Updated 12 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

449new WordPress flaws this week

390,525entries in the database

1,230 results · page 5 of 25

Aug 19, 202610Web Booster: Does not correctly validate an access token on an unauthenticated request handler and does not escape attacker-supplied stylesheet content before rendering it into the page headCVE-2026-14287 · WordPress plugins & themes · reported by WPScanMedium 4.7
The 10Web Booster WordPress plugin before 2.33.5 does not correctly validate an access token on an unauthenticated request handler and does not escape attacker-supplied stylesheet content before rendering it into the page head, allowing an unauthenticated attacker to store markup that executes as JavaScript in the browser of anonymous visitors to an affected page.
Product
10Web Booster
Fixed in
2.33.5
What to do
Update 10Web Booster to 2.33.5 or newer.
Full record and what to do →NVD record wpscan.com
Aug 18, 2026PPWP: Password Protect Pages, Posts & Full or Partial Content: Unauthorized access of dataCVE-2025-11729 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The PPWP: Password Protect Pages, Posts & Full or Partial Content plugin for WordPress is vulnerable to unauthorized access of data due to a improper capability check on the can_access function in all versions up to, and including, 1.9.15. This makes it possible for authenticated attackers, with Contributor-level access and above, to retrieve a master-password and access any password-protected content.
Product
PPWP: Password Protect Pages, Posts & Full or Partial Content
Affected
up to 1.9.15
What to do
Affects up to 1.9.15. Update PPWP: Password Protect Pages, Posts & Full or Partial Content to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Aug 18, 2026Contributor Broken Access Control in WP Table Builder <= 2.2.0 versions.CVE-2026-74006 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Contributor Broken Access Control in WP Table Builder <= 2.2.0 versions.
Affected
up to 2.2.0
What to do
Affects up to 2.2.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 18, 2026Subscriber Broken Access Control in Gravity Booster – Styles & Layouts for Gravity Forms <= 6.0 versions.CVE-2026-74004 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Subscriber Broken Access Control in Gravity Booster – Styles & Layouts for Gravity Forms <= 6.0 versions.
Affected
up to 6.0
What to do
Affects up to 6.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 18, 2026Contributor Broken Access Control in RomethemeForm For Elementor <= 1.2.6 versions.CVE-2026-74003 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Contributor Broken Access Control in RomethemeForm For Elementor <= 1.2.6 versions.
Affected
up to 1.2.6
What to do
Affects up to 1.2.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 18, 2026Unauthenticated Broken Access Control in Charitable <= 1.8.11.3 versions.CVE-2026-73994 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in Charitable <= 1.8.11.3 versions.
Affected
up to 1.8.11.3
What to do
Affects up to 1.8.11.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 18, 2026Subscriber Broken Access Control in MasterStudy LMS <= 3.7.41 versions.CVE-2026-73404 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Subscriber Broken Access Control in MasterStudy LMS <= 3.7.41 versions.
Affected
up to 3.7.41
What to do
Affects up to 3.7.41. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 18, 2026Unauthenticated Broken Access Control in Ultimate Maps by Supsystic < 1.5.0 versions.CVE-2026-73377 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in Ultimate Maps by Supsystic < 1.5.0 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Aug 18, 2026Unauthenticated Broken Access Control in GiveWP <= 4.16.5.1 versions.CVE-2026-73352 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Broken Access Control in GiveWP <= 4.16.5.1 versions.
Affected
up to 4.16.5.1
What to do
Affects up to 4.16.5.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 18, 2026Unauthenticated Broken Access Control in GiveWP < 4.16.6 versions.CVE-2026-73348 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Broken Access Control in GiveWP < 4.16.6 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Aug 18, 2026Unauthenticated Broken Access Control in Appointment Hour Booking <= 1.5.91 versions.CVE-2026-66679 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Broken Access Control in Appointment Hour Booking <= 1.5.91 versions.
Affected
up to 1.5.91
What to do
Affects up to 1.5.91. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 18, 2026Unauthenticated Broken Access Control in ThumbPress < 6.5 versions.CVE-2026-32549 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in ThumbPress < 6.5 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Aug 18, 2026Unauthenticated Broken Access Control in Online Contact Widget <= 1.3.0 versions.CVE-2026-32472 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in Online Contact Widget <= 1.3.0 versions.
