Updated 2 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

33added in the last 30 days

578new WordPress flaws this week

391,397entries in the database

24,208 results · page 60 of 485

Aug 16, 2026WC Product Table Lite: CSS InjectionCVE-2026-15441 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WC Product Table Lite plugin for WordPress is vulnerable to CSS Injection in versions up to, and including, 5.6.0 via the 'laptop_scroll_offset' shortcode attribute exposed through the unauthenticated wcpt_ajax() AJAX handler. The handler is registered for wp_ajax_nopriv_wcpt_ajax, JSON-decodes attacker-supplied attributes, only allowlists key names (not values), applies a preg_replace that strips only [ ] < >, and passes the value through do_shortcode into wcpt_style__sticky_sidebar(), where it is interpolated verbatim into inline CSS ('top: {$top}px;' and 'max-height: calc(100vh - {$top}px);') with no numeric casting or CSS escaping. This makes it possible for unauthenticated attackers to inject arbitrary CSS declarations and rules on pages rendering a product table with sticky sidebar enabled, which can be leveraged for data exfiltration (via attribute-selector + background-image URLs), UI redressing, and phishing that bypasses CSPs permitting inline styles.
Product
WC Product Table Lite
Affected
up to 5.6.0
What to do
Affects up to 5.6.0. Update WC Product Table Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 16, 2026Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution: Stored Cross-Site ScriptingCVE-2026-15009 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'soundFile' parameter in all versions up to, and including, 5.4.12 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the attacker to control a domain whose origin string is a leading prefix of the target site's backend URL (e.g. https://example.co against https://example.com), and the victim must be an authenticated WordPress administrator who visits the attacker-controlled page while the File Manager admin screen is open.
Product
Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution
Affected
up to 5.4.12
What to do
Affects up to 5.4.12. Update Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 16, 2026ProSolution WP Client: Arbitrary file deletionCVE-2026-14524 · WordPress plugins & themes · reported by WordfenceCritical 9.1
The ProSolution WP Client plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the proSol_fileDeleteProcess function in all versions up to, and including, 2.0.8. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). An attacker must first call the proSol_fileUploadModalProcess handler to poison their own session with a path-traversal key, then call proSol_fileDeleteProcess with that key as the filename parameter; both steps require only the publicly exposed frontend nonce.
Product
ProSolution WP Client
Affected
up to 2.0.8
What to do
Affects up to 2.0.8. Update ProSolution WP Client to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 16, 2026Query Wrangler: Remote Code ExecutionCVE-2026-14498 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Query Wrangler plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.5.57 via the 'options' parameter parameter. This is due to missing capability check and nonce verification on the wp_ajax_qw_form_ajax handler, combined with unsanitized attacker-controlled options fully replacing saved query options and being passed directly to call_user_func_array() guarded only by function_exists(). This makes it possible for authenticated attackers, with subscriber-level access and above, to execute code on the server. Exploitation requires only that at least one query row exists in the database, as the query_id is a small enumerable integer with no further access control.
Product
Query Wrangler
Affected
up to 1.5.57
What to do
Affects up to 1.5.57. Update Query Wrangler to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 16, 2026Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI: Authorization bypassCVE-2026-13167 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.5.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with delegated form management access and above, to activate arbitrary already-installed WordPress plugins — including previously deactivated or vulnerable plugins — without holding the core activate_plugins capability. Exploitation requires the target user to hold a delegated Everest Forms capability (manage_everest_forms, everest_forms_create_forms, or everest_forms_view_forms), which the plugin's own roles and permissions tool allows administrators to assign to non-administrator roles such as Author; the nonces required to exploit the AJAX handlers are emitted on EVF admin pages accessible to any such delegated user.
Product
Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI
Affected
up to 3.5.2
What to do
Affects up to 3.5.2. Update Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 15, 2026Link Library: Arbitrary file deletionCVE-2026-18855 · WordPress plugins & themes · reported by WordfenceCritical 9.1
The Link Library plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the ll_delete_link_fields function in all versions up to, and including, 7.9.4 This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). Exploitation requires the administrator to have enabled the 'Delete local file on link deletion' plugin option (disabled by default) and to subsequently permanently delete the attacker-submitted link, which is a routine moderation action.
