Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
24,208 results · page 62 of 485
Aug 13, 2026Unauthenticated Privilege Escalation in miniorange otp verification <= 5.5.1 versions.CVE-2026-61967 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated Privilege Escalation in miniorange otp verification <= 5.5.1 versions.
- Affected
- up to 5.5.1
- What to do
- Affects up to 5.5.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 13, 2026Subscriber SQL Injection in WPJAM Basic <= 7.0.1 versions.CVE-2026-61966 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Subscriber SQL Injection in WPJAM Basic <= 7.0.1 versions.
- Affected
- up to 7.0.1
- What to do
- Affects up to 7.0.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 13, 2026Unauthenticated Cross Site Scripting (XSS) in GeekyBot <= 1.2.6 versions.CVE-2026-61965 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in GeekyBot <= 1.2.6 versions.
- Affected
- up to 1.2.6
- What to do
- Affects up to 1.2.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 13, 2026Unauthenticated Arbitrary Code Execution in WP BASE Booking <= 6.3.0 versions.CVE-2026-61962 · WordPress plugins & themes · reported by PatchstackCritical 10
Unauthenticated Arbitrary Code Execution in WP BASE Booking <= 6.3.0 versions.
- Affected
- up to 6.3.0
- What to do
- Affects up to 6.3.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 13, 2026Unauthenticated Cross Site Scripting (XSS) in WP Full Stripe Free <= 8.5.0 versions.CVE-2026-61960 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in WP Full Stripe Free <= 8.5.0 versions.
- Affected
- up to 8.5.0
- What to do
- Affects up to 8.5.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 13, 2026Unauthenticated Arbitrary File Deletion in Participants Database <= 2.7.8.4 versions.CVE-2026-28189 · WordPress plugins & themes · reported by PatchstackHigh 7.4
Unauthenticated Arbitrary File Deletion in Participants Database <= 2.7.8.4 versions.
- Affected
- up to 2.7.8.4
- What to do
- Affects up to 2.7.8.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 13, 2026Unauthenticated Broken Access Control in Hydra Booking <= 1.2.2 versions.CVE-2026-28188 · WordPress plugins & themes · reported by PatchstackHigh 7.3
Unauthenticated Broken Access Control in Hydra Booking <= 1.2.2 versions.
- Affected
- up to 1.2.2
- What to do
- Affects up to 1.2.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 13, 2026Unauthenticated Cross Site Scripting (XSS) in Knowledge Base for Documentation, FAQs with AI Assistance <= 17.211.0 versions.CVE-2026-28187 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Knowledge Base for Documentation, FAQs with AI Assistance <= 17.211.0 versions.
- Affected
- up to 17.211.0
- What to do
- Affects up to 17.211.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 13, 2026Subscriber Broken Access Control in Travelfic Toolkit <= 1.5.1 versions.CVE-2026-28186 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Subscriber Broken Access Control in Travelfic Toolkit <= 1.5.1 versions.
- Affected
- up to 1.5.1
- What to do
- Affects up to 1.5.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 13, 2026Unauthenticated Broken Authentication in Log in with Google <= 1.4.2 versions.CVE-2026-28185 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated Broken Authentication in Log in with Google <= 1.4.2 versions.
- Affected
- up to 1.4.2
- What to do
- Affects up to 1.4.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 13, 2026Subscriber Cross Site Scripting (XSS) in AcyMailing SMTP Newsletter <= 10.11.1 versions.CVE-2026-28182 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Subscriber Cross Site Scripting (XSS) in AcyMailing SMTP Newsletter <= 10.11.1 versions.
- Affected
- up to 10.11.1
- What to do
- Affects up to 10.11.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 13, 2026Subscriber Broken Access Control in AcyMailing SMTP Newsletter <= 10.11.1 versions.CVE-2026-28181 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Subscriber Broken Access Control in AcyMailing SMTP Newsletter <= 10.11.1 versions.
- Affected
- up to 10.11.1
- What to do
- Affects up to 10.11.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 13, 2026Unauthenticated PHP Object Injection in Booking Activities <= 1.18.4 versions.CVE-2026-28176 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Unauthenticated PHP Object Injection in Booking Activities <= 1.18.4 versions.
