Updated 2 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

472new WordPress flaws this week

390,714entries in the database

2,973 results · page 5 of 60

Aug 8, 2026Link Library: Does not sanitise and escape a parameter before reflecting it back in a responseCVE-2026-16535 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Link Library WordPress plugin before 7.9.4 does not sanitise and escape a parameter before reflecting it back in a response, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting attacks against users who can be tricked into performing an action.
Product
Link Library
Fixed in
7.9.4
What to do
Update Link Library to 7.9.4 or newer.
Full record and what to do →NVD record wpscan.com
Aug 7, 2026Content Views: Does not perform a capability check on one of its AJAX actions and does not properly sanitise attacker-supplied data before using it in a SQL queryCVE-2026-15361 · WordPress plugins & themes · reported by WPScanHigh 8.1
The Content Views WordPress plugin before 4.5 does not perform a capability check on one of its AJAX actions and does not properly sanitise attacker-supplied data before using it in a SQL query, allowing any authenticated user, including Subscribers, to perform SQL injection attacks.
Product
Content Views
Fixed in
4.5
What to do
Update Content Views to 4.5 or newer.
Full record and what to do →NVD record wpscan.com
Aug 6, 2026Multiple Supsystic Pro plugins were distributed with malicious code through the vendor's compromised update server, allowing unauthenticated attackers to deployCVE-2026-17032 · WordPress plugins & themes · reported by WPScanCritical 9.8
Multiple Supsystic Pro plugins were distributed with malicious code through the vendor's compromised update server, allowing unauthenticated attackers to deploy a second-stage payload that exfiltrates credentials and other sensitive data and grants full control of affected sites.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record wpscan.com
Aug 6, 2026The Premium SEO WordPress plugin is malicious: it ships an unauthenticated backdoor that creates a hidden administrator account and, in some builds, also enableCVE-2026-14812 · WordPress plugins & themes · reported by WPScanCritical 10
The Premium SEO WordPress plugin is malicious: it ships an unauthenticated backdoor that creates a hidden administrator account and, in some builds, also enables remote code execution, server-side request forgery and arbitrary front-end script/content injection, giving an unauthenticated attacker full control of the affected site.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record wpscan.com
Aug 6, 2026Unauthenticated Broken Authentication in Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder <= 1.9.0 versions.CVE-2026-66425 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Broken Authentication in Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder <= 1.9.0 versions.
Affected
up to 1.9.0
What to do
Affects up to 1.9.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 6, 2026Unauthenticated Bypass Vulnerability in Element Pack Elementor Addons <= 8.7.13 versions.CVE-2026-65502 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Bypass Vulnerability in Element Pack Elementor Addons <= 8.7.13 versions.
Affected
up to 8.7.13
What to do
Affects up to 8.7.13. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 6, 2026Unauthenticated Cross Site Request Forgery (CSRF) in Tracking Code Manager <= 2.6.0 versions.CVE-2026-28172 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Request Forgery (CSRF) in Tracking Code Manager <= 2.6.0 versions.
Affected
up to 2.6.0
What to do
Affects up to 2.6.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 6, 2026Element Pack Addons for Elementor: Email Header InjectionCVE-2026-0673 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Element Pack Addons for Elementor plugin for WordPress is vulnerable to Email Header Injection in all versions up to, and including, 8.3.15 via the `element_pack_contact_form` AJAX action. This is due to insufficient sanitization of newline characters in user-supplied input that gets concatenated into email headers. This makes it possible for unauthenticated attackers to inject arbitrary email headers into emails sent by the contact form.
Product
Element Pack Addons for Elementor
Affected
up to 8.3.15
What to do
Affects up to 8.3.15. Update Element Pack Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Aug 6, 2026Child Pages Card: Does not sanitise and escape some of its shortcode attributes before outputting them back in a pageCVE-2026-18395 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Child Pages Card WordPress plugin before 1.09 does not sanitise and escape some of its shortcode attributes before outputting them back in a page, allowing users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
Child Pages Card
Fixed in
1.09
What to do
Update Child Pages Card to 1.09 or newer.
