Updated 6 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,754exploited flaws on CISA’s list

33added in the last 30 days

293new WordPress flaws this week

13,868entries in the database

1,158 results · page 6 of 24

Sep 10, 2026Joomla Extension - joomshaper.com - Unauthenticated SQL Injection in Property Search and Map Filtering in SP Property < 4.1.4 - The property search and listing CVE-2026-78082 · Websites & servers · reported by security@joomla.orgCritical 9.3
Joomla Extension - joomshaper.com - Unauthenticated SQL Injection in Property Search and Map Filtering in SP Property < 4.1.4 - The property search and listing query builders assembled several WHERE and ORDER BY clauses (zipcode, sorting, price_range_dropdown, and psize_range_dropdown) by directly concatenating raw request parameters into SQL strings without quoting or type casting. An unauthenticated remote attacker could execute boolean-based or time-based blind SQL injection to extract sensitive data from the database.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
NVD record joomshaper.com
Sep 10, 2026zipMoney(Zip Co) Payments Plugin for WooCommerce: Does not perform any authorisation checks on one of its front-end request handlersCVE-2026-78361 · WordPress plugins & themes · reported by WPScanCritical 9.1
The zipMoney(Zip Co) Payments Plugin for WooCommerce WordPress plugin before 2.4.0 does not perform any authorisation checks on one of its front-end request handlers, and does not restrict which option name a caller may supply, allowing unauthenticated users to delete arbitrary WordPress options. This can be used to destroy site and access control configuration, deactivate every installed zipMoney(Zip Co) Payments Plugin for WooCommerce WordPress plugin before 2.4.0, and take the site offline.
Product
zipMoney(Zip Co) Payments Plugin for WooCommerce
Fixed in
2.4.0
What to do
Update zipMoney(Zip Co) Payments Plugin for WooCommerce to 2.4.0 or newer.
NVD record wpscan.com
Sep 10, 2026miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA: Does not require a validated transaction before deleting site options whose names come from unauthenticated request inputCVE-2026-77770 · WordPress plugins & themes · reported by WPScanCritical 10
The miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA WordPress plugin before 19.3 does not require a validated transaction before deleting site options whose names come from unauthenticated request input, allowing any visitor to delete arbitrary options, which can lock every administrator out of the dashboard or deactivate every miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA WordPress plugin before 19.3 on the site.
Product
miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA
Fixed in
6.3.1
What to do
Update miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA to 6.3.1 or newer.
NVD record wpscan.com
Sep 9, 2026Drag and Drop File Upload for Elementor Forms: Arbitrary File UploadCVE-2026-18351 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Drag and Drop File Upload for Elementor Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.6.0 via the elementor_file_upload function. This is due to insufficient file type validation in the is_file_type_valid() function, which uses the attacker-controlled 'type' parameter as regex keys in the MIME allowlist, allowing blacklist bypass via a crafted extension that sanitize_file_name() later normalizes to a PHP extension. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible.
Product
Drag and Drop File Upload for Elementor Forms
Affected
up to 1.6.0
What to do
Affects up to 1.6.0. Update Drag and Drop File Upload for Elementor Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.svn.wordpress.org plugins.svn.wordpress.org
Sep 9, 2026A vulnerability in cPanel allows a mail-enabled account to achieve remote code execution as root through SQLi in EmailTrack componentCVE-2026-67401 · Websites & servers · reported by support@hackerone.comCritical 9.9
A vulnerability in cPanel allows a mail-enabled account to achieve remote code execution as root through SQLi in EmailTrack component
What to do
Apply the vendor’s update. The NVD record links to the advisory.
NVD record support.cpanel.net
Sep 5, 2026Frontend Admin by DynamiApps: Authentication Bypass to Account TakeoverCVE-2026-75816 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Authentication Bypass to Account Takeover in all versions up to, and including, 3.29.12. This is due to the pre_update_value function lacking any capability or ownership check, and ActionPost::conditions_logic() short-circuiting its current_user_can('edit_post') authorization gate whenever the post ID is non-numeric — such as the string user_1 — allowing unauthenticated form submissions to be routed to arbitrary user records without restriction. This makes it possible for unauthenticated attackers to overwrite any user's registered email address, including an administrator's, and then leverage WordPress's native password-reset flow to fully take over the targeted account.
