Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
19,394 results · page 53 of 388
Jul 8, 2026Appointment Booking Calendar Plugin and Scheduling: Does not validate data before passing it to a PHP deserialization functionCVE-2026-12378 · WordPress plugins & themes · reported by WPScanHigh 8.1
The Appointment Booking Calendar Plugin and Scheduling Plugin WordPress plugin through 1.1.28 does not validate data before passing it to a PHP deserialization function, allowing unauthenticated attackers to inject arbitrary PHP objects; where a suitable gadget chain is present on the site this can be leveraged to achieve remote code execution.
- Product
- Appointment Booking Calendar Plugin and Scheduling
- Affected
- up to 1.1.28
- What to do
- Affects up to 1.1.28. Update Appointment Booking Calendar Plugin and Scheduling to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 7, 2026sshd in OpenSSH before 10.4 does not always honor the minimum authentication delay.CVE-2026-60001 · Other software · OpenBSD · reported by MITREMedium 6.5
sshd in OpenSSH before 10.4 does not always honor the minimum authentication delay.
- Product
- OpenSSH
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 7, 2026sftp in OpenSSH before 10.4 does not properly constrain the location of downloaded files when "sftp server:/path ." is used with an attacker-controlled server.CVE-2026-59995 · Other software · OpenBSD · reported by MITREMedium 4.2
sftp in OpenSSH before 10.4 does not properly constrain the location of downloaded files when "sftp server:/path ." is used with an attacker-controlled server.
- Product
- OpenSSH
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 7, 2026The public dashboard deletion endpoint does not enforce organization isolation, allowing an Org Admin in one organization to delete public dashboards belonging CVE-2026-28378 · Other software · Grafana · reported by security@grafana.comLow 3.1
The public dashboard deletion endpoint does not enforce organization isolation, allowing an Org Admin in one organization to delete public dashboards belonging to a different organization by supplying the target dashboard's identifiers.
- Product
- Grafana Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 7, 2026Frontend File Manager: Does not validate a file path derived from user input before deleting the referenced fileCVE-2026-12277 · WordPress plugins & themes · reported by WPScanHigh 8.7
The Frontend File Manager Plugin WordPress plugin through 23.6 does not validate a file path derived from user input before deleting the referenced file, allowing unauthenticated users to delete arbitrary files on the server (such as wp-config.php) when guest upload mode is enabled. Deleting wp-config.php forces the site into its setup routine, which can be leveraged toward a full site takeover.
- Product
- Frontend File Manager
- Affected
- up to 23.6
- What to do
- Affects up to 23.6. Update Frontend File Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 7, 2026WP Travel Engine: Does not properly validate the source of a user-supplied profile image path before moving the fileCVE-2026-10834 · WordPress plugins & themes · reported by WPScanMedium 4.6
The WP Travel Engine WordPress plugin before 6.8.1 does not properly validate the source of a user-supplied profile image path before moving the file, allowing authenticated users with subscriber-level access and above to relocate arbitrary files within the WordPress uploads directory into their own profile-image path. This removes the targeted media from its original location and can break content across the site.
- Product
- WP Travel Engine
- Fixed in
- 6.8.1
- What to do
- Update WP Travel Engine to 6.8.1 or newer.
Jul 6, 2026Admin and Site Enhancements (ASE) WordPress plugin before 8.8.4, admin-site-enhancements-pro: Does not perform authenticationCVE-2026-12083 · WordPress plugins & themes · reported by WPScanHigh 8.1
The Admin and Site Enhancements (ASE) WordPress plugin before 8.8.4, admin-site-enhancements-pro WordPress plugin before 8.8.4 does not perform authentication, authorization, or nonce checks on a role-restoration request handler, allowing unauthenticated attackers to restore a previously demoted administrator account back to the administrator role. This is an incomplete fix of CVE-2024-43333 / CVE-2025-24648, which closed the issue for only one of the demotion paths the WordPress role API exposes.
