Vulnerability database

24,205 results · page 52 of 485

• Aug 28, 2026User Frontend: Does not properly validate field type definitions and deserialises user-controlled post metadataCVE-2026-14558 · WordPress plugins & themes · reported by WPScanHigh 7.2

  The User Frontend WordPress plugin before 4.3.10 does not properly validate field type definitions and deserialises user-controlled post metadata when rendering submitted posts, allowing users with Editor-level access and above to inject arbitrary PHP objects, which can lead to remote code execution when a suitable POP chain is present on the site.

  Product

  User Frontend

  Fixed in

  4.3.10

  What to do

  Update User Frontend to 4.3.10 or newer.

  Full record and what to do →NVD recordwpscan.com

• Aug 28, 2026Shared Files WordPress plugin before 1.7.67, shared-files-pro: Do not properly sanitize a file path taken from a frontend file submission and their single-pass traversal filter is bypassableCVE-2026-12513 · WordPress plugins & themes · reported by WPScanMedium 6.8

  The Shared Files WordPress plugin before 1.7.67, shared-files-pro WordPress plugin before 1.7.68 do not properly sanitize a file path taken from a frontend file submission and their single-pass traversal filter is bypassable, allowing unauthenticated users to store a path that points outside the uploads directory. When the corresponding file entry is later permanently deleted, an arbitrary file on the server (such as wp-config.php) is deleted, leading to denial of service and potential site takeover.

  Product

  Shared Files WordPress plugin before 1.7.67, shared-files-pro

  Fixed in

  1.7.67

  What to do

  Update Shared Files WordPress plugin before 1.7.67, shared-files-pro to 1.7.67 or newer.

  Full record and what to do →NVD recordwpscan.com

• Aug 28, 2026Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization: Stored Cross-Site ScriptingCVE-2026-77365 · WordPress plugins & themes · reported by WordfenceHigh 7.2

  The Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'a' (above_fold_images) parameter in all versions up to, and including, 4.2.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

  Product

  Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization

  Affected

  up to 4.2.10

  What to do

  Affects up to 4.2.10. Update Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Aug 28, 2026TranslatePress – Translate Multilingual sites with AI Translation: Stored Cross-Site ScriptingCVE-2026-76053 · WordPress plugins & themes · reported by WordfenceHigh 7.2

  The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Noise-Key Injection into HTML Parser in all versions up to, and including, 3.3.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation is possible because WordPress's comment KSES allowlist permits the payload structure — an anchor tag with href and title attributes alongside a code tag — causing the malicious comment to be stored verbatim in the database, where it is later processed by the vulnerable parser during page translation.

  Product

  TranslatePress – Translate Multilingual sites with AI Translation

  Affected

  up to 3.3.3

  What to do

  Affects up to 3.3.3. Update TranslatePress – Translate Multilingual sites with AI Translation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Aug 28, 2026Tutor LMS – eLearning and online course solution: Remote Code Execution limited to zero-argument function invocationCVE-2026-16759 · WordPress plugins & themes · reported by WordfenceMedium 6.5

  The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Remote Code Execution limited to zero-argument function invocation in all versions up to, and including, 4.0.5 via the tutor_course_filter_ajax AJAX action. This is due to missing authorization on the handler combined with unsanitized array keys being passed to extract() inside tutor_load_template(), allowing attacker-controlled POST data to overwrite the local $template variable and, in the resulting templates/single-content-loader.php template, the $method_map and $context variables invoked at $method_map[$context](). This makes it possible for unauthenticated attackers to call an arbitrary zero-argument PHP function server-side and, via WordPress core edit_user(), to create a persistent subscriber-level account from request parameters.

  Product

  Tutor LMS – eLearning and online course solution

  Affected

  up to 4.0.5

  What to do

  Affects up to 4.0.5. Update Tutor LMS – eLearning and online course solution to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Aug 28, 2026Avada (Fusion) Builder: Stored Cross-Site ScriptingCVE-2026-16654 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The Avada (Fusion) Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'size' Shortcode Attribute in all versions up to, and including, 3.15.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. WordPress's wp_kses_post filter does not neutralize the payload because the injected content resides entirely within a shortcode attribute string containing no HTML angle brackets, causing kses to pass it through unchanged at save time.

