Updated 5 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

33added in the last 30 days

577new WordPress flaws this week

391,397entries in the database

24,208 results · page 63 of 485

Aug 12, 2026ProSolution WP Client: Does not perform capability checks on two administrative AJAX actionsCVE-2026-19052 · WordPress plugins & themes · reported by WPScanMedium 4.3
The ProSolution WP Client WordPress plugin before 2.0.9 does not perform capability checks on two administrative AJAX actions, and the nonce they rely on is published on its public frontend, allowing any authenticated user, such as a subscriber, to trigger an administrative data synchronisation and to clear the ProSolution WP Client WordPress plugin before 2.0.9's activity records.
Product
ProSolution WP Client
Fixed in
2.0.9
What to do
Update ProSolution WP Client to 2.0.9 or newer.
Full record and what to do →NVD record wpscan.com
Aug 12, 2026ProSolution WP Client: Does not validate a user-supplied URLCVE-2026-19050 · WordPress plugins & themes · reported by WPScanMedium 6.4
The ProSolution WP Client WordPress plugin before 2.0.9 does not validate a user-supplied URL, and does not check the capability or nonce of the requester, before performing a server-side HTTP request with it, allowing any authenticated user, such as a subscriber, to make the site issue arbitrary requests to internal hosts and services, including requests with an attacker-chosen method, headers and body.
Product
ProSolution WP Client
Fixed in
2.0.9
What to do
Update ProSolution WP Client to 2.0.9 or newer.
Full record and what to do →NVD record wpscan.com
Aug 12, 2026WPC Admin Columns: Does not have authorisation checks in one of its AJAX actionsCVE-2026-18943 · WordPress plugins & themes · reported by WPScanMedium 6.5
The WPC Admin Columns WordPress plugin before 2.3.4 does not have authorisation checks in one of its AJAX actions, allowing users with a role as low as subscriber to read arbitrary user, post and term metadata, including data belonging to administrators.
Product
WPC Admin Columns
Fixed in
2.3.4
What to do
Update WPC Admin Columns to 2.3.4 or newer.
Full record and what to do →NVD record wpscan.com
Aug 12, 2026Ezoic: Does not properly restrict access to some of its content export functionalityCVE-2026-18789 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Ezoic WordPress plugin before 2.23.1 does not properly restrict access to some of its content export functionality, allowing unauthenticated attackers to trigger a server-side export of the site's database, including user password hashes and password reset tokens, as well as to persistently change some of its settings.
Product
Ezoic
Fixed in
2.23.1
What to do
Update Ezoic to 2.23.1 or newer.
Full record and what to do →NVD record wpscan.com
Aug 12, 2026WooCommerce Subscriptions: Does not validate user input before unserializing it on stores with High-Performance Order Storage enabledCVE-2026-18391 · WordPress plugins & themes · reported by WPScanCritical 9.8
The WooCommerce Subscriptions WordPress plugin before 9.1.0 does not validate user input before unserializing it on stores with High-Performance Order Storage enabled, leading to a PHP Object Injection issue which unauthenticated users can escalate to Remote Code Execution via a gadget chain present in the bundled dependencies.
Product
WooCommerce Subscriptions
Fixed in
9.1.0
What to do
Update WooCommerce Subscriptions to 9.1.0 or newer.
Full record and what to do →NVD record wpscan.com
Aug 12, 2026WP Directory Kit: Does not sanitise and escape a parameter before using it in a SQL statement through one of its authenticated AJAX actionsCVE-2026-18230 · WordPress plugins & themes · reported by WPScanHigh 8.1
The WP Directory Kit WordPress plugin before 1.5.6 does not sanitise and escape a parameter before using it in a SQL statement through one of its authenticated AJAX actions, which lacks an authorization check, allowing any authenticated user such as a Subscriber to perform SQL injection attacks.
Product
WP Directory Kit
Fixed in
1.5.6
What to do
Update WP Directory Kit to 1.5.6 or newer.