Affected
up to 1.3.0
What to do
Affects up to 1.3.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 18, 2026Unauthenticated Broken Access Control in FormyChat <= 2.15.7 versions.CVE-2026-28571 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in FormyChat <= 2.15.7 versions.
Affected
up to 2.15.7
What to do
Affects up to 2.15.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 18, 2026Unauthenticated Broken Access Control in WP Sort Order <= 1.3.5 versions.CVE-2026-28567 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in WP Sort Order <= 1.3.5 versions.
Affected
up to 1.3.5
What to do
Affects up to 1.3.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 16, 2026Visualizer: Does not properly authorise access to the configuration of its chartsCVE-2026-19726 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Visualizer WordPress plugin before 4.0.7 does not properly authorise access to the configuration of its charts, allowing users with the Contributor role and above to read the full configuration of any chart on the site, including charts the Visualizer WordPress plugin before 4.0.7's own interface denies them, and to retrieve every chart's configuration in a single request. The disclosed configuration can include the credentials of a remote data source a chart reads from.
Product
Visualizer
Fixed in
4.0.7
What to do
Update Visualizer to 4.0.7 or newer.
Full record and what to do →NVD record wpscan.com
Aug 13, 2026Unauthenticated Broken Access Control in User Registration <= 5.2.6 versions.CVE-2026-73403 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Broken Access Control in User Registration <= 5.2.6 versions.
Affected
up to 5.2.6
What to do
Affects up to 5.2.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 13, 2026Unauthenticated Broken Access Control in InstaWP Connect <= 0.1.3.7 versions.CVE-2026-73401 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Broken Access Control in InstaWP Connect <= 0.1.3.7 versions.
Affected
up to 0.1.3.7
What to do
Affects up to 0.1.3.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 13, 2026Unauthenticated Broken Access Control in Revolut Gateway for WooCommerce < 4.22.10 versions.CVE-2026-73353 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Broken Access Control in Revolut Gateway for WooCommerce < 4.22.10 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Aug 13, 2026Unauthenticated Broken Access Control in GiveWP < 4.16.6 versions.CVE-2026-73349 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Broken Access Control in GiveWP < 4.16.6 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Aug 13, 2026Author Cross Site Scripting (XSS) in WP Data Access <= 5.5.79 versions.CVE-2026-73344 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Author Cross Site Scripting (XSS) in WP Data Access <= 5.5.79 versions.
Affected
up to 5.5.79
What to do
Affects up to 5.5.79. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 13, 2026Subscriber Broken Access Control in Motors <= 1.4.113 versions.CVE-2026-66693 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Subscriber Broken Access Control in Motors <= 1.4.113 versions.
Affected
up to 1.4.113
What to do
Affects up to 1.4.113. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 13, 2026Unauthenticated Broken Access Control in Nokri <= 1.6.6 versions.CVE-2026-66691 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated Broken Access Control in Nokri <= 1.6.6 versions.
Affected
up to 1.6.6
What to do
Affects up to 1.6.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 13, 2026Unauthenticated Broken Access Control in Anti Spam and list cleaner – AcyChecker <= 2.0.0 versions.CVE-2026-66689 · WordPress plugins & themes · reported by PatchstackMedium 6.3
Unauthenticated Broken Access Control in Anti Spam and list cleaner – AcyChecker <= 2.0.0 versions.
Affected
up to 2.0.0
What to do
Affects up to 2.0.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 13, 2026Unauthenticated Broken Access Control in Contact Form 7 – PayPal & Stripe Add-on <= 2.5.1 versions.CVE-2026-66660 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Broken Access Control in Contact Form 7 – PayPal & Stripe Add-on <= 2.5.1 versions.
Affected
up to 2.5.1
What to do
Affects up to 2.5.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 13, 2026Unauthenticated Broken Access Control in Arvow AI SEO Writer <= 1.5.3 versions.CVE-2026-66469 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in Arvow AI SEO Writer <= 1.5.3 versions.
Affected
up to 1.5.3
What to do
Affects up to 1.5.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 13, 2026Unauthenticated Broken Access Control in StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart <= 2.1.1 versiCVE-2026-66466 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart <= 2.1.1 versions.
Affected
up to 2.1.1
What to do
Affects up to 2.1.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 13, 2026Unauthenticated Broken Access Control in Internal Link Optimiser <= 5.2.7 versions.CVE-2026-66464 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Broken Access Control in Internal Link Optimiser <= 5.2.7 versions.