  Product

  Avada (Fusion) Builder

  Affected

  up to 3.15.6

  What to do

  Affects up to 3.15.6. Update Avada (Fusion) Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordavada.comwordfence.com

• Aug 27, 2026Subscriber Broken Access Control in Push Notification for Post and BuddyPress <= 3.20 versions.CVE-2026-81279 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Subscriber Broken Access Control in Push Notification for Post and BuddyPress <= 3.20 versions.

  Affected

  up to 3.20

  What to do

  Affects up to 3.20. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 27, 2026Contributor SQL Injection in Suggestion Engine for WooCommerce <= 2.0.11 versions.CVE-2026-81277 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Contributor SQL Injection in Suggestion Engine for WooCommerce <= 2.0.11 versions.

  Affected

  up to 2.0.11

  What to do

  Affects up to 2.0.11. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 27, 2026Unauthenticated Broken Access Control in Kali Forms <= 2.4.23 versions.CVE-2026-81276 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Unauthenticated Broken Access Control in Kali Forms <= 2.4.23 versions.

  Affected

  up to 2.4.23

  What to do

  Affects up to 2.4.23. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 27, 2026Subscriber Broken Access Control in Ditty <= 3.1.67 versions.CVE-2026-81274 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Subscriber Broken Access Control in Ditty <= 3.1.67 versions.

  Affected

  up to 3.1.67

  What to do

  Affects up to 3.1.67. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 27, 2026Unauthenticated Cross Site Request Forgery (CSRF) in FluentBooking Pro <= 2.2.4 versions.CVE-2026-81273 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Unauthenticated Cross Site Request Forgery (CSRF) in FluentBooking Pro <= 2.2.4 versions.

  Affected

  up to 2.2.4

  What to do

  Affects up to 2.2.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 27, 2026Editor Broken Access Control in FluentPlayer Pro <= 1.3.2 versions.CVE-2026-81272 · WordPress plugins & themes · reported by PatchstackMedium 4.9

  Editor Broken Access Control in FluentPlayer Pro <= 1.3.2 versions.

  Affected

  up to 1.3.2

  What to do

  Affects up to 1.3.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 27, 2026Unauthenticated Cross Site Request Forgery (CSRF) in GeoDirectory <= 2.8.176 versions.CVE-2026-81271 · WordPress plugins & themes · reported by PatchstackHigh 8.8

  Unauthenticated Cross Site Request Forgery (CSRF) in GeoDirectory <= 2.8.176 versions.

  Affected

  up to 2.8.176

  What to do

  Affects up to 2.8.176. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 27, 2026Subscriber Sensitive Data Exposure in SureFeedback Client Site <= 1.2.12 versions.CVE-2026-80433 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Subscriber Sensitive Data Exposure in SureFeedback Client Site <= 1.2.12 versions.

  Affected

  up to 1.2.12

  What to do

  Affects up to 1.2.12. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 27, 2026Unauthenticated Cross Site Scripting (XSS) in WP w3all phpBB <= 3.0.6 versions.CVE-2026-78293 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in WP w3all phpBB <= 3.0.6 versions.

  Affected

  up to 3.0.6

  What to do

  Affects up to 3.0.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 27, 2026Unauthenticated PHP Object Injection in Hash Form <= 1.4.1 versions.CVE-2026-78292 · WordPress plugins & themes · reported by PatchstackCritical 9.8

  Unauthenticated PHP Object Injection in Hash Form <= 1.4.1 versions.

  Affected

  up to 1.4.1

  What to do

  Affects up to 1.4.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 27, 2026Unauthenticated Cross Site Scripting (XSS) in CozyStay <= 1.10.0 versions.CVE-2026-78289 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in CozyStay <= 1.10.0 versions.

  Affected

  up to 1.10.0

  What to do

  Affects up to 1.10.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 27, 2026Unauthenticated SQL Injection in Beautiful Taxonomy Filters <= 2.4.6 versions.CVE-2026-78288 · WordPress plugins & themes · reported by PatchstackCritical 9.3

  Unauthenticated SQL Injection in Beautiful Taxonomy Filters <= 2.4.6 versions.

