Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
24,208 results · page 58 of 485
Aug 18, 2026Unauthenticated PHP Object Injection in Easy Google Maps <= 1.13.0 versions.CVE-2026-73366 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in Easy Google Maps <= 1.13.0 versions.
- Affected
- up to 1.13.0
- What to do
- Affects up to 1.13.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 18, 2026Unauthenticated SQL Injection in JetAppointment <= 2.5.2 versions.CVE-2026-73365 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in JetAppointment <= 2.5.2 versions.
- Affected
- up to 2.5.2
- What to do
- Affects up to 2.5.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 18, 2026Unauthenticated Cross Site Scripting (XSS) in URL Shortify <= 2.5.0 versions.CVE-2026-73362 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in URL Shortify <= 2.5.0 versions.
- Affected
- up to 2.5.0
- What to do
- Affects up to 2.5.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 18, 2026Unauthenticated Cross Site Scripting (XSS) in Recipe Card Blocks for Gutenberg & Elementor <= 3.4.18 versions.CVE-2026-73361 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Recipe Card Blocks for Gutenberg & Elementor <= 3.4.18 versions.
- Affected
- up to 3.4.18
- What to do
- Affects up to 3.4.18. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 18, 2026Unauthenticated Cross Site Scripting (XSS) in Chaty Pro <= 3.5.8 versions.CVE-2026-73360 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Chaty Pro <= 3.5.8 versions.
- Affected
- up to 3.5.8
- What to do
- Affects up to 3.5.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 18, 2026Subscriber Cross Site Scripting (XSS) in WP Cookie Notice for GDPR, CCPA & ePrivacy Consent <= 4.3.9 versions.CVE-2026-73359 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Subscriber Cross Site Scripting (XSS) in WP Cookie Notice for GDPR, CCPA & ePrivacy Consent <= 4.3.9 versions.
- Affected
- up to 4.3.9
- What to do
- Affects up to 4.3.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 18, 2026Unauthenticated Cross Site Scripting (XSS) in Affiliates Manager <= 2.9.53 versions.CVE-2026-73358 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Affiliates Manager <= 2.9.53 versions.
- Affected
- up to 2.9.53
- What to do
- Affects up to 2.9.53. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 18, 2026Unauthenticated Arbitrary Content Deletion in Breeze <= 2.5.12 versions.CVE-2026-73356 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Unauthenticated Arbitrary Content Deletion in Breeze <= 2.5.12 versions.
- Affected
- up to 2.5.12
- What to do
- Affects up to 2.5.12. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 18, 2026Unauthenticated SQL Injection in Affiliates Manager <= 2.9.53 versions.CVE-2026-73355 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in Affiliates Manager <= 2.9.53 versions.
- Affected
- up to 2.9.53
- What to do
- Affects up to 2.9.53. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 18, 2026Unauthenticated Broken Access Control in GiveWP <= 4.16.5.1 versions.CVE-2026-73352 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Broken Access Control in GiveWP <= 4.16.5.1 versions.
- Affected
- up to 4.16.5.1
- What to do
- Affects up to 4.16.5.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 18, 2026Unauthenticated Cross Site Scripting (XSS) in WordPress Social Login and Register <= 7.8.1 versions.CVE-2026-73351 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in WordPress Social Login and Register <= 7.8.1 versions.
- Affected
- up to 7.8.1
- What to do
- Affects up to 7.8.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 18, 2026Unauthenticated Broken Authentication in SupportCandy <= 3.5.1 versions.CVE-2026-73350 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Unauthenticated Broken Authentication in SupportCandy <= 3.5.1 versions.
- Affected
- up to 3.5.1
- What to do
- Affects up to 3.5.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 18, 2026Unauthenticated Broken Access Control in GiveWP < 4.16.6 versions.CVE-2026-73348 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Broken Access Control in GiveWP < 4.16.6 versions.
- What to do
- Update the plugin to the newest version.
