Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,203 results · page 5 of 25
Jul 28, 2026Contact Form to Any API: Stored Cross-Site ScriptingCVE-2026-15735 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Contact Form to Any API plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'cf7anyapi_form_field' Post Meta in all versions up to, and including, 3.0.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Contact Form to Any API
- Affected
- up to 3.0.6
- What to do
- Affects up to 3.0.6. Update Contact Form to Any API to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 28, 2026PickPlugins Question Answer: SQL InjectionCVE-2026-10207 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The PickPlugins Question Answer plugin for WordPress is vulnerable to SQL Injection in versions up to and including 1.2.73. This is due to insufficient sanitization of user-supplied input via the 'id' GET parameter in the user profile template combined with the use of wp_unslash() which removes WordPress's magic quotes protection, followed by direct concatenation into a SQL query without proper escaping or prepared statements in the qa_user_profile_card() function. This makes it possible for unauthenticated attackers to append additional SQL queries into existing queries, which can be used to extract sensitive information from the database.
- Product
- PickPlugins Question Answer
- Affected
- up to 1.2.73
- What to do
- Affects up to 1.2.73. Update PickPlugins Question Answer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 27, 2026Subscriber Sensitive Data Exposure in ShipTime: Discounted Shipping Rates <= 1.1.1 versions.CVE-2026-59528 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Subscriber Sensitive Data Exposure in ShipTime: Discounted Shipping Rates <= 1.1.1 versions.
- Affected
- up to 1.1.1
- What to do
- Affects up to 1.1.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 27, 2026Download Manager: Does not bind its temporary download token to the requesting session nor expire it promptlyCVE-2026-14235 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Download Manager WordPress plugin before 3.3.62 does not bind its temporary download token to the requesting session nor expire it promptly, making the token a long-lived, multi-use, portable bearer token, so that an attacker who obtains one leaked download key can repeatedly download a role- or password-protected package file without authorization.
- Product
- Download Manager
- Fixed in
- 3.3.62
- What to do
- Update Download Manager to 3.3.62 or newer.
Jul 27, 2026Events Calendar: Does not perform an authorization check on one of its Event Aggregator import REST API routes and skips an integrity check for a particular status valueCVE-2026-13390 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Events Calendar WordPress plugin before 6.16.5.1 does not perform an authorization check on one of its Event Aggregator import REST API routes and skips an integrity check for a particular status value, allowing unauthenticated attackers to mark existing import records as failed and to store arbitrary content in a hidden comment record.
- Product
- Events Calendar
- Fixed in
- 6.16.5.1
- What to do
- Update Events Calendar to 6.16.5.1 or newer.
Jul 24, 2026CAFEHAUS API: Does not have any authentication or authorisationCVE-2026-12981 · WordPress plugins & themes · reported by WPScanHigh 7.5
The CAFEHAUS API WordPress plugin through 1.0.0 does not have any authentication or authorisation when updating user passwords, allowing unauthenticated attackers to set the password of any user, including administrators, and fully take over their accounts.
- Product
- CAFEHAUS API
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update CAFEHAUS API to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 24, 2026Wpify Woo: Privilege EscalationCVE-2026-12736 · WordPress plugins & themes · reported by WordfenceHigh 8
The Wpify Woo plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 5.4.16. This is due to the SettingsApi::save_option() REST route (POST /wp-json/wpify-woo/v1/option) passing the request-supplied 'option' and 'data' parameters directly to update_option() without any option-name allowlist or value sanitization, while the permission_callback only verifies the manage_woocommerce capability. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to elevate their privileges to Administrator by overwriting arbitrary WordPress options (for example setting default_role to administrator and users_can_register to 1, or disabling security plugins via active_plugins).
- Product
- Wpify Woo
- Affected
- up to 5.4.16
- What to do
- Affects up to 5.4.16. Update Wpify Woo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 23, 2026Contributor Cross Site Scripting (XSS) in Virtue/Ascend/Pinnacle Toolkit <= 4.9.12 versions.CVE-2026-65473 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Cross Site Scripting (XSS) in Virtue/Ascend/Pinnacle Toolkit <= 4.9.12 versions.
- Affected
- up to 4.9.12
- What to do
- Affects up to 4.9.12. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026Contributor Arbitrary File Deletion in Picture Gallery <= 1.6.5 versions.CVE-2026-57696 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Contributor Arbitrary File Deletion in Picture Gallery <= 1.6.5 versions.