- Affected
- up to 1.18.4
- What to do
- Affects up to 1.18.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 13, 2026Unauthenticated Cross Site Scripting (XSS) in Visitors Traffic Real Time Statistics <= 8.11 versions.CVE-2026-28175 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Visitors Traffic Real Time Statistics <= 8.11 versions.
- Affected
- up to 8.11
- What to do
- Affects up to 8.11. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 13, 2026Customer Sensitive Data Exposure in WP Event SOlution <= 4.1.18 versions.CVE-2026-28174 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Customer Sensitive Data Exposure in WP Event SOlution <= 4.1.18 versions.
- Affected
- up to 4.1.18
- What to do
- Affects up to 4.1.18. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 13, 2026Customer Arbitrary Content Deletion in WP Event SOlution <= 4.1.19 versions.CVE-2026-28173 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Customer Arbitrary Content Deletion in WP Event SOlution <= 4.1.19 versions.
- Affected
- up to 4.1.19
- What to do
- Affects up to 4.1.19. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 13, 2026Unauthenticated Cross Site Scripting (XSS) in Blog Floating Button <= 1.4.20 versions.CVE-2026-28170 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Blog Floating Button <= 1.4.20 versions.
- Affected
- up to 1.4.20
- What to do
- Affects up to 1.4.20. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 13, 2026Subscriber SQL Injection in CubeWP <= 1.1.30 versions.CVE-2026-28168 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Subscriber SQL Injection in CubeWP <= 1.1.30 versions.
- Affected
- up to 1.1.30
- What to do
- Affects up to 1.1.30. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 13, 2026Subscriber Privilege Escalation in Service Finder Booking <= 6.2 versions.CVE-2026-28161 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Subscriber Privilege Escalation in Service Finder Booking <= 6.2 versions.
- Affected
- up to 6.2
- What to do
- Affects up to 6.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 13, 2026Subscriber Broken Access Control in Service Finder Booking <= 6.2 versions.CVE-2026-28159 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Subscriber Broken Access Control in Service Finder Booking <= 6.2 versions.
- Affected
- up to 6.2
- What to do
- Affects up to 6.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 13, 2026Unauthenticated Cross Site Scripting (XSS) in Do Lasso <= 358 versions.CVE-2026-28158 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Do Lasso <= 358 versions.
- Affected
- up to 358
- What to do
- Affects up to 358. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 13, 2026Subscriber Path Traversal in Do Lasso <= 358 versions.CVE-2026-28157 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Subscriber Path Traversal in Do Lasso <= 358 versions.
- Affected
- up to 358
- What to do
- Affects up to 358. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 13, 2026Subscriber SQL Injection in Do Lasso <= 358 versions.CVE-2026-28156 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Subscriber SQL Injection in Do Lasso <= 358 versions.
- Affected
- up to 358
- What to do
- Affects up to 358. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 13, 2026Unauthenticated Insecure Direct Object References (IDOR) in Do Lasso <= 358 versions.CVE-2026-28155 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Insecure Direct Object References (IDOR) in Do Lasso <= 358 versions.
- Affected
- up to 358
- What to do
- Affects up to 358. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 13, 2026Unauthenticated PHP Object Injection in Headless Single Sign On <= 1.6 versions.CVE-2026-28149 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in Headless Single Sign On <= 1.6 versions.
- Affected
- up to 1.6
- What to do
- Affects up to 1.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 13, 2026Unauthenticated Bypass Vulnerability in Headless Single Sign On <= 1.6 versions.CVE-2026-28148 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated Bypass Vulnerability in Headless Single Sign On <= 1.6 versions.
- Affected
- up to 1.6
- What to do
- Affects up to 1.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 13, 2026Unauthenticated SQL Injection in Web Directory Free <= 1.7.13 versions.CVE-2026-28142 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in Web Directory Free <= 1.7.13 versions.
- Affected
- up to 1.7.13
- What to do
- Affects up to 1.7.13. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 13, 2026Unauthenticated Broken Authentication in OAuth Single Sign On – SSO (OAuth Client) <= 7.0.0 versions.CVE-2026-28008 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated Broken Authentication in OAuth Single Sign On – SSO (OAuth Client) <= 7.0.0 versions.
- Affected
- up to 7.0.0
- What to do
- Affects up to 7.0.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 13, 2026Unauthenticated Cross Site Scripting (XSS) in Business Directory <= 6.4.25 versions.CVE-2026-28004 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Business Directory <= 6.4.25 versions.