Product
Frontend Admin by DynamiApps
Affected
up to 3.29.12
What to do
Affects up to 3.29.12. Update Frontend Admin by DynamiApps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 5, 2026MemberDash: Insecure Direct Object ReferenceCVE-2026-16310 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The MemberDash plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.8.5 via the 'id' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to change the password of any WordPress user, including administrators, by supplying an arbitrary user ID during registration, and take over their account without any notification sent to the victim.
Product
MemberDash
Affected
up to 1.8.5
What to do
Affects up to 1.8.5. Update MemberDash to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record memberdashwp.com wordfence.com
Sep 5, 2026Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails: PHP Object InjectionCVE-2026-10196 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.31.0 via deserialization of untrusted input in the 'handle_form_submission' function. This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain allows attackers to execute code on the server. The vulnerability was partially patched in version 1.23.1.
Product
Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails
Affected
up to 1.31.0
What to do
Affects up to 1.31.0. Update Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 5, 2026Post Grid and Gutenberg Blocks – ComboBlocks: Unauthenticated Hook InjectionCVE-2024-11080 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Post Grid and Gutenberg Blocks – ComboBlocks plugin for WordPress is vulnerable to Unauthenticated Hook Injection in versions 2.2.32 to 2.3.1 via several functions in the ~/includes/blocks/form-wrap/function.php file. This makes it possible for unauthenticated attackers to execute actions with hooks in WordPress, granted no other security controls are present in the function.
Product
Post Grid and Gutenberg Blocks – ComboBlocks
Affected
2.2.32 to 2.3.1
What to do
Affects 2.2.32 to 2.3.1. Update Post Grid and Gutenberg Blocks – ComboBlocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 5, 2026SEO Flow by LupsOnline: Does not correctly validate the credential supplied with its API requestsCVE-2026-78362 · WordPress plugins & themes · reported by WPScanCritical 9.8
The SEO Flow by LupsOnline WordPress plugin before 3.0.3 does not correctly validate the credential supplied with its API requests, allowing unauthenticated users to be served as the administrator who configured the SEO Flow by LupsOnline WordPress plugin before 3.0.3 and take over the site. Exploitation requires the SEO Flow by LupsOnline WordPress plugin before 3.0.3 to have been configured, which is its normal operating state.
Product
SEO Flow by LupsOnline
Fixed in
3.0.3
What to do
Update SEO Flow by LupsOnline to 3.0.3 or newer.
NVD record wpscan.com
Sep 5, 2026Hummingbird – Speed Optimization, Caching, Minify, Compress & CDN: Remote Code ExecutionCVE-2026-83627 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Hummingbird – Speed Optimization, Caching, Minify, Compress & CDN plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 3.21.0 via the log_msg() function in core/modules/class-page-cache.php. The page-cache debug log is written to wp-content/wphb-logs/page-caching-log.php, a directly web-accessible PHP file that is supposed to be protected by a leading '<?php die(); ?>' header. That header is guarded by class_exists( 'Filesystem' ), which can never match because class_exists() resolves string arguments in the global namespace while the class is Hummingbird\Core\Filesystem; when the log is created during a front-end request the header is therefore omitted entirely. get_cookies() then writes the raw name of any cookie matching the wphb_cache_ prefix into that file without sanitization. This makes it possible for unauthenticated attackers to write arbitrary PHP into the log file with a single anonymous request and execute it by requesting the file directly, resulting in full remote code execution. Exploitation requires the site administrator to have enabled Page Caching with the Debug Log option (non-default), and the log file to be crea
Product
Hummingbird – Speed Optimization, Caching, Minify, Compress & CDN
Affected
up to 3.21.0
What to do
