (Approuter)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2026SAP Approuter does not sufficiently validate certain token content under specific configurations.CVE-2026-58230 · Network & remote access · SAP_SE · reported by cna@sap.comHigh 7
SAP Approuter does not sufficiently validate certain token content under specific configurations. An unauthenticated attacker could send a specially crafted token to cause sensitive credential material to be sent to an attacker-controlled destination. The attack complexity is high due to non-default preconditions required in the target environment. This results in a high impact on confidentiality and a low impact on integrity and availability.
- Product
- SAP Business AI Platform (Approuter)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2026Bitwarden Server before 2026.7.2 does not verify that the caller is a member of the organization identified in a POST /collect request body, allowing any authenCVE-2026-71959 · Other software · bitwarden · reported by VulnCheckMedium 6.9
Bitwarden Server before 2026.7.2 does not verify that the caller is a member of the organization identified in a POST /collect request body, allowing any authenticated user to write forged, arbitrarily backdated entries into any organization's audit log.
- Product
- server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2026In the Linux kernel, the following vulnerability has been resolved: hwmon: (corsair-psu) Stop device IO before calling hid_hw_stop hid_hw_stop() does not stopCVE-2026-68361 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
In the Linux kernel, the following vulnerability has been resolved: hwmon: (corsair-psu) Stop device IO before calling hid_hw_stop hid_hw_stop() does not stop the device IO. This results in a race condition between hid_input_report() and the point immediately following the execution of hid_device_io_start() within corsairpsu_probe(). If the probe operation fails after "io start" has been initiated, this race condition will result in a uaf vulnerability [1]. CPU0 CPU1 ==== ==== corsairpsu_probe() hid_device_io_start() ... unlock driver_input_lock hid_hw_stop() kfree(hidraw) __hid_input_report() ... acquire driver_input_lock hid_report_raw_event() hidraw_report_event() ... access hidraw's list_lock // trigger uaf Consequently, when corsairpsu_probe() fails and hid_hw_stop() needs to be executed, the io_started flag is first cleared while holding the driver_input_lock to prevent potential race conditions involving input reports. [1] BUG: KASAN: slab-use-after-free in rt_spin_lock+0x83/0x400 kernel/locking/spinlock_rt.c:56 Call Trace: hidraw_report_event+0x5d/0x3a0 drivers/hid/hidraw.c:577 hid_report_raw_event+0x311/0x1730 drivers/hid/hid-co
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Aug 10, 2026In the Linux kernel, the following vulnerability has been resolved: hwmon: (corsair-cpro) Stop device IO before calling hid_hw_stop Calling hid_hw_stop() doesCVE-2026-68360 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
In the Linux kernel, the following vulnerability has been resolved: hwmon: (corsair-cpro) Stop device IO before calling hid_hw_stop Calling hid_hw_stop() does not stop the device IO. This results in a race condition between hid_input_report() and the point immediately following the execution of hid_device_io_start() within the driver probe function. If the probe operation fails after "io start" has been initiated, this race condition will result in a UAF vulnerability. Fix the problem by calling hid_device_io_stop() before calling hid_hw_stop().
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Aug 10, 2026In the Linux kernel, the following vulnerability has been resolved: hwmon: (nzxt-smart2) Stop device IO before calling hid_hw_stop Calling hid_hw_stop() does CVE-2026-68359 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
In the Linux kernel, the following vulnerability has been resolved: hwmon: (nzxt-smart2) Stop device IO before calling hid_hw_stop Calling hid_hw_stop() does not stop the device IO. This results in a race condition between hid_input_report() and the point immediately following the execution of hid_device_io_start() within the driver probe function. If the probe operation fails after "io start" has been initiated, this race condition will result in a UAF vulnerability. Fix the problem by calling hid_device_io_stop() before calling hid_hw_stop().
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Aug 10, 2026In the Linux kernel, the following vulnerability has been resolved: hwmon: (nzxt-kraken3) Stop device IO before calling hid_hw_stop Calling hid_hw_stop() doesCVE-2026-68358 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
In the Linux kernel, the following vulnerability has been resolved: hwmon: (nzxt-kraken3) Stop device IO before calling hid_hw_stop Calling hid_hw_stop() does not stop the device IO. This results in a race condition between hid_input_report() and the point immediately following the execution of hid_device_io_start() within the driver probe function. If the probe operation fails after "io start" has been initiated, this race condition will result in a UAF vulnerability. Fix the problem by calling hid_device_io_stop() before calling hid_hw_stop().