Full record and what to do →NVD record wpscan.com
Aug 6, 2026Gutenberg Essential Blocks: Does not verify that an attacker-supplied post type is publicly viewable before querying it in one of its public REST routesCVE-2026-13154 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Gutenberg Essential Blocks WordPress plugin before 6.4.0 does not verify that an attacker-supplied post type is publicly viewable before querying it in one of its public REST routes, allowing unauthenticated users to read published entries of custom post types that the site registered as non-public.
Product
Gutenberg Essential Blocks
Fixed in
6.4.0
What to do
Update Gutenberg Essential Blocks to 6.4.0 or newer.
Full record and what to do →NVD record wpscan.com
Aug 6, 2026WPCargo Track & Trace: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2026-12713 · WordPress plugins & themes · reported by WPScanCritical 9.1
The WPCargo Track & Trace WordPress plugin before 8.0.4 does not properly sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks. This affects a code path distinct from the one addressed by CVE-2024-44004.
Product
WPCargo Track & Trace
Fixed in
8.0.4
What to do
Update WPCargo Track & Trace to 8.0.4 or newer.
Full record and what to do →NVD record wpscan.com
Aug 5, 2026Backup Migration: OS Command InjectionCVE-2026-7693 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Backup Migration plugin for WordPress is vulnerable to OS Command Injection in all versions up to, and including, 2.1.5.1 due to insufficient sanitization of the `file` POST parameter on the `restoreBackup()` AJAX handler. The handler applies `esc_attr()` — an HTML-context sanitizer that does not strip shell metacharacters — and concatenates the result, unquoted, into a `php-cli -f … bmi_restore <file> <remote>` command passed to `exec()`. This makes it possible for authenticated attackers, with Administrator-level access (or any user granted the plugin's `do_backups` capability) and above, to execute arbitrary OS commands as the web-server user, bypassing WordPress hardening constants such as `DISALLOW_FILE_EDIT` and `DISALLOW_FILE_MODS` that would otherwise prevent code execution from the admin UI. This is an incomplete fix of CVE-2023-7002, which patched the same pattern only in the `$_POST['url']` path of `handleQuickMigration()`; the equivalent mitigations (`rawurlencode()` + explicit shell-metachar replacement + double-quoting in `exec()`) were never applied to `$backupName`.
Product
Backup Migration
Affected
up to 2.1.5.1
What to do
Affects up to 2.1.5.1. Update Backup Migration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 5, 2026GeoDirectory: Does not sanitise and escape a place-category setting before outputting it back in an admin pageCVE-2025-15677 · WordPress plugins & themes · reported by WPScanLow 3.5
The GeoDirectory WordPress plugin before 2.8.110 does not sanitise and escape a place-category setting before outputting it back in an admin page, allowing high-privilege users such as editors and above to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in a multisite setup).
Product
GeoDirectory
Fixed in
2.8.110
What to do
Update GeoDirectory to 2.8.110 or newer.
Full record and what to do →NVD record wpscan.com
Aug 5, 2026PrettyLinks – Affiliate Links, Link Branding, Link Tracking, Marketing and Stripe Payments: SQL InjectionCVE-2026-5062 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The PrettyLinks – Affiliate Links, Link Branding, Link Tracking, Marketing and Stripe Payments Plugin plugin for WordPress is vulnerable to SQL Injection via the 's' (search) parameter on the Pretty Links listing page in all versions up to, and including, 3.6.20. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query in the `search_links_table()` function. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
PrettyLinks – Affiliate Links, Link Branding, Link Tracking, Marketing and Stripe Payments
Affected
up to 3.6.20
What to do
Affects up to 3.6.20. Update PrettyLinks – Affiliate Links, Link Branding, Link Tracking, Marketing and Stripe Payments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 2, 2026SMS Alert: Does not bind its "mobile verified" session flag to the phone number that was actually verified: after an attacker verifies an OTP sent to their own phoneCVE-2026-15206 · WordPress plugins & themes · reported by WPScanHigh 7.5
The SMS Alert WordPress plugin before 3.9.8 does not bind its "mobile verified" session flag to the phone number that was actually verified: after an attacker verifies an OTP sent to their own phone, the signup/login handler reads a fresh, attacker-supplied phone number to select the account and logs them in. An unauthenticated attacker can therefore log in as any user, including an administrator, who has a billing phone on file.