Affects up to 3.21.0. Update Hummingbird – Speed Optimization, Caching, Minify, Compress & CDN to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 5, 2026Mstore Api: Authentication BypassCVE-2026-13447 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Mstore Api plugin for WordPress is vulnerable to Authentication Bypass via JWT Forgery in versions up to, and including, 4.20.0 This is due to missing cryptographic signature verification in the FirebasePhoneAuthHelper::verify_id_token() function, which decodes and validates Firebase ID token claims (alg, kid, aud, iss) but never calls openssl_verify() or any equivalent to validate the JWT signature against Google's actual public key certificates. This makes it possible for unauthenticated attackers to forge a Firebase Phone Auth JWT signed with a self-generated RSA key pair and impersonate any phone number, resulting in unauthorized access to existing WordPress accounts or creation of new arbitrary accounts.
Product
Mstore Api
Affected
up to 4.20.0
What to do
Affects up to 4.20.0. Update Mstore Api to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 4, 2026The AI Website Builder WordPress plugin (GitHub build) 1.0.0 does not perform any authorisation or nonce check on its REST API routes, allowing unauthenticated CVE-2026-82923 · WordPress plugins & themes · reported by WPScanCritical 9.8
The AI Website Builder WordPress plugin (GitHub build) 1.0.0 does not perform any authorisation or nonce check on its REST API routes, allowing unauthenticated attackers to install and activate plugins and themes, import content from a URL under their control, write a file of their choosing into the uploads directory, and delete site content and media. On a host that serves PHP from the uploads directory, that file write is remote code execution.
What to do
Update the plugin to the newest version.
NVD record wpscan.com
Sep 4, 2026Divi Ajax Filter: Local File InclusionCVE-2026-11613 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Divi Ajax Filter plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 5.1.2 via the 'custom_loop_template' parameter parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. This vulnerability is only exploitable when the loop_templates parameter is set to 'custom-template'.
Product
Divi Ajax Filter
Affected
up to 5.1.2
What to do
Affects up to 5.1.2. Update Divi Ajax Filter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record diviengine.com wordfence.com
Sep 3, 2026Unauthenticated PHP Object Injection in JobSearch <= 3.2.0 versions.CVE-2026-84834 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in JobSearch <= 3.2.0 versions.
What to do
Update the plugin to the newest version.
NVD record patchstack.com
Sep 3, 2026Subscriber Privilege Escalation in Bricksforge <= 3.1.8.8 versions.CVE-2026-84814 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Subscriber Privilege Escalation in Bricksforge <= 3.1.8.8 versions.
What to do
Update the plugin to the newest version.
NVD record patchstack.com
Sep 3, 2026Unauthenticated SQL Injection in GeoDirectory <= 2.8.174 versions.CVE-2026-84813 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in GeoDirectory <= 2.8.174 versions.
What to do
Update the plugin to the newest version.
NVD record patchstack.com
Sep 3, 2026Unauthenticated SQL Injection in VikAppointments Services Booking Calendar <= 1.2.20 versions.CVE-2026-84768 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in VikAppointments Services Booking Calendar <= 1.2.20 versions.
What to do
Update the plugin to the newest version.
NVD record patchstack.com
Sep 3, 2026Unauthenticated PHP Object Injection in Mail Mint <= 1.31.0 versions.CVE-2026-84753 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in Mail Mint <= 1.31.0 versions.
What to do
Update the plugin to the newest version.
NVD record patchstack.com
Sep 3, 2026Unauthenticated Broken Access Control in YITH Request a Quote for WooCommerce Premium < 4.46.0 versions.CVE-2026-84238 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated Broken Access Control in YITH Request a Quote for WooCommerce Premium < 4.46.0 versions.
What to do
Update the plugin to the newest version.
NVD record patchstack.com
Sep 3, 2026Joomla Extension - feenders.de - Unauthenticated SQL injection in JooDatabase Lite < 5.1.0 - The cid parameter is used in queries without validation, allowing SCVE-2026-78080 · Websites & servers · reported by security@joomla.orgCritical 9.3
Joomla Extension - feenders.de - Unauthenticated SQL injection in JooDatabase Lite < 5.1.0 - The cid parameter is used in queries without validation, allowing SQLi vectors.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
NVD record joodb.feenders.de
Sep 3, 2026Joomla Extension - j2commerce.com - Missing authorization on Apps controller delegation chain in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6 - `J2StoreContrCVE-2026-78069 · Websites & servers · reported by security@joomla.orgCritical 9.5
