Updated 7 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

33added in the last 30 days

528new WordPress flaws this week

391,528entries in the database

35,102 results · page 62 of 703

Jun 17, 2026Unauthenticated Cross Site Scripting (XSS) in Profile Builder Pro <= 3.15.0 versions.CVE-2026-42385 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Profile Builder Pro <= 3.15.0 versions.
Affected
up to 3.15.0
What to do
Affects up to 3.15.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 17, 2026Unauthenticated Cross Site Scripting (XSS) in Kapee < 1.7.1 versions.CVE-2026-41557 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Kapee < 1.7.1 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jun 17, 2026Unauthenticated Cross Site Scripting (XSS) in collectchat <= 2.4.9 versions.CVE-2026-40765 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in collectchat <= 2.4.9 versions.
Affected
up to 2.4.9
What to do
Affects up to 2.4.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 17, 2026Unauthenticated Cross Site Scripting (XSS) in WPZOOM Addons for Elementor <= 1.3.4 versions.CVE-2026-39597 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in WPZOOM Addons for Elementor <= 1.3.4 versions.
Affected
up to 1.3.4
What to do
Affects up to 1.3.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 17, 2026Unauthenticated Cross Site Scripting (XSS) in MagOne <= 9.0 versions.CVE-2026-39548 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in MagOne <= 9.0 versions.
Affected
up to 9.0
What to do
Affects up to 9.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 17, 2026Unauthenticated Cross Site Scripting (XSS) in WPJobster <= 6.3.5 versions.CVE-2026-22339 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in WPJobster <= 6.3.5 versions.
Affected
up to 6.3.5
What to do
Affects up to 6.3.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 17, 2026Unauthenticated Cross Site Scripting (XSS) in Skillate <= 1.2.10 versions.CVE-2026-22329 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Skillate <= 1.2.10 versions.
Affected
up to 1.2.10
What to do
Affects up to 1.2.10. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 17, 2026Unauthenticated Cross Site Scripting (XSS) in Auto Repair <= 22.6 versions.CVE-2026-22328 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Auto Repair <= 22.6 versions.
Affected
up to 22.6
What to do
Affects up to 22.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 17, 2026Stored cross-site scripting (XSS) in NewsItemApiController In SimplCommerce prior to commit 6142d3b5 allows an authenticated administrator to execute arbitrary CVE-2026-11975 · Websites & servers · simplcommerce · reported by 596c5446-0ce5-4ba2-aa66-48b3b757a647Medium 6.2
Stored cross-site scripting (XSS) in NewsItemApiController In SimplCommerce prior to commit 6142d3b5 allows an authenticated administrator to execute arbitrary JavaScript via the ShortContent and FullContent fields, which are stored without HTML sanitization and rendered unencoded via @Html.Raw()
Product
SimplCommerce
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jun 17, 2026Unauthenticated Cross Site Scripting (XSS) in Grand Car Rental <= 3.7 versions.CVE-2025-69151 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Grand Car Rental <= 3.7 versions.
Affected
up to 3.7
What to do
Affects up to 3.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 17, 2026Unauthenticated Cross Site Scripting (XSS) in Qreatix <= 1.9.4 versions.CVE-2025-69104 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Qreatix <= 1.9.4 versions.
Affected
up to 1.9.4
What to do
Affects up to 1.9.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 17, 2026Unauthenticated Cross Site Scripting (XSS) in Sonaar <= 4.27.4 versions.CVE-2025-59560 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Sonaar <= 4.27.4 versions.
Affected
up to 4.27.4
What to do
Affects up to 4.27.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 17, 2026Themify Folo: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31013 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themify Folo allows Reflected XSS. This issue affects Themify Folo: from n/a through 1.9.6.
Product
Themify Folo
Affected
up to 1.9.6
What to do
Affects up to 1.9.6. Update Themify Folo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 17, 2026Unauthenticated Cross Site Scripting (XSS) in my flatonica <= 0.0.8 versions.CVE-2024-49269 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in my flatonica <= 0.0.8 versions.
Affected
up to 0.0.8
What to do
Affects up to 0.0.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 16, 2026Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in PowerSchool Employee Access Center allows Cross-SitCVE-2026-12425 · Other software · PowerSchool · reported by psirt@paloaltonetworks.comMedium 5.7
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in PowerSchool Employee Access Center allows Cross-Site Scripting (XSS). This issue affects Employee Access Center: 23.10. It is possible to add in javascript code after the login URL and have it be eval()'d in the page and execute in the context of the user.
Product
Employee Access Center
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com
Jun 16, 2026OpenClaw before 2026.5.12 contains a cross-site scripting vulnerability in exported session HTML that preserves unsafe javascript: and data: links in generated CVE-2026-53841 · Other software · OpenClaw · reported by VulnCheckLow 2.1
OpenClaw before 2026.5.12 contains a cross-site scripting vulnerability in exported session HTML that preserves unsafe javascript: and data: links in generated content. Attackers can execute browser-side scripts if a trusted operator opens the exported file and activates a malicious link.
