Updated 6 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

344new WordPress flaws this week

390,080entries in the database

921 results · page 5 of 19

Jun 6, 2026WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters: Stored Cross-Site ScriptingCVE-2026-9594 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'location_messages' parameter in all versions up to, and including, 4.9.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the attacker to hold the custom wpgmp_manage_location capability, which is granted to administrators by default but can be assigned to lower-privileged roles via the plugin's Permissions screen.
Product
WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters
Affected
up to 4.9.4
What to do
Affects up to 4.9.4. Update WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 6, 2026Smart Slider 3: Directory TraversalCVE-2026-9197 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The Smart Slider 3 plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.5.1.36 via the replaceHTMLImage function. This makes it possible for authenticated attackers, with administrator-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.
Product
Smart Slider 3
Affected
up to 3.5.1.36
What to do
Affects up to 3.5.1.36. Update Smart Slider 3 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 5, 2026Migration, Backup, Staging – WPvivid Backup & Migration: Arbitrary directory deletionCVE-2025-12656 · WordPress plugins & themes · reported by WordfenceLow 3.8
The Migration, Backup, Staging – WPvivid Backup & Migration plugin for WordPress is vulnerable to arbitrary directory deletion due to insufficient file path validation in the delete_cancel_staging_site() function in all versions up to, and including, 0.9.128. This makes it possible for authenticated attackers, with Administrator-level access and above, to delete arbitrary folders on the server, which leads to a loss of data.
Product
Migration, Backup, Staging – WPvivid Backup & Migration
Affected
up to 0.9.128
What to do
Affects up to 0.9.128. Update Migration, Backup, Staging – WPvivid Backup & Migration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 1, 2026Classified Listing: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2026-42679 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Mamunur Rashid Classified Listing allows Path Traversal. This issue affects Classified Listing: from n/a through 5.3.8.
Product
Classified Listing
Affected
up to 5.3.8
What to do
Affects up to 5.3.8. Update Classified Listing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 1, 2026WP Directory Kit: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-42672 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Wp Directory Kit WP Directory Kit allows Blind SQL Injection. This issue affects WP Directory Kit: from n/a through 1.5.1.
Product
WP Directory Kit
Affected
up to 1.5.1
What to do
Affects up to 1.5.1. Update WP Directory Kit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 1, 2026GeoDirectory: Missing AuthorizationCVE-2026-42671 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Paolo GeoDirectory allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects GeoDirectory: from n/a through 2.8.157.
Product
GeoDirectory
Affected
up to 2.8.157
What to do
Affects up to 2.8.157. Update GeoDirectory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 1, 2026Gravity Forms: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2026-48866 · WordPress plugins & themes · reported by PatchstackCritical 9.6
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Rocketgenius Inc. Gravity Forms allows Path Traversal. This issue affects Gravity Forms: from n/a through 2.10.0.1.
Product
Gravity Forms
Affected
up to 2.10.0.1
What to do
Affects up to 2.10.0.1. Update Gravity Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 27, 2026WebinarIgnition: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2026-42757 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Saleswonder Team: Tobias WebinarIgnition webinar-ignition allows Path Traversal.This issue affects WebinarIgnition: from n/a through < 4.08.253.
Product
WebinarIgnition
What to do
Update WebinarIgnition to the newest version.
Full record and what to do →NVD record patchstack.com
May 27, 2026QuickWebP – Compress / Optimize Images & Convert WebP | SEO Friendly: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2026-42756 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Ludwig You QuickWebP – Compress / Optimize Images & Convert WebP | SEO Friendly quickwebp allows Path Traversal.This issue affects QuickWebP – Compress / Optimize Images & Convert WebP | SEO Friendly: from n/a through <= 3.2.7.
Product
QuickWebP – Compress / Optimize Images & Convert WebP | SEO Friendly
Affected
up to 3.2.7
What to do
Affects up to 3.2.7. Update QuickWebP – Compress / Optimize Images & Convert WebP | SEO Friendly to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 27, 2026VikBooking Hotel Booking Engine & PMS: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2026-42737 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in e4jvikwp VikBooking Hotel Booking Engine & PMS vikbooking allows Path Traversal.This issue affects VikBooking Hotel Booking Engine & PMS: from n/a through <= 1.8.9.
Product
VikBooking Hotel Booking Engine & PMS
Affected
up to 1.8.9
What to do
Affects up to 1.8.9. Update VikBooking Hotel Booking Engine & PMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 25, 2026QR Redirector: Missing AuthorizationCVE-2026-24545 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Nikki Blight QR Redirector allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects QR Redirector: from n/a through 2.0.3.