- Product
- Admin and Site Enhancements (ASE) WordPress plugin before 8.8.4, admin-site-enhancements-pro
- Fixed in
- 8.8.4
- What to do
- Update Admin and Site Enhancements (ASE) WordPress plugin before 8.8.4, admin-site-enhancements-pro to 8.8.4 or newer.
Jul 6, 2026FileOrganizer: Does not validate the file type on several of its file-management operationsCVE-2026-11962 · WordPress plugins & themes · reported by WPScanHigh 8.8
The FileOrganizer WordPress plugin before 1.2.0 does not validate the file type on several of its file-management operations, allowing authenticated users who have been granted file-manager access — which its premium add-on can extend to sub-administrator roles — to upload arbitrary PHP files and achieve remote code execution. This is an incomplete fix of CVE-2024-7985, which only added file-type validation to the upload operation.
- Product
- FileOrganizer
- Fixed in
- 1.2.0
- What to do
- Update FileOrganizer to 1.2.0 or newer.
Jul 6, 2026Simple Membership: Does not verify the authenticity of Stripe webhook requestsCVE-2026-11855 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Simple Membership WordPress plugin before 4.7.5 does not verify the authenticity of Stripe webhook requests when no signing secret is configured, nor escape a value taken from them before outputting it in an administrator notice, allowing unauthenticated attackers to inject arbitrary web scripts that execute in the context of a logged-in administrator.
- Product
- Simple Membership
- Fixed in
- 4.7.5
- What to do
- Update Simple Membership to 4.7.5 or newer.
Jul 6, 2026Ultimate Member: Does not properly sanitise and escape the value of custom textarea profile fields before outputting it on user profilesCVE-2026-11766 · WordPress plugins & themes · reported by WPScanHigh 8
The Ultimate Member WordPress plugin before 2.12.0 does not properly sanitise and escape the value of custom textarea profile fields before outputting it on user profiles, allowing authenticated users with Subscriber-level access and above to store JavaScript that executes when any user, including an administrator, views the affected profile.
- Product
- Ultimate Member
- Fixed in
- 2.12.0
- What to do
- Update Ultimate Member to 2.12.0 or newer.
Jul 6, 2026AllCoach: Does not verify that an email address submitted to a public account-registration endpoint is not already associated with an existing user before overwriting that user's passwordCVE-2026-10830 · WordPress plugins & themes · reported by WPScanHigh 8.8
The AllCoach WordPress plugin before 1.0.2 does not verify that an email address submitted to a public account-registration endpoint is not already associated with an existing user before overwriting that user's password, allowing unauthenticated attackers to reset the password of arbitrary accounts, including administrators, and take over the site.
- Product
- AllCoach
- Fixed in
- 1.0.2
- What to do
- Update AllCoach to 1.0.2 or newer.
Jul 6, 2026Notifications for Forms & WordPress Actions: Does not validate a user-supplied value before using it to build a server-side file inclusion pathCVE-2024-6228 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Notifications for Forms & WordPress Actions WordPress plugin before 2.6 does not validate a user-supplied value before using it to build a server-side file inclusion path, allowing authenticated users with subscriber-level access and above to include and execute arbitrary local PHP files on the server.
- Product
- Notifications for Forms & WordPress Actions
- Fixed in
- 2.6
- What to do
- Update Notifications for Forms & WordPress Actions to 2.6 or newer.
Jul 3, 2026Puppet resource_api (shipped in Puppet Core 8.x and Puppet Enterprise 2023.8.x and 2025.x) does not preserve the sensitive flag on parameters defined via the reCVE-2026-8804 · Other software · Perforce · reported by security@puppet.comMedium 6.7
Puppet resource_api (shipped in Puppet Core 8.x and Puppet Enterprise 2023.8.x and 2025.x) does not preserve the sensitive flag on parameters defined via the resource-api, causing values such as passwords to be stored in cleartext in the agent's local transaction state cache. Affected versions of the resource_api module include all versions between 1.5.0 - 1.9.1 and 2.0.0 The issue was fixed in puppet resource_api 1.9.2 and 2.0.1 released with Puppet Core 8.20.0 and PE 2023.8.10 & PE 2025.11.0.
