Updated 7 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

343new WordPress flaws this week

390,080entries in the database

2,505 results · page 6 of 51

Aug 10, 2026vitepos WordPress plugin before 3.6.0, Vitepos: Do not perform a per-target authorization check in their point-of-sale password-reset API and grant the custom Outlet Manager role an over-broad password-reset capability bCVE-2026-14237 · WordPress plugins & themes · reported by WPScanHigh 7.2
The vitepos WordPress plugin before 3.6.0, Vitepos WordPress plugin before 3.5.0 do not perform a per-target authorization check in their point-of-sale password-reset API and grant the custom Outlet Manager role an over-broad password-reset capability by default, allowing an Outlet Manager to reset any user's password, including an administrator's, and take over the account.
Product
vitepos WordPress plugin before 3.6.0, Vitepos
Fixed in
3.6.0
What to do
Update vitepos WordPress plugin before 3.6.0, Vitepos to 3.6.0 or newer.
Full record and what to do →NVD record wpscan.com
Aug 9, 2026Iptanus File Upload: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2026-17044 · WordPress plugins & themes · reported by WPScanHigh 8.6
The Iptanus File Upload WordPress plugin before 5.1.8 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to an SQL injection exploitable by unauthenticated users.
Product
Iptanus File Upload
Fixed in
5.1.8
What to do
Update Iptanus File Upload to 5.1.8 or newer.
Full record and what to do →NVD record wpscan.com
Aug 9, 2026LWS Optimize: Does not properly escape a value submitted through an unauthenticated analytics endpoint before storing it and rendering it in an administrative dashboardCVE-2026-16032 · WordPress plugins & themes · reported by WPScanMedium 6.1
The LWS Optimize WordPress plugin before 4.1.2 does not properly escape a value submitted through an unauthenticated analytics endpoint before storing it and rendering it in an administrative dashboard, allowing unauthenticated attackers to inject arbitrary web scripts that execute when an administrator views the affected dashboard page.
Product
LWS Optimize
Fixed in
4.1.2
What to do
Update LWS Optimize to 4.1.2 or newer.
Full record and what to do →NVD record wpscan.com
Aug 8, 2026AI Engine: Does not verify ownership of a guest's uploaded chatbot files before deletionCVE-2026-16953 · WordPress plugins & themes · reported by WPScanMedium 4.8
The AI Engine WordPress plugin before 3.6.4 does not verify ownership of a guest's uploaded chatbot files before deletion, authorising the action solely by a client-supplied session cookie value, so an unauthenticated attacker who obtains a victim's session identifier and file reference can delete that victim's uploaded files.
Product
AI Engine
Fixed in
3.6.4
What to do
Update AI Engine to 3.6.4 or newer.
Full record and what to do →NVD record wpscan.com
Aug 8, 2026Download Monitor: Does not perform authorization checks on one of its download-logging AJAX actionsCVE-2026-16608 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Download Monitor WordPress plugin before 5.2.6 does not perform authorization checks on one of its download-logging AJAX actions, and exposes the nonce protecting it to unauthenticated visitors, allowing unauthenticated users to inject arbitrary download log entries and inflate a site's download statistics.
Product
Download Monitor
Fixed in
5.2.6
What to do
Update Download Monitor to 5.2.6 or newer.
Full record and what to do →NVD record wpscan.com
Aug 8, 2026Dokan: AI Powered WooCommerce Multivendor Marketplace Solution: Does not verify that a downloadable product belongs to the requesting vendor before granting download permissions through one of its order REST endpointsCVE-2026-16574 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.11 does not verify that a downloadable product belongs to the requesting vendor before granting download permissions through one of its order REST endpoints, allowing an authenticated vendor to grant their own customer free download access to another vendor's paid downloadable files.
Product
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution
Fixed in
5.0.11
What to do
Update Dokan: AI Powered WooCommerce Multivendor Marketplace Solution to 5.0.11 or newer.
Full record and what to do →NVD record wpscan.com
Aug 8, 2026WP Statistics: Does not perform a capability check on a set of dashboard analytics AJAX handlersCVE-2026-16562 · WordPress plugins & themes · reported by WPScanMedium 6.5
The WP Statistics WordPress plugin before 14.16.10 does not perform a capability check on a set of dashboard analytics AJAX handlers, relying only on a nonce that every authenticated user holds, allowing users with Subscriber-level access and above to disclose the site's visitor analytics data.