Product
SMS Alert
Fixed in
3.9.8
What to do
Update SMS Alert to 3.9.8 or newer.
Full record and what to do →NVD record wpscan.com
Aug 2, 2026Element Pack Addons for Elementor: Does not sanitize option values passed through certain data attributes before a bundled front-end library re-parses and renders them in the browserCVE-2026-14817 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Element Pack Addons for Elementor WordPress plugin before 8.7.13 does not sanitize option values passed through certain data attributes before a bundled front-end library re-parses and renders them in the browser, allowing users with contributor-level access or higher to inject arbitrary JavaScript that executes in the session of any visitor who views the affected content.
Product
Element Pack Addons for Elementor
Fixed in
8.7.13
What to do
Update Element Pack Addons for Elementor to 8.7.13 or newer.
Full record and what to do →NVD record wpscan.com
Aug 1, 2026WPvivid Backup & Migration: SQL InjectionCVE-2026-17555 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The WPvivid Backup & Migration plugin for WordPress is vulnerable to SQL Injection via the export_data parameter in versions up to, and including, 0.9.131. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. The values are received in prepare_export_post(), passed through sanitize_text_field() and stripslashes(), JSON-decoded, and the attacker-controlled JSON object keys are collected as $posts_ids without integer casting. They are stored in the export task options and later joined with commas and interpolated directly into a `WHERE ID IN (...)` clause inside a $wpdb->get_results() call in export_post_to_xml() (unquoted, numeric context), with no $wpdb->prepare() or esc_sql(). This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
WPvivid Backup & Migration
Affected
up to 0.9.131
What to do
Affects up to 0.9.131. Update WPvivid Backup & Migration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 1, 2026Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder: Authorization bypassCVE-2026-11995 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.9.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to modify the read/unread status of or permanently trash arbitrary form submission entries belonging to any form. The nonce issued by check_ajax_referer() does not function as an authorization barrier because the nonce action 'gutena_Forms' is emitted to unauthenticated visitors via wp_localize_script() on any public page that contains a Gutena Forms block, making it freely obtainable by anonymous attackers.
Product
Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder
Affected
up to 1.9.0
What to do
Affects up to 1.9.0. Update Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 1, 2026Download Manager: Does not properly escape a package's title before outputting it in the front-end package templatesCVE-2026-14292 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Download Manager WordPress plugin before 3.3.66 does not properly escape a package's title before outputting it in the front-end package templates, allowing users with the Author role or above to store a title that results in arbitrary JavaScript execution in the browser of any user, including unauthenticated visitors, who views a page displaying the package.
Product
Download Manager
Fixed in
3.3.66
What to do
Update Download Manager to 3.3.66 or newer.
Full record and what to do →NVD record wpscan.com
Jul 31, 2026Demi: Stores its full-site backup archives in a publicly accessible location under a predictable filename and without access protectionCVE-2026-14333 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Demi WordPress plugin before 0.0.7 stores its full-site backup archives in a publicly accessible location under a predictable filename and without access protection, allowing unauthenticated attackers to download complete backups including the site database and its user password hashes.
Product
Demi
Fixed in
0.0.7
What to do
Update Demi to 0.0.7 or newer.
Full record and what to do →NVD record wpscan.com
Jul 30, 2026Ultimate Addons for WPBakery Page Builder: Does not perform a capability or nonce check before deleting a site's custom-uploaded icon font packsCVE-2026-15382 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Ultimate Addons for WPBakery Page Builder WordPress plugin before 3.21.4 does not perform a capability or nonce check before deleting a site's custom-uploaded icon font packs, allowing unauthenticated attackers to permanently delete all of a site's custom icon fonts with a single request.
