Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,207 results · page 6 of 25
Aug 1, 2026Spectra Legacy: Does not validate or escape several block style attributes before using them to build the CSS it outputs on the front endCVE-2026-10827 · WordPress plugins & themes · reported by WPScanLow 3.5
The Spectra Legacy WordPress plugin before 2.20.0 does not validate or escape several block style attributes before using them to build the CSS it outputs on the front end, allowing users with the Contributor role and above to inject arbitrary CSS into the pages that render the affected block. The injected styles are served to anonymous visitors of those pages and can force external resource loads, deface/redress the page, or exfiltrate data via CSS attribute selectors. JavaScript execution is not possible at this role (the script-tag breakout is removed by KSES), so the impact is limited to CSS injection.
- Product
- Spectra Legacy
- Fixed in
- 2.20.0
- What to do
- Update Spectra Legacy to 2.20.0 or newer.
Jul 31, 2026miniOrange 2FA: Does not validate the submitted one-time password against the targeted user's stored secretCVE-2026-12695 · WordPress plugins & themes · reported by WPScanHigh 8.1
The miniOrange 2FA WordPress plugin before 6.2.6 does not validate the submitted one-time password against the targeted user's stored secret, instead verifying it against an attacker-supplied value, allowing an unauthenticated attacker who knows a victim's password to bypass two-factor authentication and gain access to the victim's account, including administrators.
- Product
- miniOrange 2FA
- Fixed in
- 6.2.6
- What to do
- Update miniOrange 2FA to 6.2.6 or newer.
Jul 30, 2026RegistrationMagic: Does not properly validate that a one-time password presented in a cookie belongs to the identity being requested before returning front-end form submissionsCVE-2026-15255 · WordPress plugins & themes · reported by WPScanMedium 5.3
The RegistrationMagic WordPress plugin before 6.0.9.4 does not properly validate that a one-time password presented in a cookie belongs to the identity being requested before returning front-end form submissions, allowing unauthenticated attackers to read other users' form submission data, including personal information.
- Product
- RegistrationMagic
- Fixed in
- 6.0.9.4
- What to do
- Update RegistrationMagic to 6.0.9.4 or newer.
Jul 30, 2026Sync Post With Other Site: Does not correctly enforce the page-editing capability on a REST route that creates and updates postsCVE-2026-14923 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Sync Post With Other Site WordPress plugin before 1.9.3 does not correctly enforce the page-editing capability on a REST route that creates and updates posts, because of an operator-precedence flaw in its authorization check. An authenticated user holding only the post-editing capability (such as a Contributor) can create, publish, and overwrite arbitrary Pages, including modifying content authored by higher-privileged users.
- Product
- Sync Post With Other Site
- Fixed in
- 1.9.3
- What to do
- Update Sync Post With Other Site to 1.9.3 or newer.
Jul 30, 2026Essential Addons for Elementor: Does not validate the HTML tag name of the Pricing Table widget title before outputting itCVE-2026-13344 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Essential Addons for Elementor WordPress plugin before 6.6.10 does not validate the HTML tag name of the Pricing Table widget title before outputting it, allowing users with Contributor-level access and above to inject JavaScript that will be executed (Stored Cross-Site Scripting) when the page is viewed, including in the session of an administrator previewing or visiting the post.
- Product
- Essential Addons for Elementor
- Fixed in
- 6.6.10
- What to do
- Update Essential Addons for Elementor to 6.6.10 or newer.
Jul 30, 2026WP Travel Engine: Does not perform a capability check on an AJAX action that updates a WP Travel Engine WordPress plugin before 6CVE-2026-12500 · WordPress plugins & themes · reported by WPScanHigh 7.5
The WP Travel Engine WordPress plugin before 6.8.2 does not perform a capability check on an AJAX action that updates a WP Travel Engine WordPress plugin before 6.8.2 option, allowing unauthenticated users to overwrite a site-wide WP Travel Engine WordPress plugin before 6.8.2 option (the public nonce that gates the action is served to anonymous visitors).