Product
WP Statistics
Fixed in
14.16.10
What to do
Update WP Statistics to 14.16.10 or newer.
Full record and what to do →NVD record wpscan.com
Aug 8, 2026YMC Filter: Does not sanitize SVG files uploaded through one of its icon upload features and permits their upload by low-privileged usersCVE-2026-16559 · WordPress plugins & themes · reported by WPScanMedium 6.8
The YMC Filter WordPress plugin before 3.12.9 does not sanitize SVG files uploaded through one of its icon upload features and permits their upload by low-privileged users, allowing users with the Author role and above to upload a file containing JavaScript that executes in the site's origin when the file is viewed.
Product
YMC Filter
Fixed in
3.12.9
What to do
Update YMC Filter to 3.12.9 or newer.
Full record and what to do →NVD record wpscan.com
Aug 7, 2026Estatik Real Estate: Does not bind its OAuth social login flow to the initiating user sessionCVE-2026-16262 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Estatik Real Estate Plugin WordPress plugin before 4.3.3 does not bind its OAuth social login flow to the initiating user session, allowing an unauthenticated attacker to log a victim into an attacker-controlled account (login CSRF), so that the victim's subsequent activity is stored under and readable by the attacker.
Product
Estatik Real Estate
Fixed in
4.3.3
What to do
Update Estatik Real Estate to 4.3.3 or newer.
Full record and what to do →NVD record wpscan.com
Aug 6, 2026Unauthenticated Arbitrary File Upload in Type Hub <= 2.0.6 versions.CVE-2026-66665 · WordPress plugins & themes · reported by PatchstackCritical 10
Unauthenticated Arbitrary File Upload in Type Hub <= 2.0.6 versions.
Affected
up to 2.0.6
What to do
Affects up to 2.0.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 6, 2026Unauthenticated SQL Injection in WordPress File Upload <= 5.1.7 versions.CVE-2026-66447 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in WordPress File Upload <= 5.1.7 versions.
Affected
up to 5.1.7
What to do
Affects up to 5.1.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 6, 2026Unauthenticated SQL Injection in WP OAuth Server <= 6.2.0 versions.CVE-2026-65520 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in WP OAuth Server <= 6.2.0 versions.
Affected
up to 6.2.0
What to do
Affects up to 6.2.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 6, 2026Unauthenticated Broken Access Control in BOX NOW Delivery Croatia <= 3.3.0 versions.CVE-2026-65504 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in BOX NOW Delivery Croatia <= 3.3.0 versions.
Affected
up to 3.3.0
What to do
Affects up to 3.3.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 6, 2026Contributor Arbitrary File Download in Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 2.0.14 versions.CVE-2026-28146 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Arbitrary File Download in Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 2.0.14 versions.
Affected
up to 2.0.14
What to do
Affects up to 2.0.14. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 6, 2026Events Manager: Does not perform any authorization check on a REST route that serves temporarily stored file uploadsCVE-2026-18050 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Events Manager WordPress plugin before 7.4 does not perform any authorization check on a REST route that serves temporarily stored file uploads, allowing unauthenticated users to retrieve another user's in-progress upload when its temporary identifier is known. The identifier is high-entropy, is disclosed only to the uploader, and the file is removed on submission or by a scheduled cleanup, so a cross-user read is not achievable by guessing alone.
Product
Events Manager
Fixed in
7.4
What to do
Update Events Manager to 7.4 or newer.
Full record and what to do →NVD record wpscan.com
Aug 6, 2026Drag and Drop Multiple File Upload for WooCommerce: Does not prevent unauthenticated users from obtaining a valid nonce that is the only control gating its file-deletion routineCVE-2026-16054 · WordPress plugins & themes · reported by WPScanCritical 9.1
The Drag and Drop Multiple File Upload for WooCommerce WordPress plugin before 1.1.8 does not prevent unauthenticated users from obtaining a valid nonce that is the only control gating its file-deletion routine, allowing anonymous attackers to delete files staged in its upload directory and irreversibly destroy customers' pending order attachments.