- Affected
- up to 6.4.25
- What to do
- Affects up to 6.4.25. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 13, 2026Unauthenticated Cross Site Scripting (XSS) in Maspik – Spam blacklist <= 2.9.1 versions.CVE-2026-28003 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Maspik – Spam blacklist <= 2.9.1 versions.
- Affected
- up to 2.9.1
- What to do
- Affects up to 2.9.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 13, 2026Booktics: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-28002 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Arraytics Booktics allows Blind SQL Injection. This issue affects Booktics: from n/a through 1.0.22.
- Product
- Booktics
- Affected
- up to 1.0.22
- What to do
- Affects up to 1.0.22. Update Booktics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 13, 2026Unauthenticated SQL Injection in WP Directory Kit <= 1.5.4 versions.CVE-2026-28001 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in WP Directory Kit <= 1.5.4 versions.
- Affected
- up to 1.5.4
- What to do
- Affects up to 1.5.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 13, 2026Subscriber Broken Access Control in Tourfic <= 2.23.1 versions.CVE-2026-27999 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Subscriber Broken Access Control in Tourfic <= 2.23.1 versions.
- Affected
- up to 2.23.1
- What to do
- Affects up to 2.23.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 13, 2026Unauthenticated Remote Code Execution (RCE) in QA Analytics <= 5.2.0.0 versions.CVE-2026-27544 · WordPress plugins & themes · reported by PatchstackCritical 10
Unauthenticated Remote Code Execution (RCE) in QA Analytics <= 5.2.0.0 versions.
- Affected
- up to 5.2.0.0
- What to do
- Affects up to 5.2.0.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 13, 2026Unauthenticated Privilege Escalation in MStore API <= 4.20.0 versions.CVE-2026-27543 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Privilege Escalation in MStore API <= 4.20.0 versions.
- Affected
- up to 4.20.0
- What to do
- Affects up to 4.20.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 13, 2026Unauthenticated Cross Site Scripting (XSS) in Welcart e-Commerce <= 2.11.31 versions.CVE-2026-27539 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Welcart e-Commerce <= 2.11.31 versions.
- Affected
- up to 2.11.31
- What to do
- Affects up to 2.11.31. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 13, 2026Unauthenticated SQL Injection in WP Directory Kit <= 1.5.4 versions.CVE-2026-27538 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated SQL Injection in WP Directory Kit <= 1.5.4 versions.
- Affected
- up to 1.5.4
- What to do
- Affects up to 1.5.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 13, 2026Unauthenticated Cross Site Scripting (XSS) in Popup by Supsystic <= 1.11.2 versions.CVE-2026-27537 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Cross Site Scripting (XSS) in Popup by Supsystic <= 1.11.2 versions.
- Affected
- up to 1.11.2
- What to do
- Affects up to 1.11.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 13, 2026Unauthenticated Cross Site Scripting (XSS) in MailChimp Subscribe Forms <= 4.3.3 versions.CVE-2026-27536 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in MailChimp Subscribe Forms <= 4.3.3 versions.
- Affected
- up to 4.3.3
- What to do
- Affects up to 4.3.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 13, 2026Subscriber Broken Access Control in Solace Extra <= 1.6.0 versions.CVE-2026-27535 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Subscriber Broken Access Control in Solace Extra <= 1.6.0 versions.
- Affected
- up to 1.6.0
- What to do
- Affects up to 1.6.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 13, 2026Editor PHP Object Injection in Car Rental Manager <= 1.3.9 versions.CVE-2026-27380 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Editor PHP Object Injection in Car Rental Manager <= 1.3.9 versions.
- Affected
- up to 1.3.9
- What to do
- Affects up to 1.3.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 13, 2026Unauthenticated Broken Access Control in Taxi Booking Manager for WooCommerce <= 2.0.3 versions.CVE-2026-27345 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in Taxi Booking Manager for WooCommerce <= 2.0.3 versions.
- Affected
- up to 2.0.3
- What to do
- Affects up to 2.0.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 13, 2026Ecwid by Lightspeed Ecommerce Shopping Cart: Does not perform a capability check or nonce verification on one of its store-management actionsCVE-2026-14332 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Ecwid by Lightspeed Ecommerce Shopping Cart WordPress plugin before 7.0.9 does not perform a capability check or nonce verification on one of its store-management actions, allowing any authenticated user, such as a subscriber, to disconnect the store and take the storefront offline until an administrator reconnects it.