- Affected
- up to 1.6.5
- What to do
- Affects up to 1.6.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026AI Copilot – Content Generator: Generic SQL InjectionCVE-2026-13009 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The AI Copilot – Content Generator plugin for WordPress is vulnerable to generic SQL Injection via 'order[0][dir]' Parameter in all versions up to, and including, 1.5.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The required waic-nonce is emitted on the front-end whenever the [waic_form] or [aiwu-form] shortcode is rendered, enabling contributor-level users who can publish shortcodes to obtain a valid nonce and reach the vulnerable AJAX handler, which performs no capability check beyond nonce verification when the shortcodes are not already embedded in a page.
- Product
- AI Copilot – Content Generator
- Affected
- up to 1.5.4
- What to do
- Affects up to 1.5.4. Update AI Copilot – Content Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 23, 2026Praison AI SEO: Does not perform authorization checks on several of its REST API routesCVE-2026-12082 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Praison AI SEO WordPress plugin before 5.0.7 does not perform authorization checks on several of its REST API routes, allowing unauthenticated users to modify the permalink of any published post and to read Praison AI SEO WordPress plugin before 5.0.7 configuration data.
- Product
- Praison AI SEO
- Fixed in
- 5.0.7
- What to do
- Update Praison AI SEO to 5.0.7 or newer.
Jul 21, 2026bpost-shipping-platform: Does not properly sanitize a parameter before using it in a SQL query during WooCommerce order submissionCVE-2026-8082 · WordPress plugins & themes · reported by WPScanHigh 7.5
The bpost-shipping-platform WordPress plugin before 3.2.3 does not properly sanitize a parameter before using it in a SQL query during WooCommerce order submission, allowing unauthenticated attackers to perform time-based blind SQL injection on stores running this bpost-shipping-platform WordPress plugin before 3.2.3.
- Product
- bpost-shipping-platform
- Fixed in
- 3.2.3
- What to do
- Update bpost-shipping-platform to 3.2.3 or newer.
Jul 21, 2026Bit Form: Does not properly validate its workflow-trigger token once the associated transient has expiredCVE-2026-13694 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Bit Form WordPress plugin before 3.1.0 does not properly validate its workflow-trigger token once the associated transient has expired, allowing unauthenticated attackers to re-trigger a form's configured workflow actions such as notification emails and integrations.
- Product
- Bit Form
- Fixed in
- 3.1.0
- What to do
- Update Bit Form to 3.1.0 or newer.
Jul 20, 2026All in One SEO: Does not correctly restrict access to some of its AI integration REST API endpointsCVE-2026-10755 · WordPress plugins & themes · reported by WPScanLow 2.7
The All in One SEO WordPress plugin before 4.9.9 does not correctly restrict access to some of its AI integration REST API endpoints, allowing users with low-level privileges such as Contributors to overwrite or reset the site-wide AI integration state.
- Product
- All in One SEO
- Fixed in
- 4.9.9
- What to do
- Update All in One SEO to 4.9.9 or newer.
Jul 20, 2026Unlimited Elements For Elementor: Does not sanitize or escape Google review content fetched from the Serp API before rendering it in the Google Reviews widget outputCVE-2026-10081 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Unlimited Elements For Elementor WordPress plugin before 2.0.11 does not sanitize or escape Google review content fetched from the Serp API before rendering it in the Google Reviews widget output, allowing unauthenticated attackers who submit a malicious review on the targeted business's Google listing to deliver Stored XSS to any visitor (including administrators) of any WP page displaying that Place ID's reviews.
- Product
- Unlimited Elements For Elementor
- Fixed in
- 2.0.11
- What to do
- Update Unlimited Elements For Elementor to 2.0.11 or newer.
Jul 17, 2026AI Copilot: Does not bind OAuth access tokens to a WordPress userCVE-2026-9810 · WordPress plugins & themes · reported by WPScanCritical 9.8
The AI Copilot WordPress plugin before 1.5.4 does not bind OAuth access tokens to a WordPress user, and accepts any valid token as an administrator session, allowing unauthenticated attackers who complete the public OAuth flow to execute privileged MCP tools as an administrator, including arbitrary user creation and role escalation.
- Product
- AI Copilot
- Fixed in
- 1.5.4
- What to do
- Update AI Copilot to 1.5.4 or newer.
Jul 13, 2026User Profile Picture: Authorization Bypass Through User-Controlled KeyCVE-2026-61971 · WordPress plugins & themes · reported by PatchstackLow 2.7
Authorization Bypass Through User-Controlled Key vulnerability in Cozmoslabs User Profile Picture metronet-profile-picture allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Profile Picture: from n/a through <= 2.6.3.