- Product
- WP Travel Engine
- Fixed in
- 6.8.2
- What to do
- Update WP Travel Engine to 6.8.2 or newer.
Jul 30, 2026Points and Rewards for WooCommerce: Does not have authorisation checks in place on a wallet and points update action that is available to unauthenticated usersCVE-2026-11782 · WordPress plugins & themes · reported by WPScanMedium 5.9
The Points and Rewards for WooCommerce WordPress plugin before 2.10.1 does not have authorisation checks in place on a wallet and points update action that is available to unauthenticated users, and does not verify that the requester owns the account being changed, allowing unauthenticated attackers to arbitrarily modify or corrupt (including driving it negative) the stored wallet balance and loyalty points of any user. Modifying the wallet balance additionally requires the companion Wallet System for WooCommerce Points and Rewards for WooCommerce WordPress plugin before 2.10.1 to be active.
- Product
- Points and Rewards for WooCommerce
- Fixed in
- 2.10.1
- What to do
- Update Points and Rewards for WooCommerce to 2.10.1 or newer.
Jul 29, 2026Easy Appointments: Does not verify that the appointment targeted by its customer-data update action belongs to the current user; the action only checks a shared nonce that any authenticated user can obtain from their ownCVE-2026-14224 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Easy Appointments WordPress plugin before 3.12.28 does not verify that the appointment targeted by its customer-data update action belongs to the current user; the action only checks a shared nonce that any authenticated user can obtain from their own appointment's edit form. A subscriber-level user with an appointment of their own can therefore reuse that nonce to overwrite the customer metadata (email, name, phone, description) of another user's appointment. Because the Easy Appointments WordPress plugin before 3.12.28 then treats that metadata as the appointment's contact data, a subsequent administrator status change with customer notifications enabled delivers the victim's appointment notification to the attacker-controlled email address.
- Product
- Easy Appointments
- Fixed in
- 3.12.28
- What to do
- Update Easy Appointments to 3.12.28 or newer.
Jul 29, 2026UsersWP: Does not validate the selected authentication provider in its two-factor login handlerCVE-2026-13690 · WordPress plugins & themes · reported by WPScanHigh 7.4
The UsersWP WordPress plugin before 1.2.67 does not validate the selected authentication provider in its two-factor login handler, allowing an attacker who already knows a user's credentials to bypass the second authentication factor and log in as that user.
- Product
- UsersWP
- Fixed in
- 1.2.67
- What to do
- Update UsersWP to 1.2.67 or newer.
Jul 29, 2026wp-media-folder-addon: Does not validate a user-supplied parameter before using it in a file read operation in two AJAX actions available to unauthenticated usersCVE-2026-11974 · WordPress plugins & themes · reported by WPScanHigh 8.6
The wp-media-folder-addon WordPress plugin before 4.1.7 does not validate a user-supplied parameter before using it in a file read operation in two AJAX actions available to unauthenticated users, leading to Arbitrary File Disclosure and Server-Side Request Forgery on sites where a cloud storage connection has been configured. This is an incomplete fix of CVE-2026-9690, whose patch hardened only one of the affected cloud-storage handlers and left the others unpatched.
- Product
- wp-media-folder-addon
- Fixed in
- 4.1.7
- What to do
- Update wp-media-folder-addon to 4.1.7 or newer.
Jul 28, 2026TrueBooker: Does not validate account ownershipCVE-2026-14545 · WordPress plugins & themes · reported by WPScanCritical 9.8
The TrueBooker WordPress plugin before 1.2.4 does not validate account ownership when resetting a user's password through one of its front-end account handlers, allowing unauthenticated attackers to set an arbitrary password on any account, including an administrator, and take over the site.
- Product
- TrueBooker
- Fixed in
- 1.2.4
- What to do
- Update TrueBooker to 1.2.4 or newer.