Full record and what to do →NVD record wpscan.com
Aug 12, 2026WP Photo Album Plus: Does not perform any capability or nonce check on one of its public endpoint actions and builds an option name from a client-supplied value without restricting it to its own optionsCVE-2026-18049 · WordPress plugins & themes · reported by WPScanHigh 7.5
The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not perform any capability or nonce check on one of its public endpoint actions and builds an option name from a client-supplied value without restricting it to its own options, allowing unauthenticated users to read the value of other autoloaded options whose names end in a matching suffix.
Product
WP Photo Album Plus
Fixed in
9.2.07.002
What to do
Update WP Photo Album Plus to 9.2.07.002 or newer.
Full record and what to do →NVD record wpscan.com
Aug 12, 2026WP Photo Album Plus: Does not validate a client-controlled value used to build a file path in one of its public endpoint actionsCVE-2026-18048 · WordPress plugins & themes · reported by WPScanHigh 7.5
The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not validate a client-controlled value used to build a file path in one of its public endpoint actions, and performs no authorisation check on it, allowing unauthenticated attackers to delete arbitrary ZIP archives on the server, including ones stored outside the web root.
Product
WP Photo Album Plus
Fixed in
9.2.07.002
What to do
Update WP Photo Album Plus to 9.2.07.002 or newer.
Full record and what to do →NVD record wpscan.com
Aug 12, 2026Cookie Consent: Does not correctly enforce its intended administrator-only capability check on the REST route that stores its geolocation service license keyCVE-2026-18046 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Cookie Consent WordPress plugin before 0.0.10 does not correctly enforce its intended administrator-only capability check on the REST route that stores its geolocation service license key, so the route falls back to an authentication-only gate, allowing any authenticated user such as a subscriber to overwrite the stored key and disrupt the Cookie Consent WordPress plugin before 0.0.10's geolocation-based consent banner targeting.
Product
Cookie Consent
Fixed in
0.0.10
What to do
Update Cookie Consent to 0.0.10 or newer.
Full record and what to do →NVD record wpscan.com
Aug 12, 2026User Access Manager: Does not apply its access restrictions to REST API requestsCVE-2026-18035 · WordPress plugins & themes · reported by WPScanMedium 5.3
The User Access Manager WordPress plugin before 2.3.15 does not apply its access restrictions to REST API requests, allowing unauthenticated attackers to read the content of posts, pages and custom post types that have been restricted to specific user groups.
Product
User Access Manager
Fixed in
2.3.15
What to do
Update User Access Manager to 2.3.15 or newer.
Full record and what to do →NVD record wpscan.com
Aug 12, 2026WP Travel Engine: Does not perform authorization or ownership checksCVE-2026-16737 · WordPress plugins & themes · reported by WPScanMedium 5.3
The WP Travel Engine WordPress plugin before 6.8.5 does not perform authorization or ownership checks when loading a caller-supplied booking identifier in one of its unauthenticated cart actions, allowing unauthenticated attackers to disclose any customer's booking order details and their stored billing information, and to overwrite that customer's booking record with their own data.
Product
WP Travel Engine
Fixed in
6.8.5
What to do
Update WP Travel Engine to 6.8.5 or newer.
Full record and what to do →NVD record wpscan.com
Aug 12, 2026Total Upkeep: Does not adequately protect the secret that authorizes its backup-restore functionality and exposes it to unauthenticated usersCVE-2026-16253 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Total Upkeep WordPress plugin before 1.17.3 does not adequately protect the secret that authorizes its backup-restore functionality and exposes it to unauthenticated users, allowing them to disclose sensitive backup information and to force a full site restore that overwrites the live site's files and database. This is an incomplete fix of CVE-2020-36848, as the protection added at the time never took effect on distributed copies of the plugin.
Product
Total Upkeep
Fixed in
1.17.3
What to do
Update Total Upkeep to 1.17.3 or newer.
Full record and what to do →NVD record wpscan.com
Aug 12, 2026Import WP: Does not perform any authorization check on one of its export-file download handlersCVE-2026-14925 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Import WP WordPress plugin before 2.14.23 does not perform any authorization check on one of its export-file download handlers, allowing unauthenticated attackers to download export files generated by administrators, which may contain user personal data such as email addresses, login names and roles. Exploitation requires an unconsumed export to already exist and a low-entropy, time-based download key to be obtained.