Product
Link Library
Affected
up to 7.9.4
What to do
Affects up to 7.9.4. Update Link Library to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 15, 2026Pods – Custom Content Types and Fields: Privilege EscalationCVE-2026-19598 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Pods – Custom Content Types and Fields plugin for WordPress is vulnerable to Privilege Escalation via Authorization Bypass in all versions up to, and including, 3.3.9. The vulnerability exists because the pods_admin AJAX router funnels every access check — including the method allowlist, nonce verification, login enforcement, and capability gate — through pods_error(), which under the JSON meta-box-loader compatibility path only writes failures to the PHP error log and returns false instead of terminating the request, rendering all guards ineffective. This makes it possible for unauthenticated attackers to escalate their privileges to Administrator or overwrite the password of any user account, including the site owner's, enabling complete site takeover, or perform another administrator action.
Product
Pods – Custom Content Types and Fields
Affected
up to 3.3.9
What to do
Affects up to 3.3.9. Update Pods – Custom Content Types and Fields to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Aug 15, 2026WPML Multilingual CMS: SQL InjectionCVE-2026-12248 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The WPML Multilingual CMS plugin for WordPress is vulnerable to SQL Injection via the 'sorting' parameter in all versions up to, and including, 4.9.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with translator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
WPML Multilingual CMS
Affected
up to 4.9.5
What to do
Affects up to 4.9.5. Update WPML Multilingual CMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 15, 2026Templately – Elementor & Gutenberg Template Library: 6500+ Free & Pro Ready Templates And Cloud!: Remote Code ExecutionCVE-2026-18438 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Templately – Elementor & Gutenberg Template Library: 6500+ Free & Pro Ready Templates And Cloud! plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 3.7.1 via the fetch_remote_file function. This is due to a filename validation/destination mismatch in fetch_remote_file, where file type validation is performed against the attacker-controlled Content-Disposition filename rather than the URL-path-derived destination filename. This makes it possible for authenticated attackers, with contributor-level access and above, to execute code on the server. A GIF+PHP polyglot file passes wp_check_filetype_and_ext validation as image/gif via the Content-Disposition filename, while the actual destination path is written with a .php extension derived from the URL path, bypassing the unfiltered_upload capability gate entirely. The affected endpoints are reachable at this privilege level because Templately's entire REST API — including the cloud import endpoints used in this attack (/templately/v1/clouds/upload and /templately/v1/insert) — is authorized only by a current_user_can('delete_posts') check, with no administrator or manage_options capabili
Product
Templately – Elementor & Gutenberg Template Library: 6500+ Free & Pro Ready Templates And Cloud!
Affected
up to 3.7.1
What to do
Affects up to 3.7.1. Update Templately – Elementor & Gutenberg Template Library: 6500+ Free & Pro Ready Templates And Cloud! to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 15, 2026Real Estate Manager Pro: Privilege EscalationCVE-2026-15142 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Real Estate Manager Pro plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 12.8.6. This is due to improper capability handling in the allow_attachment_actions() function, which can treat a target user ID as a media attachment ID during user capability checks. This makes it possible for authenticated attackers, with Subscriber-level access and above, to edit an administrator account and escalate their privileges to Administrator when the targeted user ID matches the ID of an existing media attachment.
Product
Real Estate Manager Pro
Affected
up to 12.8.6
What to do
Affects up to 12.8.6. Update Real Estate Manager Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wp-rem.com wordfence.com
Aug 15, 2026User Profile Builder: Authentication BypassCVE-2026-15826 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The User Profile Builder plugin for WordPress is vulnerable to Authentication Bypass via Type Confusion in versions up to, and including, 3.16.4. This is due to the wppb_log_in_user() function calling absint() on the return value of wp_insert_user() before performing an is_wp_error() check — when a registration is submitted with a 61–70 character username, WordPress core rejects it with a WP_Error object, but absint() coerces that object to the integer 1 before the error check can short-circuit execution, causing the plugin to bind and return a transient-backed autologin nonce tied to user ID 1. This makes it possible for unauthenticated attackers to log in as the site's Administrator account (user ID 1), resulting in full administrative takeover of the site.