Product
OpenClaw
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com vulncheck.com
Jun 16, 2026PowerStore contains a Stored Cross-Site Scripting Vulnerability in the PowerStore Manager.CVE-2024-30476 · Other software · Dell · reported by security_alert@emc.comMedium 5.4
PowerStore contains a Stored Cross-Site Scripting Vulnerability in the PowerStore Manager. A remote authenticated low-privileged malicious actor could potentially exploit this vulnerability, it could lead to script execution in the client browser.
Product
PowerStore
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record dell.com
Jun 16, 2026Unauthenticated Cross Site Scripting (XSS) in Media LIbrary Assistant <= 3.35 versions.CVE-2026-54198 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Media LIbrary Assistant <= 3.35 versions.
Affected
up to 3.35
What to do
Affects up to 3.35. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 16, 2026Unauthenticated Cross Site Scripting (XSS) in Pods <= 3.3.8 versions.CVE-2026-54191 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Pods <= 3.3.8 versions.
Affected
up to 3.3.8
What to do
Affects up to 3.3.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 16, 2026Unauthenticated Cross Site Scripting (XSS) in Min Max Step Quantity Limits Manager for WooCommerce <= 5.2.2 versions.CVE-2026-39437 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Min Max Step Quantity Limits Manager for WooCommerce <= 5.2.2 versions.
Affected
up to 5.2.2
What to do
Affects up to 5.2.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 16, 2026File Sharing & Download Manager – User Private Files: Stored Cross-Site ScriptingCVE-2026-10093 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The File Sharing & Download Manager – User Private Files plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'fldr_ttl' parameter in all versions up to, and including, 2.1.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
File Sharing & Download Manager – User Private Files
Affected
up to 2.1.6
What to do
Affects up to 2.1.6. Update File Sharing & Download Manager – User Private Files to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 15, 2026Unauthenticated Cross Site Scripting (XSS) in SEO Redirection <= 9.17 versions.CVE-2026-52702 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in SEO Redirection <= 9.17 versions.
Affected
up to 9.17
What to do
Affects up to 9.17. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 15, 2026Subscriber Cross Site Scripting (XSS) in FV Flowplayer Video Player < 7.5.51.7212 versions.CVE-2026-49773 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Subscriber Cross Site Scripting (XSS) in FV Flowplayer Video Player < 7.5.51.7212 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jun 15, 2026Unauthenticated Cross Site Scripting (XSS) in Drag and Drop Multiple File Upload – Contact Form 7 <= 1.3.9.7 versions.CVE-2026-49055 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Drag and Drop Multiple File Upload – Contact Form 7 <= 1.3.9.7 versions.
Affected
up to 1.3.9.7
What to do
Affects up to 1.3.9.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 15, 2026Unauthenticated Cross Site Scripting (XSS) in Funnel Builder by FunnelKit <= 3.15.0.2 versions.CVE-2026-48966 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Funnel Builder by FunnelKit <= 3.15.0.2 versions.
Affected
up to 3.15.0.2
What to do
Affects up to 3.15.0.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 15, 2026Unauthenticated Cross Site Scripting (XSS) in HollerBox <= 2.3.10.1 versions.CVE-2026-48885 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in HollerBox <= 2.3.10.1 versions.
Affected
up to 2.3.10.1
What to do
Affects up to 2.3.10.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 15, 2026Subscriber Cross Site Scripting (XSS) in WP Job Portal <= 2.5.2 versions.CVE-2026-48880 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Subscriber Cross Site Scripting (XSS) in WP Job Portal <= 2.5.2 versions.
Affected
up to 2.5.2
What to do
Affects up to 2.5.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 15, 2026Unauthenticated Cross Site Scripting (XSS) in Stop Spammers <= 2026.3 versions.CVE-2026-48876 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Stop Spammers <= 2026.3 versions.
Affected
up to 2026.3
What to do
Affects up to 2026.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 15, 2026Unauthenticated Cross Site Scripting (XSS) in MW WP Form <= 5.1.3 versions.CVE-2026-48871 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in MW WP Form <= 5.1.3 versions.
Affected
up to 5.1.3
What to do
Affects up to 5.1.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 15, 2026Subscriber Cross Site Scripting (XSS) in King Addons for Elementor <= 51.1.62 versions.CVE-2026-48870 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Subscriber Cross Site Scripting (XSS) in King Addons for Elementor <= 51.1.62 versions.
Affected
up to 51.1.62
What to do
Affects up to 51.1.62. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 15, 2026Unauthenticated Cross Site Scripting (XSS) in Quiz And Survey Master <= 11.1.2 versions.CVE-2026-48867 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Quiz And Survey Master <= 11.1.2 versions.
Affected
up to 11.1.2
What to do
Affects up to 11.1.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 15, 2026Unauthenticated Cross Site Scripting (XSS) in Post SMTP <= 3.6.2 versions.CVE-2026-48838 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Post SMTP <= 3.6.2 versions.
Affected
up to 3.6.2
What to do