Jul 27, 2026Contact Form 7: Does not validate the host of a user-supplied return URL before using itCVE-2026-14236 · WordPress plugins & themes · reported by WPScanMedium 4.7
The Contact Form 7 WordPress plugin before 2.5 does not validate the host of a user-supplied return URL before using it as the success and cancel redirect targets of a Stripe checkout, allowing an unauthenticated attacker to redirect a victim, via a crafted link, to an arbitrary external site after the checkout flow.
- Product
- Contact Form 7
- Fixed in
- 2.5
- What to do
- Update Contact Form 7 to 2.5 or newer.
Jul 27, 2026WPBot: Does not validate administrator-configured field identifiers before using them in a SQL queryCVE-2026-14189 · WordPress plugins & themes · reported by WPScanLow 3.8
The WPBot WordPress plugin before 8.5.2 does not validate administrator-configured field identifiers before using them in a SQL query, allowing users with administrator access to perform SQL injection that executes when a visitor triggers a search.
- Product
- WPBot
- Fixed in
- 8.5.2
- What to do
- Update WPBot to 8.5.2 or newer.
Jul 27, 2026Realtyna Organic IDX plugin + WPL Real Estate: Does not validate the type of uploaded filesCVE-2026-13714 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Realtyna Organic IDX plugin + WPL Real Estate WordPress plugin before 5.3.0 does not validate the type of uploaded files, and its file upload functionality is gated only by an API that is enabled by default and authenticated with hardcoded credentials shipped identically across all installations. This makes it possible for unauthenticated attackers to upload arbitrary PHP files and achieve remote code execution.
- Product
- Realtyna Organic IDX plugin + WPL Real Estate
- Fixed in
- 5.3.0
- What to do
- Update Realtyna Organic IDX plugin + WPL Real Estate to 5.3.0 or newer.
Jul 27, 2026微信二维码登陆: Does not properly validate WeChat webhook requestsCVE-2026-13597 · WordPress plugins & themes · reported by WPScanCritical 9.1
The 微信二维码登陆 WordPress plugin through 1.3 does not properly validate WeChat webhook requests, as its signature check always passes, and it discloses the generated login code in the webhook response. This allows an unauthenticated attacker to forge a login event for any existing username, read the login code, and redeem it through an unauthenticated AJAX action to log in as that user, including an administrator, without a password.
- Product
- 微信二维码登陆
- Affected
- up to 1.3
- What to do
- Affects up to 1.3. Update 微信二维码登陆 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 27, 2026MemberGlut: Does not validate the role chosen during front-end registrationCVE-2026-12394 · WordPress plugins & themes · reported by WPScanCritical 9.8
The MemberGlut WordPress plugin before 1.1.5 does not validate the role chosen during front-end registration, allowing unauthenticated users to register an account with an arbitrary role, including administrator, leading to full site compromise.
- Product
- MemberGlut
- Fixed in
- 1.1.5
- What to do
- Update MemberGlut to 1.1.5 or newer.
Jul 23, 2026WP Compress: Does not validate the value of a query parameter that controls the asset CDN host before using it to build the URLs of JavaScript files emitted on the pageCVE-2026-9066 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP Compress WordPress plugin before 7.10.04 does not validate the value of a query parameter that controls the asset CDN host before using it to build the URLs of JavaScript files emitted on the page, leading to Reflected XSS. When a visitor follows a crafted link, the WP Compress WordPress plugin before 7.10.04's loader injects script elements pointing to an attacker-controlled origin, which lets the attacker execute arbitrary JavaScript in the visitor's session on the target site.
- Product
- WP Compress
- Fixed in
- 7.10.04
- What to do
- Update WP Compress to 7.10.04 or newer.