Product
User Profile Builder
Affected
up to 3.16.4
What to do
Affects up to 3.16.4. Update User Profile Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 15, 2026Wholesale Market: Privilege escalationCVE-2026-14279 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Wholesale Market plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 2.2.2 via the ced_wholesale_request_send AJAX action. The ced_wholesale_request_send_callback() handler only verifies a nonce (which is exposed to any authenticated user through wp_localize_script on the frontend) and that the caller has a positive user ID, then calls WP_User::add_role() with the client-supplied role_required POST parameter without restricting the value to an allowlist of wholesale roles. This makes it possible for authenticated attackers, with Subscriber-level access and above, to elevate their privileges to Administrator when the site administrator has enabled the 'Assigning requested role directly' option.
Product
Wholesale Market
Affected
up to 2.2.2
What to do
Affects up to 2.2.2. Update Wholesale Market to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 15, 2026ECS: Does not have capability or ownership checks on its dynamic repeater actionsCVE-2026-18807 · WordPress plugins & themes · reported by WPScanMedium 4.3
The ECS WordPress plugin before 4.3.13 does not have capability or ownership checks on its dynamic repeater actions, relying only on a nonce available to any user who can open the page builder, allowing users with a contributor-level account or above to read, alter and delete the binding configuration of posts they do not own and to change the ECS WordPress plugin before 4.3.13's site-wide presets.
Product
ECS
Fixed in
4.3.13
What to do
Update ECS to 4.3.13 or newer.
Full record and what to do →NVD record wpscan.com
Aug 15, 2026Backup Migration: Does not properly restrict a post-restore automatic login mechanismCVE-2026-18216 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Backup Migration WordPress plugin before 2.1.7 does not properly restrict a post-restore automatic login mechanism, allowing a user who administers one site of a multisite network to obtain a long-lived authenticated session as an administrator of another site in the same network, without credentials and bypassing two-factor authentication.
Product
Backup Migration
Fixed in
2.1.7
What to do
Update Backup Migration to 2.1.7 or newer.
Full record and what to do →NVD record wpscan.com
Aug 15, 2026Product Feed PRO for WooCommerce by AdTribes: Does not perform an authorization check on one of its REST read routesCVE-2026-16611 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Product Feed PRO for WooCommerce by AdTribes WordPress plugin before 13.5.7 does not perform an authorization check on one of its REST read routes, allowing unauthenticated users to disclose a store's feed configuration (rules, filters and field mapping) and to enumerate the full product category taxonomy.
Product
Product Feed PRO for WooCommerce by AdTribes
Fixed in
13.5.7
What to do
Update Product Feed PRO for WooCommerce by AdTribes to 13.5.7 or newer.
Full record and what to do →NVD record wpscan.com
Aug 15, 2026Groundhogg — CRM, Newsletters, and Marketing Automation: Generic SQL InjectionCVE-2026-18387 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to generic SQL Injection via the 'tag_query' parameter in all versions up to, and including, 4.5.14 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with vendor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Exploitation requires the attacker to trigger the vulnerable Legacy_Contact_Query code path by submitting an unknown filter type (e.g. filters[0][0][type]=force_fallback), which causes a FilterException that dispatches execution away from the modern query handler.
Product
Groundhogg — CRM, Newsletters, and Marketing Automation
Affected
up to 4.5.14
What to do
Affects up to 4.5.14. Update Groundhogg — CRM, Newsletters, and Marketing Automation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 15, 2026Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe: Second-Order SQL InjectionCVE-2026-16586 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe plugin for WordPress is vulnerable to Second-Order SQL Injection via MultipleFiles Second-Order Payload via 'cg_multiple_files_for_post' -> 'cgRealId' in all versions up to, and including, 30.0.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with author-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe
Affected
up to 30.0.7
What to do
Affects up to 30.0.7. Update Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 15, 2026Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms: Generic SQL InjectionCVE-2026-16146 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms plugin for WordPress is vulnerable to generic SQL Injection via Pattern JSON Keys/Values in all versions up to, and including, 5.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with editor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms
Affected
up to 5.1
What to do
Affects up to 5.1. Update Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 15, 2026Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms: Generic SQL InjectionCVE-2026-16094 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms plugin for WordPress is vulnerable to generic SQL Injection via the 'key' parameter in all versions up to, and including, 5.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with editor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms
Affected
up to 5.1
What to do
Affects up to 5.1. Update Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 15, 2026Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder: Blind SQL InjectionCVE-2026-15993 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to blind SQL Injection via '{username}' Placeholder in Dynamic-Choice Field WHERE Clause in all versions up to, and including, 1.15.44 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This requires that a form is configured with a DB-backed dynamic choice field whose WHERE template references the {username} placeholder, and the attacker must first set their own display_name to a SQL payload via the standard WordPress profile edit screen before triggering the fm_reload_input AJAX endpoint.