Joomla Extension - j2commerce.com - Missing authorization on Apps controller delegation chain in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6 - `J2StoreControllerApps`'s `appTask` delegation path instantiates app-plugin controllers with no ACL check anywhere in the code. It currently returns 403 only as a side effect of `fof.xml`'s wildcard-deny resolving under the singularised ACL key `app`, which has no explicit allow rule — not because of any deliberate check. Behind that path, `applocalizationdata::getInstallerTool()` used a caller-influenced table name with no allow-list, both to select a `#__j2store_*` table for truncation and to build a path to SQL files it then executes — a path-traversal-capable file read/execute.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
NVD record j2commerce.com
Sep 2, 2026WatchMan-Site7: Does not restrict access to its debugging consoleCVE-2026-77009 · WordPress plugins & themes · reported by WPScanCritical 9.9
The WatchMan-Site7 WordPress plugin through 4.2.0 does not restrict access to its debugging console, which executes user-supplied PHP code, allowing any authenticated user, such as a subscriber, to run arbitrary code on the server.
Product
WatchMan-Site7
Affected
up to 4.2.0
What to do
Affects up to 4.2.0. Update WatchMan-Site7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record wpscan.com
Sep 2, 2026Embed HTML5 Game: Does not properly restrict who can upload files via the pluginCVE-2026-4357 · WordPress plugins & themes · reported by WPScanCritical 10
The Embed HTML5 Game WordPress plugin through 1.3 does not properly restrict who can upload files via the plugin, as well as what can be uploaded, making it possible for unauthenticated attackers to upload PHP backdoors on affected sites.
Product
Embed HTML5 Game
Affected
up to 1.3
What to do
Affects up to 1.3. Update Embed HTML5 Game to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record wpscan.com
Sep 2, 2026The Developer Tools WordPress plugin through 1.1.3 contains an unauthenticated arbitrary file upload vulnerability in the bundled SWFUpload componentCVE-2025-9314 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Developer Tools WordPress plugin through 1.1.3 contains an unauthenticated arbitrary file upload vulnerability in the bundled SWFUpload component
Affected
up to 1.1.3
What to do
Affects up to 1.1.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record wpscan.com
Sep 2, 2026Incorrect Authorization vulnerability in Drupal Commerce PayPal allows Forceful Browsing.CVE-2026-73475 · Websites & servers · reported by mlhess@drupal.orgCritical 9.1
Incorrect Authorization vulnerability in Drupal Commerce PayPal allows Forceful Browsing. This issue affects Commerce PayPal versions: from 0.0.0 to 1.12.0, from 2.0.0 to 2.1.3.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
NVD record drupal.org
Sep 2, 2026Unauthenticated Privilege Escalation in Authorizer <= 3.15.1 versions.CVE-2026-81294 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated Privilege Escalation in Authorizer <= 3.15.1 versions.
What to do
Update the plugin to the newest version.
NVD record patchstack.com
Sep 2, 2026Unauthenticated SQL Injection in WCFM Marketplace <= 3.8.1 versions.CVE-2026-81286 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in WCFM Marketplace <= 3.8.1 versions.
What to do
Update the plugin to the newest version.
NVD record patchstack.com
Sep 2, 2026SigmaForms Pro – AI Generated Forms: Arbitrary file deletionCVE-2026-78657 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The SigmaForms Pro – AI Generated Forms plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_submission_files function in all versions up to, and including, 1.4.11. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). The malicious path traversal URL is submitted via form upload field and stored in the database, with deletion triggered when an administrator deletes the submission record from the admin panel.
Product
SigmaForms Pro – AI Generated Forms
Affected
up to 1.4.11
What to do
Affects up to 1.4.11. Update SigmaForms Pro – AI Generated Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record feedback.bdthemes.com wordfence.com
Sep 2, 2026Booking for Appointments and Events Calendar – Amelia (Premium): Privilege EscalationCVE-2026-9055 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Booking for Appointments and Events Calendar – Amelia (Premium) plugin for WordPress is vulnerable to Privilege Escalation in versions 8.0 - 9.6.2. This is due to insufficient validation of the attacker-controlled 'type' parameter in the customer update endpoint, which allows customers to set their role to 'manager' and trigger creation of a WordPress user with the wpamelia-manager role when the 'externalId' parameter is set to 0. This makes it possible for unauthenticated attackers to escalate their privileges to administrator by first elevating to the manager role, then creating a provider entity linked to an administrator user ID and overwriting that administrator's password.
Product
Booking for Appointments and Events Calendar – Amelia (Premium)
What to do