Jul 21, 2026Bit Form: Does not properly validate its workflow-trigger token once the associated transient has expiredCVE-2026-13694 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Bit Form WordPress plugin before 3.1.0 does not properly validate its workflow-trigger token once the associated transient has expired, allowing unauthenticated attackers to re-trigger a form's configured workflow actions such as notification emails and integrations.
- Product
- Bit Form
- Fixed in
- 3.1.0
- What to do
- Update Bit Form to 3.1.0 or newer.
Jul 20, 2026Kirki: Does not validate a user-supplied URL before requesting it server-sideCVE-2026-13147 · WordPress plugins & themes · reported by WPScanCritical 9.1
The Kirki WordPress plugin before 6.0.12 does not validate a user-supplied URL before requesting it server-side, allowing unauthenticated attackers to make the site issue HTTP requests to arbitrary hosts (Server-Side Request Forgery).
- Product
- Kirki
- Fixed in
- 6.0.12
- What to do
- Update Kirki to 6.0.12 or newer.
Jul 17, 2026User Registration & Membership: Does not validate that the membership tier submitted during public registration is one of the tiers allowed by the registration form before assigning that tier's associated user roleCVE-2026-11961 · WordPress plugins & themes · reported by WPScanHigh 8.1
The User Registration & Membership WordPress plugin before 5.2.3 does not validate that the membership tier submitted during public registration is one of the tiers allowed by the registration form before assigning that tier's associated user role, allowing unauthenticated users to register into an arbitrary published membership tier and obtain its role — up to administrator when such a tier exists.
- Product
- User Registration & Membership
- Fixed in
- 5.2.3
- What to do
- Update User Registration & Membership to 5.2.3 or newer.
Jul 17, 2026PhonePe Payment Solutions: Does not properly verify the authenticity of incoming payment callbacks: the secret used to validate the callback signature is empty on sites configured through the current setup flowCVE-2026-11575 · WordPress plugins & themes · reported by WPScanHigh 7.5
The PhonePe Payment Solutions WordPress plugin before 3.1.0 does not properly verify the authenticity of incoming payment callbacks: the secret used to validate the callback signature is empty on sites configured through the current setup flow, so the expected signature reduces to an unkeyed hash of the request body that anyone can compute. This allows unauthenticated attackers to forge a payment-success notification and mark unpaid WooCommerce orders as paid without any payment being made.
- Product
- PhonePe Payment Solutions
- Fixed in
- 3.1.0
- What to do
- Update PhonePe Payment Solutions to 3.1.0 or newer.
Jul 16, 2026FunnelKit: Does not validate a user-supplied path before deleting a file during a template-import operationCVE-2026-12979 · WordPress plugins & themes · reported by WPScanMedium 5.5
The FunnelKit WordPress plugin before 3.15.0.6 does not validate a user-supplied path before deleting a file during a template-import operation, allowing users with administrator privileges to delete arbitrary .json files outside the intended directory through path traversal, which can disable other FunnelKit WordPress plugin before 3.15.0.6 or (denial of service).
- Product
- FunnelKit
- Fixed in
- 3.15.0.6
- What to do
- Update FunnelKit to 3.15.0.6 or newer.
Jul 16, 2026Happy Coders OTP Login for WooCommerce: Does not verify that a one-time password was actually validated before authenticating a user based on a supplied identifierCVE-2026-12492 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Happy Coders OTP Login for WooCommerce WordPress plugin before 2.8 does not verify that a one-time password was actually validated before authenticating a user based on a supplied identifier, allowing unauthenticated attackers to log in as any existing user, including administrators, as well as to create new accounts.
- Product
- Happy Coders OTP Login for WooCommerce
- Fixed in
- 2.8
- What to do
- Update Happy Coders OTP Login for WooCommerce to 2.8 or newer.