Product
Import WP
Fixed in
2.14.23
What to do
Update Import WP to 2.14.23 or newer.
Full record and what to do →NVD record wpscan.com
Aug 12, 2026WP Crowdfunding: Does not check the campaign-submission capability in one of its AJAX actionsCVE-2026-14859 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WP Crowdfunding WordPress plugin before 2.2.1 does not check the campaign-submission capability in one of its AJAX actions, allowing any authenticated users such as Subscribers to create crowdfunding campaign posts despite not being granted that permission.
Product
WP Crowdfunding
Fixed in
2.2.1
What to do
Update WP Crowdfunding to 2.2.1 or newer.
Full record and what to do →NVD record wpscan.com
Aug 12, 2026WP Crowdfunding: Does not verify ownership of a campaign before allowing its update history to be modified and a notification email sent to its backersCVE-2026-14857 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WP Crowdfunding WordPress plugin before 2.2.1 does not verify ownership of a campaign before allowing its update history to be modified and a notification email sent to its backers, allowing any authenticated users such as Subscribers to alter other users' campaigns.
Product
WP Crowdfunding
Fixed in
2.2.1
What to do
Update WP Crowdfunding to 2.2.1 or newer.
Full record and what to do →NVD record wpscan.com
Aug 12, 2026Eventin: Does not perform an authorization check on its waiting-list registration handlerCVE-2026-13171 · WordPress plugins & themes · reported by WPScanHigh 8.2
The Eventin WordPress plugin before 4.1.20 does not perform an authorization check on its waiting-list registration handler, allowing unauthenticated users to create WordPress user accounts for arbitrary email addresses and inject order records.
Product
Eventin
Fixed in
4.1.20
What to do
Update Eventin to 4.1.20 or newer.
Full record and what to do →NVD record wpscan.com
Aug 11, 2026Social Login, Passkeys, Magic Link & Email OTP – Passwordless Login by VentraConnect: Authentication BypassCVE-2026-18961 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Social Login, Passkeys, Magic Link & Email OTP – Passwordless Login by VentraConnect plugin for WordPress is vulnerable to Authentication Bypass via Unverified Provider Email in all versions up to, and including, 1.4.3. This is due to the plugin trusting the unverified email field returned by Spotify's /v1/me endpoint as proof of mailbox ownership — Generic::normalize_common() copies this value into the normalized profile without requiring an email_verified assertion, and User_Links::link_or_login_user() subsequently passes it directly to get_user_by('email', $email) and issues a persistent authentication cookie via wp_set_auth_cookie() without a provider-specific verified-email gate, a local mailbox challenge, or a logged-in approval step. This makes it possible for unauthenticated attackers to log in as any existing WordPress user, including Administrators, by supplying a known target email address through a controlled Spotify OAuth flow, gaining full administrative access to the site.
Product
Social Login, Passkeys, Magic Link & Email OTP – Passwordless Login by VentraConnect
Affected
up to 1.4.3
What to do
Affects up to 1.4.3. Update Social Login, Passkeys, Magic Link & Email OTP – Passwordless Login by VentraConnect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record developer.spotify.com plugins.svn.wordpress.org
Aug 11, 2026Frontend Admin by DynamiApps: Authorization bypassCVE-2026-15606 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.29.9. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level and above permissions, to reset the password of any user on the site, including administrators, leading to full account takeover and complete site compromise. Exploitation requires the attacker to hold a valid encrypted Current-User token obtained by accessing any Edit User form they are legitimately authorized to submit, which they then use as a known-plaintext base for the CBC bit-flipping forgery.
Product
Frontend Admin by DynamiApps
Affected
up to 3.29.9
What to do
Affects up to 3.29.9. Update Frontend Admin by DynamiApps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 11, 2026GeoDirectory – WP Business Directory Plugin and Classified Listings Directory: Arbitrary file deletionCVE-2026-19091 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_revision function in all versions up to, and including, 2.8.169. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). By placing post_type=attachment exclusively in the query string to bypass the consistency check, an attacker can convert an auto-draft GeoDirectory listing into a WordPress attachment with attacker-controlled file paths injected into attachment metadata, which the delete_revision handler then dereferences and unlinks without any post-type or path validation.