Update Booking for Appointments and Events Calendar – Amelia (Premium) to the newest version.
NVD record wpamelia.com wordfence.com
Sep 1, 2026Nokri - Job Board WordPress: Privilege EscalationCVE-2026-18550 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Nokri - Job Board WordPress Theme for WordPress is vulnerable to Privilege Escalation via Account Takeover in all versions up to, and including, 1.6.6. This is due to insufficient reset token validation in the `nokri_reset_password()` function, which allows empty attacker-supplied reset tokens to match empty or unset `sb_password_forget_token` user meta values. This makes it possible for unauthenticated attackers to reset the password of any user, including administrators, and gain access to their account.
Product
Nokri - Job Board WordPress
Affected
up to 1.6.6
What to do
Affects up to 1.6.6. Update Nokri - Job Board WordPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record nokriwp.com themeforest.net
Aug 31, 2026WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode: Arbitrary file uploadCVE-2026-75865 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode plugin for WordPress is vulnerable to arbitrary file upload due to missing file type validation in the saas_upload_logo() function combined with an authorization bypass on the WPLP connector REST endpoints in all versions up to, and including, 4.4.1. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode
Affected
up to 4.4.1
What to do
Affects up to 4.4.1. Update WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org wordfence.com
Aug 31, 2026Unauthenticated PHP Object Injection in Tickera <= 3.6.0.2 versions.CVE-2026-82226 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in Tickera <= 3.6.0.2 versions.
What to do
Update the plugin to the newest version.
NVD record patchstack.com
Aug 31, 2026Unauthenticated Arbitrary File Upload in Hash Form <= 1.4.2 versions.CVE-2026-81780 · WordPress plugins & themes · reported by PatchstackCritical 10
Unauthenticated Arbitrary File Upload in Hash Form <= 1.4.2 versions.
What to do
Update the plugin to the newest version.
NVD record patchstack.com
Aug 31, 2026Silk Themes Newspapers X: Improper Validation of Specified Quantity in InputCVE-2026-81779 · WordPress plugins & themes · reported by PatchstackCritical 10
Improper Validation of Specified Quantity in Input vulnerability in Silk Themes Newspapers X allows Malicious Software Implanted. This issue affects Newspapers X: from 1.0.46 through 1.0.48.
Product
Silk Themes Newspapers X
Affected
up to 1.0.48
What to do
Affects up to 1.0.48. Update Silk Themes Newspapers X to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record patchstack.com
Aug 31, 2026Unauthenticated SQL Injection in Throws SPAM Away <= 3.8.2 versions.CVE-2026-81763 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in Throws SPAM Away <= 3.8.2 versions.
What to do
Update the plugin to the newest version.
NVD record patchstack.com
Aug 31, 2026Unauthenticated SQL Injection in Smart Marketing SMS and Newsletters Forms <= 5.1.24 versions.CVE-2026-81756 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in Smart Marketing SMS and Newsletters Forms <= 5.1.24 versions.
What to do
Update the plugin to the newest version.
NVD record patchstack.com
Aug 31, 2026Unauthenticated SQL Injection in WP Data Access <= 5.5.81 versions.CVE-2026-81293 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in WP Data Access <= 5.5.81 versions.
What to do
Update the plugin to the newest version.
NVD record patchstack.com
Aug 31, 2026WP Legal Pages WP Cookie Notice for GDPR, CCPA & ePrivacy Consent: Unrestricted Upload of File with Dangerous TypeCVE-2026-82970 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in WP Legal Pages WP Cookie Notice for GDPR, CCPA & ePrivacy Consent allows Using Malicious Files. This issue affects WP Cookie Notice for GDPR, CCPA & ePrivacy Consent: from n/a through 4.4.1.
Product
WP Legal Pages WP Cookie Notice for GDPR, CCPA & ePrivacy Consent
Affected
up to 4.4.1
What to do
Affects up to 4.4.1. Update WP Legal Pages WP Cookie Notice for GDPR, CCPA & ePrivacy Consent to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record patchstack.com
Aug 31, 2026ProfilePress (wp-user-avatar) WordPress plugin before 4.17.2 contains an unauthenticated remote code execution vulnerability that allows unauthenticated attackeCVE-2026-66047 · WordPress plugins & themes · reported by VulnCheckCritical 9.2
ProfilePress (wp-user-avatar) WordPress plugin before 4.17.2 contains an unauthenticated remote code execution vulnerability that allows unauthenticated attackers to install and activate arbitrary plugins by brute-forcing a weak 32-bit connect token via the ppress_connect_process AJAX handler. Attackers can supply a caller-controlled URL through the file request parameter to trigger silent plugin installation and activation, achieving PHP code execution as the web-server user.
