Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
11,503 results · page 64 of 231
Aug 30, 2026geotargetingwp: Does not sanitise or escape several parameters before reflecting them back in AJAX responses that are served with an HTML content typeCVE-2026-14307 · WordPress plugins & themes · reported by WPScanHigh 7.1
The geotargetingwp WordPress plugin before 3.5.6.2 does not sanitise or escape several parameters before reflecting them back in AJAX responses that are served with an HTML content type, allowing unauthenticated attackers to inject arbitrary web scripts that execute when a victim is tricked into submitting a crafted request.
- Product
- geotargetingwp
- Fixed in
- 3.5.6.2
- What to do
- Update geotargetingwp to 3.5.6.2 or newer.
Aug 30, 2026MyHome Core: Authentication BypassCVE-2026-15980 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The MyHome Core plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 4.4.5. This is due to missing authorization in the send_link() AJAX handler and improper token validation in the activate() function. This makes it possible for unauthenticated attackers to generate an activation token for an unconfirmed user account and obtain a valid authentication cookie for that account, including administrators. Successful exploitation requires the MyHome theme to be configured in legacy/WPBakery mode with frontend registration and confirmation email enabled, and the target account must not already have the myhome_agent_confirmed user meta set.
- Product
- MyHome Core
- Affected
- up to 4.4.5
- What to do
- Affects up to 4.4.5. Update MyHome Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 29, 2026Custom User Registration Fields for WooCommerce: Privilege EscalationCVE-2026-15369 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Custom User Registration Fields for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 2.2.3. This is due to the plugin accepting an attacker-controlled afreg_select_user_role value from the unauthenticated WooCommerce Store API /wc/store/v1/checkout request in the af_reg_checkout_data_to_order_meta_data_block() function, persisting it in order meta, and then passing it directly to WP_User::add_role() in the af_reg_custom_order_processing_function() function (hooked to woocommerce_thankyou) without validating against the plugin's admin-configured allowed role list. This makes it possible for unauthenticated attackers to elevate their privileges to Administrator by creating an account during checkout with a modified JSON body specifying administrator (or any other role slug) as the desired role. Note: The exploit requires the "User Role Selection" setting to be enabled.
- Product
- Custom User Registration Fields for WooCommerce
- Affected
- up to 2.2.3
- What to do
- Affects up to 2.2.3. Update Custom User Registration Fields for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 29, 2026SAML Single Sign On – SSO Login: Authentication BypassCVE-2026-75807 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The SAML Single Sign On – SSO Login plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 5.4.6. This is due to the mo_saml_login_validate() ACS handler persisting the X.509 certificate extracted from an incoming SAMLResponse into the mo_saml_required_certificate option before the signature-validation verdict is enforced, because mo_saml_find_certificate() returns false on a fingerprint mismatch rather than halting execution. This makes it possible for unauthenticated attackers to overwrite the plugin's stored IdP signing certificate with an attacker-controlled value, and subsequently forge SAML assertions for any WordPress account — including administrators — to obtain a fully privileged session. Note: The exploit requires the administrator to perform a repair after receiving the test_config_error_wpsamlerr004 error message during the test configuration.
- Product
- SAML Single Sign On – SSO Login
- Affected
- up to 5.4.6
- What to do
- Affects up to 5.4.6. Update SAML Single Sign On – SSO Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 29, 2026Sigma Forms Pro: Remote Code ExecutionCVE-2026-14494 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Sigma Forms Pro plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.4.5 via the handle_form_submission function. This is due to the plugin dynamically granting the unfiltered_upload capability to all users during form submissions and bypassing MIME type validation when allowed_file_types is not configured. This makes it possible for unauthenticated attackers to execute code on the server. Several default pre-built templates including Job Application, Support Ticket, and Wholesale Application have file upload fields with no file type restrictions configured by design, making this vulnerability immediately exploitable upon installation.