Product
Drag and Drop Multiple File Upload for WooCommerce
Fixed in
1.1.8
What to do
Update Drag and Drop Multiple File Upload for WooCommerce to 1.1.8 or newer.
Full record and what to do →NVD record wpscan.com
Aug 6, 2026PeproDev WooCommerce Receipt Uploader: Does not verify that a requested attachment belongs to the order referenced by its access tokenCVE-2026-14314 · WordPress plugins & themes · reported by WPScanMedium 5.3
The PeproDev WooCommerce Receipt Uploader WordPress plugin through 2.8.0 does not verify that a requested attachment belongs to the order referenced by its access token, allowing unauthenticated attackers to forge a token and disclose image attachments, including other customers' uploaded payment receipts, that they do not own.
Product
PeproDev WooCommerce Receipt Uploader
Affected
up to 2.8.0
What to do
Affects up to 2.8.0. Update PeproDev WooCommerce Receipt Uploader to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Aug 6, 2026PeproDev WooCommerce Receipt Uploader (PeproDev WooCommerce Receipt Uploader WordPress plugin through 2.8.0 slug: pepro-bacs-receipt-upload-for-woocommerce), alCVE-2026-14313 · WordPress plugins & themes · reported by WPScanMedium 5.3
PeproDev WooCommerce Receipt Uploader (PeproDev WooCommerce Receipt Uploader WordPress plugin through 2.8.0 slug: pepro-bacs-receipt-upload-for-woocommerce), all versions up to and including 2.8.0 (latest on wordpress.org; no fixed version available at the time of writing), is vulnerable to unauthenticated missing-authorization / IDOR write. Requires WooCommerce.
Affected
up to 2.8.0
What to do
Affects up to 2.8.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Aug 6, 2026Nexter Blocks: Does not sanitize uploaded SVG files and allows SVG uploads for any user able to upload files (Author by default)CVE-2025-15678 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Nexter Blocks WordPress plugin before 5.0.2 does not sanitize uploaded SVG files and allows SVG uploads for any user able to upload files (Author by default), allowing them to upload a file containing malicious JavaScript that executes when the file is accessed, leading to Stored Cross-Site Scripting.
Product
Nexter Blocks
Fixed in
5.0.2
What to do
Update Nexter Blocks to 5.0.2 or newer.
Full record and what to do →NVD record wpscan.com
Aug 6, 2026WPMU DEV Dashboard: Authentication BypassCVE-2026-15459 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The WPMU DEV Dashboard plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.0.0. On sites not yet connected to the WPMU DEV Hub — the default state after installation — the site API key that keys the WDP-AUTH request signature is empty, making the signature verified by validate_hash() trivially forgeable; version 5.0.0 additionally removed the replay check in validate_nonce(), and the remote handler is bound to the public init hook with no capability check. This makes it possible for unauthenticated attackers to invoke privileged Hub actions — including installing and activating a plugin from an attacker-supplied URL (resulting in remote code execution), deleting plugins and themes, upgrading WordPress core, or logging in as an administrator via SSO. Sites connected to a WPMU DEV account, which have a non-empty 64-character API key, are not affected.
Product
WPMU DEV Dashboard
Affected
up to 5.0.0
What to do
Affects up to 5.0.0. Update WPMU DEV Dashboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpmudev.com wordfence.com
Aug 5, 2026The wp-downloadmanager WordPress plugin, in version 1.68.11 (also affecting the 6.9.4 release line), allows an admin-privileged user (current_user_can('manage_dCVE-2026-18933 · WordPress plugins & themes · reported by 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2cHigh 7.2
The wp-downloadmanager WordPress plugin, in version 1.68.11 (also affecting the 6.9.4 release line), allows an admin-privileged user (current_user_can('manage_downloads')) to upload arbitrary files via download-add.php with no extension or MIME-type validation of any kind - no wp_check_filetype_and_ext, no validate_file, and no extension blocklist exist anywhere in the upload handler.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record wordpress.org
Aug 5, 2026LightSync Pro: Arbitrary file uploadsCVE-2026-6147 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The LightSync Pro plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the rest_replace_media() function in all versions up to, and including, 2.1.6. This makes it possible for authenticated attackers, with Author-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
LightSync Pro
Affected
up to 2.1.6
What to do
Affects up to 2.1.6. Update LightSync Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 5, 2026Material Dashboard: Unauthorized access and modification of dataCVE-2026-6079 · WordPress plugins & themes · reported by WordfenceHigh 7.3
The Material Dashboard plugin for WordPress is vulnerable to unauthorized access and modification of data due to missing capability checks on the amd_ajax_target_task_manager() function in all versions up to, and including, 1.4.10. This makes it possible for unauthenticated attackers to enumerate all scheduled tasks (potentially exposing PII), execute arbitrary tasks, and delete any task via the public_amd_ajax_handler AJAX action.