  Affected

  up to 2.4.6

  What to do

  Affects up to 2.4.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 27, 2026Unauthenticated PHP Object Injection in Geo Controller <= 8.9.8 versions.CVE-2026-78286 · WordPress plugins & themes · reported by PatchstackCritical 9.8

  Unauthenticated PHP Object Injection in Geo Controller <= 8.9.8 versions.

  Affected

  up to 8.9.8

  What to do

  Affects up to 8.9.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 27, 2026Subscriber SQL Injection in Like Button Rating <= 2.6.61 versions.CVE-2026-78285 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Subscriber SQL Injection in Like Button Rating <= 2.6.61 versions.

  Affected

  up to 2.6.61

  What to do

  Affects up to 2.6.61. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 27, 2026Unauthenticated Cross Site Scripting (XSS) in Music Player for WooCommerce <= 1.8.9 versions.CVE-2026-78283 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in Music Player for WooCommerce <= 1.8.9 versions.

  Affected

  up to 1.8.9

  What to do

  Affects up to 1.8.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 27, 2026Unauthenticated Cross Site Scripting (XSS) in CP Media Player <= 1.3.0 versions.CVE-2026-78281 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in CP Media Player <= 1.3.0 versions.

  Affected

  up to 1.3.0

  What to do

  Affects up to 1.3.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 27, 2026Editor PHP Object Injection in Fluent Boards Pro <= 2.0.11 versions.CVE-2026-78276 · WordPress plugins & themes · reported by PatchstackHigh 7.2

  Editor PHP Object Injection in Fluent Boards Pro <= 2.0.11 versions.

  Affected

  up to 2.0.11

  What to do

  Affects up to 2.0.11. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 27, 2026Editor Arbitrary File Deletion in Fluent Boards Pro <= 2.0.11 versions.CVE-2026-78275 · WordPress plugins & themes · reported by PatchstackMedium 6.8

  Editor Arbitrary File Deletion in Fluent Boards Pro <= 2.0.11 versions.

  Affected

  up to 2.0.11

  What to do

  Affects up to 2.0.11. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 27, 2026Editor Arbitrary File Upload in Fluent Boards Pro <= 2.0.11 versions.CVE-2026-78274 · WordPress plugins & themes · reported by PatchstackCritical 9.1

  Editor Arbitrary File Upload in Fluent Boards Pro <= 2.0.11 versions.

  Affected

  up to 2.0.11

  What to do

  Affects up to 2.0.11. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 27, 2026Subscriber Cross Site Scripting (XSS) in Fluent Boards Pro <= 2.0.11 versions.CVE-2026-78273 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Subscriber Cross Site Scripting (XSS) in Fluent Boards Pro <= 2.0.11 versions.

  Affected

  up to 2.0.11

  What to do

  Affects up to 2.0.11. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 27, 2026Editor Privilege Escalation in FluentCRM Pro <= 3.1.12 versions.CVE-2026-78271 · WordPress plugins & themes · reported by PatchstackHigh 7.2

  Editor Privilege Escalation in FluentCRM Pro <= 3.1.12 versions.

  Affected

  up to 3.1.12

  What to do

  Affects up to 3.1.12. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 27, 2026Unauthenticated Cross Site Scripting (XSS) in Realtyna Organic IDX plugin <= 5.4.1 versions.CVE-2026-78261 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in Realtyna Organic IDX plugin <= 5.4.1 versions.

  Affected

  up to 5.4.1

  What to do

  Affects up to 5.4.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 27, 2026Unauthenticated SQL Injection in Epayco <= 8.4.6 versions.CVE-2026-78260 · WordPress plugins & themes · reported by PatchstackCritical 9.3

  Unauthenticated SQL Injection in Epayco <= 8.4.6 versions.

  Affected

  up to 8.4.6

  What to do

  Affects up to 8.4.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 27, 2026Contributor PHP Object Injection in Booking and Rental Manager <= 2.7.5 versions.CVE-2026-78257 · WordPress plugins & themes · reported by PatchstackHigh 8.8

  Contributor PHP Object Injection in Booking and Rental Manager <= 2.7.5 versions.