Affected
up to 5.2.7
What to do
Affects up to 5.2.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 13, 2026Unauthenticated Broken Access Control in SMEPay: UPI Gateway for WooCommerce <= 1.0.5 versions.CVE-2026-66461 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in SMEPay: UPI Gateway for WooCommerce <= 1.0.5 versions.
Affected
up to 1.0.5
What to do
Affects up to 1.0.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 13, 2026Unauthenticated Broken Access Control in AI for SEO <= 2.4.2 versions.CVE-2026-66459 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Broken Access Control in AI for SEO <= 2.4.2 versions.
Affected
up to 2.4.2
What to do
Affects up to 2.4.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 13, 2026Subscriber Broken Access Control in ReactPress <= 3.4.0 versions.CVE-2026-66455 · WordPress plugins & themes · reported by PatchstackMedium 6
Subscriber Broken Access Control in ReactPress <= 3.4.0 versions.
Affected
up to 3.4.0
What to do
Affects up to 3.4.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 13, 2026Unauthenticated Broken Access Control in WP Social Avatar <= 1.5 versions.CVE-2026-66454 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Broken Access Control in WP Social Avatar <= 1.5 versions.
Affected
up to 1.5
What to do
Affects up to 1.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 13, 2026Unauthenticated Broken Access Control in MultiVendorX <= 5.0.10 versions.CVE-2026-66441 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in MultiVendorX <= 5.0.10 versions.
Affected
up to 5.0.10
What to do
Affects up to 5.0.10. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 13, 2026Unauthenticated Broken Access Control in Bitcoin Lightning Payment Gateway for WooCommerce (via CLINK) <= 1.0.7 versions.CVE-2026-66431 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in Bitcoin Lightning Payment Gateway for WooCommerce (via CLINK) <= 1.0.7 versions.
Affected
up to 1.0.7
What to do
Affects up to 1.0.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 13, 2026Unauthenticated Broken Access Control in WPMobile.App <= 11.77 versions.CVE-2026-61984 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in WPMobile.App <= 11.77 versions.
Affected
up to 11.77
What to do
Affects up to 11.77. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 13, 2026Unauthenticated Broken Access Control in Secure Card Gateway for ePay Paycenter (Piraeus Bank) <= 1.0.32 versions.CVE-2026-61978 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Broken Access Control in Secure Card Gateway for ePay Paycenter (Piraeus Bank) <= 1.0.32 versions.
Affected
up to 1.0.32
What to do
Affects up to 1.0.32. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 13, 2026Unauthenticated Broken Access Control in Hydra Booking <= 1.2.2 versions.CVE-2026-28188 · WordPress plugins & themes · reported by PatchstackHigh 7.3
Unauthenticated Broken Access Control in Hydra Booking <= 1.2.2 versions.
Affected
up to 1.2.2
What to do
Affects up to 1.2.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 13, 2026Subscriber Broken Access Control in Travelfic Toolkit <= 1.5.1 versions.CVE-2026-28186 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Subscriber Broken Access Control in Travelfic Toolkit <= 1.5.1 versions.
Affected
up to 1.5.1
What to do
Affects up to 1.5.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 13, 2026Subscriber Broken Access Control in AcyMailing SMTP Newsletter <= 10.11.1 versions.CVE-2026-28181 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Subscriber Broken Access Control in AcyMailing SMTP Newsletter <= 10.11.1 versions.
Affected
up to 10.11.1
What to do
Affects up to 10.11.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 13, 2026Subscriber Broken Access Control in Service Finder Booking <= 6.2 versions.CVE-2026-28159 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Subscriber Broken Access Control in Service Finder Booking <= 6.2 versions.
Affected
up to 6.2
What to do
Affects up to 6.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 13, 2026Subscriber Broken Access Control in Tourfic <= 2.23.1 versions.CVE-2026-27999 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Subscriber Broken Access Control in Tourfic <= 2.23.1 versions.
Affected
up to 2.23.1
What to do
Affects up to 2.23.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 13, 2026Subscriber Broken Access Control in Solace Extra <= 1.6.0 versions.CVE-2026-27535 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Subscriber Broken Access Control in Solace Extra <= 1.6.0 versions.