Product
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory
Affected
up to 2.8.169
What to do
Affects up to 2.8.169. Update GeoDirectory – WP Business Directory Plugin and Classified Listings Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com github.com
Aug 11, 2026Formidable Digital Signatures: File deletionCVE-2026-16230 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Formidable Digital Signatures plugin for WordPress is vulnerable to file deletion due to insufficient file path validation in the delete_file function in all versions up to, and including, 3.0.6. This makes it possible for unauthenticated attackers to delete files on the server by supplying an attacker-controlled filename in the item_meta[field_id][content] parameter alongside the delete_saved_image flag during the standard entry-creation POST flow on any form that accepts anonymous submissions.
Product
Formidable Digital Signatures
Affected
up to 3.0.6
What to do
Affects up to 3.0.6. Update Formidable Digital Signatures to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record formidableforms.com formidableforms.com
Aug 11, 2026InstaWP Connect – 1-click WP Staging & Migration: Remote Code ExecutionCVE-2026-13457 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 0.1.3.6 via the (top-level script) function. This is due to the plugin stores its encrypted options file as options-{migrate_key}.txt in wp-content/instawpbackups/ without deploying an index.php or .htaccess to prevent directory listing, exposing the 40-character migrate_key on Apache servers with directory indexing enabled, which allows an attacker to derive the AES-256-CBC passphrase via SHA256(migrate_key), decrypt the options file to recover the api_signature. This makes it possible for unauthenticated attackers to get the database access details and api_signature. Exploitation requires the target WordPress site to be hosted on Apache with directory listing enabled (Options +Indexes) for the wp-content/instawpbackups/ directory, and time limited because it can only be exploited during the migration period.
Product
InstaWP Connect – 1-click WP Staging & Migration
Affected
up to 0.1.3.6
What to do
Affects up to 0.1.3.6. Update InstaWP Connect – 1-click WP Staging & Migration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 11, 2026AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for: Authorization bypassCVE-2026-15426 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 10.11.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to overwrite the BCC field of the acy_notification_cms notification template, causing subsequent WordPress password-reset emails — including those targeting administrator accounts — to be silently copied to an attacker-controlled address, enabling account takeover via the captured reset link. Successful exploitation requires the site administrator to have enabled the "Send website emails with AcyMailing" option, which routes WordPress core notification emails through AcyMailing's templating system.
Product
AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for
Affected
up to 10.11.1
What to do
Affects up to 10.11.1. Update AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 11, 2026Ray Enterprise Translation: Does not perform any capability or nonce checks on one of its AJAX actionsCVE-2026-14549 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Ray Enterprise Translation WordPress plugin through 1.7.3 does not perform any capability or nonce checks on one of its AJAX actions, allowing any authenticated user, including Subscribers, to add or delete the site's configured languages.
Product
Ray Enterprise Translation
Affected
up to 1.7.3
What to do
Affects up to 1.7.3. Update Ray Enterprise Translation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Aug 11, 2026Ray Enterprise Translation: Does not perform any capability or nonce checks on one of its AJAX actionsCVE-2026-14548 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Ray Enterprise Translation WordPress plugin through 1.7.3 does not perform any capability or nonce checks on one of its AJAX actions, allowing any authenticated user, including Subscribers, to overwrite the administrator-configured translation API token with an arbitrary value.
Product
Ray Enterprise Translation
Affected
up to 1.7.3
What to do
Affects up to 1.7.3. Update Ray Enterprise Translation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Aug 10, 2026the pageIntegritySubmission() method in src/integrity.lib.php that: Sucuri Security WordPress plugin through version 2.7.3 contains a path traversalCVE-2026-73033 · WordPress plugins & themes · reported by VulnCheckHigh 7
Sucuri Security WordPress plugin through version 2.7.3 contains a path traversal vulnerability in the pageIntegritySubmission() method in src/integrity.lib.php that allows authenticated administrators to delete arbitrary files by supplying directory traversal sequences in the sucuriscan_integrity parameter. Attackers can manipulate the unsanitized file path concatenated with ABSPATH to traverse outside the WordPress installation directory and invoke unlink() on sensitive files such as wp-config.php and .htaccess, causing site outage or enabling malicious reinstallation.