  Affected

  up to 2.7.5

  What to do

  Affects up to 2.7.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 27, 2026Unauthenticated Privilege Escalation in ACPT (Pro) - Custom Post Types Plugin for WordPress <= 2.0.63 versions.CVE-2026-32566 · WordPress plugins & themes · reported by PatchstackCritical 9.8

  Unauthenticated Privilege Escalation in ACPT (Pro) - Custom Post Types Plugin for WordPress <= 2.0.63 versions.

  Affected

  up to 2.0.63

  What to do

  Affects up to 2.0.63. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 27, 2026Subscriber SQL Injection in ACPT (Pro) - Custom Post Types Plugin for WordPress <= 2.0.63 versions.CVE-2026-32564 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Subscriber SQL Injection in ACPT (Pro) - Custom Post Types Plugin for WordPress <= 2.0.63 versions.

  Affected

  up to 2.0.63

  What to do

  Affects up to 2.0.63. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 27, 2026Subscriber SQL Injection in Kadence Shop Kit <= 3.0.6 versions.CVE-2026-32550 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Subscriber SQL Injection in Kadence Shop Kit <= 3.0.6 versions.

  Affected

  up to 3.0.6

  What to do

  Affects up to 3.0.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 27, 2026Unauthenticated SQL Injection in Visitor Traffic Real Time Statistics Pro <= 11.17 versions.CVE-2026-32479 · WordPress plugins & themes · reported by PatchstackCritical 9.3

  Unauthenticated SQL Injection in Visitor Traffic Real Time Statistics Pro <= 11.17 versions.

  Affected

  up to 11.17

  What to do

  Affects up to 11.17. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 27, 2026Unauthenticated Broken Access Control in Mobile App for WooCommerce <= 0.4.62 versions.CVE-2026-27330 · WordPress plugins & themes · reported by PatchstackHigh 8.6

  Unauthenticated Broken Access Control in Mobile App for WooCommerce <= 0.4.62 versions.

  Affected

  up to 0.4.62

  What to do

  Affects up to 0.4.62. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 27, 2026Notifima: Does not verify that the caller owns the subscription being modified on one of its REST endpoints in all versions up toCVE-2026-78139 · WordPress plugins & themes · reported by WPScanMedium 4.3

  The Notifima WordPress plugin before 3.1.4 does not verify that the caller owns the subscription being modified on one of its REST endpoints in all versions up to, and including, 3.1.3, allowing authenticated attackers with Subscriber-level access to unsubscribe arbitrary customers from product stock-alert notifications.

  Product

  Notifima

  Affected

  up to 3.1.3

  Fixed in

  3.1.4

  What to do

  Update Notifima to 3.1.4 or newer.

  Full record and what to do →NVD recordwpscan.com

• Aug 27, 2026Finale Lite: Does not perform a capability check on an AJAX action that returns a sales-campaign's configuration for an arbitrary post IDCVE-2026-78138 · WordPress plugins & themes · reported by WPScanMedium 4.3

  The Finale Lite WordPress plugin before 2.21.0 does not perform a capability check on an AJAX action that returns a sales-campaign's configuration for an arbitrary post ID, allowing any authenticated user (Subscriber and above) to read the Finale Lite WordPress plugin before 2.21.0's campaign configuration and scheduling data.

  Product

  Finale Lite

  Fixed in

  2.21.0

  What to do

  Update Finale Lite to 2.21.0 or newer.

  Full record and what to do →NVD recordwpscan.com

• Aug 27, 2026StoreGrowth: Does not validate a browser-supplied product price on two of its unauthenticated actionsCVE-2026-78137 · WordPress plugins & themes · reported by WPScanHigh 7.5

  The StoreGrowth WordPress plugin before 2.1.2 does not validate a browser-supplied product price on two of its unauthenticated actions, allowing unauthenticated attackers to add a product to the cart at an arbitrary, attacker-chosen price that carries through to the checkout total when the BOGO offer feature is enabled.

  Product

  StoreGrowth

  Fixed in

  2.1.2

  What to do

  Update StoreGrowth to 2.1.2 or newer.