- Product
- Puppet Core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 2, 2026Weaviate before 1.38.0 does not verify that a principal performing an RBAC role assignment holds the permissions granted by the assigned role.CVE-2026-59093 · Other software · weaviate · reported by VulnCheckHigh 8.7
Weaviate before 1.38.0 does not verify that a principal performing an RBAC role assignment holds the permissions granted by the assigned role. The assignRoleToUser and assignRoleToGroup handlers (POST /authz/users/{id}/assign and /authz/groups/{id}/assign) authorize only that the caller may assign roles to the target user or group, not the permissions contained in the assigned roles, unlike role creation which enforces that a user can only create roles with permissions less than or equal to its own. A user holding only the delegated assign_and_revoke_users or assign_and_revoke_groups permission can assign the built-in admin role, or any high-privilege custom role, to itself or others, escalating to full administrative control of the database.
- Product
- weaviate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 2, 2026The Erlang/OTP ssl application does not validate that the PSK identity list and binder list carried in a TLS 1.3 ClientHello pre-shared key extension have equalCVE-2026-55952 · Other software · Erlang · reported by 6b3ad84c-e1a6-4bf7-a703-f496b71e49dbHigh 8.2
The Erlang/OTP ssl application does not validate that the PSK identity list and binder list carried in a TLS 1.3 ClientHello pre-shared key extension have equal length before passing them to the session ticket handler. In tls_handshake_1_3:handle_pre_shared_key/3, an OfferedPreSharedKeys record with a mismatched number of identities and binders is forwarded directly to tls_server_session_ticket:use/4, which crashes the session ticket handler process. An unauthenticated remote attacker can send a single crafted ClientHello to a TLS 1.3 server with session tickets enabled (stateful or stateless mode) and permanently disrupt session ticket handling on that listener. New TLS 1.3 handshakes complete but subsequently crash when the server attempts to issue a session ticket, effectively making TLS 1.3 unusable on the affected listener until the ssl application is restarted. TLS 1.2 connections are not affected. This issue affects OTP from OTP 22.2 before OTP 29.0.3, OTP 28.5.0.3 and OTP 27.3.4.14, corresponding to ssl from 9.5 before 11.7.3, 11.6.0.3 and 11.2.12.10.
- Product
- OTP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcna.erlef.orggithub.com
Jul 2, 2026User Registration & Membership: Does not enforce payment completion before activating a paid membership subscriptionCVE-2026-11965 · WordPress plugins & themes · reported by WPScanMedium 6.5
The User Registration & Membership WordPress plugin before 5.2.0 does not enforce payment completion before activating a paid membership subscription, allowing unauthenticated users (after self-registering an account through the open registration flow) to obtain an active subscription on any paid plan without paying and access the gated content.
- Product
- User Registration & Membership
- Fixed in
- 5.2.0
- What to do
- Update User Registration & Membership to 5.2.0 or newer.
Jul 2, 2026Adminify: Does not perform per-user read-capability checks on the results returned by one of its administration search featuresCVE-2026-11781 · WordPress plugins & themes · reported by WPScanLow 2.7
The Adminify WordPress plugin before 4.2.10 does not perform per-user read-capability checks on the results returned by one of its administration search features, allowing users with a low-privilege role (Contributor) to disclose non-public content that WordPress would not otherwise expose to them, such as other authors' unpublished post titles, pending comment content, the site's Adminify WordPress plugin before 4.2.10 inventory, and user account names.
- Product
- Adminify
- Fixed in
- 4.2.10
- What to do
- Update Adminify to 4.2.10 or newer.
Jul 2, 2026Fluent Forms: Does not properly restrict the deletion of form submission entries to the forms a restricted Manager is authorized to manageCVE-2026-11578 · WordPress plugins & themes · reported by WPScanLow 2.7
The Fluent Forms WordPress plugin before 6.2.5 does not properly restrict the deletion of form submission entries to the forms a restricted Manager is authorized to manage, allowing a Manager limited to specific forms to permanently delete submission entries belonging to other forms. This requires a non-default configuration in which an administrator has created at least one Manager restricted to specific forms.