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Aug 10, 2026In the Linux kernel, the following vulnerability has been resolved: phonet: pep: fix use-after-free in pep_get_sb() pep_get_sb() doesn't consider that pskb_maCVE-2026-68144 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Critical 9.8
In the Linux kernel, the following vulnerability has been resolved: phonet: pep: fix use-after-free in pep_get_sb() pep_get_sb() doesn't consider that pskb_may_pull() might have relocated the skb data, and continue to access the older pointer, causing UAF. Reproduced under KASAN: BUG: KASAN: slab-use-after-free in pep_get_sb+0x234/0x3b0 Read of size 1 at addr ff11000105510f50 by task repro/157 pep_get_sb+0x234/0x3b0 pipe_handler_do_rcv+0x5f7/0xa10 pep_do_rcv+0x203/0x410 __sk_receive_skb+0x471/0x4a0 phonet_rcv+0x5b3/0x6c0 __netif_receive_skb+0xcc/0x1d0 Refetch the header with skb_header_pointer() after pskb_may_pull(), so the possibly stale pointer is no longer dereferenced. There are better ways to solve this, but, this is the less instrusive one.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Aug 10, 2026Product Input Fields for WooCommerce: Does not validate uploaded file typesCVE-2026-19089 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Product Input Fields for WooCommerce WordPress plugin before 2.0.2 does not validate uploaded file types when its accepted-types setting is left empty, which its own documentation advertises as accepting all files, allowing unauthenticated attackers to upload arbitrary files and achieve remote code execution on servers that do not honour the directory's access rules.
- Product
- Product Input Fields for WooCommerce
- Fixed in
- 2.0.2
- What to do
- Update Product Input Fields for WooCommerce to 2.0.2 or newer.
Aug 10, 2026Duplicate Post: Does not perform per-object authorisation checks in its bulk copy and delete operationsCVE-2026-19077 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Duplicate Post WordPress plugin before 1.5.5 does not perform per-object authorisation checks in its bulk copy and delete operations, allowing any user whose role an administrator has granted Duplicate Post WordPress plugin before 1.5.5 access to permanently delete arbitrary posts on the site, including those belonging to other users.
- Product
- Duplicate Post
- Fixed in
- 1.5.5
- What to do
- Update Duplicate Post to 1.5.5 or newer.
Aug 10, 2026ProSolution WP Client: Does not sanitise and escape a parameter before using it in a SQL statement reachable by unauthenticated visitorsCVE-2026-19053 · WordPress plugins & themes · reported by WPScanCritical 9.1
The ProSolution WP Client WordPress plugin before 2.0.6 does not sanitise and escape a parameter before using it in a SQL statement reachable by unauthenticated visitors, leading to a blind SQL injection.
- Product
- ProSolution WP Client
- Fixed in
- 2.0.6
- What to do
- Update ProSolution WP Client to 2.0.6 or newer.
Aug 10, 2026ProSolution WP Client: Does not sanitise a cookie value before using it in SQL queriesCVE-2026-19049 · WordPress plugins & themes · reported by WPScanHigh 8.6
The ProSolution WP Client WordPress plugin before 2.0.9 does not sanitise a cookie value before using it in SQL queries, and processes that cookie on every request without any authentication or capability check, allowing unauthenticated users to read arbitrary data from the database and to delete the records the ProSolution WP Client WordPress plugin before 2.0.9 stores.
- Product
- ProSolution WP Client
- Fixed in
- 2.0.9
- What to do
- Update ProSolution WP Client to 2.0.9 or newer.
Aug 10, 2026Block User Account: Does not enforce its account block on every authentication pathCVE-2026-18960 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Block User Account WordPress plugin before 2.0.1 does not enforce its account block on every authentication path, allowing a blocked user who holds an application password created before the block to retain their full role-level read and write access through the REST API.
- Product
- Block User Account
- Fixed in
- 2.0.1
- What to do
- Update Block User Account to 2.0.1 or newer.
Aug 10, 2026Contact Form to Any API: Does not use a random filenameCVE-2026-18946 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Contact Form to Any API WordPress plugin before 3.0.7 does not use a random filename when copying files uploaded through contact forms into a publicly accessible directory, allowing unauthenticated attackers to enumerate and download files submitted by other users.
- Product
- Contact Form to Any API
- Fixed in
- 3.0.7
- What to do
- Update Contact Form to Any API to 3.0.7 or newer.
Aug 10, 2026RSS Aggregator by Feedzy: Does not verify that the requesting user owns or is allowed to edit the import job named in the requestCVE-2026-18934 · WordPress plugins & themes · reported by WPScanMedium 5.5
The RSS Aggregator by Feedzy WordPress plugin before 5.2.6 does not verify that the requesting user owns or is allowed to edit the import job named in the request, allowing users with author-level access and above to permanently delete the posts created by another user's import job, reset its deduplication and scheduling state, disable it, or clear its error log. One of the affected actions performs no object-type check either, so arbitrary posts and pages can also be unpublished regardless of who owns them.