  Full record and what to do →NVD recordwpscan.com

• Aug 27, 2026LearnPress: Does not perform any authorization check on one of its REST endpoints in all versions up toCVE-2026-78125 · WordPress plugins & themes · reported by WPScanMedium 5.3

  The LearnPress WordPress plugin before 4.0.3 does not perform any authorization check on one of its REST endpoints in all versions up to, and including, 4.0.2, allowing unauthenticated attackers to disclose the payment status of arbitrary orders by enumerating order identifiers.

  Product

  LearnPress

  Affected

  up to 4.0.2

  Fixed in

  4.0.3

  What to do

  Update LearnPress to 4.0.3 or newer.

  Full record and what to do →NVD recordwpscan.com

• Aug 27, 2026UpdraftPlus: WP Backup & Migration: Does not have CSRF checks in one of its backup management actionsCVE-2026-76549 · WordPress plugins & themes · reported by WPScanMedium 5.9

  The UpdraftPlus: WP Backup & Migration Plugin WordPress plugin before 1.26.7 does not have CSRF checks in one of its backup management actions, which could allow attackers to make a logged in admin restore an existing backup, reverting the site's database and files to an earlier state, via a crafted link.

  Product

  UpdraftPlus: WP Backup & Migration

  Fixed in

  1.26.7

  What to do

  Update UpdraftPlus: WP Backup & Migration to 1.26.7 or newer.

  Full record and what to do →NVD recordwpscan.com

• Aug 27, 2026JetBackup: Does not perform its multisite authorisation check before serving backup archives and job logsCVE-2026-19454 · WordPress plugins & themes · reported by WPScanMedium 4.4

  The JetBackup WordPress plugin before 3.1.23.5 does not perform its multisite authorisation check before serving backup archives and job logs, allowing an administrator of the network's main site who is not a Super Admin to download a full backup of the entire network, including every site's data and the shared webroot.

  Product

  JetBackup

  Fixed in

  3.1.23.5

  What to do

  Update JetBackup to 3.1.23.5 or newer.

  Full record and what to do →NVD recordwpscan.com

• Aug 27, 2026Mobile App for WooCommerce: ShopApper Mobile App Builder Service for WooCommerce: Does not check the user's capabilities before allowing a stock-update operation through one of its REST endpointsCVE-2026-16569 · WordPress plugins & themes · reported by WPScanMedium 4.3

  The Mobile App for WooCommerce: ShopApper Mobile App Builder Service for WooCommerce WordPress plugin through 0.4.62 does not check the user's capabilities before allowing a stock-update operation through one of its REST endpoints, allowing any authenticated user, such as a customer or subscriber, to change the stock quantity of arbitrary products.

  Product

  Mobile App for WooCommerce: ShopApper Mobile App Builder Service for WooCommerce

  Affected

  up to 0.4.62

  What to do

  Affects up to 0.4.62. Update Mobile App for WooCommerce: ShopApper Mobile App Builder Service for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordwpscan.com

• Aug 27, 2026CMP: Does not enforce an option-name allow-listCVE-2026-13415 · WordPress plugins & themes · reported by WPScanHigh 7.2

  The CMP WordPress plugin before 4.1.18 does not enforce an option-name allow-list when importing settings via one of its AJAX actions, allowing users with the Editor role (when the administrator has granted the Editor role access to the CMP WordPress plugin before 4.1.18's admin-bar controls) to update arbitrary WordPress options, including options that lead to privilege escalation to Administrator.

  Product

  CMP

  Fixed in

  4.1.18

  What to do

  Update CMP to 4.1.18 or newer.

  Full record and what to do →NVD recordwpscan.com

• Aug 27, 2026CMP: Does not perform authorization checks on one of its AJAX actions and relies on a nonce that is skipped for certain (and exposed to anonymous visitors on others)CVE-2026-13414 · WordPress plugins & themes · reported by WPScanMedium 4.8

  The CMP WordPress plugin before 4.1.18 does not perform authorization checks on one of its AJAX actions and relies on a nonce that is skipped for certain (and exposed to anonymous visitors on others), allowing unauthenticated attackers to disable the site's maintenance/coming-soon mode under a non-default countdown configuration.

  Product

  CMP

  Fixed in

  4.1.18

  What to do

  Update CMP to 4.1.18 or newer.