Product
QR Redirector
Affected
up to 2.0.3
What to do
Affects up to 2.0.3. Update QR Redirector to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 21, 2026WP Directory Kit: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-39531 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Wp Directory Kit WP Directory Kit allows Blind SQL Injection. This issue affects WP Directory Kit: from n/a through 1.5.0.
Product
WP Directory Kit
Affected
up to 1.5.0
What to do
Affects up to 1.5.0. Update WP Directory Kit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 17, 2026Google Drive for WordPress 2.2 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files by injecting directory travCVE-2018-25326 · WordPress plugins & themes · reported by VulnCheckHigh 8.7
Google Drive for WordPress 2.2 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files by injecting directory traversal sequences in the file_name parameter. Attackers can send POST requests to gdrive-ajaxs.php with the ajaxstype parameter set to del_fl_bkp and file_name containing traversal sequences ../../wp-config.php to access sensitive configuration files.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record lenonleite.com.br exploit-db.com
May 16, 2026WordPress Plugin Anti-Malware Security and Bruteforce Firewall 4.20.59 contains a directory traversal vulnerability that allows unauthenticated attackers to reaCVE-2021-47977 · WordPress plugins & themes · reported by VulnCheckHigh 8.7
WordPress Plugin Anti-Malware Security and Bruteforce Firewall 4.20.59 contains a directory traversal vulnerability that allows unauthenticated attackers to read arbitrary files by manipulating the file parameter. Attackers can send requests to the duplicator_download action via admin-ajax.php with path traversal sequences to access sensitive system files outside the intended directory.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record gotmls.net gotmls.net
May 15, 2026Classified Listing – AI-Powered Classified ads & Business Directory: Unauthorized accessCVE-2026-7563 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Classified Listing – AI-Powered Classified ads & Business Directory Plugin plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 5.3.10. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to add arbitrary notes to any order and trigger unsolicited notification and moderation emails to listing owners without administrative authorization.
Product
Classified Listing – AI-Powered Classified ads & Business Directory
Affected
up to 5.3.10
What to do
Affects up to 5.3.10. Update Classified Listing – AI-Powered Classified ads & Business Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 8, 2026User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration: Deserialization of Untrusted DataCVE-2026-5127 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration plugin for WordPress is vulnerable to Deserialization of Untrusted Data in versions up to, and including, 4.3.1 This is due to insufficient input validation and type checking on the wpuf_files parameter during form submission, combined with unconditional deserialization via maybe_unserialize() when displaying post content. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary PHP objects, which can be leveraged to execute arbitrary code, delete arbitrary files, or perform other malicious actions if a POP chain is present on the target system.
Product
User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration
Affected
up to 4.3.1
What to do
Affects up to 4.3.1. Update User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 2, 2026Simple Link Directory: Stored Cross-Site ScriptingCVE-2026-7209 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Simple Link Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `qcopd-directory` shortcode in all versions up to, and including, 8.9.2. This is due to insufficient input sanitization and output escaping on user supplied attributes such as `title_font_size`. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Simple Link Directory
Affected
up to 8.9.2
What to do
Affects up to 8.9.2. Update Simple Link Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 27, 2026Directorist Social Login: Incorrect Privilege AssignmentCVE-2026-22337 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Incorrect Privilege Assignment vulnerability in Directorist Directorist Social Login allows Privilege Escalation.This issue affects Directorist Social Login: from n/a before 2.1.4.
Product
Directorist Social Login
Fixed in
2.1.4
What to do
Update Directorist Social Login to 2.1.4 or newer.
Full record and what to do →NVD record patchstack.com
Apr 27, 2026Directorist Booking: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-22336 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Directorist Booking allows SQL Injection.This issue affects Directorist Booking: from n/a before 3.0.2.
Product
Directorist Booking
Fixed in
3.0.2
What to do
Update Directorist Booking to 3.0.2 or newer.