Product
Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder
Affected
up to 1.15.44
What to do
Affects up to 1.15.44. Update Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 15, 2026KiviCare – Clinic & Patient Management System (EHR): Generic SQL InjectionCVE-2026-15453 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to generic SQL Injection via the 'searchTerm' parameter in all versions up to, and including, 4.5.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with custom-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Exploitation requires a KiviCare custom role with the 'settings_view' permission (e.g., Doctor or Receptionist), meaning standard WordPress subscribers cannot exploit this without a KiviCare-assigned role.
Product
KiviCare – Clinic & Patient Management System (EHR)
Affected
up to 4.5.1
What to do
Affects up to 4.5.1. Update KiviCare – Clinic & Patient Management System (EHR) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 14, 2026Booking calendar, Appointment Booking System: Authorization bypassCVE-2026-8840 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Booking calendar, Appointment Booking System plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.2.36. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to mark arbitrary reservations as paid or completed, cancel legitimate payments, auto-approve reservations, and trigger transactional booking emails by writing attacker-supplied payment status and transaction data directly into the payments table. The auto-approval of reservations is only triggered when the 'enable_psuccess_approval' site option is enabled, but payment status manipulation and email dispatch are exploitable regardless of that setting.
Product
Booking calendar, Appointment Booking System
Affected
up to 3.2.36
What to do
Affects up to 3.2.36. Update Booking calendar, Appointment Booking System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 14, 2026Image Uploader for Welcart: Generic SQL InjectionCVE-2026-16080 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Image Uploader for Welcart plugin for WordPress is vulnerable to generic SQL Injection via the 'post_title' parameter in all versions up to, and including, 1.4.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with author-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Image Uploader for Welcart
Affected
up to 1.4.6
What to do
Affects up to 1.4.6. Update Image Uploader for Welcart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 14, 2026User Session Synchronizer: Authentication Bypass leading to Account TakeoverCVE-2026-15341 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The User Session Synchronizer plugin for WordPress is vulnerable to Authentication Bypass leading to Account Takeover in all versions up to, and including, 1.4.0. The `synchronize_session()` function, hooked on `init` and therefore executed on every request, performs no nonce, capability, or shared-secret validation against the attacker-supplied `ussync-key`, `ussync-token`, and `ussync-ref` parameters; when `ussync-key` references an unregistered slot, `get_option()` returns `false` for both the secret key and the domain list, causing the AES-256-CBC encryption key to degrade to the fully predictable `md5('')` and the referer allowlist to collapse to an empty-string match, while the AES IV is unconditionally hard-coded as `md5('another-secret')`. This makes it possible for unauthenticated attackers to supply a crafted request encrypting any known or guessable user email address in the `ussync-ref` parameter, causing the handler to call `wp_set_auth_cookie()` for the matched user and granting full authentication as that user — including administrators — with no prior knowledge of site secrets.
Product
User Session Synchronizer
Affected
up to 1.4.0
What to do
Affects up to 1.4.0. Update User Session Synchronizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 14, 2026Propovoice: All-in-One Client Management System: Privilege EscalationCVE-2026-15312 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Propovoice: All-in-One Client Management System plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.7.8. This is due to the `create()` function's REST endpoint failing to validate the user-supplied `role` parameter against an allowlist of permitted WordPress roles and omitting any `promote_users` capability check before passing the sanitized value directly to `WP_User::set_role()`. This makes it possible for authenticated attackers with `ndpv_manager`-level access and above to create a new WordPress user account with the `administrator` role assigned, achieving full vertical privilege escalation. The `ndpv_manager` capability is a sub-administrator CRM team role granted by Propovoice itself, meaning the attack surface extends beyond site administrators to any user the plugin has elevated to a manager position.