- Product
- Ecwid by Lightspeed Ecommerce Shopping Cart
- Fixed in
- 7.0.9
- What to do
- Update Ecwid by Lightspeed Ecommerce Shopping Cart to 7.0.9 or newer.
Aug 13, 2026Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder: Stored Cross-Site ScriptingCVE-2026-18146 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Notification Smartcode Values in all versions up to, and including, 6.2.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute in the browser of an administrator (or any user with the Fluent Forms entry-viewing capability) when they view the form's entry Submission Logs in the WordPress admin dashboard. Exploitation requires that a site administrator or Fluent Forms manager has configured an email notification whose subject or static (direct) Send To value references an attacker-influenced Smartcode such as an input_password field value, a cookie value, or submission.response.
- Product
- Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder
- Affected
- up to 6.2.11
- What to do
- Affects up to 6.2.11. Update Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 13, 2026ShopEngine Elementor WooCommerce Builder Addon: Does not protect one of its authentication endpoints against CSRFCVE-2026-19088 · WordPress plugins & themes · reported by WPScanMedium 5.4
The ShopEngine Elementor WooCommerce Builder Addon WordPress plugin before 4.9.3 does not protect one of its authentication endpoints against CSRF, allowing an attacker to log a victim into an attacker-controlled account, so that the billing and shipping details the victim then enters at checkout are stored under and readable by the attacker.
- Product
- ShopEngine Elementor WooCommerce Builder Addon
- Fixed in
- 4.9.3
- What to do
- Update ShopEngine Elementor WooCommerce Builder Addon to 4.9.3 or newer.
Aug 13, 2026Customer Email Verification for WooCommerce: Does not correctly validate the email-verification activation codeCVE-2026-14182 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Customer Email Verification for WooCommerce WordPress plugin before 3.2.6 does not correctly validate the email-verification activation code, relying on a loose comparison that an attacker can satisfy with a crafted value type, allowing unauthenticated users to verify and take over the account of any registered user who has not yet confirmed their email address.
- Product
- Customer Email Verification for WooCommerce
- Fixed in
- 3.2.6
- What to do
- Update Customer Email Verification for WooCommerce to 3.2.6 or newer.
Aug 13, 2026KiviCare: Does not restrict the roles assignable through its unauthenticated registration endpointCVE-2026-13610 · WordPress plugins & themes · reported by WPScanHigh 7.5
The KiviCare WordPress plugin before 4.5.2 does not restrict the roles assignable through its unauthenticated registration endpoint, allowing unauthenticated attackers to create an active, privileged clinic-staff (doctor) account with full access to patient records, billing and clinic data.
- Product
- KiviCare
- Fixed in
- 4.5.2
- What to do
- Update KiviCare to 4.5.2 or newer.
Aug 13, 2026Food Menu: Does not perform any capability or ownership check on its reservation-status update actionCVE-2026-13328 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Food Menu WordPress plugin before 6.0.2 does not perform any capability or ownership check on its reservation-status update action, which is also exposed to unauthenticated users and gated only by a nonce that is publicly available to visitors, allowing unauthenticated attackers to change the status of arbitrary reservations.
- Product
- Food Menu
- Fixed in
- 6.0.2
- What to do
- Update Food Menu to 6.0.2 or newer.
Aug 12, 2026Kirki: Does not properly authorise its front-end form submission REST routes and passes attacker-controlled input through shortcode executionCVE-2026-16747 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Kirki WordPress plugin before 6.2.1 does not properly authorise its front-end form submission REST routes and passes attacker-controlled input through shortcode execution, allowing unauthenticated users to run any shortcode registered on the site, which on a default install leads to disclosure of the site administrator's email address and an arbitrary-recipient mail relay from the victim's domain.
- Product
- Kirki
- Fixed in
- 6.2.1
- What to do
- Update Kirki to 6.2.1 or newer.
Aug 12, 2026Tablesome Table: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-66659 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Essekia Tablesome Table allows Blind SQL Injection. This issue affects Tablesome Table: from n/a through 1.2.9.
- Product
- Tablesome Table
- Affected
- up to 1.2.9
- What to do
- Affects up to 1.2.9. Update Tablesome Table to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.