Affects up to 3.6.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 15, 2026Unauthenticated Cross Site Scripting (XSS) in Product Filter Widget for Elementor <= 1.0.6 versions.CVE-2026-45437 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Product Filter Widget for Elementor <= 1.0.6 versions.
Affected
up to 1.0.6
What to do
Affects up to 1.0.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 15, 2026Unauthenticated Cross Site Scripting (XSS) in AutomatorWP <= 5.7.2 versions.CVE-2026-42775 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in AutomatorWP <= 5.7.2 versions.
Affected
up to 5.7.2
What to do
Affects up to 5.7.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 15, 2026Subscriber Cross Site Scripting (XSS) in Modula Image Gallery <= 2.14.23 versions.CVE-2026-42688 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Subscriber Cross Site Scripting (XSS) in Modula Image Gallery <= 2.14.23 versions.
Affected
up to 2.14.23
What to do
Affects up to 2.14.23. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 15, 2026Subscriber Cross Site Scripting (XSS) in EventPrime <= 4.3.2.1 versions.CVE-2026-42686 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Subscriber Cross Site Scripting (XSS) in EventPrime <= 4.3.2.1 versions.
Affected
up to 4.3.2.1
What to do
Affects up to 4.3.2.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 15, 2026Unauthenticated Cross Site Scripting (XSS) in Simple Membership <= 4.7.2 versions.CVE-2026-42663 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Cross Site Scripting (XSS) in Simple Membership <= 4.7.2 versions.
Affected
up to 4.7.2
What to do
Affects up to 4.7.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 15, 2026Unauthenticated Cross Site Scripting (XSS) in Classified Listing <= 5.3.8 versions.CVE-2026-42658 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Classified Listing <= 5.3.8 versions.
Affected
up to 5.3.8
What to do
Affects up to 5.3.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 15, 2026Subscriber Cross Site Scripting (XSS) in Contest Gallery <= 28.1.6 versions.CVE-2026-42656 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Subscriber Cross Site Scripting (XSS) in Contest Gallery <= 28.1.6 versions.
Affected
up to 28.1.6
What to do
Affects up to 28.1.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 15, 2026Unauthenticated Cross Site Scripting (XSS) in AutomatorWP <= 5.6.7 versions.CVE-2026-42650 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Unauthenticated Cross Site Scripting (XSS) in AutomatorWP <= 5.6.7 versions.
Affected
up to 5.6.7
What to do
Affects up to 5.6.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 15, 2026Unauthenticated Cross Site Scripting (XSS) in Favicon Rotator <= 1.2.11 versions.CVE-2026-42649 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Favicon Rotator <= 1.2.11 versions.
Affected
up to 1.2.11
What to do
Affects up to 1.2.11. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 15, 2026Subscriber Cross Site Scripting (XSS) in ProfilePress <= 4.16.13 versions.CVE-2026-41556 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Subscriber Cross Site Scripting (XSS) in ProfilePress <= 4.16.13 versions.
Affected
up to 4.16.13
What to do
Affects up to 4.16.13. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 15, 2026Unauthenticated Cross Site Scripting (XSS) in WP Time Slots Booking Form <= 1.2.46 versions.CVE-2026-40791 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in WP Time Slots Booking Form <= 1.2.46 versions.
Affected
up to 1.2.46
What to do
Affects up to 1.2.46. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 15, 2026Unauthenticated Cross Site Scripting (XSS) in Quiz And Survey Master <= 11.0.0 versions.CVE-2026-40787 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Quiz And Survey Master <= 11.0.0 versions.
Affected
up to 11.0.0
What to do
Affects up to 11.0.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 15, 2026Unauthenticated Cross Site Scripting (XSS) in Coupon Affiliates <= 7.5.3 versions.CVE-2026-40770 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Coupon Affiliates <= 7.5.3 versions.
Affected
up to 7.5.3
What to do
Affects up to 7.5.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 15, 2026Unauthenticated Cross Site Scripting (XSS) in Notification for Telegram <= 3.5 versions.CVE-2026-40732 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Notification for Telegram <= 3.5 versions.
Affected
up to 3.5
What to do
Affects up to 3.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 15, 2026Subscriber Cross Site Scripting (XSS) in Shipment Tracker for Woocommerce <= 1.5.3.2 versions.CVE-2026-39540 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Subscriber Cross Site Scripting (XSS) in Shipment Tracker for Woocommerce <= 1.5.3.2 versions.
Affected
up to 1.5.3.2
What to do
Affects up to 1.5.3.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 15, 2026Unauthenticated Cross Site Scripting (XSS) in Paid Member Subscriptions <= 2.17.3 versions.CVE-2026-39514 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Paid Member Subscriptions <= 2.17.3 versions.
Affected
up to 2.17.3
What to do
Affects up to 2.17.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 15, 2026Unauthenticated Cross Site Scripting (XSS) in Social Slider Feed <= 2.3.2 versions.CVE-2026-39507 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Social Slider Feed <= 2.3.2 versions.
Affected
up to 2.3.2
What to do
Affects up to 2.3.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 15, 2026Subscriber Cross Site Scripting (XSS) in JupiterX Core <= 4.14.1 versions.CVE-2026-39491 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Subscriber Cross Site Scripting (XSS) in JupiterX Core <= 4.14.1 versions.
Affected
up to 4.14.1
What to do
Affects up to 4.14.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.