- Product
- RSS Aggregator by Feedzy
- Fixed in
- 5.2.6
- What to do
- Update RSS Aggregator by Feedzy to 5.2.6 or newer.
Aug 10, 2026CheckView: Does not restrict its REST API authentication filter to its own routes and unconditionally discards the authentication error raised for any request whose URI merely contains a CheckView WordPress plugin beforeCVE-2026-18786 · WordPress plugins & themes · reported by WPScanHigh 8.8
The CheckView WordPress plugin before 2.3.2 does not restrict its REST API authentication filter to its own routes and unconditionally discards the authentication error raised for any request whose URI merely contains a CheckView WordPress plugin before 2.3.2-specific string, making it possible for unauthenticated attackers to bypass the REST nonce check and perform any REST action available to a logged-in administrator, such as creating a new administrator account, via a crafted link an administrator is tricked into opening.
- Product
- CheckView
- Fixed in
- 2.3.2
- What to do
- Update CheckView to 2.3.2 or newer.
Aug 10, 2026Library Management System: Does not sanitize and escape a user-supplied parameter before using it in a SQL statementCVE-2026-18666 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Library Management System WordPress plugin before 3.6.7 does not sanitize and escape a user-supplied parameter before using it in a SQL statement, allowing users with a role as low as Subscriber to perform SQL injection and extract arbitrary data from the database, including user password hashes.
- Product
- Library Management System
- Fixed in
- 3.6.7
- What to do
- Update Library Management System to 3.6.7 or newer.
Aug 10, 2026Login & Register Forms: Does not verify that a password reset request comes from the account's ownerCVE-2026-18470 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Login & Register Forms WordPress plugin before 4.0.2 does not verify that a password reset request comes from the account's owner, and does not adequately redact the address returned in its response, allowing unauthenticated users to obtain registered users' email addresses, including administrators'.
- Product
- Login & Register Forms
- Fixed in
- 4.0.2
- What to do
- Update Login & Register Forms to 4.0.2 or newer.
Aug 10, 2026Login & Register Forms: Does not enforce its password reset attempt limit against a server-derived valueCVE-2026-18469 · WordPress plugins & themes · reported by WPScanHigh 8.1
The Login & Register Forms WordPress plugin before 4.0.2 does not enforce its password reset attempt limit against a server-derived value, keying both the verification code and the per-source attempt counter on client-controlled data, allowing unauthenticated attackers to reset the limit at will and brute-force the code to take over any account, including administrators, when the verification-code reset mode is enabled.
- Product
- Login & Register Forms
- Fixed in
- 4.0.2
- What to do
- Update Login & Register Forms to 4.0.2 or newer.
Aug 10, 2026Login & Register Forms: Does not bind the password reset verification state to the account being reset or to the party that completed the verificationCVE-2026-18468 · WordPress plugins & themes · reported by WPScanHigh 8.1
The Login & Register Forms WordPress plugin before 4.0.2 does not bind the password reset verification state to the account being reset or to the party that completed the verification, keying it instead on a value the client controls, allowing unauthenticated attackers to take over the account of any user who recently completed a reset verification, including an administrator.
- Product
- Login & Register Forms
- Fixed in
- 4.0.2
- What to do
- Update Login & Register Forms to 4.0.2 or newer.
Aug 10, 2026FoodBoxBooker: Does not verify that the user account being updated belongs to the user making the requestCVE-2026-18200 · WordPress plugins & themes · reported by WPScanMedium 4.3
The FoodBoxBooker WordPress plugin before 1.0.8 does not verify that the user account being updated belongs to the user making the request, allowing authenticated users, with Subscriber-level access and above, to modify the profile details of arbitrary users, including administrators.
- Product
- FoodBoxBooker
- Fixed in
- 1.0.8
- What to do
- Update FoodBoxBooker to 1.0.8 or newer.
Aug 10, 2026BricksForge: Does not verify the identity of the requesterCVE-2026-18030 · WordPress plugins & themes · reported by WPScanHigh 8.1
The BricksForge WordPress plugin before 3.1.8.8 does not verify the identity of the requester when processing a password change submitted through one of its form actions, allowing unauthenticated attackers to set an arbitrary password for any user, including administrators, and take over their account. Exploitation requires the site to have a form using the BricksForge WordPress plugin before 3.1.8.8's password reset action in its update mode. The server-side current-password verification option for that action is disabled by default, so the vulnerable state is the default one once the action is used.
- Product
- BricksForge
- Fixed in
- 3.1.8.8
- What to do
- Update BricksForge to 3.1.8.8 or newer.