Aug 18, 2026Customer SQL Injection in License Manager for WooCommerce <= 3.0.18 versions.CVE-2026-73345 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Customer SQL Injection in License Manager for WooCommerce <= 3.0.18 versions.
- Affected
- up to 3.0.18
- What to do
- Affects up to 3.0.18. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 18, 2026Unauthenticated Remote Code Execution (RCE) in WP Compress < 7.20.01 versions.CVE-2026-73343 · WordPress plugins & themes · reported by PatchstackCritical 10
Unauthenticated Remote Code Execution (RCE) in WP Compress < 7.20.01 versions.
- What to do
- Update the plugin to the newest version.
Aug 18, 2026Unauthenticated Cross Site Scripting (XSS) in WP Multilang <= 2.4.31 versions.CVE-2026-73342 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in WP Multilang <= 2.4.31 versions.
- Affected
- up to 2.4.31
- What to do
- Affects up to 2.4.31. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 18, 2026Unauthenticated PHP Object Injection in RegistrationMagic <= 6.0.9.7 versions.CVE-2026-73341 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in RegistrationMagic <= 6.0.9.7 versions.
- Affected
- up to 6.0.9.7
- What to do
- Affects up to 6.0.9.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 18, 2026Unauthenticated SQL Injection in Modern Events Calendar < 7.35.0 versions.CVE-2026-73339 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in Modern Events Calendar < 7.35.0 versions.
- What to do
- Update the plugin to the newest version.
Aug 18, 2026Unauthenticated Cross Site Scripting (XSS) in Autopay <= 5.0.0 versions.CVE-2026-73338 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Autopay <= 5.0.0 versions.
- Affected
- up to 5.0.0
- What to do
- Affects up to 5.0.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 18, 2026WPDM – Premium Packages: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-73190 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in W3 Eden WPDM – Premium Packages wpdm-premium-packages allows DOM-Based XSS.This issue affects WPDM – Premium Packages: from n/a through 7.0.5.
- Product
- WPDM – Premium Packages
- Affected
- up to 7.0.5
- What to do
- Affects up to 7.0.5. Update WPDM – Premium Packages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 18, 2026Unauthenticated SQL Injection in Sticky Chat Widget <= 1.4.2 versions.CVE-2026-73187 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in Sticky Chat Widget <= 1.4.2 versions.
- Affected
- up to 1.4.2
- What to do
- Affects up to 1.4.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 18, 2026Unauthenticated Arbitrary File Download in Extra Product Options & Add-Ons for WooCommerce < 7.6 versions.CVE-2026-73181 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Arbitrary File Download in Extra Product Options & Add-Ons for WooCommerce < 7.6 versions.
- What to do
- Update the plugin to the newest version.
Aug 18, 2026Subscriber Privilege Escalation in MasterStudy LMS <= 3.7.41 versions.CVE-2026-68568 · WordPress plugins & themes · reported by PatchstackMedium 6.3
Subscriber Privilege Escalation in MasterStudy LMS <= 3.7.41 versions.
- Affected
- up to 3.7.41
- What to do
- Affects up to 3.7.41. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 18, 2026EasyTest – Simplify A/B Testing: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-68567 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Grids EasyTest – Simplify A/B Testing convertpro allows DOM-Based XSS.This issue affects EasyTest – Simplify A/B Testing: from n/a through 1.0.1.
- Product
- EasyTest – Simplify A/B Testing
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update EasyTest – Simplify A/B Testing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 18, 2026Contributor Cross Site Scripting (XSS) in GeoDirectory <= 2.8.172 versions.CVE-2026-68565 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Cross Site Scripting (XSS) in GeoDirectory <= 2.8.172 versions.
- Affected
- up to 2.8.172
- What to do
- Affects up to 2.8.172. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 18, 2026Unauthenticated Broken Access Control in Appointment Hour Booking <= 1.5.91 versions.CVE-2026-66679 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Broken Access Control in Appointment Hour Booking <= 1.5.91 versions.