Product
Ultimate Addons for WPBakery Page Builder
Fixed in
3.21.4
What to do
Update Ultimate Addons for WPBakery Page Builder to 3.21.4 or newer.
Full record and what to do →NVD record wpscan.com
Jul 30, 2026Eventin: Does not properly authorize order creation and accepts an attacker-supplied order statusCVE-2026-13178 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Eventin WordPress plugin before 4.1.16 does not properly authorize order creation and accepts an attacker-supplied order status, allowing unauthenticated users to create orders marked as paid without completing any payment.
Product
Eventin
Fixed in
4.1.16
What to do
Update Eventin to 4.1.16 or newer.
Full record and what to do →NVD record wpscan.com
Jul 30, 2026WP Travel: Does not verify PayPal Instant Payment Notifications through the PayPal post-back handshake before marking a booking paidCVE-2026-13143 · WordPress plugins & themes · reported by WPScanMedium 5.3
The WP Travel WordPress plugin before 11.8.1 does not verify PayPal Instant Payment Notifications through the PayPal post-back handshake before marking a booking paid, allowing unauthenticated attackers to forge a notification that flips an arbitrary pending booking to a paid and booked state at an attacker-chosen amount.
Product
WP Travel
Fixed in
11.8.1
What to do
Update WP Travel to 11.8.1 or newer.
Full record and what to do →NVD record wpscan.com
Jul 30, 2026WP Ghost (Hide My WP Ghost): Does not verify that client IP information comes from a trusted proxy before trusting attacker-controllable HTTP headersCVE-2026-11870 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Ghost (Hide My WP Ghost) WordPress plugin before 7.0.05 does not verify that client IP information comes from a trusted proxy before trusting attacker-controllable HTTP headers, allowing unauthenticated attackers to spoof their IP address to bypass the WP Ghost (Hide My WP Ghost) WordPress plugin before 7.0.05's own brute-force protection and to downgrade its firewall by matching a hardcoded whitelisted IP range.
Product
WP Ghost (Hide My WP Ghost)
Fixed in
7.0.05
What to do
Update WP Ghost (Hide My WP Ghost) to 7.0.05 or newer.
Full record and what to do →NVD record wpscan.com
Jul 28, 2026Premium Packages – Sell Digital Products Securely: SQL InjectionCVE-2026-12800 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to SQL Injection via the 'code' parameter of the POST /wp-json/wpdmpp/v1/cart/coupon REST API endpoint in versions up to, and including, 6.2.0. This is due to insufficient escaping on the user-supplied parameter, which is interpolated directly into a raw SQL query string in the CouponCodes::find() method without use of $wpdb->prepare() or esc_sql(). This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Premium Packages – Sell Digital Products Securely
Affected
up to 6.2.0
What to do
Affects up to 6.2.0. Update Premium Packages – Sell Digital Products Securely to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 28, 2026Demi – One Click Demo Import, WP Backup & Site Migration: Arbitrary Directory CopyCVE-2026-15012 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Demi – One Click Demo Import, WP Backup & Site Migration plugin for WordPress is vulnerable to Arbitrary Directory Copy in all versions up to, and including, 0.0.8 via the handle_restore_step function. This is due to missing HTTP access controls on the wp-content/uploads/demi-backup-state/ directory, which exposes the cryptographic restore key used to both authenticate the unauthenticated AJAX handler and forge signed restore-state envelopes. This makes it possible for unauthenticated attackers to copy arbitrary files to attacker-controlled destinations on the server. An active restore operation must have been initiated, which writes the .restore_key and .restore_step_token files to the public upload directory, before the exposed secrets can be harvested and chained to achieve unauthenticated arbitrary file copy.