Product
the pageIntegritySubmission() method in src/integrity.lib.php that
What to do
Update the pageIntegritySubmission() method in src/integrity.lib.php that to the newest version.
Full record and what to do →NVD record github.com vulncheck.com
Aug 10, 2026Duplicate Post: Does not perform per-object authorisation checks in its bulk copy and delete operationsCVE-2026-19077 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Duplicate Post WordPress plugin before 1.5.5 does not perform per-object authorisation checks in its bulk copy and delete operations, allowing any user whose role an administrator has granted Duplicate Post WordPress plugin before 1.5.5 access to permanently delete arbitrary posts on the site, including those belonging to other users.
Product
Duplicate Post
Fixed in
1.5.5
What to do
Update Duplicate Post to 1.5.5 or newer.
Full record and what to do →NVD record wpscan.com
Aug 10, 2026ProSolution WP Client: Does not sanitise and escape a parameter before using it in a SQL statement reachable by unauthenticated visitorsCVE-2026-19053 · WordPress plugins & themes · reported by WPScanCritical 9.1
The ProSolution WP Client WordPress plugin before 2.0.6 does not sanitise and escape a parameter before using it in a SQL statement reachable by unauthenticated visitors, leading to a blind SQL injection.
Product
ProSolution WP Client
Fixed in
2.0.6
What to do
Update ProSolution WP Client to 2.0.6 or newer.
Full record and what to do →NVD record wpscan.com
Aug 10, 2026ProSolution WP Client: Does not sanitise a cookie value before using it in SQL queriesCVE-2026-19049 · WordPress plugins & themes · reported by WPScanHigh 8.6
The ProSolution WP Client WordPress plugin before 2.0.9 does not sanitise a cookie value before using it in SQL queries, and processes that cookie on every request without any authentication or capability check, allowing unauthenticated users to read arbitrary data from the database and to delete the records the ProSolution WP Client WordPress plugin before 2.0.9 stores.
Product
ProSolution WP Client
Fixed in
2.0.9
What to do
Update ProSolution WP Client to 2.0.9 or newer.
Full record and what to do →NVD record wpscan.com
Aug 10, 2026Block User Account: Does not enforce its account block on every authentication pathCVE-2026-18960 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Block User Account WordPress plugin before 2.0.1 does not enforce its account block on every authentication path, allowing a blocked user who holds an application password created before the block to retain their full role-level read and write access through the REST API.
Product
Block User Account
Fixed in
2.0.1
What to do
Update Block User Account to 2.0.1 or newer.
Full record and what to do →NVD record wpscan.com
Aug 10, 2026CheckView: Does not restrict its REST API authentication filter to its own routes and unconditionally discards the authentication error raised for any request whose URI merely contains a CheckView WordPress plugin beforeCVE-2026-18786 · WordPress plugins & themes · reported by WPScanHigh 8.8
The CheckView WordPress plugin before 2.3.2 does not restrict its REST API authentication filter to its own routes and unconditionally discards the authentication error raised for any request whose URI merely contains a CheckView WordPress plugin before 2.3.2-specific string, making it possible for unauthenticated attackers to bypass the REST nonce check and perform any REST action available to a logged-in administrator, such as creating a new administrator account, via a crafted link an administrator is tricked into opening.
Product
CheckView
Fixed in
2.3.2
What to do
Update CheckView to 2.3.2 or newer.
Full record and what to do →NVD record wpscan.com
Aug 10, 2026Login & Register Forms: Does not bind the password reset verification state to the account being reset or to the party that completed the verificationCVE-2026-18468 · WordPress plugins & themes · reported by WPScanHigh 8.1
The Login & Register Forms WordPress plugin before 4.0.2 does not bind the password reset verification state to the account being reset or to the party that completed the verification, keying it instead on a value the client controls, allowing unauthenticated attackers to take over the account of any user who recently completed a reset verification, including an administrator.
Product
Login & Register Forms
Fixed in
4.0.2
What to do
Update Login & Register Forms to 4.0.2 or newer.