- Affected
- up to 1.5.91
- What to do
- Affects up to 1.5.91. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 18, 2026Unauthenticated Cross Site Scripting (XSS) in Templately <= 3.7.1 versions.CVE-2026-66667 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Templately <= 3.7.1 versions.
- Affected
- up to 3.7.1
- What to do
- Affects up to 3.7.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 18, 2026MultiVendorX: Missing AuthorizationCVE-2026-66651 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in MultiVendorX MultiVendorX dc-woocommerce-multi-vendor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MultiVendorX: from n/a through 5.0.20.
- Product
- MultiVendorX
- Affected
- up to 5.0.20
- What to do
- Affects up to 5.0.20. Update MultiVendorX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 18, 2026Contributor Cross Site Scripting (XSS) in WP Tab Widget <= 1.2.11 versions.CVE-2026-66646 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Cross Site Scripting (XSS) in WP Tab Widget <= 1.2.11 versions.
- Affected
- up to 1.2.11
- What to do
- Affects up to 1.2.11. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 18, 2026Contributor Cross Site Scripting (XSS) in Table Of Contents Block <= 1.5.0 versions.CVE-2026-66645 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Cross Site Scripting (XSS) in Table Of Contents Block <= 1.5.0 versions.
- Affected
- up to 1.5.0
- What to do
- Affects up to 1.5.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 18, 2026Contributor Cross Site Scripting (XSS) in Typing Effect <= 1.3.7 versions.CVE-2026-66644 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Cross Site Scripting (XSS) in Typing Effect <= 1.3.7 versions.
- Affected
- up to 1.3.7
- What to do
- Affects up to 1.3.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 18, 2026Contributor Cross Site Scripting (XSS) in Wufoo Shortcode <= 1.55 versions.CVE-2026-66643 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Cross Site Scripting (XSS) in Wufoo Shortcode <= 1.55 versions.
- Affected
- up to 1.55
- What to do
- Affects up to 1.55. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 18, 2026Contributor Cross Site Scripting (XSS) in Video Conferencing with Zoom <= 4.6.8 versions.CVE-2026-66641 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Cross Site Scripting (XSS) in Video Conferencing with Zoom <= 4.6.8 versions.
- Affected
- up to 4.6.8
- What to do
- Affects up to 4.6.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 18, 2026Contributor Cross Site Scripting (XSS) in Login With Ajax <= 4.5.1 versions.CVE-2026-66640 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Cross Site Scripting (XSS) in Login With Ajax <= 4.5.1 versions.
- Affected
- up to 4.5.1
- What to do
- Affects up to 4.5.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 18, 2026Contributor Cross Site Scripting (XSS) in WPZOOM Forms – Contact Form Plugin for Gutenberg <= 2.0.4 versions.CVE-2026-66639 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Cross Site Scripting (XSS) in WPZOOM Forms – Contact Form Plugin for Gutenberg <= 2.0.4 versions.
- Affected
- up to 2.0.4
- What to do
- Affects up to 2.0.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 18, 2026Contributor Cross Site Scripting (XSS) in Frontend Admin by DynamiApps <= 3.29.10 versions.CVE-2026-66638 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Cross Site Scripting (XSS) in Frontend Admin by DynamiApps <= 3.29.10 versions.
- Affected
- up to 3.29.10
- What to do
- Affects up to 3.29.10. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 18, 2026Contributor Cross Site Scripting (XSS) in Featured Video Plus <= 2.3.3 versions.CVE-2026-66637 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Cross Site Scripting (XSS) in Featured Video Plus <= 2.3.3 versions.
- Affected
- up to 2.3.3
- What to do
- Affects up to 2.3.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 18, 2026Wise Chat: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-66636 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Marcin Wise Chat wise-chat allows Stored XSS.This issue affects Wise Chat: from n/a through 3.4.3.