Product
Demi – One Click Demo Import, WP Backup & Site Migration
Affected
up to 0.0.8
What to do
Affects up to 0.0.8. Update Demi – One Click Demo Import, WP Backup & Site Migration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 28, 2026Database for Contact Form 7, WPforms, Elementor forms: Does not properly sanitise and escape a parameter before reflecting it back in an admin pageCVE-2026-14870 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Database for Contact Form 7, WPforms, Elementor forms WordPress plugin before 1.5.3 does not properly sanitise and escape a parameter before reflecting it back in an admin page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Product
Database for Contact Form 7, WPforms, Elementor forms
Fixed in
1.5.3
What to do
Update Database for Contact Form 7, WPforms, Elementor forms to 1.5.3 or newer.
Full record and what to do →NVD record wpscan.com
Jul 28, 2026Demi – One Click Demo Import, WP Backup & Site Migration: Arbitrary Directory DeletionCVE-2026-14490 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Demi – One Click Demo Import, WP Backup & Site Migration plugin for WordPress is vulnerable to Arbitrary Directory Deletion in all versions up to, and including, 0.0.7. The vulnerability exists because the plugin stores its HMAC signing key and per-step restore token as dotfiles inside a publicly accessible subdirectory of the WordPress uploads folder — without any `.htaccess` or index file protection — and the `demi_restore_step` AJAX handler, registered for unauthenticated callers, explicitly accepts possession of the on-disk signing key as a standalone alternative to WordPress capability and nonce checks; an unauthenticated attacker who retrieves the exposed key can forge a valid signed state envelope to invoke `CleanDir::execute()` with a caller-supplied absolute path that is subject to no allow-list or path-canonicalization check. This makes it possible for unauthenticated attackers to recursively delete arbitrary directories on the server.
Product
Demi – One Click Demo Import, WP Backup & Site Migration
Affected
up to 0.0.7
What to do
Affects up to 0.0.7. Update Demi – One Click Demo Import, WP Backup & Site Migration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 27, 2026Unauthenticated Cross Site Scripting (XSS) in BackWPup <= 5.7.4 versions.CVE-2026-65443 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in BackWPup <= 5.7.4 versions.
Affected
up to 5.7.4
What to do
Affects up to 5.7.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 27, 2026bookingpress-appointment-booking-pro: Does not correctly invoke its REST permission callbackCVE-2026-9830 · WordPress plugins & themes · reported by WPScanHigh 8.2
The bookingpress-appointment-booking-pro WordPress plugin before 5.7.3 does not correctly invoke its REST permission callback, leaving every route in one of its API namespaces reachable without authentication and allowing unauthenticated attackers to read customer booking data and modify other users' bookings.
Product
bookingpress-appointment-booking-pro
Fixed in
5.7.3
What to do
Update bookingpress-appointment-booking-pro to 5.7.3 or newer.
Full record and what to do →NVD record wpscan.com
Jul 27, 2026MPG: Does not sanitise and escape a parameter before reflecting it back in the responseCVE-2026-13726 · WordPress plugins & themes · reported by WPScanHigh 7.1
The MPG WordPress plugin before 4.1.8 does not sanitise and escape a parameter before reflecting it back in the response, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting against a victim who is induced to send a crafted request.
Product
MPG
Fixed in
4.1.8
What to do
Update MPG to 4.1.8 or newer.
Full record and what to do →NVD record wpscan.com
Jul 27, 2026Document Gallery: Does not properly sanitise and escape user input before reflecting it back in the response of an unauthenticated AJAX actionCVE-2026-12982 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Document Gallery WordPress plugin before 5.1.1 does not properly sanitise and escape user input before reflecting it back in the response of an unauthenticated AJAX action, leading to a Reflected Cross-Site Scripting vulnerability which can be exploited against unauthenticated users.
Product
Document Gallery
Fixed in
5.1.1
What to do
Update Document Gallery to 5.1.1 or newer.
Full record and what to do →NVD record wpscan.com
Jul 25, 2026Fluent Forms Pro Add On Pack: PHP Object InjectionCVE-2026-15962 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Fluent Forms Pro Add On Pack plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.2.6 via deserialization of untrusted input. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject a PHP Object. The additional presence of a POP chain allows attackers to change user passwords and potentially take over administrator accounts. Note: This can only be exploited if user update integration is enabled and a user meta field is mapped.