- Product
- User Profile Picture
- Affected
- up to 2.6.3
- What to do
- Affects up to 2.6.3. Update User Profile Picture to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 13, 2026APIExperts Square for WooCommerce: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-57810 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Saad Iqbal APIExperts Square for WooCommerce woosquare allows Blind SQL Injection.This issue affects APIExperts Square for WooCommerce: from n/a through <= 4.7.4.
- Product
- APIExperts Square for WooCommerce
- Affected
- up to 4.7.4
- What to do
- Affects up to 4.7.4. Update APIExperts Square for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 13, 2026picu: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-57387 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in picu picu picu allows Stored XSS.This issue affects picu: from n/a through <= 3.5.1.
- Product
- picu
- Affected
- up to 3.5.1
- What to do
- Affects up to 3.5.1. Update picu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 13, 2026MStore API: Missing AuthorizationCVE-2026-57375 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in FluxBuilder MStore API mstore-api allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MStore API: from n/a through <= 4.18.4.
- Product
- MStore API
- Affected
- up to 4.18.4
- What to do
- Affects up to 4.18.4. Update MStore API to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 9, 2026Everest Forms: Does not correctly restrict access to several REST API endpoints belonging to its onboarding assistant: the capability check is only appliedCVE-2026-12270 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Everest Forms WordPress plugin before 3.5.0 does not correctly restrict access to several REST API endpoints belonging to its onboarding assistant: the capability check is only applied when an attacker-controllable request header holds a specific value, so it can be bypassed by omitting or changing that header. This makes it possible for unauthenticated attackers to read onboarding status information, modify the related Everest Forms WordPress plugin before 3.5.0 options, and trigger an email from the site to an arbitrary address.
- Product
- Everest Forms
- Fixed in
- 3.5.0
- What to do
- Update Everest Forms to 3.5.0 or newer.
Jul 3, 2026JSON API User: Stored Cross-Site ScriptingCVE-2026-9626 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The JSON API User plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content' parameter of the post_comment API endpoint in versions up to, and including, 4.1.0 This is due to insufficient input sanitization in the post_comment() function, which passes the attacker-controlled comment_content value directly to wp_insert_comment() without applying any HTML sanitization, and additionally allows the caller to set comment_approved=1 to self-approve the comment and bypass moderation. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- JSON API User
- Affected
- up to 4.1.0
- What to do
- Affects up to 4.1.0. Update JSON API User to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 2, 2026Unauthenticated Cross Site Request Forgery (CSRF) in WPIDE – File Manager & Code Editor <= 3.5.6 versions.CVE-2026-57766 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Unauthenticated Cross Site Request Forgery (CSRF) in WPIDE – File Manager & Code Editor <= 3.5.6 versions.
- What to do
- Update the plugin to the newest version.
Jul 2, 2026Sendcloud Shipping: Missing AuthorizationCVE-2026-57760 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Sendcloud Sendcloud Shipping allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Sendcloud Shipping: from n/a through 1.0.29.
- Product
- Sendcloud Shipping
- Affected
- up to 1.0.29
- What to do
- Affects up to 1.0.29. Update Sendcloud Shipping to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 2, 2026Contributor Local File Inclusion in Shopify <= 1.0.0 versions.CVE-2026-57748 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Contributor Local File Inclusion in Shopify <= 1.0.0 versions.
- What to do
- Update the plugin to the newest version.
Jul 2, 2026Unauthenticated Broken Authentication in ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce <= 2.2.0 versions.CVE-2026-57352 · WordPress plugins & themes · reported by PatchstackMedium 4.8
Unauthenticated Broken Authentication in ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce <= 2.2.0 versions.
- What to do
- Update the plugin to the newest version.
Jul 2, 2026Subscriber Cross Site Scripting (XSS) in ShortPixel Adaptive Images <= 3.11.3 versions.CVE-2026-57342 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Subscriber Cross Site Scripting (XSS) in ShortPixel Adaptive Images <= 3.11.3 versions.
- What to do
- Update the plugin to the newest version.