  Full record and what to do →NVD recordwpscan.com

• Aug 26, 2026Classified Listing - Mobile Number Verification: Authentication BypassCVE-2026-15985 · WordPress plugins & themes · reported by WordfenceHigh 8.1

  The Classified Listing - Mobile Number Verification plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.6.0. This is due to missing server-side Firebase OTP validation in the process_otp_login() function. This makes it possible for unauthenticated attackers to authenticate as any user with a phone number registered in the plugin's phone table by submitting an arbitrary OTP code and UID through the Firebase OTP login flow. Successful exploitation requires OTP login to be enabled with Firebase selected as the verification gateway, and requires the attacker to know or guess the target account's registered phone number. Administrator account takeover is possible if an administrator account has a phone number registered in the plugin.

  Product

  Classified Listing - Mobile Number Verification

  Affected

  up to 1.6.0

  What to do

  Affects up to 1.6.0. Update Classified Listing - Mobile Number Verification to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordradiustheme.comwordfence.com

• Aug 26, 2026Greenshift – animation and page builder blocks: Stored Cross-Site ScriptingCVE-2026-5092 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the customapi action handler in versions up to, and including, 12.8.9. This is due to insufficient sanitization of API responses before output via innerHTML. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the injected page.

  Product

  Greenshift – animation and page builder blocks

  Affected

  up to 12.8.9

  What to do

  Affects up to 12.8.9. Update Greenshift – animation and page builder blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Aug 26, 2026Mang Board WP: Missing AuthorizationCVE-2026-75977 · WordPress plugins & themes · reported by WordfenceHigh 8.8

  The Mang Board WP plugin for WordPress is vulnerable to Missing Authorization via Authentication Cookie Forgery in all versions up to, and including, 2.3.7. This is due to flawed HMAC generation in the mbw_get_hash_key() function that uses the current user's identity instead of the cookie username parameter when a WordPress user is logged in, combined with insufficient validation in mbw_validate_auth_cookie(). This makes it possible for authenticated attackers, with subscriber-level access and above, to forge administrator authentication cookies and change administrator passwords to achieve complete site takeover.

  Product

  Mang Board WP

  Affected

  up to 2.3.7

  What to do

  Affects up to 2.3.7. Update Mang Board WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Aug 26, 2026WooCommerce Lottery: Time-Based SQL InjectionCVE-2026-18884 · WordPress plugins & themes · reported by WordfenceHigh 7.5

  The WooCommerce Lottery plugin for WordPress is vulnerable to Time-Based SQL Injection via 'orderby' and 'order' GET Parameters in all versions up to, and including, 2.2.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

  Product

  WooCommerce Lottery

  Affected

  up to 2.2.9

  What to do

  Affects up to 2.2.9. Update WooCommerce Lottery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordcodecanyon.netplugins.trac.wordpress.org

• Aug 26, 2026RegistrationMagic: Does not sanitise and escape a parameter before using it in a SQL statementCVE-2026-77790 · WordPress plugins & themes · reported by WPScanMedium 5.5

  The RegistrationMagic WordPress plugin before 6.0.9.4 does not sanitise and escape a parameter before using it in a SQL statement, which could allow high privilege users such as admin to perform SQL injection attacks.

  Product

  RegistrationMagic

  Fixed in

  6.0.9.4

  What to do

  Update RegistrationMagic to 6.0.9.4 or newer.

  Full record and what to do →NVD recordwpscan.com

• Aug 26, 2026Stripe Payment Forms by WP Full Pay: Does not verify that a subscription belongs to the customer bound to the requesting customer-portal session before acting on itCVE-2026-77789 · WordPress plugins & themes · reported by WPScanMedium 4.3

  The Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.1 does not verify that a subscription belongs to the customer bound to the requesting customer-portal session before acting on it, allowing a user with a confirmed portal session to cancel, reactivate or modify subscriptions belonging to other customers.

  Product

  Stripe Payment Forms by WP Full Pay

  Fixed in

  8.5.1

  What to do

  Update Stripe Payment Forms by WP Full Pay to 8.5.1 or newer.

  Full record and what to do →NVD recordwpscan.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.