Full record and what to do →NVD record wpscan.com
Aug 10, 2026File Manager: Does not have authorisation checks on one of its REST API routesCVE-2026-17541 · WordPress plugins & themes · reported by WPScanHigh 7.5
The File Manager WordPress plugin before 6.9.1 does not have authorisation checks on one of its REST API routes, allowing unauthenticated users to read its file activity log, disclosing the file operations performed on the site, the paths involved and the name of the user who performed them.
Product
File Manager
Fixed in
6.9.1
What to do
Update File Manager to 6.9.1 or newer.
Full record and what to do →NVD record wpscan.com
Aug 10, 2026Salon Booking System: Does not perform any capability check or validate an OAuth state value on its Google Calendar authorization callbackCVE-2026-17023 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Salon Booking System WordPress plugin through 10.30.33 does not perform any capability check or validate an OAuth state value on its Google Calendar authorization callback, which is also hooked for unauthenticated users, allowing an unauthenticated attacker to overwrite the site's stored Google Calendar connection tokens with attacker-controlled ones and hijack the integration. Exploitation requires the site to have configured its own Google OAuth client for the calendar feature.
Product
Salon Booking System
Affected
up to 10.30.33
What to do
Affects up to 10.30.33. Update Salon Booking System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Aug 10, 2026Salon Booking System: Does not properly validate a booking's ownership token before loading it in its booking-wizard confirmation stepsCVE-2026-17022 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Salon Booking System WordPress plugin before 10.30.34 does not properly validate a booking's ownership token before loading it in its booking-wizard confirmation steps, allowing unauthenticated attackers to disclose other customers' booking records, including personal information, by supplying a sequential booking identifier.
Product
Salon Booking System
Fixed in
10.30.34
What to do
Update Salon Booking System to 10.30.34 or newer.
Full record and what to do →NVD record wpscan.com
Aug 10, 2026Salon Booking System: Does not properly restrict access to some of its booking-modification AJAX actions and does not verify ownership of the targeted bookingCVE-2026-17021 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Salon Booking System WordPress plugin before 10.30.34 does not properly restrict access to some of its booking-modification AJAX actions and does not verify ownership of the targeted booking, allowing unauthenticated users to tamper with the stored total of arbitrary bookings.
Product
Salon Booking System
Fixed in
10.30.34
What to do
Update Salon Booking System to 10.30.34 or newer.
Full record and what to do →NVD record wpscan.com
Aug 10, 2026CubeWP Framework: Does not perform a per-object read authorization checkCVE-2026-17018 · WordPress plugins & themes · reported by WPScanMedium 4.9
The CubeWP Framework WordPress plugin through 1.1.30 does not perform a per-object read authorization check, nor restrict which metadata keys may be requested, on one of its REST API endpoints, allowing users with the Contributor role and above to read arbitrary post metadata (including that of other users' draft, pending, private, and password-protected posts) and arbitrary user metadata of any user, including administrators.
Product
CubeWP Framework
Affected
up to 1.1.30
What to do
Affects up to 1.1.30. Update CubeWP Framework to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Aug 10, 2026Accept PayPal & Stripe with Subscriptions for WooCommerce: Does not validate the amount actually paid against the order total in its PayPal Data Transfer return handlerCVE-2026-17016 · WordPress plugins & themes · reported by WPScanLow 3.7
The Accept PayPal & Stripe with Subscriptions for WooCommerce WordPress plugin through 3.1.0 does not validate the amount actually paid against the order total in its PayPal Data Transfer return handler, allowing a customer to pay less than the order total and still have the order marked as fully paid when the PayPal Data Transfer feature is enabled.
Product
Accept PayPal & Stripe with Subscriptions for WooCommerce
Affected
up to 3.1.0
What to do
Affects up to 3.1.0. Update Accept PayPal & Stripe with Subscriptions for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Aug 10, 2026Accept PayPal & Stripe with Subscriptions for WooCommerce: Does not verify that the PayPal accountCVE-2026-17012 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Accept PayPal & Stripe with Subscriptions for WooCommerce WordPress plugin through 3.1.0 does not verify that the PayPal account which received a payment matches the merchant's configured account before marking the order as paid, allowing unauthenticated buyers to complete a WooCommerce order by paying the full amount to their own PayPal account instead of the merchant's.