Jul 16, 2026Appointment Booking: Does not validate a CSRF nonce on several state-changing actions handled by its central request dispatcherCVE-2026-11866 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Appointment Booking Plugin WordPress plugin before 5.6.3 does not validate a CSRF nonce on several state-changing actions handled by its central request dispatcher, allowing attackers to perform privileged actions, such as overwriting the booking-form configuration or disconnecting the connected payment gateway, via Cross-Site Request Forgery against a logged-in administrator.
- Product
- Appointment Booking
- Fixed in
- 5.6.3
- What to do
- Update Appointment Booking to 5.6.3 or newer.
Jul 14, 2026SureForms: Does not properly validate the payment amount on forms that use a dynamically-sourced (variable/hidden) payment amountCVE-2026-11567 · WordPress plugins & themes · reported by WPScanMedium 5.9
The SureForms WordPress plugin before 2.11.1 does not properly validate the payment amount on forms that use a dynamically-sourced (variable/hidden) payment amount, allowing unauthenticated users to underpay for the configured product or subscription. Forms using a fixed configured price are not affected.
- Product
- SureForms
- Fixed in
- 2.11.1
- What to do
- Update SureForms to 2.11.1 or newer.
Jul 14, 2026Word Count and Social Shares: Does not validate a user-supplied file path before deletionCVE-2026-11563 · WordPress plugins & themes · reported by WPScanCritical 9.6
The Word Count and Social Shares WordPress plugin through 1.0 does not validate a user-supplied file path before deletion, nor does it have proper authorization or CSRF checks, allowing any authenticated user, such as a Subscriber, to delete arbitrary files on the server, which can lead to a full site takeover (e.g. by deleting wp-config.php).
- Product
- Word Count and Social Shares
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Word Count and Social Shares to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 9, 2026Fediverse Embeds: Does not validate the destination of the server-side request performed by an unauthenticated site-info endpoint before fetching itCVE-2026-12517 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Fediverse Embeds WordPress plugin before 1.5.8 does not validate the destination of the server-side request performed by an unauthenticated site-info endpoint before fetching it, allowing anonymous users (the gating nonce is exposed on public pages carrying an embed) to make the site request internal and private-network URLs and read back the parsed page metadata. This is a Server-Side Request Forgery.
- Product
- Fediverse Embeds
- Fixed in
- 1.5.8
- What to do
- Update Fediverse Embeds to 1.5.8 or newer.
Jul 9, 2026Fediverse Embeds: Does not validate the destination of the server-side request performed by an unauthenticated media-proxying endpointCVE-2026-12516 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Fediverse Embeds WordPress plugin before 1.5.8 does not validate the destination of the server-side request performed by an unauthenticated media-proxying endpoint, allowing anonymous users to make the site fetch arbitrary URLs, including internal and private-network addresses, and read back the response body. This results in a full-read Server-Side Request Forgery and open proxy.
- Product
- Fediverse Embeds
- Fixed in
- 1.5.8
- What to do
- Update Fediverse Embeds to 1.5.8 or newer.
Jul 8, 2026Appointment Booking Calendar Plugin and Scheduling: Does not validate data before passing it to a PHP deserialization functionCVE-2026-12378 · WordPress plugins & themes · reported by WPScanHigh 8.1
The Appointment Booking Calendar Plugin and Scheduling Plugin WordPress plugin through 1.1.28 does not validate data before passing it to a PHP deserialization function, allowing unauthenticated attackers to inject arbitrary PHP objects; where a suitable gadget chain is present on the site this can be leveraged to achieve remote code execution.
- Product
- Appointment Booking Calendar Plugin and Scheduling
- Affected
- up to 1.1.28
- What to do
- Affects up to 1.1.28. Update Appointment Booking Calendar Plugin and Scheduling to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 8, 2026Bulk Order Update for WooCommerce: Arbitrary File ReadCVE-2026-14500 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Bulk Order Update for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Read in versions up to, and including, 1.6. This is due to the bouw_fetch_csv_data() AJAX handler being registered on the wp_ajax_nopriv_ hook with no capability or nonce check, and passing the attacker-supplied csv_url POST parameter — filtered only by esc_url_raw() (which leaves absolute filesystem paths intact) and validate_file() (which only rejects '..' traversal patterns) — directly into fopen()/fgetcsv() and reflecting the first parsed line in the JSON response. This makes it possible for unauthenticated attackers to read the first line of arbitrary files on the server (such as /etc/passwd) and to use the handler as a file-existence oracle.