Jun 30, 2026PixMagix – WordPress Image Editor: Directory TraversalCVE-2026-11367 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The PixMagix – WordPress Image Editor plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.7.2 via the move_image_on_server function. This makes it possible for authenticated attackers, with author-level access and above, to write files with attacker-controlled content to arbitrary locations on the server. The unsanitized 'layers[].id' parameter is concatenated into a filesystem path and passed to PHP's copy() function, allowing traversal sequences (e.g. '../../') to escape the intended upload directory and write attacker-supplied file contents to arbitrary paths accessible by the web server process. The save_template REST endpoint is gated by the create_projects permission (edit_pixmagix + upload_files), which Author-level users hold by default after plugin activation, making this exploitable by any Author on sites running PixMagix.
- Product
- PixMagix – WordPress Image Editor
- Affected
- up to 1.7.2
- What to do
- Affects up to 1.7.2. Update PixMagix – WordPress Image Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 26, 2026Unauthenticated Arbitrary File Deletion in ShortPixel Adaptive Images <= 3.11.4 versions.CVE-2026-56066 · WordPress plugins & themes · reported by PatchstackMedium 5.8
Unauthenticated Arbitrary File Deletion in ShortPixel Adaptive Images <= 3.11.4 versions.
- What to do
- Update the plugin to the newest version.
Jun 26, 2026Unauthenticated Broken Access Control in Syncee Premium Dropshipping & Wholesale <= 1.0.27 versions.CVE-2026-54846 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in Syncee Premium Dropshipping & Wholesale <= 1.0.27 versions.
- What to do
- Update the plugin to the newest version.
Jun 26, 2026YMC Filter: Does not properly authorize access to one of its REST API endpoints and does not validate a user-supplied query parameterCVE-2026-10823 · WordPress plugins & themes · reported by WPScanHigh 7.5
The YMC Filter WordPress plugin before 3.11.3 does not properly authorize access to one of its REST API endpoints and does not validate a user-supplied query parameter, allowing unauthenticated attackers to retrieve the titles and content of private, draft, and other non-public posts.
- Product
- YMC Filter
- Fixed in
- 3.11.3
- What to do
- Update YMC Filter to 3.11.3 or newer.
Jun 25, 2026Customer Broken Access Control in UPI QR Code Payment Gateway for WooCommerce <= 1.6.2 versions.CVE-2026-56023 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Customer Broken Access Control in UPI QR Code Payment Gateway for WooCommerce <= 1.6.2 versions.
- Affected
- up to 1.6.2
- What to do
- Affects up to 1.6.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 25, 2026APIExperts Square for WooCommerce: Insertion of Sensitive Information Into Sent DataCVE-2026-54848 · WordPress plugins & themes · reported by PatchstackHigh 8.3
Insertion of Sensitive Information Into Sent Data vulnerability in Saad Iqbal APIExperts Square for WooCommerce allows Retrieve Embedded Sensitive Data. This issue affects APIExperts Square for WooCommerce: from n/a through 4.7.3.
- Product
- APIExperts Square for WooCommerce
- Affected
- up to 4.7.3
- What to do
- Affects up to 4.7.3. Update APIExperts Square for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 25, 2026Masteriyo LMS: Does not perform authorization checks in a course-progress REST API controllerCVE-2026-10824 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Masteriyo LMS WordPress plugin before 2.2.1 does not perform authorization checks in a course-progress REST API controller, allowing unauthenticated users to read and permanently delete any user's course-progress records.
- Product
- Masteriyo LMS
- Fixed in
- 2.2.1
- What to do
- Update Masteriyo LMS to 2.2.1 or newer.
Jun 24, 2026Cornerstone: Does not enforce capability checks on one of its REST API routesCVE-2026-9709 · WordPress plugins & themes · reported by WPScanHigh 7.7
The Cornerstone WordPress plugin before 7.8.9 does not enforce capability checks on one of its REST API routes, allowing any authenticated user to disclose the metadata of any other user, including roles, session token previews and stored billing/shipping fields. This affects the premium co Cornerstone page builder distributed bundled with the X , not the unrelated free `cornerstone` Cornerstone WordPress plugin before 7.8.9 (v0.8.x) on the .org repository.
- Product
- Cornerstone
- Fixed in
- 7.8.9
- What to do
- Update Cornerstone to 7.8.9 or newer.
Jun 24, 2026Site Kit by Google: Does not properly restrict a REST API write endpoint to administratorsCVE-2026-10753 · WordPress plugins & themes · reported by WPScanLow 2.7
The Site Kit by Google WordPress plugin before 1.176.0 does not properly restrict a REST API write endpoint to administrators, allowing lower-privileged users who have been granted dashboard sharing access (such as Editors) to modify a site-wide Site Kit by Google WordPress plugin before 1.176.0 setting that should only be modifiable by administrators.