Product
Material Dashboard
Affected
up to 1.4.10
What to do
Affects up to 1.4.10. Update Material Dashboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 5, 2026Multi Uploader for Gravity Forms: Unauthorized arbitrary media deletionCVE-2026-5581 · WordPress plugins & themes · reported by WordfenceCritical 9.1
The Multi Uploader for Gravity Forms plugin for WordPress is vulnerable to unauthorized arbitrary media deletion in all versions up to, and including, 1.1.8. This is due to missing capability checks in the `plupload_ajax_delete_file()` function, which is registered via `wp_ajax_nopriv_gfmu_delete_file`. The nonce intended for CSRF protection is exposed on any public-facing page containing a multi-uploader form field via the `GFMU_options` JavaScript object. This makes it possible for unauthenticated attackers to permanently delete any WordPress media attachment by supplying its attachment ID, potentially leading to complete media library destruction.
Product
Multi Uploader for Gravity Forms
Affected
up to 1.1.8
What to do
Affects up to 1.1.8. Update Multi Uploader for Gravity Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 5, 2026Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More: Does not sanitize uploaded SVG filesCVE-2026-16583 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More WordPress plugin before 3.0.8 does not sanitize uploaded SVG files when its SVG upload feature is enabled, allowing authenticated users with the upload capability (Author and above by default, without the unfiltered_html capability) to upload SVG files containing JavaScript that executes in the site context when the file is viewed, leading to Stored Cross-Site Scripting.
Product
Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More
Fixed in
3.0.8
What to do
Update Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More to 3.0.8 or newer.
Full record and what to do →NVD record wpscan.com
Aug 5, 2026Bit Form: Does not sanitize an uploaded signature image before storing itCVE-2026-16573 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Bit Form WordPress plugin before 3.2.0 does not sanitize an uploaded signature image before storing it, allowing unauthenticated attackers to upload a crafted SVG file containing JavaScript that executes when the file is viewed, leading to Stored Cross-Site Scripting.
Product
Bit Form
Fixed in
3.2.0
What to do
Update Bit Form to 3.2.0 or newer.
Full record and what to do →NVD record wpscan.com
Aug 5, 2026Ajax Load More: Does not properly sanitise and escape a parameter before using it in a SQL queryCVE-2026-15360 · WordPress plugins & themes · reported by WPScanCritical 9.1
The Ajax Load More WordPress plugin before 8.0.1 does not properly sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated attackers to perform time-based blind SQL injection and extract sensitive data from the database.
Product
Ajax Load More
Fixed in
8.0.1
What to do
Update Ajax Load More to 8.0.1 or newer.
Full record and what to do →NVD record wpscan.com
Aug 5, 2026zportals: Does not properly validate uploaded filesCVE-2026-14553 · WordPress plugins & themes · reported by WPScanHigh 8.1
The zportals WordPress plugin before 6.3.4 does not properly validate uploaded files, trusting the client-supplied content type and preserving the original file extension, allowing any authenticated user (Subscriber or higher) to upload arbitrary PHP files and achieve remote code execution.
Product
zportals
Fixed in
6.3.4
What to do
Update zportals to 6.3.4 or newer.
Full record and what to do →NVD record wpscan.com
Aug 5, 2026The plugin provides an Admin Search page that allows users with the `edit_posts` capability to run Relevanssi searches from the WordPress dashboard.CVE-2026-15941 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The plugin provides an Admin Search page that allows users with the `edit_posts` capability to run Relevanssi searches from the WordPress dashboard. The AJAX handler accepts a URL-encoded `args` parameter, parses it into a `WP_Query`, and then passes user-controlled taxonomy query data into Relevanssi's taxonomy restriction builder. The taxonomy value is sanitized as text but is not parameterized for SQL before being interpolated into a term taxonomy lookup query. This allows an authenticated contributor-level attacker to inject SQL through the Admin Search AJAX request and execute time-based blind SQL injection against the WordPress database.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 4, 2026Improve SEO: Does not properly validate uploaded filesCVE-2026-16618 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Improve SEO WordPress plugin through 2.0.11 does not properly validate uploaded files, checking only the file content type while writing the file with the attacker-supplied extension into a publicly accessible directory, allowing unauthenticated users to upload executable PHP files and achieve remote code execution.