- Product
- Bulk Order Update for WooCommerce
- Affected
- up to 1.6
- What to do
- Affects up to 1.6. Update Bulk Order Update for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 7, 2026Frontend File Manager: Does not validate a file path derived from user input before deleting the referenced fileCVE-2026-12277 · WordPress plugins & themes · reported by WPScanHigh 8.7
The Frontend File Manager Plugin WordPress plugin through 23.6 does not validate a file path derived from user input before deleting the referenced file, allowing unauthenticated users to delete arbitrary files on the server (such as wp-config.php) when guest upload mode is enabled. Deleting wp-config.php forces the site into its setup routine, which can be leveraged toward a full site takeover.
- Product
- Frontend File Manager
- Affected
- up to 23.6
- What to do
- Affects up to 23.6. Update Frontend File Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 7, 2026WP Travel Engine: Does not properly validate the source of a user-supplied profile image path before moving the fileCVE-2026-10834 · WordPress plugins & themes · reported by WPScanMedium 4.6
The WP Travel Engine WordPress plugin before 6.8.1 does not properly validate the source of a user-supplied profile image path before moving the file, allowing authenticated users with subscriber-level access and above to relocate arbitrary files within the WordPress uploads directory into their own profile-image path. This removes the targeted media from its original location and can break content across the site.
- Product
- WP Travel Engine
- Fixed in
- 6.8.1
- What to do
- Update WP Travel Engine to 6.8.1 or newer.
Jul 6, 2026FileOrganizer: Does not validate the file type on several of its file-management operationsCVE-2026-11962 · WordPress plugins & themes · reported by WPScanHigh 8.8
The FileOrganizer WordPress plugin before 1.2.0 does not validate the file type on several of its file-management operations, allowing authenticated users who have been granted file-manager access — which its premium add-on can extend to sub-administrator roles — to upload arbitrary PHP files and achieve remote code execution. This is an incomplete fix of CVE-2024-7985, which only added file-type validation to the upload operation.
- Product
- FileOrganizer
- Fixed in
- 1.2.0
- What to do
- Update FileOrganizer to 1.2.0 or newer.
Jul 6, 2026Notifications for Forms & WordPress Actions: Does not validate a user-supplied value before using it to build a server-side file inclusion pathCVE-2024-6228 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Notifications for Forms & WordPress Actions WordPress plugin before 2.6 does not validate a user-supplied value before using it to build a server-side file inclusion path, allowing authenticated users with subscriber-level access and above to include and execute arbitrary local PHP files on the server.
- Product
- Notifications for Forms & WordPress Actions
- Fixed in
- 2.6
- What to do
- Update Notifications for Forms & WordPress Actions to 2.6 or newer.
Jul 1, 2026WebAuthn Provider for Two Factor: Does not correctly validate the second-factor authentication responseCVE-2026-11883 · WordPress plugins & themes · reported by WPScanHigh 7.2
The WebAuthn Provider for Two Factor WordPress plugin before 2.5.6 does not correctly validate the second-factor authentication response, allowing an attacker who already knows a user's password to bypass the two-factor authentication requirement by submitting a malformed request.
- Product
- WebAuthn Provider for Two Factor
- Fixed in
- 2.5.6
- What to do
- Update WebAuthn Provider for Two Factor to 2.5.6 or newer.