Full record and what to do →NVD record patchstack.com
Apr 17, 2026JetBackup – Backup, Restore & Migrate: Path Traversal leading to Arbitrary Directory DeletionCVE-2026-4853 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The JetBackup – Backup, Restore & Migrate plugin for WordPress is vulnerable to Path Traversal leading to Arbitrary Directory Deletion in versions up to and including 3.1.19.8. This is due to insufficient input validation on the fileName parameter in the file upload handler. The plugin sanitizes the fileName parameter using sanitize_text_field(), which removes HTML tags but does not prevent path traversal sequences like '../'. The unsanitized filename is then directly concatenated in Upload::getFileLocation() without using basename() or validating the resolved path stays within the intended directory. When an invalid file is uploaded, the cleanup logic calls dirname() on the traversed path and passes it to Util::rm(), which recursively deletes the entire resolved directory. This makes it possible for authenticated attackers with administrator-level access to traverse outside the intended upload directory and trigger deletion of critical WordPress directories such as wp-content/plugins, effectively disabling all installed plugins and causing severe site disruption.
Product
JetBackup – Backup, Restore & Migrate
Affected
up to 3.1.19.8
What to do
Affects up to 3.1.19.8. Update JetBackup – Backup, Restore & Migrate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 16, 2026DirectoryPress – Business Directory And Classified Ad Listing: SQL InjectionCVE-2026-3489 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The DirectoryPress – Business Directory And Classified Ad Listing plugin for WordPress is vulnerable to SQL Injection via the 'packages' parameter in versions up to, and including, 3.6.26 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
DirectoryPress – Business Directory And Classified Ad Listing
Affected
up to 3.6.26
What to do
Affects up to 3.6.26. Update DirectoryPress – Business Directory And Classified Ad Listing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 16, 2026WP Maps – Store Locator,Google Maps,OpenStreetMap,Mapbox,Listing,Directory & Filters: Stored Cross-Site ScriptingCVE-2025-13364 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP Maps – Store Locator,Google Maps,OpenStreetMap,Mapbox,Listing,Directory & Filters plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'put_wpgm' shortcode in all versions up to, and including, 4.8.7. This is due to insufficient input sanitization and output escaping on user-supplied shortcode attributes. This makes it possible for authenticated attackers, with contributor level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WP Maps – Store Locator,Google Maps,OpenStreetMap,Mapbox,Listing,Directory & Filters
Affected
up to 4.8.7
What to do
Affects up to 4.8.7. Update WP Maps – Store Locator,Google Maps,OpenStreetMap,Mapbox,Listing,Directory & Filters to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 15, 2026Eleganzo: Arbitrary directory deletionCVE-2025-15470 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Eleganzo theme for WordPress is vulnerable to arbitrary directory deletion due to insufficient path validation in the akd_required_plugin_callback function in all versions up to, and including, 1.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary directories on the server, including the WordPress root directory.
Product
Eleganzo
Affected
up to 1.2
What to do
Affects up to 1.2. Update Eleganzo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record testwp.local wordfence.com
Apr 10, 2026UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP: Blind Server-Side Request ForgeryCVE-2026-4979 · WordPress plugins & themes · reported by WordfenceMedium 5
The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP plugin for WordPress is vulnerable to blind Server-Side Request Forgery in all versions up to, and including, 1.2.58. This is due to insufficient URL origin validation in the process_image_crop() method when processing avatar/banner image crop operations. The function accepts a user-controlled URL via the uwp_crop POST parameter and only validates it using esc_url() for sanitization and wp_check_filetype() for extension verification, without enforcing that the URL references a local uploads file. The URL is then passed to uwp_resizeThumbnailImage() which uses it in PHP image processing functions (getimagesize(), imagecreatefrom*()) that support URL wrappers and perform outbound HTTP requests. This makes it possible for authenticated attackers with subscriber-level access and above to coerce the WordPress server into making arbitrary HTTP requests to attacker-controlled or internal network destinations, enabling internal network scanning and potential access to sensitive services.
Product
UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP
Affected
up to 1.2.58
What to do
Affects up to 1.2.58. Update UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Apr 9, 2026UsersWP – Front-end login form, User Registration, User Profile & Members Directory: Improper Access ControlCVE-2026-4977 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress is vulnerable to Improper Access Control in all versions up to, and including, 1.2.58 This is due to insufficient field-level permission validation in the upload_file_remove() AJAX handler where the $htmlvar parameter is not validated against a whitelist of allowed fields or checked against the field's for_admin_use property. This makes it possible for authenticated attackers, with subscriber-level access and above, to clear or reset any restricted usermeta column for their own user record, including fields marked as "For admin use only", bypassing intended field-level access restrictions.