- Product
- Site Kit by Google
- Fixed in
- 1.176.0
- What to do
- Update Site Kit by Google to 1.176.0 or newer.
Jun 22, 2026Pie Register: Does not use sufficiently random valuesCVE-2026-10530 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Pie Register WordPress plugin before 3.8.4.10 does not use sufficiently random values when generating its account verification tokens, allowing unauthenticated attackers to predict a valid token and activate an account without access to the associated email inbox.
- Product
- Pie Register
- Fixed in
- 3.8.4.10
- What to do
- Update Pie Register to 3.8.4.10 or newer.
Jun 17, 2026MStore API: Authentication Bypass Using an Alternate Path or ChannelCVE-2026-54817 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Authentication Bypass Using an Alternate Path or Channel vulnerability in FluxBuilder MStore API allows Password Recovery Exploitation. This issue affects MStore API: from n/a through 4.18.4.
- Product
- MStore API
- Affected
- up to 4.18.4
- What to do
- Affects up to 4.18.4. Update MStore API to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Cargo Shipping Location for WooCommerce: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-54815 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Cargo RD Cargo Shipping Location for WooCommerce allows Blind SQL Injection. This issue affects Cargo Shipping Location for WooCommerce: from n/a through 5.6.
- Product
- Cargo Shipping Location for WooCommerce
- Affected
- up to 5.6
- What to do
- Affects up to 5.6. Update Cargo Shipping Location for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026The Hospital: Deserialization of Untrusted DataCVE-2025-60231 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in EMV The Hospital nrghospital allows Object Injection. This issue affects The Hospital: from n/a through 1.8.1.
- Product
- The Hospital
- Affected
- up to 1.8.1
- What to do
- Affects up to 1.8.1. Update The Hospital to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated Broken Authentication in WooCommerce Dropshipping <= 5.2.4 versions.CVE-2026-49071 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Broken Authentication in WooCommerce Dropshipping <= 5.2.4 versions.
- Affected
- up to 5.2.4
- What to do
- Affects up to 5.2.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated Local File Inclusion in Spike <= 1.2 versions.CVE-2025-69168 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Local File Inclusion in Spike <= 1.2 versions.
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated Local File Inclusion in Raider Spirit <= 1.1.2 versions.CVE-2025-69109 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Local File Inclusion in Raider Spirit <= 1.1.2 versions.
- Affected
- up to 1.1.2
- What to do
- Affects up to 1.1.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 16, 2026Unauthenticated Broken Access Control in JupiterX Core <= 4.14.1 versions.CVE-2026-39490 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in JupiterX Core <= 4.14.1 versions.
- Affected
- up to 4.14.1
- What to do
- Affects up to 4.14.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Subscriber SQL Injection in WCMultiShipping <= 3.0.2 versions.CVE-2026-52700 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Subscriber SQL Injection in WCMultiShipping <= 3.0.2 versions.
- Affected
- up to 3.0.2
- What to do
- Affects up to 3.0.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated Sensitive Data Exposure in WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels <= 4.9.4 versions.CVE-2026-49056 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Sensitive Data Exposure in WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels <= 4.9.4 versions.
- Affected
- up to 4.9.4
- What to do
- Affects up to 4.9.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated Insecure Direct Object References (IDOR) in Simple Shopping Cart <= 5.2.9 versions.CVE-2026-48868 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Insecure Direct Object References (IDOR) in Simple Shopping Cart <= 5.2.9 versions.
- Affected
- up to 5.2.9
- What to do
- Affects up to 5.2.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Subscriber Sensitive Data Exposure in WPPizza <= 3.19.9 versions.CVE-2026-40796 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Subscriber Sensitive Data Exposure in WPPizza <= 3.19.9 versions.
- Affected
- up to 3.19.9
- What to do
- Affects up to 3.19.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Subscriber Cross Site Scripting (XSS) in JupiterX Core <= 4.14.1 versions.CVE-2026-39491 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Subscriber Cross Site Scripting (XSS) in JupiterX Core <= 4.14.1 versions.
- Affected
- up to 4.14.1
- What to do
- Affects up to 4.14.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Author PHP Object Injection in ShortPixel Image Optimizer <= 6.4.3 versions.CVE-2026-39471 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Author PHP Object Injection in ShortPixel Image Optimizer <= 6.4.3 versions.
- Affected
- up to 6.4.3
- What to do
- Affects up to 6.4.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.