Product
Accept PayPal & Stripe with Subscriptions for WooCommerce
Affected
up to 3.1.0
What to do
Affects up to 3.1.0. Update Accept PayPal & Stripe with Subscriptions for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Aug 10, 2026Squeeze: Does not validate the file type or extension of the per-size image data written by one of its attachment-update actionsCVE-2026-16985 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Squeeze WordPress plugin before 1.7.12 does not validate the file type or extension of the per-size image data written by one of its attachment-update actions, allowing users with the upload_files capability (Author and above) to write an executable PHP file into the uploads directory and achieve remote code execution.
Product
Squeeze
Fixed in
1.7.12
What to do
Update Squeeze to 1.7.12 or newer.
Full record and what to do →NVD record wpscan.com
Aug 10, 2026MotoPress Hotel Booking: Does not perform any authorization or ownership check on a REST endpoint that creates payment recordsCVE-2026-15237 · WordPress plugins & themes · reported by WPScanMedium 5.3
The MotoPress Hotel Booking WordPress plugin before 6.2.3 does not perform any authorization or ownership check on a REST endpoint that creates payment records, allowing unauthenticated users to create completed payment records against arbitrary bookings and falsely mark them as paid.
Product
MotoPress Hotel Booking
Fixed in
6.2.3
What to do
Update MotoPress Hotel Booking to 6.2.3 or newer.
Full record and what to do →NVD record wpscan.com
Aug 10, 2026Customer Reviews for WooCommerce: Does not perform nonce or capability checks on several settings-related AJAX actionsCVE-2026-14941 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Customer Reviews for WooCommerce WordPress plugin before 5.116.0 does not perform nonce or capability checks on several settings-related AJAX actions, allowing users with minimal permissions such as Subscribers to invoke administrative settings handlers, update Customer Reviews for WooCommerce WordPress plugin before 5.116.0 options, and disclose store configuration.
Product
Customer Reviews for WooCommerce
Fixed in
5.116.0
What to do
Update Customer Reviews for WooCommerce to 5.116.0 or newer.
Full record and what to do →NVD record wpscan.com
Aug 10, 2026Podcast Player: Does not validate the destination of a server-side request built from user-supplied inputCVE-2026-14860 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Podcast Player WordPress plugin before 8.3.1 does not validate the destination of a server-side request built from user-supplied input, allowing unauthenticated attackers to make the server issue requests to arbitrary hosts and read back responses that parse as RSS/XML.
Product
Podcast Player
Fixed in
8.3.1
What to do
Update Podcast Player to 8.3.1 or newer.
Full record and what to do →NVD record wpscan.com
Aug 10, 2026Autopay: Does not perform any capability or nonce check before saving a styling option from a public requestCVE-2026-14293 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Autopay WordPress plugin before 5.0.1 does not perform any capability or nonce check before saving a styling option from a public request, and does not escape that value when it is later output on the checkout page, allowing unauthenticated attackers to store JavaScript that executes in the browser of any user, including administrators, who loads the checkout page.
Product
Autopay
Fixed in
5.0.1
What to do
Update Autopay to 5.0.1 or newer.
Full record and what to do →NVD record wpscan.com
Aug 10, 2026vitepos WordPress plugin before 3.6.0, Vitepos: Do not perform a per-target authorization check in their point-of-sale password-reset API and grant the custom Outlet Manager role an over-broad password-reset capability bCVE-2026-14237 · WordPress plugins & themes · reported by WPScanHigh 7.2
The vitepos WordPress plugin before 3.6.0, Vitepos WordPress plugin before 3.5.0 do not perform a per-target authorization check in their point-of-sale password-reset API and grant the custom Outlet Manager role an over-broad password-reset capability by default, allowing an Outlet Manager to reset any user's password, including an administrator's, and take over the account.
Product
vitepos WordPress plugin before 3.6.0, Vitepos
Fixed in
3.6.0
What to do
Update vitepos WordPress plugin before 3.6.0, Vitepos to 3.6.0 or newer.