Product
Propovoice: All-in-One Client Management System
Affected
up to 1.7.8
What to do
Affects up to 1.7.8. Update Propovoice: All-in-One Client Management System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 14, 20266Storage Rentals: Authentication bypassCVE-2026-15303 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The 6Storage Rentals plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.27.0. This is due to the six_storage_create_wp_user() AJAX handler being registered on wp_ajax_nopriv_six_storage_create_wp_user without any nonce, capability, credential, or ownership verification, while calling wp_set_current_user() and wp_set_auth_cookie() for any WordPress user resolved by the attacker-supplied email address. This makes it possible for unauthenticated attackers to log in as any existing WordPress user, including administrators, by submitting that user's email address.
Product
6Storage Rentals
Affected
up to 2.27.0
What to do
Affects up to 2.27.0. Update 6Storage Rentals to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 14, 2026Object Sync for Salesforce: Unauthenticated SQL InjectionCVE-2026-15162 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Object Sync for Salesforce plugin is vulnerable to unauthenticated SQL Injection via the wordpress_object_type parameter of its /wp-json/object-sync-for-salesforce/push/ REST route. The route's permission callback (can_process()) checks only the HTTP method for the push class — no capability or nonce — so it is reachable by unauthenticated users. The wordpress_object_type value is concatenated directly into a SQL query (post_type = "$object_type", class-object-sync-sf-wordpress.php:328) and executed via $wpdb->get_results() with no $wpdb->prepare() (:578). Because REST body parameters are not magic-quoted, an attacker can break out of the quoted string and inject arbitrary SQL. This makes it possible for unauthenticated attackers to append additional SQL queries (time-based blind), enabling extraction of sensitive information such as password hashes from the database. Only a valid wordpress_id (e.g. 1) is required — no authentication or Salesforce connection.
Product
Object Sync for Salesforce
What to do
Update Object Sync for Salesforce to the newest version.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 14, 2026bLoyal: Loyalty & Promotions by bLoyal: Privilege EscalationCVE-2026-15001 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The bLoyal: Loyalty & Promotions by bLoyal plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.1.611.78. This is due to the AJAX actions `save_bloyal_configuration_data` and `save_bloyal_accesskeyverification_data` being registered without any capability or nonce checks, and the `bloyal_customer_auto_login` function unconditionally trusting the `Customer.ExternalId` value returned by whichever API URL is stored in the plugin's options. This makes it possible for authenticated attackers, with Subscriber-level access and above, to overwrite the plugin's bLoyal Loyalty Engine API URL (`bloyal_custom_loyaltyengine_api_url`) and the `is_bloyal_custom_api_url` flag via the unprotected AJAX actions, then trigger the unauthenticated `/cart` REST route to cause `bloyal_customer_auto_login` to fetch customer data from an attacker-controlled endpoint and call `wp_set_auth_cookie()` with an attacker-supplied `Customer.ExternalId`, thereby authenticating as any WordPress user including the site Administrator.
Product
bLoyal: Loyalty & Promotions by bLoyal
Affected
up to 3.1.611.78
What to do
Affects up to 3.1.611.78. Update bLoyal: Loyalty & Promotions by bLoyal to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 14, 2026RapiSafe – Secure Multi File Upload for Contact Form 7: Arbitrary file deletionCVE-2026-14484 · WordPress plugins & themes · reported by WordfenceCritical 9.1
The RapiSafe – Secure Multi File Upload for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the handleAjaxRemoveUpload function in all versions up to, and including, 1.0.4. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). The nonce required to invoke the removal handler is exposed in public-facing JavaScript as RSMFCF7Vars.nonce on every Contact Form 7 page rendering a RapiSafe upload field, making it obtainable by any unauthenticated visitor.