Product
Fluent Forms Pro Add On Pack
Affected
up to 6.2.6
What to do
Affects up to 6.2.6. Update Fluent Forms Pro Add On Pack to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record fluentforms.com wordfence.com
Jul 24, 2026Project Management, Bug and Issue Tracking: Does not sanitise and escape user supplied input before using it in a SQL queryCVE-2026-12877 · WordPress plugins & themes · reported by WPScanCritical 9.1
The Project Management, Bug and Issue Tracking Plugin WordPress plugin before 5.1.0 does not sanitise and escape user supplied input before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection attacks. This is exploitable in the Project Management, Bug and Issue Tracking Plugin WordPress plugin before 5.1.0's standard front-end issue-tracker configuration.
Product
Project Management, Bug and Issue Tracking
Fixed in
5.1.0
What to do
Update Project Management, Bug and Issue Tracking to 5.1.0 or newer.
Full record and what to do →NVD record wpscan.com
Jul 23, 2026Unauthenticated SQL Injection in WPDM – Premium Packages <= 6.2.0 versions.CVE-2026-61948 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in WPDM – Premium Packages <= 6.2.0 versions.
Affected
up to 6.2.0
What to do
Affects up to 6.2.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 23, 2026Unauthenticated Broken Access Control in WPDM – Premium Packages <= 6.2.0 versions.CVE-2026-61943 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in WPDM – Premium Packages <= 6.2.0 versions.
Affected
up to 6.2.0
What to do
Affects up to 6.2.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 23, 2026Premium Packages – Sell Digital Products Securely: Generic SQL InjectionCVE-2026-15906 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to generic SQL Injection via the 'orderby' parameter in all versions up to, and including, 7.0.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with admin-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Premium Packages – Sell Digital Products Securely
Affected
up to 7.0.4
What to do
Affects up to 7.0.4. Update Premium Packages – Sell Digital Products Securely to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 23, 2026Premium Packages – Sell Digital Products Securely: Authentication BypassCVE-2026-15348 · WordPress plugins & themes · reported by WordfenceMedium 6.3
The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 7.0.4 via the `wpdmppdl` parameter. This is due to the `download()` function — hooked to the unauthenticated WordPress `wp` action — decoding the attacker-controlled `wpdmppdl` parameter using only `base64_decode()` and `json_decode()` with no HMAC, cryptographic signature, or nonce verification, and then issuing WordPress authentication cookies after a domain check that is trivially bypassed because both sides of the comparison are attacker-supplied values. This makes it possible for unauthenticated attackers to authenticate as any non-administrator WordPress user, including subscribers, customers, contributors, authors, editors, and shop managers, who owns an order, gaining full session-level access to that account.