Full record and what to do →NVD record wpscan.com
Aug 10, 2026HT Contact Form: Does not perform any authorization check on the endpoint that returns a saved form draftCVE-2026-14206 · WordPress plugins & themes · reported by WPScanHigh 7.5
The HT Contact Form WordPress plugin before 2.9.3 does not perform any authorization check on the endpoint that returns a saved form draft, allowing unauthenticated users to read the personal data (name, email, phone, address) stored in form drafts.
Product
HT Contact Form
Fixed in
2.9.3
What to do
Update HT Contact Form to 2.9.3 or newer.
Full record and what to do →NVD record wpscan.com
Aug 10, 2026AutoNetTV Relay: Does not perform any capability or authentication check before setting a WordPress administrator authentication cookie during its scheduled content-synchronization taskCVE-2026-13600 · WordPress plugins & themes · reported by WPScanHigh 8.1
The AutoNetTV Relay WordPress plugin before 3.0.14 does not perform any capability or authentication check before setting a WordPress administrator authentication cookie during its scheduled content-synchronization task. On server configurations where the scheduled task executes before the HTTP response is committed, an unauthenticated attacker who triggers the due task can receive the administrator's session cookie and gain administrator access without credentials.
Product
AutoNetTV Relay
Fixed in
3.0.14
What to do
Update AutoNetTV Relay to 3.0.14 or newer.
Full record and what to do →NVD record wpscan.com
Aug 9, 2026PiWeb Cancel order / Refund request for WooCommerce: Does not have authorization or ownership checksCVE-2026-18603 · WordPress plugins & themes · reported by WPScanMedium 6.5
The PiWeb Cancel order / Refund request for WooCommerce WordPress plugin before 1.3.4.34 does not have authorization or ownership checks when adding the contents of a previous order to the cart, allowing unauthenticated users to disclose the contents of other customers' orders, as well as to clear and repopulate a logged in user's cart via a crafted link.
Product
PiWeb Cancel order / Refund request for WooCommerce
Fixed in
1.3.4.34
What to do
Update PiWeb Cancel order / Refund request for WooCommerce to 1.3.4.34 or newer.
Full record and what to do →NVD record wpscan.com
Aug 9, 2026WP MAPS PRO: Does not perform a capability check in one of its AJAX actionsCVE-2026-18465 · WordPress plugins & themes · reported by WPScanMedium 6.5
The WP MAPS PRO WordPress plugin before 6.1.3 does not perform a capability check in one of its AJAX actions, which is also available to unauthenticated users, and does not properly validate a user-controlled path before using it in a file inclusion, allowing unauthenticated attackers to include and execute arbitrary existing local PHP files on the server.
Product
WP MAPS PRO
Fixed in
6.1.3
What to do
Update WP MAPS PRO to 6.1.3 or newer.
Full record and what to do →NVD record wpscan.com
Aug 9, 2026WP MAPS PRO: Does not perform a capability check in one of its AJAX actionsCVE-2026-18464 · WordPress plugins & themes · reported by WPScanHigh 7.5
The WP MAPS PRO WordPress plugin before 6.1.3 does not perform a capability check in one of its AJAX actions, which is also available to unauthenticated users, and does not restrict the operation it dispatches, allowing unauthenticated attackers to trigger uncontrolled recursion that exhausts server resources, resulting in a Denial of Service.
Product
WP MAPS PRO
Fixed in
6.1.3
What to do
Update WP MAPS PRO to 6.1.3 or newer.
Full record and what to do →NVD record wpscan.com
Aug 9, 2026WPC Order Tip for WooCommerce: Does not perform authorisation or nonce checks in one of its reporting featuresCVE-2026-18357 · WordPress plugins & themes · reported by WPScanHigh 7.5
The WPC Order Tip for WooCommerce WordPress plugin before 3.3.1 does not perform authorisation or nonce checks in one of its reporting features, allowing unauthenticated attackers to retrieve sensitive order data belonging to any customer of the store, such as billing names, order IDs and statuses, fee amounts and order dates.
Product
WPC Order Tip for WooCommerce
Fixed in
3.3.1
What to do
Update WPC Order Tip for WooCommerce to 3.3.1 or newer.
Full record and what to do →NVD record wpscan.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.