Jul 1, 2026WS Form LITE: Does not have a capability check on one of its settings-update actionsCVE-2026-11562 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WS Form LITE WordPress plugin before 1.11.8 does not have a capability check on one of its settings-update actions, allowing authenticated users with subscriber-level access and above to modify the WS Form LITE WordPress plugin before 1.11.8's settings.
- Product
- WS Form LITE
- Fixed in
- 1.11.8
- What to do
- Update WS Form LITE to 1.11.8 or newer.
Jun 30, 2026WP Support Plus Responsive Ticket System: Does not properly validate uploaded filesCVE-2026-11589 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WP Support Plus Responsive Ticket System WordPress plugin through 9.1.2 does not properly validate uploaded files, allowing unauthenticated users to upload files containing malicious JavaScript (such as HTML or SVG) to a publicly accessible location, leading to Stored Cross-Site Scripting attacks against site users and administrators.
- Product
- WP Support Plus Responsive Ticket System
- Affected
- up to 9.1.2
- What to do
- Affects up to 9.1.2. Update WP Support Plus Responsive Ticket System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 26, 2026YMC Filter: Does not properly authorize access to one of its REST API endpoints and does not validate a user-supplied query parameterCVE-2026-10823 · WordPress plugins & themes · reported by WPScanHigh 7.5
The YMC Filter WordPress plugin before 3.11.3 does not properly authorize access to one of its REST API endpoints and does not validate a user-supplied query parameter, allowing unauthenticated attackers to retrieve the titles and content of private, draft, and other non-public posts.
- Product
- YMC Filter
- Fixed in
- 3.11.3
- What to do
- Update YMC Filter to 3.11.3 or newer.
Jun 25, 2026InPost PL: Does not verify that the request originates from the legitimate buyer before allowing the WooCommerce order parcel-locker destination to be updatedCVE-2026-9702 · WordPress plugins & themes · reported by WPScanHigh 7.5
The InPost PL WordPress plugin before 1.9.1 does not verify that the request originates from the legitimate buyer before allowing the WooCommerce order parcel-locker destination to be updated, allowing unauthenticated attackers to silently redirect the shipping destination of any pending or processing order on the site.
- Product
- InPost PL
- Fixed in
- 1.9.1
- What to do
- Update InPost PL to 1.9.1 or newer.
Jun 24, 2026Welcome Software Publishing: Arbitrary Options UpdateCVE-2026-4297 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Welcome Software Publishing plugin for WordPress is vulnerable to Arbitrary Options Update in all versions up to and including 0.0.31. This is due to a missing capability check in the nc_setOption() function, which is exposed via the nc.setOption XML-RPC method. The function authenticates the user via $wp_xmlrpc_server->login() (verifying credentials are valid) but does not perform any authorization check such as current_user_can('manage_options'). This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary WordPress options via XML-RPC requests. This can be leveraged to change the default_role option to 'administrator' and then register a new administrator account, achieving full privilege escalation and site takeover.
- Product
- Welcome Software Publishing
- Affected
- up to 0.0.31
- What to do
- Affects up to 0.0.31. Update Welcome Software Publishing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 23, 2026Infility Global Infility Global: For WordPress does not sanitize or validate the orderby and order parameters in the import_list()CVE-2026-7842 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Infility Global Infility Global WordPress plugin before 2.15.20 for WordPress does not sanitize or validate the orderby and order parameters in the import_list(), url_detail(), and file_detail() admin page callbacks before using them in SQL queries, allowing authenticated attackers with Editor-level access or higher to perform time-based blind SQL injection and extract sensitive data from the database. The ImportData module must be enabled via the Infility Global WordPress plugin before 2.15.20's module toggle page.
- Product
- Infility Global Infility Global
- Fixed in
- 2.15.20
- What to do
- Update Infility Global Infility Global to 2.15.20 or newer.