Product
Premium Packages – Sell Digital Products Securely
Affected
up to 7.0.4
What to do
Affects up to 7.0.4. Update Premium Packages – Sell Digital Products Securely to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 21, 2026Ninja Forms WordPress plugin version 3.14.8 and prior contains an improper input validation vulnerability that allows unauthenticated attackers to inject arbitrCVE-2026-65052 · WordPress plugins & themes · reported by VulnCheckHigh 8.7
Ninja Forms WordPress plugin version 3.14.8 and prior contains an improper input validation vulnerability that allows unauthenticated attackers to inject arbitrary numeric values into form calculations and payment totals by submitting values that do not match any configured option in ListSelect or ListRadio fields. Attackers can tamper with form submission payloads to the ajax submit endpoint, causing the get_calc_value() method to fail open and return attacker-controlled values, enabling manipulation of payment amounts to zero or arbitrary figures and bypassing admin-configured pricing logic.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record wordpress.org wordpress.org
Jul 21, 2026Ninja Forms WordPress plugin version 3.14.8 contains a client-side enforcement of server-side security vulnerability that allows unauthenticated attackers to byCVE-2026-65051 · WordPress plugins & themes · reported by VulnCheckMedium 6.9
Ninja Forms WordPress plugin version 3.14.8 contains a client-side enforcement of server-side security vulnerability that allows unauthenticated attackers to bypass all form validation by merging attacker-controlled field metadata over server-loaded form definitions before validation runs. Attackers can craft a malicious AJAX submission overriding field types, removing required flags, and disabling CAPTCHA checks through the nopriv AJAX endpoint to trigger form actions such as email notifications and database storage with unverified, attacker-controlled content.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record wordpress.org wordpress.org
Jul 21, 2026the render callback of the `ninja-forms/submissions-table` Gutenberg block that: Ninja Forms WordPress plugin version 3.14.8 and prior contains a missing authorizationCVE-2026-65050 · WordPress plugins & themes · reported by VulnCheckHigh 7.1
Ninja Forms WordPress plugin version 3.14.8 and prior contains a missing authorization vulnerability in the render callback of the `ninja-forms/submissions-table` Gutenberg block that allows authenticated attackers with Author-level privileges to expose stored form submissions to unauthenticated visitors by embedding the block with an arbitrary formID on a published post. Attackers can retrieve the signed bearer token injected into every page visitor's browser via `wp_localize_script` and use it against the REST API submissions endpoint to access all saved form submission field values, including sensitive personally identifiable information such as names, email addresses, and phone numbers.
Product
the render callback of the `ninja-forms/submissions-table` Gutenberg block that
What to do
Update the render callback of the `ninja-forms/submissions-table` Gutenberg block that to the newest version.
Full record and what to do →NVD record wordpress.org wordpress.org
Jul 20, 2026All-in-One WP Migration and Backup: Does not properly sanitise a user-supplied value before using it to build a file pathCVE-2026-12898 · WordPress plugins & themes · reported by WPScanMedium 6.5
The All-in-One WP Migration and Backup WordPress plugin before 7.106 does not properly sanitise a user-supplied value before using it to build a file path, allowing unauthenticated attackers to create or append a log file in arbitrary locations outside its intended storage directory.
Product
All-in-One WP Migration and Backup
Fixed in
7.106
What to do
Update All-in-One WP Migration and Backup to 7.106 or newer.
Full record and what to do →NVD record wpscan.com
Jul 17, 2026PhonePe Payment Solutions: Does not properly verify the authenticity of incoming payment callbacks: the secret used to validate the callback signature is empty on sites configured through the current setup flowCVE-2026-11575 · WordPress plugins & themes · reported by WPScanHigh 7.5
The PhonePe Payment Solutions WordPress plugin before 3.1.0 does not properly verify the authenticity of incoming payment callbacks: the secret used to validate the callback signature is empty on sites configured through the current setup flow, so the expected signature reduces to an unkeyed hash of the request body that anyone can compute. This allows unauthenticated attackers to forge a payment-success notification and mark unpaid WooCommerce orders as paid without any payment being made.
Product
PhonePe Payment Solutions
Fixed in
3.1.0
What to do
Update PhonePe Payment Solutions to 3.1.0 or newer.
Full record and what to do →NVD record wpscan.com
Jul 17, 2026NEX-Forms: Does not sanitise and escape some submitted form data before storing it and outputting it back in the admin dashboardCVE-2026-10525 · WordPress plugins & themes · reported by WPScanMedium 6.1
The NEX-Forms WordPress plugin before 9.2.3 does not sanitise and escape some submitted form data before storing it and outputting it back in the admin dashboard, leading to a Stored Cross-Site Scripting vulnerability which could allow unauthenticated users to perform Stored Cross-Site Scripting attacks against high privilege users such as administrators when they view the submitted entries.
Product
NEX-Forms
Fixed in
9.2.3
What to do
Update NEX-Forms to 9.2.3 or newer.