Product
Improve SEO
Affected
up to 2.0.11
What to do
Affects up to 2.0.11. Update Improve SEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Aug 4, 2026Chat Widget: Floating Customer Support Button for 30+ Channels, Supporting SMS, Calls, and Chat: Does not validate the typeCVE-2026-16548 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Chat Widget: Floating Customer Support Button for 30+ Channels, Supporting SMS, Calls, and Chat WordPress plugin before 1.8.2 does not validate the type, extension, content, or size of files submitted to its public response endpoint and stores them under the uploads directory, so an unauthenticated user can upload arbitrary files. The original extension is discarded (files are stored under a bare UUID), so this does not yield code execution or stored XSS; impact is bounded to disk consumption and content hosting. The storing path requires the channel's response storage or mail-forwarding to be configured.
Product
Chat Widget: Floating Customer Support Button for 30+ Channels, Supporting SMS, Calls, and Chat
Fixed in
1.8.2
What to do
Update Chat Widget: Floating Customer Support Button for 30+ Channels, Supporting SMS, Calls, and Chat to 1.8.2 or newer.
Full record and what to do →NVD record wpscan.com
Aug 4, 2026REST API Log: Does not bind the token protecting its log download feature to the log entry being requestedCVE-2026-16547 · WordPress plugins & themes · reported by WPScanMedium 5.9
The REST API Log WordPress plugin before 1.7.1 does not bind the token protecting its log download feature to the log entry being requested, nor does it check the capability of the requester, allowing unauthenticated users in possession of any such token to download the logged REST API requests and responses of any entry, which may contain sensitive data such as credentials, authentication tokens or private content.
Product
REST API Log
Fixed in
1.7.1
What to do
Update REST API Log to 1.7.1 or newer.
Full record and what to do →NVD record wpscan.com
Aug 3, 2026Personal QR Message: Does not restrict the file types that can be uploaded through an unauthenticated handlerCVE-2026-16250 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Personal QR Message WordPress plugin through 1.0 does not restrict the file types that can be uploaded through an unauthenticated handler, allowing unauthenticated users to upload arbitrary executable PHP files that are directly reachable, leading to remote code execution.
Product
Personal QR Message
Affected
up to 1.0
What to do
Affects up to 1.0. Update Personal QR Message to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Aug 3, 2026Insert or Embed Articulate Content into: Does not correctly validate the contents of an uploaded archiveCVE-2026-16060 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Insert or Embed Articulate Content into WordPress plugin through 4.3000000027 does not correctly validate the contents of an uploaded archive, relying on a bypassable check that lets an Editor-level user upload a server-executable file into a public directory, resulting in remote code execution on servers configured to execute it.
Product
Insert or Embed Articulate Content into
Affected
up to 4.3000000027
What to do
Affects up to 4.3000000027. Update Insert or Embed Articulate Content into to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Aug 3, 2026Blog Floating Button: Does not sanitize or escape the visitor User-Agent headerCVE-2026-15383 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Blog Floating Button WordPress plugin through 1.4.20 does not sanitize or escape the visitor User-Agent header, which it stores through an unauthenticated tracking REST endpoint and later renders unescaped in an administrator report page. This allows an unauthenticated attacker to store a malicious script that executes in the session of any administrator who views the access report, leading to site takeover.
Product
Blog Floating Button
Affected
up to 1.4.20
What to do
Affects up to 1.4.20. Update Blog Floating Button to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Aug 3, 2026SVG Support: Does not apply its SVG sanitisation to uploaded files using theCVE-2026-13340 · WordPress plugins & themes · reported by WPScanMedium 6.1
The SVG Support WordPress plugin before 2.5.17 does not apply its SVG sanitisation to uploaded files using the .svgz extension, even though it registers and serves them as SVG, allowing a user permitted to upload SVGs (such as an Author once granted upload access) to store a script-bearing file that executes in the browser of anyone who later views it, including an administrator.