Fixed in
4.17.2
What to do
Update the plugin to 4.17.2 or newer.
NVD record profilepress.com wordpress.org
Aug 30, 2026MyHome Core: Authentication BypassCVE-2026-15980 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The MyHome Core plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 4.4.5. This is due to missing authorization in the send_link() AJAX handler and improper token validation in the activate() function. This makes it possible for unauthenticated attackers to generate an activation token for an unconfirmed user account and obtain a valid authentication cookie for that account, including administrators. Successful exploitation requires the MyHome theme to be configured in legacy/WPBakery mode with frontend registration and confirmation email enabled, and the target account must not already have the myhome_agent_confirmed user meta set.
Product
MyHome Core
Affected
up to 4.4.5
What to do
Affects up to 4.4.5. Update MyHome Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record themeforest.net wordfence.com
Aug 29, 2026Custom User Registration Fields for WooCommerce: Privilege EscalationCVE-2026-15369 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Custom User Registration Fields for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 2.2.3. This is due to the plugin accepting an attacker-controlled afreg_select_user_role value from the unauthenticated WooCommerce Store API /wc/store/v1/checkout request in the af_reg_checkout_data_to_order_meta_data_block() function, persisting it in order meta, and then passing it directly to WP_User::add_role() in the af_reg_custom_order_processing_function() function (hooked to woocommerce_thankyou) without validating against the plugin's admin-configured allowed role list. This makes it possible for unauthenticated attackers to elevate their privileges to Administrator by creating an account during checkout with a modified JSON body specifying administrator (or any other role slug) as the desired role. Note: The exploit requires the "User Role Selection" setting to be enabled.
Product
Custom User Registration Fields for WooCommerce
Affected
up to 2.2.3
What to do
Affects up to 2.2.3. Update Custom User Registration Fields for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record woocommerce.com wordfence.com
Aug 29, 2026Sigma Forms Pro: Remote Code ExecutionCVE-2026-14494 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Sigma Forms Pro plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.4.5 via the handle_form_submission function. This is due to the plugin dynamically granting the unfiltered_upload capability to all users during form submissions and bypassing MIME type validation when allowed_file_types is not configured. This makes it possible for unauthenticated attackers to execute code on the server. Several default pre-built templates including Job Application, Support Ticket, and Wholesale Application have file upload fields with no file type restrictions configured by design, making this vulnerability immediately exploitable upon installation.
Product
Sigma Forms Pro
Affected
up to 1.4.5
What to do
Affects up to 1.4.5. Update Sigma Forms Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record feedback.bdthemes.com wordfence.com
Aug 29, 2026爱采集数据采集和发布插件: Does not require a per-install secret for one of its unauthenticated endpointsCVE-2026-77012 · WordPress plugins & themes · reported by WPScanCritical 9.3
The 爱采集数据采集和发布插件 WordPress plugin through 1.0.0 does not require a per-install secret for one of its unauthenticated endpoints, relying on a hardcoded default, and does not validate the URLs or destination paths it is given, allowing unauthenticated attackers to read arbitrary files from the server, force it to issue arbitrary requests and retrieve the responses, and write attacker-supplied content outside the uploads directory.
Product
爱采集数据采集和发布插件
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update 爱采集数据采集和发布插件 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record wpscan.com
Aug 29, 2026Total processing card payments for WooCommerce: Does not validate a user-supplied path before using it to build a server-side verification requestCVE-2026-16947 · WordPress plugins & themes · reported by WPScanCritical 9.1
The Total processing card payments for WooCommerce WordPress plugin through 7.3 does not validate a user-supplied path before using it to build a server-side verification request, and does not verify the authenticity of the response, allowing unauthenticated attackers to redirect that request to an arbitrary host (disclosing the merchant's payment-gateway credentials) and to forge a success response that marks arbitrary WooCommerce orders as paid.
Product
Total processing card payments for WooCommerce
Affected
up to 7.3
What to do