Product
RapiSafe – Secure Multi File Upload for Contact Form 7
Affected
up to 1.0.4
What to do
Affects up to 1.0.4. Update RapiSafe – Secure Multi File Upload for Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 14, 2026Pinpoint Booking System – Version 2: Price ManipulationCVE-2026-12128 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Pinpoint Booking System – Version 2 plugin for WordPress is vulnerable to Price Manipulation via the `cart_data` parameter in all versions up to, and including, 2.9.9.6.8. This is due to the `dopbsp_woocommerce_add_to_cart` AJAX action being registered via `wp_ajax_nopriv_*` with no authentication, no nonce verification, and no server-side recalculation of pricing — the `update` handler reads `price_total` directly from the attacker-controlled `cart_data` POST parameter and persists it to the database via `$wpdb->insert()` without validating it against the calendar's configured pricing. The `woocommerce_before_calculate_totals` callback subsequently reads the stored attacker-supplied value back from the database and passes it directly to `$product->set_price()` without recomputing from calendar settings. This makes it possible for unauthenticated attackers to override the WooCommerce checkout price of any bookable product tied to a booking calendar to an arbitrary value, effectively enabling the purchase of any such product at a self-chosen price.
Product
Pinpoint Booking System – Version 2
Affected
up to 2.9.9.6.8
What to do
Affects up to 2.9.9.6.8. Update Pinpoint Booking System – Version 2 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 14, 2026Essential Addons for Elementor: Does not prevent user-supplied registration fields from overwriting reserved account attributesCVE-2026-18039 · WordPress plugins & themes · reported by WPScanHigh 8.1
The Essential Addons for Elementor WordPress plugin before 6.7.2 does not prevent user-supplied registration fields from overwriting reserved account attributes, allowing unauthenticated attackers to register an account with an arbitrary role, including administrator, on sites where a custom profile field with a particular label has been configured.
Product
Essential Addons for Elementor
Fixed in
6.7.2
What to do
Update Essential Addons for Elementor to 6.7.2 or newer.
Full record and what to do →NVD record wpscan.com
Aug 14, 2026Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder: Generic SQL InjectionCVE-2026-16810 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder plugin for WordPress is vulnerable to generic SQL Injection via the 'data[queryCondition]' parameter in all versions up to, and including, 3.2.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder
Affected
up to 3.2.0
What to do
Affects up to 3.2.0. Update Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 14, 2026Epeken All Kurir for Woocommerce: Does not verify that a payment-confirmation request originates from the owner of the targeted orderCVE-2026-16739 · WordPress plugins & themes · reported by WPScanMedium 5.9
The Epeken All Kurir for Woocommerce WordPress plugin through 2.1.4 does not verify that a payment-confirmation request originates from the owner of the targeted order, nor that any payment actually occurred, allowing unauthenticated attackers to mark arbitrary orders as confirmed and, in a non-default configuration, paid.
Product
Epeken All Kurir for Woocommerce
Affected
up to 2.1.4
What to do
Affects up to 2.1.4. Update Epeken All Kurir for Woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Aug 14, 2026affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display: Time-based SQL InjectionCVE-2026-12743 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display plugin for WordPress is vulnerable to time-based SQL Injection via the 'orderby' parameter in all versions up to, and including, 3.8.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display
Affected
up to 3.8.8
What to do
Affects up to 3.8.8. Update affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 13, 2026Ninja Tables Pro 5.2.11 contains an embedded malicious code vulnerability introduced via a tampered plugin build served through a decommissioned update server.CVE-2026-73533 · WordPress plugins & themes · reported by VulnCheckCritical 9.3
Ninja Tables Pro 5.2.11 contains an embedded malicious code vulnerability introduced via a tampered plugin build served through a decommissioned update server. The tampered build introduced a rogue PHP file (app/Library/updater/NinjaTableDataSync.php) that established a backdoor REST API endpoint, dropped persistent PHP files in mu-plugins and uploads directories, installed a passwordless administrator account, and registered scheduled tasks that survived plugin removal.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record wordpress.org wpmanageninja.com
Aug 13, 2026Fluent Forms Pro 6.2.7 contains an embedded malicious code vulnerability introduced via a tampered plugin build served through a decommissioned update server.CVE-2026-73532 · WordPress plugins & themes · reported by VulnCheckCritical 9.3
Fluent Forms Pro 6.2.7 contains an embedded malicious code vulnerability introduced via a tampered plugin build served through a decommissioned update server. The tampered build introduced a rogue PHP file (libs/class-license-sync.php), loaded via a require_once directive added to fluentformpro.php, that established a backdoor REST API endpoint, dropped persistent PHP files in mu-plugins and uploads directories, installed a passwordless administrator account, and registered scheduled tasks that survived plugin removal.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com wordpress.org
Aug 13, 2026Samex - Clean, Minimal Shop WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-28154 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in snstheme Samex - Clean, Minimal Shop WooCommerce WordPress Theme and snstheme M.Anh - Fashion WooCoommerce WordPress Theme allows Reflected XSS. This issue affects Samex - Clean, Minimal Shop WooCommerce WordPress Theme: from n/a through 2.5; M.Anh - Fashion WooCoommerce WordPress Theme: from n/a through 1.7.