Affected
up to 1.6.0
What to do
Affects up to 1.6.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 13, 2026Unauthenticated Broken Access Control in Taxi Booking Manager for WooCommerce <= 2.0.3 versions.CVE-2026-27345 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in Taxi Booking Manager for WooCommerce <= 2.0.3 versions.
Affected
up to 2.0.3
What to do
Affects up to 2.0.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 13, 2026Prevent Direct Access – Protect WordPress Files: Unauthorized access of protected filesCVE-2026-3835 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Prevent Direct Access – Protect WordPress Files plugin for WordPress is vulnerable to unauthorized access of protected files due to insufficient token validation in the `get_advance_file_by_url()` method in all versions up to, and including, 2.8.8.8 The method uses a SQL `LIKE` operator for token lookup without escaping wildcard characters via `$wpdb->esc_like()`. This makes it possible for unauthenticated attackers to bypass the private token requirement by supplying SQL wildcard characters (such as `%`) as the token value, matching any record in the plugin's file table and downloading any protected file.
Product
Prevent Direct Access – Protect WordPress Files
Affected
up to 2.8.8.8
What to do
Affects up to 2.8.8.8. Update Prevent Direct Access – Protect WordPress Files to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 13, 2026Booking for Appointments and Events Calendar: Does not verify that an authenticated employee (provider) is assigned to the appointment being accessedCVE-2026-14213 · WordPress plugins & themes · reported by WPScanLow 3.7
The Booking for Appointments and Events Calendar WordPress plugin before 2.4.6 does not verify that an authenticated employee (provider) is assigned to the appointment being accessed, allowing any employee to read any appointment by its identifier and disclose the booked customer's personal data.
Product
Booking for Appointments and Events Calendar
Fixed in
2.4.6
What to do
Update Booking for Appointments and Events Calendar to 2.4.6 or newer.
Full record and what to do →NVD record wpscan.com
Aug 12, 2026Ezoic: Does not properly restrict access to some of its content export functionalityCVE-2026-18789 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Ezoic WordPress plugin before 2.23.1 does not properly restrict access to some of its content export functionality, allowing unauthenticated attackers to trigger a server-side export of the site's database, including user password hashes and password reset tokens, as well as to persistently change some of its settings.
Product
Ezoic
Fixed in
2.23.1
What to do
Update Ezoic to 2.23.1 or newer.
Full record and what to do →NVD record wpscan.com
Aug 12, 2026User Access Manager: Does not apply its access restrictions to REST API requestsCVE-2026-18035 · WordPress plugins & themes · reported by WPScanMedium 5.3
The User Access Manager WordPress plugin before 2.3.15 does not apply its access restrictions to REST API requests, allowing unauthenticated attackers to read the content of posts, pages and custom post types that have been restricted to specific user groups.
Product
User Access Manager
Fixed in
2.3.15
What to do
Update User Access Manager to 2.3.15 or newer.
Full record and what to do →NVD record wpscan.com
Aug 12, 2026KiviCare: Does not verify that the requesting user owns the records being accessedCVE-2026-13612 · WordPress plugins & themes · reported by WPScanMedium 4.3
The KiviCare WordPress plugin before 4.5.2 does not verify that the requesting user owns the records being accessed, allowing authenticated patient-level users to read other patients' bills, invoices and appointment details.
Product
KiviCare
Fixed in
4.5.2
What to do
Update KiviCare to 4.5.2 or newer.
Full record and what to do →NVD record wpscan.com
Aug 12, 2026Eventin: Does not properly restrict access to individual order recordsCVE-2026-13177 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Eventin WordPress plugin before 4.1.20 does not properly restrict access to individual order records, allowing users with contributor-level access and above to read other customers' order data including personal information by iterating order identifiers.
Product
Eventin
Fixed in
4.1.20
What to do
Update Eventin to 4.1.20 or newer.
Full record and what to do →NVD record wpscan.com
Aug 12, 2026Eventin: Does not properly restrict access to stored customer recordsCVE-2026-13168 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Eventin WordPress plugin before 4.1.20 does not properly restrict access to stored customer records, allowing users with contributor-level access and above to read other customers' personal data such as names and email addresses.
Product
Eventin
Fixed in
4.1.20
What to do
Update Eventin to 4.1.20 or newer.
Full record and what to do →NVD record wpscan.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.