Full record and what to do →NVD record wpscan.com
Jul 17, 2026pCloud WP Backup: Sensitive Information ExposureCVE-2026-14503 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The pCloud WP Backup plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.0.3 via the wp2pcl_ajax_process_request_inner. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract force generation of a full-site backup archive written to a publicly accessible directory, exposing wp-config.php database credentials, WordPress secret salts, and the complete PHP source tree. The resulting archive is deposited in the plugin's unprotected tmp/ directory at a predictable URL, making the extracted data accessible to unauthenticated visitors once the backup is triggered.
Product
pCloud WP Backup
Affected
up to 2.0.3
What to do
Affects up to 2.0.3. Update pCloud WP Backup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 13, 2026Advanced Shipment Tracking for WooCommerce: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-57773 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Zorem Advanced Shipment Tracking for WooCommerce woo-advanced-shipment-tracking allows Blind SQL Injection.This issue affects Advanced Shipment Tracking for WooCommerce: from n/a through <= 4.0.
Product
Advanced Shipment Tracking for WooCommerce
Affected
up to 4.0
What to do
Affects up to 4.0. Update Advanced Shipment Tracking for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 11, 2026bbp Style Pack: Stored Cross-Site ScriptingCVE-2026-15010 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The bbp Style Pack plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 6.4.5 via the Topic Form Additional Fields feature. This is due to insufficient input sanitization in bsp_topic_fields_form_save() (which writes $_POST['bsp_topic_fields_label{n}'] directly to post meta via update_post_meta() with no filtering) and missing output escaping in bsp_topic_content_append_topic_fields() (which concatenates the stored meta value into an HTML <span> and echoes it via apply_filters/echo without esc_html()). This makes it possible for authenticated attackers, with Subscriber-level access and above (who have bbPress topic-creation privileges), to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page, including unauthenticated visitors.
Product
bbp Style Pack
Affected
up to 6.4.5
What to do
Affects up to 6.4.5. Update bbp Style Pack to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 11, 2026Affilia – Affiliate Program & Referral Tracking for: Unauthorized accessCVE-2026-7559 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Affilia – Affiliate Program & Referral Tracking for WordPress plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 3.3.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to approve or reject affiliate referrals, credit commissions to affiliate wallets, delete referral records, and modify custom banner plugin options, enabling financial fraud. The nonce required to pass the only authentication check is embedded in every frontend page load via rtwalwm_global_params.rtwalwm_nonce, making it trivially accessible to any authenticated user regardless of role.
Product
Affilia – Affiliate Program & Referral Tracking for
Affected
up to 3.3.3
What to do
Affects up to 3.3.3. Update Affilia – Affiliate Program & Referral Tracking for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 11, 2026Booking Package: Generic SQL InjectionCVE-2026-15335 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Booking Package plugin for WordPress is vulnerable to generic SQL Injection via 'email' Form Parameter (form<N>) in all versions up to, and including, 1.7.20 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The vulnerable REST API endpoint /wp-json/booking-package/v1/request is registered with permission_callback: __return_true and wp_magic_quotes does not apply to REST-sourced $_POST values, meaning single quotes in the payload reach the SQL sink intact without any authentication requirement. The impact of this is severely limited as the vulnerable parameter goes through is_email.
Product
Booking Package
Affected
up to 1.7.20
What to do
Affects up to 1.7.20. Update Booking Package to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 11, 2026PDF Invoices & Packing Slips for WooCommerce: Insecure Direct Object ReferenceCVE-2026-13116 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.14.0 via the generate_document_shortcode due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with contributor-level access and above, to mint publicly accessible, session-free download links for arbitrary third-party orders, exposing customer names, billing and shipping addresses, email addresses, phone numbers, order and invoice numbers, line items, totals, payment details, and customer notes contained in those orders' invoices and packing slips. Exploitation requires the plugin's Document link access type setting to be configured to 'full'; with the default 'logged_in' value, generated URLs are signed with a per-session nonce rather than the order_key, making the shortcode path unexploitable for unauthorized access to third-party orders.
Product
PDF Invoices & Packing Slips for WooCommerce
Affected
up to 5.14.0
What to do
Affects up to 5.14.0. Update PDF Invoices & Packing Slips for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.