Product
UsersWP – Front-end login form, User Registration, User Profile & Members Directory
Affected
up to 1.2.58
What to do
Affects up to 1.2.58. Update UsersWP – Front-end login form, User Registration, User Profile & Members Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 8, 2026DirectoryPress: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2026-39566 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Designinvento DirectoryPress directorypress allows Retrieve Embedded Sensitive Data.This issue affects DirectoryPress: from n/a through <= 3.6.26.
Product
DirectoryPress
Affected
up to 3.6.26
What to do
Affects up to 3.6.26. Update DirectoryPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 8, 2026Directorist: Missing AuthorizationCVE-2026-39509 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in wpWax Directorist directorist allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Directorist: from n/a through <= 8.5.10.
Product
Directorist
Affected
up to 8.5.10
What to do
Affects up to 8.5.10. Update Directorist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 4, 2026Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership: Stored Cross-Site ScriptingCVE-2025-15064 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the user description field in all versions up to, and including, 2.11.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerability is only exploitable when "HTML support for user description" is enabled in Ultimate Member settings.
Product
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership
Affected
up to 2.11.1
What to do
Affects up to 2.11.1. Update Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wordfence.com
Mar 25, 2026YML for Yandex Market: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2026-32567 · WordPress plugins & themes · reported by PatchstackMedium 6.8
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in icopydoc YML for Yandex Market yml-for-yandex-market allows Path Traversal.This issue affects YML for Yandex Market: from n/a through < 5.3.0.
Product
YML for Yandex Market
What to do
Update YML for Yandex Market to the newest version.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026WooCommerce Support Ticket System: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2026-32522 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in vanquish WooCommerce Support Ticket System woocommerce-support-ticket-system allows Path Traversal.This issue affects WooCommerce Support Ticket System: from n/a through < 18.5.
Product
WooCommerce Support Ticket System
What to do
Update WooCommerce Support Ticket System to the newest version.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026Spam Protect for Contact Form 7: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2026-32496 · WordPress plugins & themes · reported by PatchstackMedium 6.8
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in NYSL Spam Protect for Contact Form 7 wp-contact-form-7-spam-blocker allows Path Traversal.This issue affects Spam Protect for Contact Form 7: from n/a through <= 1.2.9.
Product
Spam Protect for Contact Form 7
Affected
up to 1.2.9
What to do
Affects up to 1.2.9. Update Spam Protect for Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026Scape: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2026-31913 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Whitebox-Studio Scape scape allows Path Traversal.This issue affects Scape: from n/a through < 1.5.16.
Product
Scape
What to do
Update Scape to the newest version.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026WZone: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2026-27040 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in AA-Team WZone woozone allows Path Traversal.This issue affects WZone: from n/a through <= 14.0.31.
Product
WZone
Affected
up to 14.0.31
What to do
Affects up to 14.0.31. Update WZone to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026Product File Upload for WooCommerce: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2026-25328 · WordPress plugins & themes · reported by PatchstackMedium 6.8
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in add-ons.org Product File Upload for WooCommerce products-file-upload-for-woocommerce allows Path Traversal.This issue affects Product File Upload for WooCommerce: from n/a through <= 2.2.4.
Product
Product File Upload for WooCommerce
Affected
up to 2.2.4
What to do
Affects up to 2.2.4. Update Product File Upload for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026Energox: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2026-24970 · WordPress plugins & themes · reported by PatchstackHigh 7.7
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in designingmedia Energox energox allows Path Traversal.This issue affects Energox: from n/a through <= 1.2.
Product
Energox
Affected
up to 1.2
What to do
Affects up to 1.2. Update Energox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026Instant VA: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2026-24969 · WordPress plugins & themes · reported by PatchstackHigh 7.7
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in designingmedia Instant VA instantva allows Path Traversal.This issue affects Instant VA: from n/a through <= 1.0.1.
Product
Instant VA
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update Instant VA to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026PitchPrint: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2026-22448 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in flexcubed PitchPrint pitchprint allows Path Traversal.This issue affects PitchPrint: from n/a through <= 11.1.2.
Product
PitchPrint
Affected
up to 11.1.2
What to do
Affects up to 11.1.2. Update PitchPrint to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 22, 2026WP Maps – Store Locator,Google Maps,OpenStreetMap,Mapbox,Listing,Directory & Filters: Time-based SQL InjectionCVE-2026-2580 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The WP Maps – Store Locator,Google Maps,OpenStreetMap,Mapbox,Listing,Directory & Filters plugin for WordPress is vulnerable to time-based SQL Injection via the ‘orderby’ parameter in all versions up to, and including, 4.9.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
WP Maps – Store Locator,Google Maps,OpenStreetMap,Mapbox,Listing,Directory & Filters
Affected
up to 4.9.1
What to do
Affects up to 4.9.1. Update WP Maps – Store Locator,Google Maps,OpenStreetMap,Mapbox,Listing,Directory & Filters to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 16, 2026User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration: Unauthorized modification of dataCVE-2026-2233 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the draft_post() function in all versions up to, and including, 4.2.8. This makes it possible for unauthenticated attackers to modify arbitrary posts (e.g. unpublish published posts and overwrite the contents) via the 'post_id' parameter.