- Product
- Fluent Forms
- Fixed in
- 6.2.5
- What to do
- Update Fluent Forms to 6.2.5 or newer.
Jul 2, 2026yootheme: Does not prevent its bundled front-end framework from treating certain HTML attributesCVE-2026-10077 · WordPress plugins & themes · reported by WPScanMedium 6.8
The yootheme WordPress theme before 5.0.35 does not prevent its bundled front-end framework from treating certain HTML attributes, which are permitted by wp_kses_post(), as markup, allowing users with the Author role to perform Stored Cross-Site Scripting attacks that execute in the browser of any user who views the affected post.
- Product
- yootheme
- Fixed in
- 5.0.35
- What to do
- Update yootheme to 5.0.35 or newer.
Jul 1, 2026NodeBB does not bind the claimed author of an inbound ActivityPub object to the authenticated remote actor.CVE-2026-58593 · Other software · NodeBB · reported by VulnCheckHigh 8.7
NodeBB does not bind the claimed author of an inbound ActivityPub object to the authenticated remote actor. The inbound middleware verifies the HTTP-signature actor and checks the origin of object.id, but never validates that attributedTo corresponds to the sender. In the object mock, attributedTo is used directly as a uid, and actors.assert silently ignores numeric identifiers (filtering them out without re-deriving the uid), so a federated remote actor can set attributedTo to a bare numeric value such as 1 and have the resulting post or private message created with that local uid as author, including the administrator account. This lets a remote attacker forge posts and direct messages attributed to arbitrary local users. Requires the ActivityPub/federation feature to be enabled.
- Product
- NodeBB
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 1, 2026RAOP module accepts unbounded Content-Length values and does not check the pw_array_add() return.CVE-2026-14324 · Other software · Red Hat · reported by Red HatMedium 6.5
RAOP module accepts unbounded Content-Length values and does not check the pw_array_add() return.
- Product
- Red Hat Enterprise Linux 10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Jul 1, 2026MCO does not correctly validate types of uploaded files.CVE-2026-53909 · Other software · MyComplianceOffice · reported by cvd@cert.plMedium 5.3
MCO does not correctly validate types of uploaded files. File upload validation functionality relies only on client-side checks, which can be bypassed. An authorized, low-privileged attacker can upload files with arbitrary types to the server. Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in version 25.3.3.1 but may also affect other versions.
- Product
- MCO
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert.plmco.mycomplianceoffice.com
Jul 1, 2026MCO does not properly enforce authorization checks in the /customer/servlet/mco/webapi/admin-view-hierarchy/get-acl-tree-structure endpoint.CVE-2026-53905 · Other software · MyComplianceOffice · reported by cvd@cert.plMedium 5.3
MCO does not properly enforce authorization checks in the /customer/servlet/mco/webapi/admin-view-hierarchy/get-acl-tree-structure endpoint. An authenticated, low-privileged user can retrieve administrator access control structures without proper authorization checks. This may expose sensitive permission mappings and internal configuration details. Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in version 25.3.3.1 but may also affect other versions.
- Product
- MCO
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert.plmco.mycomplianceoffice.com
Jul 1, 2026MCO does not properly enforce authorization checks in the /customer/servlet/mco/webapi/profile-sections/group-membership endpoint.CVE-2026-53902 · Other software · MyComplianceOffice · reported by cvd@cert.plHigh 7.1
MCO does not properly enforce authorization checks in the /customer/servlet/mco/webapi/profile-sections/group-membership endpoint. An authenticated user can modify their group membership without proper authorization checks, allowing privilege escalation. An attacker can add themselves to arbitrary groups by supplying a valid group ID, which can be obtained via other application functionalities (e.g. /customer/servlet/mco/webapi/group/picker/groups), provided he has necessary permissions, or potentially inferred through brute-force techniques. Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in version 25.3.3.1 but may also affect other versions.