Product
SVG Support
Fixed in
2.5.17
What to do
Update SVG Support to 2.5.17 or newer.
Full record and what to do →NVD record wpscan.com
Aug 3, 2026Webinfos: Does not validate the type or name of uploaded filesCVE-2026-12872 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Webinfos WordPress plugin through 1.2 does not validate the type or name of uploaded files, nor restrict the upload action with any authentication, capability, or nonce check, allowing unauthenticated attackers to upload arbitrary files (including PHP) to a web-accessible directory, leading to remote code execution on servers that execute PHP from the uploads path.
Product
Webinfos
Affected
up to 1.2
What to do
Affects up to 1.2. Update Webinfos to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Aug 2, 2026Gallery for Google Photos: Does not properly restrict access to the stored third-party OAuth credentials of the connected accountCVE-2026-15236 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Gallery for Google Photos WordPress plugin before 1.2.1 does not properly restrict access to the stored third-party OAuth credentials of the connected account, exposing the persistent access and refresh tokens to unauthenticated users and allowing long-term compromise of the linked account.
Product
Gallery for Google Photos
Fixed in
1.2.1
What to do
Update Gallery for Google Photos to 1.2.1 or newer.
Full record and what to do →NVD record wpscan.com
Aug 2, 2026FluentBoards: Does not verify that the items selected for a board import operation belong to a board the requesting user is authorized to accessCVE-2026-14938 · WordPress plugins & themes · reported by WPScanMedium 4.3
The FluentBoards WordPress plugin before 1.95.3 does not verify that the items selected for a board import operation belong to a board the requesting user is authorized to access, allowing any authenticated user with member access to a single board to copy and read the stages and tasks (including titles, descriptions and file attachments) of any other board on the site.
Product
FluentBoards
Fixed in
1.95.3
What to do
Update FluentBoards to 1.95.3 or newer.
Full record and what to do →NVD record wpscan.com
Aug 1, 2026Download Manager: Stored Cross-Site ScriptingCVE-2026-16685 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'icon' Shortcode Attribute in all versions up to, and including, 3.3.66 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. wp_kses_post() does not neutralize the payload because it operates on post content at save time and does not process shortcode attribute values that are emitted unescaped at render time.
Product
Download Manager
Affected
up to 3.3.66
What to do
Affects up to 3.3.66. Update Download Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 1, 2026Support Genix: Does not prevent directory traversal in its ticket-attachment download routeCVE-2026-15932 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Support Genix WordPress plugin before 1.4.48 does not prevent directory traversal in its ticket-attachment download route, allowing unauthenticated attackers to read arbitrary files with an allowlisted extension — including other users' private ticket attachments — from the server.
Product
Support Genix
Fixed in
1.4.48
What to do
Update Support Genix to 1.4.48 or newer.
Full record and what to do →NVD record wpscan.com
Aug 1, 2026Download Manager: Does not properly escape a package's title before outputting it in the front-end package templatesCVE-2026-14292 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Download Manager WordPress plugin before 3.3.66 does not properly escape a package's title before outputting it in the front-end package templates, allowing users with the Author role or above to store a title that results in arbitrary JavaScript execution in the browser of any user, including unauthenticated visitors, who views a page displaying the package.
Product
Download Manager
Fixed in
3.3.66
What to do
Update Download Manager to 3.3.66 or newer.
Full record and what to do →NVD record wpscan.com
Aug 1, 2026Everest Toolkit: Does not validate the type of files uploaded during demo-content import (the WordPress file-type test is disabled)CVE-2026-13158 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Everest Toolkit WordPress plugin through 1.2.3 does not validate the type of files uploaded during demo-content import (the WordPress file-type test is disabled), allowing high-privilege users (Administrator by default, including non-super-admin site administrators on multisite) to upload executable PHP files to the uploads directory.
Product
Everest Toolkit
Affected
up to 1.2.3
What to do
Affects up to 1.2.3. Update Everest Toolkit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Aug 1, 2026Demo Import: Does not validate the type of files uploaded during demo-content import (the WordPress file-type test is disabled)CVE-2026-13157 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Demo Import WordPress plugin through 1.1.3 does not validate the type of files uploaded during demo-content import (the WordPress file-type test is disabled), allowing high-privilege users (Administrator by default, including non-super-admin site administrators on multisite) to upload executable PHP files to the uploads directory.