Aug 10, 2026File Manager: Does not perform any capability check on one of its file manager connector endpointsCVE-2026-17542 · WordPress plugins & themes · reported by WPScanHigh 7.5
The File Manager WordPress plugin before 6.9.1 does not perform any capability check on one of its file manager connector endpoints, allowing any authenticated user, such as a subscriber, to browse the entire WordPress installation directory and download files of certain types from it, including archives and documents which may contain sensitive data.
- Product
- File Manager
- Fixed in
- 6.9.1
- What to do
- Update File Manager to 6.9.1 or newer.
Aug 10, 2026File Manager: Does not have authorisation checks on one of its REST API routesCVE-2026-17541 · WordPress plugins & themes · reported by WPScanHigh 7.5
The File Manager WordPress plugin before 6.9.1 does not have authorisation checks on one of its REST API routes, allowing unauthenticated users to read its file activity log, disclosing the file operations performed on the site, the paths involved and the name of the user who performed them.
- Product
- File Manager
- Fixed in
- 6.9.1
- What to do
- Update File Manager to 6.9.1 or newer.
Aug 10, 2026File Manager: Does not properly authorise its file management commandsCVE-2026-17540 · WordPress plugins & themes · reported by WPScanHigh 8.8
The File Manager WordPress plugin before 6.9.1 does not properly authorise its file management commands, allowing any authenticated user, such as a subscriber, to read and delete arbitrary files under the WordPress installation directory, which could lead to the disclosure of the site's configuration secrets and to denial of service.
- Product
- File Manager
- Fixed in
- 6.9.1
- What to do
- Update File Manager to 6.9.1 or newer.
Aug 10, 2026Salon Booking System: Does not perform any capability check or validate an OAuth state value on its Google Calendar authorization callbackCVE-2026-17023 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Salon Booking System WordPress plugin through 10.30.33 does not perform any capability check or validate an OAuth state value on its Google Calendar authorization callback, which is also hooked for unauthenticated users, allowing an unauthenticated attacker to overwrite the site's stored Google Calendar connection tokens with attacker-controlled ones and hijack the integration. Exploitation requires the site to have configured its own Google OAuth client for the calendar feature.
- Product
- Salon Booking System
- Affected
- up to 10.30.33
- What to do
- Affects up to 10.30.33. Update Salon Booking System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 10, 2026Salon Booking System: Does not properly validate a booking's ownership token before loading it in its booking-wizard confirmation stepsCVE-2026-17022 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Salon Booking System WordPress plugin before 10.30.34 does not properly validate a booking's ownership token before loading it in its booking-wizard confirmation steps, allowing unauthenticated attackers to disclose other customers' booking records, including personal information, by supplying a sequential booking identifier.
- Product
- Salon Booking System
- Fixed in
- 10.30.34
- What to do
- Update Salon Booking System to 10.30.34 or newer.
Aug 10, 2026Salon Booking System: Does not properly restrict access to some of its booking-modification AJAX actions and does not verify ownership of the targeted bookingCVE-2026-17021 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Salon Booking System WordPress plugin before 10.30.34 does not properly restrict access to some of its booking-modification AJAX actions and does not verify ownership of the targeted booking, allowing unauthenticated users to tamper with the stored total of arbitrary bookings.
- Product
- Salon Booking System
- Fixed in
- 10.30.34
- What to do
- Update Salon Booking System to 10.30.34 or newer.
Aug 10, 2026Salon Booking System: Does not verify that a requested booking belongs to the caller on one of its REST API endpointsCVE-2026-17020 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Salon Booking System WordPress plugin through 10.31.0 does not verify that a requested booking belongs to the caller on one of its REST API endpoints, requiring only a basic read capability, allowing any authenticated user (including a Subscriber or self-registered customer account) to disclose any customer's booking personal data such as name, email, phone number, address and private notes by enumerating booking identifiers.
- Product
- Salon Booking System
- Affected
- up to 10.31.0
- What to do
- Affects up to 10.31.0. Update Salon Booking System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 10, 2026JetEngine: Does not sanitise uploaded SVG files before storing and serving themCVE-2026-17019 · WordPress plugins & themes · reported by WPScanMedium 6.1
The JetEngine WordPress plugin before 3.8.13.1 does not sanitise uploaded SVG files before storing and serving them, and does not adequately restrict who can upload them, allowing unauthenticated attackers to upload a file containing malicious JavaScript that executes in the browser of any user who opens it (Stored Cross-Site Scripting).
- Product
- JetEngine
- Fixed in
- 3.8.13.1
- What to do
- Update JetEngine to 3.8.13.1 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.