- Product
- MCO
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert.plmco.mycomplianceoffice.com
Jul 1, 2026A Control-M/Server communication command does not sufficiently filter or sanitize user-supplied input.CVE-2026-10539 · Other software · BMC · reported by cert@airbus.comCritical 9.5
A Control-M/Server communication command does not sufficiently filter or sanitize user-supplied input. Under certain conditions, this issue may allow an unauthenticated attacker to execute unauthorized commands on the affected server, potentially leading to compromise of the server. This vulnerability affects Control-M/Server versions 9.0.20.x to 9.0.21.200 (included) and potentially earlier unsupported versions.
- Product
- Control-M/Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 1, 2026Salon Booking System: Does not have proper authorisation checks on one of its AJAX actionsCVE-2026-11887 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Salon Booking System WordPress plugin before 10.30.20 does not have proper authorisation checks on one of its AJAX actions, allowing any authenticated user, such as a subscriber, to modify a Salon Booking System WordPress plugin before 10.30.20 setting and bypass the manual approval of new bookings.
- Product
- Salon Booking System
- Fixed in
- 10.30.20
- What to do
- Update Salon Booking System to 10.30.20 or newer.
Jul 1, 2026WebAuthn Provider for Two Factor: Does not correctly validate the second-factor authentication responseCVE-2026-11883 · WordPress plugins & themes · reported by WPScanHigh 7.2
The WebAuthn Provider for Two Factor WordPress plugin before 2.5.6 does not correctly validate the second-factor authentication response, allowing an attacker who already knows a user's password to bypass the two-factor authentication requirement by submitting a malformed request.
- Product
- WebAuthn Provider for Two Factor
- Fixed in
- 2.5.6
- What to do
- Update WebAuthn Provider for Two Factor to 2.5.6 or newer.
Jul 1, 2026Fluent Forms: Does not properly verify ownership before processing a subscription cancellation requestCVE-2026-11880 · WordPress plugins & themes · reported by WPScanLow 3.1
The Fluent Forms WordPress plugin before 6.2.1 does not properly verify ownership before processing a subscription cancellation request, allowing authenticated users with a low-privilege account to cancel subscriptions belonging to other users.
- Product
- Fluent Forms
- Fixed in
- 6.2.1
- What to do
- Update Fluent Forms to 6.2.1 or newer.
Jul 1, 2026Advanced Form Integration — Connect Forms to 200+ Apps: Does not restrict the WordPress role assignedCVE-2026-11794 · WordPress plugins & themes · reported by WPScanHigh 8.1
The Advanced Form Integration — Connect Forms to 200+ Apps WordPress plugin before 2.1.1 does not restrict the WordPress role assigned when it creates a user from a public form submission, allowing unauthenticated visitors to create an administrator account when an active integration maps the user role to a public form field. This requires a specific, non-default multi-Advanced Form Integration — Connect Forms to 200+ Apps WordPress plugin before 2.1.1 configuration.
- Product
- Advanced Form Integration — Connect Forms to 200+ Apps
- Fixed in
- 2.1.1
- What to do
- Update Advanced Form Integration — Connect Forms to 200+ Apps to 2.1.1 or newer.
Jul 1, 2026User Submitted Posts: Does not escape a submitted value before outputting it in an admin-configured display templateCVE-2026-11570 · WordPress plugins & themes · reported by WPScanMedium 4.2
The User Submitted Posts WordPress plugin before 20260608 does not escape a submitted value before outputting it in an admin-configured display template, leading to a Stored Cross-Site Scripting that can be triggered by unauthenticated users when a non-default display option is enabled.
- Product
- User Submitted Posts
- Fixed in
- 20260608
- What to do
- Update User Submitted Posts to 20260608 or newer.