Product
Demo Import
Affected
up to 1.1.3
What to do
Affects up to 1.1.3. Update Demo Import to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Aug 1, 2026Builderall for: Does not bind the state value of its public OAuth authentication routes to the initiating user sessionCVE-2026-11882 · WordPress plugins & themes · reported by WPScanLow 3.7
The Builderall for WordPress plugin before 3.0.2 does not bind the state value of its public OAuth authentication routes to the initiating user session, allowing unauthenticated attackers to complete the connection flow and overwrite the stored third-party integration access token. A durable overwrite requires the site to already be connected to a paid account.
Product
Builderall for
Fixed in
3.0.2
What to do
Update Builderall for to 3.0.2 or newer.
Full record and what to do →NVD record wpscan.com
Jul 31, 2026Realtyna Organic IDX: Arbitrary File UploadCVE-2026-16236 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Realtyna Organic IDX plugin for WordPress is vulnerable to Arbitrary File Upload in versions up to, and including, 5.3.0. This is due to missing file extension and content validation in the saveLiveImages() function combined with an insufficient authorization check on the get_keys() AJAX handler and a missing authentication check on the REST API import endpoint. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
Realtyna Organic IDX
Affected
up to 5.3.0
What to do
Affects up to 5.3.0. Update Realtyna Organic IDX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 31, 2026JS Help Desk: Does not verify that the requesting user owns the ticket being loaded: a low-privileged authenticated user can supply another user's ticket ID and read that ticket's contentsCVE-2026-15209 · WordPress plugins & themes · reported by WPScanMedium 6.5
The JS Help Desk WordPress plugin before 3.1.5 does not verify that the requesting user owns the ticket being loaded: a low-privileged authenticated user can supply another user's ticket ID and read that ticket's contents, including the reporter's PII and message body.
Product
JS Help Desk
Fixed in
3.1.5
What to do
Update JS Help Desk to 3.1.5 or newer.
Full record and what to do →NVD record wpscan.com
Jul 31, 2026Support Genix: Does not properly authorize access to support-ticket attachment downloadsCVE-2026-14862 · WordPress plugins & themes · reported by WPScanLow 3.7
The Support Genix WordPress plugin before 1.4.48 does not properly authorize access to support-ticket attachment downloads, allowing unauthenticated users who obtain the stored attachment file name to download other users' private ticket attachments.
Product
Support Genix
Fixed in
1.4.48
What to do
Update Support Genix to 1.4.48 or newer.
Full record and what to do →NVD record wpscan.com
Jul 31, 2026Paid Membership Subscriptions: Does not protect the member and payment export files it writes to a predictable location in the uploads directoryCVE-2026-14849 · WordPress plugins & themes · reported by WPScanLow 3.7
The Paid Membership Subscriptions WordPress plugin before 3.0.7 does not protect the member and payment export files it writes to a predictable location in the uploads directory, allowing unauthenticated users to download the exported member and payment data (including PII) while an export artifact is present.
Product
Paid Membership Subscriptions
Fixed in
3.0.7
What to do
Update Paid Membership Subscriptions to 3.0.7 or newer.
Full record and what to do →NVD record wpscan.com
Jul 31, 2026Realtyna Organic IDX plugin + WPL Real Estate: Arbitrary File UploadCVE-2026-14483 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Realtyna Organic IDX plugin + WPL Real Estate plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 5.2.0 via the upload function. This is due to missing file type validation in the upload function, combined with a publicly accessible I/O endpoint authenticated solely by static, plugin-seeded API credentials that are identical across all installations. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. The WPL I/O service endpoint is registered on the public WordPress init hook with no WordPress capability check, and the required api_key and api_secret values are static defaults seeded by the plugin's own SQL migration files, meaning any unauthenticated attacker who knows these publicly documented defaults can reach and exploit the vulnerable upload path.
Product
Realtyna Organic IDX plugin + WPL Real Estate
Affected
up to 5.2.0
What to do
Affects up to 5.2.0. Update Realtyna Organic IDX plugin + WPL Real Estate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.