Product
Samex - Clean, Minimal Shop WooCommerce
Affected
up to 2.5
What to do
Affects up to 2.5. Update Samex - Clean, Minimal Shop WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Aug 13, 2026Unauthenticated Broken Access Control in User Registration <= 5.2.6 versions.CVE-2026-73403 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Broken Access Control in User Registration <= 5.2.6 versions.
Affected
up to 5.2.6
What to do
Affects up to 5.2.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 13, 2026Unauthenticated Broken Access Control in InstaWP Connect <= 0.1.3.7 versions.CVE-2026-73401 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Broken Access Control in InstaWP Connect <= 0.1.3.7 versions.
Affected
up to 0.1.3.7
What to do
Affects up to 0.1.3.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 13, 2026Donor Cross Site Scripting (XSS) in GiveWP < 4.16.6 versions.CVE-2026-73357 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Donor Cross Site Scripting (XSS) in GiveWP < 4.16.6 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Aug 13, 2026Unauthenticated Broken Access Control in Revolut Gateway for WooCommerce < 4.22.10 versions.CVE-2026-73353 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Broken Access Control in Revolut Gateway for WooCommerce < 4.22.10 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Aug 13, 2026Unauthenticated Broken Access Control in GiveWP < 4.16.6 versions.CVE-2026-73349 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Broken Access Control in GiveWP < 4.16.6 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Aug 13, 2026Administrator SQL Injection in MailChimp For WooCommerce < 6.2 versions.CVE-2026-73346 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Administrator SQL Injection in MailChimp For WooCommerce < 6.2 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Aug 13, 2026Author Cross Site Scripting (XSS) in WP Data Access <= 5.5.79 versions.CVE-2026-73344 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Author Cross Site Scripting (XSS) in WP Data Access <= 5.5.79 versions.
Affected
up to 5.5.79
What to do
Affects up to 5.5.79. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 13, 2026Contributor Cross Site Scripting (XSS) in Featured Image from URL <= 5.3.3 versions.CVE-2026-73340 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Cross Site Scripting (XSS) in Featured Image from URL <= 5.3.3 versions.
Affected
up to 5.3.3
What to do
Affects up to 5.3.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 13, 2026Unauthenticated Server Side Request Forgery (SSRF) in Gutenverse Companion <= 2.5.1 versions.CVE-2026-66704 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Unauthenticated Server Side Request Forgery (SSRF) in Gutenverse Companion <= 2.5.1 versions.
Affected
up to 2.5.1
What to do
Affects up to 2.5.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 13, 2026Unauthenticated Cross Site Scripting (XSS) in Smart Online Order for Clover <= 1.6.1 versions.CVE-2026-66700 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Smart Online Order for Clover <= 1.6.1 versions.
Affected
up to 1.6.1
What to do
Affects up to 1.6.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 13, 2026Unauthenticated Cross Site Scripting (XSS) in SureDash <= 1.10.1 versions.CVE-2026-66698 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in SureDash <= 1.10.1 versions.
Affected
up to 1.10.1
What to do
Affects up to 1.10.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 13, 2026Unauthenticated Cross Site Scripting (XSS) in Colissimo Officiel : Méthodes de livraison pour WooCommerce <= 2.10.0 versions.CVE-2026-66697 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Colissimo Officiel : Méthodes de livraison pour WooCommerce <= 2.10.0 versions.
Affected
up to 2.10.0
What to do
Affects up to 2.10.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 13, 2026Subscriber Broken Access Control in Motors <= 1.4.113 versions.CVE-2026-66693 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Subscriber Broken Access Control in Motors <= 1.4.113 versions.
Affected
up to 1.4.113
What to do
Affects up to 1.4.113. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.