Jul 1, 2026Product Configurator for WooCommerce: Does not perform any authorisation or post-status check before returning WooCommerce product data through a public AJAX actionCVE-2026-11568 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Product Configurator for WooCommerce WordPress plugin before 1.7.3 does not perform any authorisation or post-status check before returning WooCommerce product data through a public AJAX action, allowing unauthenticated users to retrieve the data (title, price, weight, stock status, and configurator option pricing/SKUs) of private and draft, non-public products by supplying the product ID. WordPress post-visibility controls are bypassed.
- Product
- Product Configurator for WooCommerce
- Fixed in
- 1.7.3
- What to do
- Update Product Configurator for WooCommerce to 1.7.3 or newer.
Jul 1, 2026WS Form LITE: Does not have a capability check on one of its settings-update actionsCVE-2026-11562 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WS Form LITE WordPress plugin before 1.11.8 does not have a capability check on one of its settings-update actions, allowing authenticated users with subscriber-level access and above to modify the WS Form LITE WordPress plugin before 1.11.8's settings.
- Product
- WS Form LITE
- Fixed in
- 1.11.8
- What to do
- Update WS Form LITE to 1.11.8 or newer.
Jul 1, 2026Royal MCP: Does not perform capability checks on the majority of its MCP tools after token authenticationCVE-2026-10750 · WordPress plugins & themes · reported by WPScanHigh 8.1
The Royal MCP WordPress plugin before 1.4.26 does not perform capability checks on the majority of its MCP tools after token authentication, allowing authenticated users with a low-privileged role such as Subscriber to read private content, enumerate all users and their roles, and create, modify, or delete content owned by other users.
- Product
- Royal MCP
- Fixed in
- 1.4.26
- What to do
- Update Royal MCP to 1.4.26 or newer.
Jun 30, 2026IBM DevOps Automation 1.0.1 and IBM DevOps Loop 1.0.2 does not invalidate session IDs after expiration which could allow an authenticated user to impersonate anCVE-2025-36359 · Other software · IBM · reported by psirt@us.ibm.comHigh 8.1
IBM DevOps Automation 1.0.1 and IBM DevOps Loop 1.0.2 does not invalidate session IDs after expiration which could allow an authenticated user to impersonate another user on the system.
- Product
- DevOps Automation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 30, 2026KTM System e-BOK does not implement any limit or timeout on consecutive login attempts, allowing an attacker to perform unlimited authentication requests.CVE-2026-35098 · Other software · KTM System · reported by cvd@cert.plMedium 6.9
KTM System e-BOK does not implement any limit or timeout on consecutive login attempts, allowing an attacker to perform unlimited authentication requests. This lack of rate‑limiting enables efficient brute‑force attacks against user accounts. When combined with vulnerability CVE-2026-35097, where passwords are restricted to a six‑digit numeric format, this becomes a critical issue, as such passwords can be brute‑forced in a relatively short time. This issue was fixed in the patch published in June 2026.
- Product
- e-BOK
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 30, 2026KTM System e-BOK enforces a maximum password length of six numeric digits and does not permit the use of any alphabetic, special, or extended characters.CVE-2026-35097 · Other software · KTM System · reported by cvd@cert.plMedium 6.9
KTM System e-BOK enforces a maximum password length of six numeric digits and does not permit the use of any alphabetic, special, or extended characters. This issue was fixed in the patch published in June 2026.
- Product
- e-BOK
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 30, 2026Fluent Booking: Does not verify ownership of the requested group_id before exporting attendee data via the export endpointCVE-2026-9576 · WordPress plugins & themes · reported by WPScanMedium 4.9
The Fluent Booking WordPress plugin before 2.1.2 does not verify ownership of the requested group_id before exporting attendee data via the export endpoint, allowing users with at least the Calendar Manager role to retrieve attendees' PII (name, email, phone, address, payment information) from calendar groups they do not own.
- Product
- Fluent Booking
- Fixed in
- 2.1.2
- What to do
- Update Fluent Booking to 2.1.2 or newer.