Affects up to 7.3. Update Total processing card payments for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record wpscan.com
Aug 29, 2026Uix UserCenter: Does not verify that the account being modified through an unauthenticated profile-update action belongs to the requesterCVE-2026-16259 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Uix UserCenter WordPress plugin through 1.0.3 does not verify that the account being modified through an unauthenticated profile-update action belongs to the requester, and it authenticates that action with a token whose signing key is hardcoded and identical across every install, allowing unauthenticated attackers to forge a token for any user, overwrite an administrator's email and password, and take over the account.
Product
Uix UserCenter
Affected
up to 1.0.3
What to do
Affects up to 1.0.3. Update Uix UserCenter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record wpscan.com
Aug 29, 2026MemberHero: Does not restrictCVE-2026-10522 · WordPress plugins & themes · reported by WPScanCritical 9.8
The MemberHero WordPress plugin through 6.9 does not restrict which account fields can be supplied during its frontend registration process, allowing unauthenticated attackers to register a new user with an arbitrary role, including Administrator, leading to a full site takeover. Version 6.9 is advertised as resolving this issue, but the fix is incomplete and the current version remains exploitable by unauthenticated attackers to obtain administrator access and to take over existing accounts. No version that fully addresses the issue is available at the time of this advisory. Mitigation: deactivate and remove the MemberHero WordPress plugin through 6.9 until a version that fully resolves this issue is released. If the MemberHero WordPress plugin through 6.9 must stay active, disable public registration, restrict access to the registration functionality, and monitor the site for unexpected administrator accounts.
Product
MemberHero
Affected
up to 6.9
What to do
Affects up to 6.9. Update MemberHero to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record wpscan.com
Aug 28, 2026Liquid Web / StellarWP GiveWP: Deserialization of Untrusted DataCVE-2026-82222 · WordPress plugins & themes · reported by PatchstackCritical 10
Deserialization of Untrusted Data vulnerability in Liquid Web / StellarWP GiveWP allows Object Injection. This issue affects GiveWP: from n/a through 4.16.7.1.
Product
Liquid Web / StellarWP GiveWP
Affected
up to 4.16.7.1
What to do
Affects up to 4.16.7.1. Update Liquid Web / StellarWP GiveWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record patchstack.com patchstack.com
Aug 28, 2026WPMU DEV Dashboard: Authentication BypassCVE-2026-76581 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The WPMU DEV Dashboard plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.0.1. This is due to inconsistent and ambiguous HMAC message construction between the unauthenticated `wdpsso_step1` and `wdpsso_step2` AJAX actions, where step 1 signs and discloses an unseparated concatenation of the token, state, redirect, and domain values, while step 2 verifies an unseparated concatenation that omits the domain field. This makes it possible for unauthenticated attackers, on sites connected to WPMU DEV with Hub SSO enabled and mapped to an administrator, to obtain a valid HMAC from step 1 and replay it to step 2 by moving the domain value into the redirect field, resulting in an authenticated administrator session.
Product
WPMU DEV Dashboard
Affected
up to 5.0.1
What to do
Affects up to 5.0.1. Update WPMU DEV Dashboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record wpmudev.com wordfence.com
Aug 27, 2026Tutor LMS: Does not prevent request data from overwriting internal variables while rendering templatesCVE-2026-19092 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Tutor LMS WordPress plugin before 4.0.6 does not prevent request data from overwriting internal variables while rendering templates, allowing unauthenticated users to invoke arbitrary zero-argument PHP functions and receive their output.
Product
Tutor LMS
Fixed in
4.0.6
What to do
Update Tutor LMS to 4.0.6 or newer.
NVD record wpscan.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. The WordPress, CMS and hosting-panel entries come from the National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan and others); we show who. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Start a project

Tell us what you're building.

A website, a booking system, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.

01The person who'll build it writes back

02A planning call, then a written plan with the price and the date

03A preview on your phone while it's being built

04Launch night handled: redirects, email, Google

843-331-6339

Not ready to talk yet? Run the free website check and see what Google sees.