Jun 18, 2026MagicForm: Does not properly validate the type of files uploaded through an unauthenticated AJAX actionCVE-2026-9815 · WordPress plugins & themes · reported by WPScanMedium 6.5
The MagicForm WordPress plugin through 0.1.3 does not properly validate the type of files uploaded through an unauthenticated AJAX action when a form's per-field extension allowlist is left empty, allowing unauthenticated attackers to upload PHP files and execute arbitrary code on the server.
- Product
- MagicForm
- Affected
- up to 0.1.3
- What to do
- Affects up to 0.1.3. Update MagicForm to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated Cross Site Scripting (XSS) in SweetDate Core < 1.1.5 versions.CVE-2025-69140 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in SweetDate Core < 1.1.5 versions.
- What to do
- Update the plugin to the newest version.
Jun 15, 2026Unauthenticated SQL Injection in Order Delivery Date for WooCommerce <= 4.5.1 versions.CVE-2026-42386 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in Order Delivery Date for WooCommerce <= 4.5.1 versions.
- Affected
- up to 4.5.1
- What to do
- Affects up to 4.5.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 13, 2026Store Locator: Does not validate a parameter before using it in a file pathCVE-2026-9062 · WordPress plugins & themes · reported by WPScanLow 3.4
The Store Locator WordPress plugin before 1.6.9 does not validate a parameter before using it in a file path, allowing high-privileged users such as administrators to read arbitrary `.php` files from the server, including configuration files that contain database credentials and authentication keys.
- Product
- Store Locator
- Fixed in
- 1.6.9
- What to do
- Update Store Locator to 1.6.9 or newer.
Jun 10, 2026Schema & Structured Data for WP & AMP: Does not check user capabilities on its frontend AJAX file-upload handlers and does not validate the actual content of uploaded files against the endpoint's intended media typeCVE-2026-9067 · WordPress plugins & themes · reported by WPScanCritical 9.1
The Schema & Structured Data for WP & AMP WordPress plugin before 1.60 does not check user capabilities on its frontend AJAX file-upload handlers and does not validate the actual content of uploaded files against the endpoint's intended media type, allowing unauthenticated users to upload any file type accepted by WordPress's media library through endpoints that should only accept images or videos.
- Product
- Schema & Structured Data for WP & AMP
- Fixed in
- 1.60
- What to do
- Update Schema & Structured Data for WP & AMP to 1.60 or newer.
Jun 1, 2026Auto Image Attributes From Filename With Bulk Updater (Add Alt Text, Image Title For Image SEO): Stored Cross-Site ScriptingCVE-2026-3722 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Auto Image Attributes From Filename With Bulk Updater (Add Alt Text, Image Title For Image SEO) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the attachment metadata in all versions up to, and including, 4.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Auto Image Attributes From Filename With Bulk Updater (Add Alt Text, Image Title For Image SEO)
- Affected
- up to 4.9
- What to do
- Affects up to 4.9. Update Auto Image Attributes From Filename With Bulk Updater (Add Alt Text, Image Title For Image SEO) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
May 28, 2026Easy Updates Manager: Reflected Cross-Site ScriptingCVE-2026-7660 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Easy Updates Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'paged' parameter in versions up to, and including, 9.0.20 This is due to insufficient input sanitization and output escaping in the pagination() function. This makes it possible for attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page granted they can trick an administrator into performing an action such as clicking on a link.
- Product
- Easy Updates Manager
- Affected
- up to 9.0.20
- What to do
- Affects up to 9.0.20. Update Easy Updates Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
May 27, 2026WP Meta and Date Remover: Missing AuthorizationCVE-2026-49051 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Prasad Kirpekar WP Meta and Date Remover allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WP Meta and Date Remover: from n/a through 2.3.6.
- Product
- WP Meta and Date Remover
- Affected
- up to 2.3.6
- What to do
- Affects up to 2.3.6. Update WP Meta and Date Remover to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 12, 2026Next Date: Stored Cross-Site ScriptingCVE-2026-4920 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Next Date plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'default' shortcode attribute in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Next Date
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Next Date to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.