- Product
- Wise Chat
- Affected
- up to 3.4.3
- What to do
- Affects up to 3.4.3. Update Wise Chat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 18, 2026Subscriber Insecure Direct Object References (IDOR) in Modal Survey <= 2.0.2.2.3 versions.CVE-2026-66634 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Subscriber Insecure Direct Object References (IDOR) in Modal Survey <= 2.0.2.2.3 versions.
- Affected
- up to 2.0.2.2.3
- What to do
- Affects up to 2.0.2.2.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 18, 2026Unauthenticated Cross Site Scripting (XSS) in Fluent Forms Pro Add On Pack < 6.2.12 versions.CVE-2026-66633 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Fluent Forms Pro Add On Pack < 6.2.12 versions.
- What to do
- Update the plugin to the newest version.
Aug 18, 2026Unauthenticated Cross Site Scripting (XSS) in Kirki <= 6.2.3 versions.CVE-2026-66629 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Kirki <= 6.2.3 versions.
- Affected
- up to 6.2.3
- What to do
- Affects up to 6.2.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 18, 2026Unauthenticated SQL Injection in Depicter Slider <= 4.8.0 versions.CVE-2026-66622 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated SQL Injection in Depicter Slider <= 4.8.0 versions.
- Affected
- up to 4.8.0
- What to do
- Affects up to 4.8.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 18, 2026Ultimate Dashboard Pro: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-66621 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ultimate Dashboard Ultimate Dashboard Pro ultimate-dashboard-pro allows DOM-Based XSS.This issue affects Ultimate Dashboard Pro: from n/a through 3.11.2.
- Product
- Ultimate Dashboard Pro
- Affected
- up to 3.11.2
- What to do
- Affects up to 3.11.2. Update Ultimate Dashboard Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 18, 2026Editor PHP Object Injection in OptionTree <= 2.7.3 versions.CVE-2026-66620 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Editor PHP Object Injection in OptionTree <= 2.7.3 versions.
- Affected
- up to 2.7.3
- What to do
- Affects up to 2.7.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 18, 2026Unauthenticated Server Side Request Forgery (SSRF) in OttoKit <= 1.1.35 versions.CVE-2026-32553 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Unauthenticated Server Side Request Forgery (SSRF) in OttoKit <= 1.1.35 versions.
- Affected
- up to 1.1.35
- What to do
- Affects up to 1.1.35. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 18, 2026Unauthenticated Broken Access Control in ThumbPress < 6.5 versions.CVE-2026-32549 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in ThumbPress < 6.5 versions.
- What to do
- Update the plugin to the newest version.
Aug 18, 2026Unauthenticated Cross Site Scripting (XSS) in BP Better Messages <= 2.15.22 versions.CVE-2026-32547 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in BP Better Messages <= 2.15.22 versions.
- Affected
- up to 2.15.22
- What to do
- Affects up to 2.15.22. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 18, 2026Unauthenticated Broken Authentication in Ezoic <= 2.22.11 versions.CVE-2026-32481 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Authentication in Ezoic <= 2.22.11 versions.
- Affected
- up to 2.22.11
- What to do
- Affects up to 2.22.11. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 18, 2026Contributor Arbitrary File Upload in Templatiq <= 0.2.5 versions.CVE-2026-32474 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Contributor Arbitrary File Upload in Templatiq <= 0.2.5 versions.
- Affected
- up to 0.2.5
- What to do
- Affects up to 0.2.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 18, 2026Unauthenticated Server Side Request Forgery (SSRF) in PDF Smart Viewer for Elementor <= 1.0.4 versions.CVE-2026-32473 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Unauthenticated Server Side Request Forgery (SSRF) in PDF Smart Viewer for Elementor <= 1.0.4 versions.
- Affected
- up to 1.0.4
- What to do
- Affects up to 1.0.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.