Product
User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration
Affected
up to 4.2.8
What to do
Affects up to 4.2.8. Update User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 11, 2026Name Directory: Stored Cross-Site ScriptingCVE-2026-3178 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Name Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name_directory_name' parameter in all versions up to, and including, 1.32.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerability was partially patched in versions 1.30.3 and 1.32.1.
Product
Name Directory
Affected
up to 1.32.1
What to do
Affects up to 1.32.1. Update Name Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 5, 2026Lawyer Directory: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-28127 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e-plugins Lawyer Directory lawyer-directory allows Reflected XSS.This issue affects Lawyer Directory: from n/a through <= 1.3.2.
Product
Lawyer Directory
Affected
up to 1.3.2
What to do
Affects up to 1.3.2. Update Lawyer Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 5, 2026uListing: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2026-28078 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Stylemix uListing ulisting allows Path Traversal.This issue affects uListing: from n/a through <= 2.2.0.
Product
uListing
Affected
up to 2.2.0
What to do
Affects up to 2.2.0. Update uListing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 5, 2026Directory Pro: Missing AuthorizationCVE-2026-27396 · WordPress plugins & themes · reported by PatchstackHigh 7.3
Missing Authorization vulnerability in e-plugins Directory Pro directory-pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Directory Pro: from n/a through <= 2.5.6.
Product
Directory Pro
Affected
up to 2.5.6
What to do
Affects up to 2.5.6. Update Directory Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 5, 2026DesignThemes Directory Addon: Missing AuthorizationCVE-2026-27386 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in designthemes DesignThemes Directory Addon designthemes-directory-addon allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects DesignThemes Directory Addon: from n/a through <= 1.8.
Product
DesignThemes Directory Addon
Affected
up to 1.8
What to do
Affects up to 1.8. Update DesignThemes Directory Addon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 5, 2026FormGent: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2026-22460 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in wpWax FormGent formgent allows Path Traversal.This issue affects FormGent: from n/a through <= 1.7.0.
Product
FormGent
Affected
up to 1.7.0
What to do
Affects up to 1.7.0. Update FormGent to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 5, 2026ionCube tester plus: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-69411 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Robert Seyfriedsberger ionCube tester plus ioncube-tester-plus allows Path Traversal.This issue affects ionCube tester plus: from n/a through <= 1.3.
Product
ionCube tester plus
Affected
up to 1.3
What to do
Affects up to 1.3. Update ionCube tester plus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 26, 2026User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration: Arbitrary file uploadsCVE-2026-1565 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration plugin for WordPress is vulnerable to arbitrary file uploads due to incorrect file type validation in the 'WPUF_Admin_Settings::check_filetype_and_ext' function and in the 'Admin_Tools::check_filetype_and_ext' function in all versions up to, and including, 4.2.8. This makes it possible for authenticated attackers, with Author-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration
Affected
up to 4.2.8
What to do
Affects up to 4.2.8. Update User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 20, 2026Simple File List: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2026-24953 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Mitchell Bennis Simple File List simple-file-list allows Path Traversal.This issue affects Simple File List: from n/a through <= 6.1.15.
Product
Simple File List
Affected
up to 6.1.15
What to do
Affects up to 6.1.15. Update Simple File List to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 20, 2026Upload Files Anywhere: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-69380 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in vanquish Upload Files Anywhere wp-upload-files-anywhere allows Path Traversal.This issue affects Upload Files Anywhere: from n/a through <= 2.8.
Product
Upload Files Anywhere
Affected
up to 2.8
What to do
Affects up to 2.8. Update Upload Files Anywhere to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 20, 2026Upload Files Anywhere: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-69379 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in vanquish Upload Files Anywhere wp-upload-files-anywhere allows Path Traversal.This issue affects Upload Files Anywhere: from n/a through <= 2.8.
Product
Upload Files Anywhere
Affected
up to 2.8
What to do
Affects up to 2.8. Update Upload Files Anywhere to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.