Jun 30, 2026WP Support Plus Responsive Ticket System: Does not sanitize user-supplied array keys before using them in a SQL statementCVE-2026-11590 · WordPress plugins & themes · reported by WPScanHigh 8.6
The WP Support Plus Responsive Ticket System WordPress plugin through 9.1.2 does not sanitize user-supplied array keys before using them in a SQL statement, allowing unauthenticated users to perform SQL injection attacks.
- Product
- WP Support Plus Responsive Ticket System
- Affected
- up to 9.1.2
- What to do
- Affects up to 9.1.2. Update WP Support Plus Responsive Ticket System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 30, 2026WP Support Plus Responsive Ticket System: Does not properly validate uploaded filesCVE-2026-11589 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WP Support Plus Responsive Ticket System WordPress plugin through 9.1.2 does not properly validate uploaded files, allowing unauthenticated users to upload files containing malicious JavaScript (such as HTML or SVG) to a publicly accessible location, leading to Stored Cross-Site Scripting attacks against site users and administrators.
- Product
- WP Support Plus Responsive Ticket System
- Affected
- up to 9.1.2
- What to do
- Affects up to 9.1.2. Update WP Support Plus Responsive Ticket System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 30, 2026Kali Forms — Contact Form & Drag-and-Drop Builder: Does not sanitise a form field's caption before outputting itCVE-2026-11581 · WordPress plugins & themes · reported by WPScanMedium 5.9
The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.13 does not sanitise a form field's caption before outputting it as a column header on the administrator form-entries screen, allowing users with Contributor-level access or above to store JavaScript that executes in an administrator's session. A missing capability check in the Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.13's post-duplication action additionally lets the Contributor publish the malicious form so an administrator renders it.
- Product
- Kali Forms — Contact Form & Drag-and-Drop Builder
- Fixed in
- 2.4.13
- What to do
- Update Kali Forms — Contact Form & Drag-and-Drop Builder to 2.4.13 or newer.
Jun 29, 2026Because O+ Connect's IPC service does not authenticate clients, external applications can escalate privileges and perform sensitive actions through the IPC chanCVE-2026-22078 · Other software · OPPO · reported by security@oppo.comHigh 7.3
Because O+ Connect's IPC service does not authenticate clients, external applications can escalate privileges and perform sensitive actions through the IPC channel.
- Product
- O+ Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 29, 2026F4 Post Tree: Does not perform capability checks or CSRF/nonce verification on one of its AJAX actionsCVE-2026-9676 · WordPress plugins & themes · reported by WPScanMedium 4.3
The F4 Post Tree WordPress plugin before 2.0.5 does not perform capability checks or CSRF/nonce verification on one of its AJAX actions, allowing authenticated users with Subscriber-level access and above to modify the parent and menu order of arbitrary posts.
- Product
- F4 Post Tree
- Fixed in
- 2.0.5
- What to do
- Update F4 Post Tree to 2.0.5 or newer.
Jun 29, 2026APCu Manager: Does not escape APCu object-cache keys before rendering them in an admin-area pageCVE-2026-10083 · WordPress plugins & themes · reported by WPScanHigh 7.5
The APCu Manager WordPress plugin before 4.5.0 does not escape APCu object-cache keys before rendering them in an admin-area page, leading to a Stored Cross-Site Scripting vulnerability. When a persistent object cache is enabled, cache keys derived from unsanitised user input (e.g. a transient name created by another APCu Manager WordPress plugin before 4.5.0 from an unauthenticated request) are output without escaping and execute arbitrary JavaScript in the session of an administrator viewing the page.
- Product
- APCu Manager
- Fixed in
- 4.5.0
- What to do
- Update APCu Manager to 4.5.0 or newer.
Jun 27, 2026Nmap through 7.99 does not keep the IPv6 extension-header walk within the captured packet in ipv6_get_data_primitive (libnetutil/netutil.cc), so the pointer advCVE-2026-58058 · Other software · Nmap · reported by VulnCheckMedium 6.9
Nmap through 7.99 does not keep the IPv6 extension-header walk within the captured packet in ipv6_get_data_primitive (libnetutil/netutil.cc), so the pointer advances past the buffer and the remaining-length computation underflows to a large value. A scanned target or on-path attacker returning a crafted IPv6 response with a truncated extension header can trigger out-of-bounds reads and a crash during raw IPv6 scans.
- Product
- Nmap
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 27, 2026RustDesk gates incoming control messages on per-capability flags rather than on the session's authorized connection type, and a file-transfer session does not cCVE-2026-58056 · Other software · RustDesk · reported by VulnCheckHigh 7.2
RustDesk gates incoming control messages on per-capability flags rather than on the session's authorized connection type, and a file-transfer session does not clear those flags. A peer holding only a valid FileTransfer authorization can inject keyboard and mouse input and reach the unguarded screenshot and display-capture handlers, acting outside its granted scope.
- Product
- RustDesk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Jun 27, 2026libssh2 through 1.11.1 grows its publickey list with SSH2_REALLOC but does not zero-initialize new entries before parsing populates them, so a parse failure reaCVE-2026-58051 · Other software · libssh2 · reported by VulnCheckHigh 8.3
libssh2 through 1.11.1 grows its publickey list with SSH2_REALLOC but does not zero-initialize new entries before parsing populates them, so a parse failure reaching the cleanup path leaves libssh2_publickey_list_free operating on an uninitialized entry. A malicious SSH server offering the publickey subsystem can use a malformed response to make cleanup free an uninitialized, attacker-influenceable attrs pointer in a connecting libssh2 client.
- Product
- libssh2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 27, 2026Shariff for WordPress Shariff for: Does not sanitize or escape the shariff_infourl setting before outputting it in the frontend HTML via the generateshariff() functionCVE-2026-9677 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Shariff for WordPress Shariff for WordPress plugin through 1.0.11 does not sanitize or escape the shariff_infourl setting before outputting it in the frontend HTML via the generateshariff() function, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Shariff for WordPress Shariff for
- Affected
- up to 1.0.11
- What to do
- Affects up to 1.0.11. Update Shariff for WordPress Shariff for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 27, 2026Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content: Does not verify that the user performing a subscription action owns the targeted subscriptionCVE-2026-10820 · WordPress plugins & themes · reported by WPScanHigh 8.1
The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content WordPress plugin before 4.16.17 does not verify that the user performing a subscription action owns the targeted subscription, allowing any authenticated user (Subscriber+) to cancel other users' active subscriptions via an Insecure Direct Object Reference.
- Product
- Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content
- Fixed in
- 4.16.17
- What to do
- Update Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content to 4.16.17 or newer.
Jun 26, 2026extract-zip does not validate symlink targets when extracting zip archives.CVE-2026-56876 · Other software · max-mapper · reported by 9119a7d8-5eab-497f-8521-727c672e3725High 8.6
extract-zip does not validate symlink targets when extracting zip archives. When processing a malicious zip file containing a symlink with a relative path like '../../../../etc/passwd', extract-zip will extract the symlink without validation, allowing it to point outside the extraction directory. Depending on how extract-zip is used, an attacker could read or write to arbitrary files.
- Product
- extract-zip
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comraw.githubusercontent.com
Jun 26, 2026The WSO2 API Manager's message flow component, when processing WS-Addressing headers, does not sufficiently validate or restrict user-controlled input within thCVE-2026-2053 · Other software · WSO2 · reported by ed10eef1-636d-4fbe-9993-6890dfa878f8High 8.3
The WSO2 API Manager's message flow component, when processing WS-Addressing headers, does not sufficiently validate or restrict user-controlled input within these headers. This omission allows an attacker to manipulate WS-Addressing headers to specify arbitrary destinations for server-initiated requests. Successful exploitation allows an unauthenticated attacker to control the destination of server-initiated requests originating from the WSO2 API Manager. This direct control can enable unauthorized access to internal network resources or services that would typically be inaccessible from external networks.
- Product
- WSO2 API Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.docs.wso2.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.