- Product
- Sigma Forms Pro
- Affected
- up to 1.4.5
- What to do
- Affects up to 1.4.5. Update Sigma Forms Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 29, 2026Frontend Admin by DynamiApps: Does not perform a capability check on one of its AJAX actionsCVE-2026-81346 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Frontend Admin by DynamiApps WordPress plugin before 3.29.11 does not perform a capability check on one of its AJAX actions, allowing any authenticated user, such as a subscriber, to delete arbitrary membership plans.
- Product
- Frontend Admin by DynamiApps
- Fixed in
- 3.29.11
- What to do
- Update Frontend Admin by DynamiApps to 3.29.11 or newer.
Aug 29, 2026MasterStudy LMS: Does not validate a redirect parameter supplied during user registration before using itCVE-2026-81342 · WordPress plugins & themes · reported by WPScanMedium 4.7
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.43 does not validate a redirect parameter supplied during user registration before using it, allowing unauthenticated attackers to redirect users to arbitrary external URLs.
- Product
- MasterStudy LMS
- Fixed in
- 3.7.43
- What to do
- Update MasterStudy LMS to 3.7.43 or newer.
Aug 29, 2026MasterStudy LMS: Does not correctly restrict access to order informationCVE-2026-81200 · WordPress plugins & themes · reported by WPScanLow 2.7
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.42 does not correctly restrict access to order information, allowing any user with the instructor role to read other users' order billing details, including name, email address, phone number and postal address, by enumerating order IDs.
- Product
- MasterStudy LMS
- Fixed in
- 3.7.42
- What to do
- Update MasterStudy LMS to 3.7.42 or newer.
Aug 29, 2026MasterStudy LMS: Does not verify the amountCVE-2026-81026 · WordPress plugins & themes · reported by WPScanMedium 4.8
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.40 does not verify the amount, receiver, currency or status of a payment notification before marking the corresponding order completed, allowing unauthenticated users to complete full-price orders and gain access to paid content by paying only a token amount.
- Product
- MasterStudy LMS
- Fixed in
- 3.7.40
- What to do
- Update MasterStudy LMS to 3.7.40 or newer.
Aug 29, 2026WP Ultimate CSV Importer: Does not properly sanitise and escape imported field values before using them in a SQL statementCVE-2026-80488 · WordPress plugins & themes · reported by WPScanMedium 4.1
The WP Ultimate CSV Importer WordPress plugin before 9.0 does not properly sanitise and escape imported field values before using them in a SQL statement, which could allow high privilege users such as admin to perform SQL injection attacks.
- Product
- WP Ultimate CSV Importer
- Fixed in
- 9.0
- What to do
- Update WP Ultimate CSV Importer to 9.0 or newer.
Aug 29, 2026Stripe Payment Forms by WP Full Pay: Does not verify that a subscription belongs to the customer bound to the requesting customer-portal session before cancelling itCVE-2026-80311 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.5 does not verify that a subscription belongs to the customer bound to the requesting customer-portal session before cancelling it, allowing a user with a confirmed portal session to cancel subscriptions belonging to other customers. Exploitation requires the attacker to know the target subscription's identifier, which is high-entropy and not enumerable through the Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.5.
- Product
- Stripe Payment Forms by WP Full Pay
- Fixed in
- 8.5.5
- What to do
- Update Stripe Payment Forms by WP Full Pay to 8.5.5 or newer.
Aug 29, 2026Rank Math SEO: Does not check that the user requesting an automated SEO fix holds the capability WordPress itself requires for the settings being changedCVE-2026-77786 · WordPress plugins & themes · reported by WPScanMedium 4.9
The Rank Math SEO WordPress plugin before 1.0.277 does not check that the user requesting an automated SEO fix holds the capability WordPress itself requires for the settings being changed, allowing users with the Editor role to modify site-wide core WordPress settings that are reserved to administrators.
- Product
- Rank Math SEO
- Fixed in
- 1.0.277
- What to do
- Update Rank Math SEO to 1.0.277 or newer.
Aug 29, 2026Booking for Appointments and Events Calendar: Does not check that a user holds the required capability before letting them change an appointment's statusCVE-2026-77704 · WordPress plugins & themes · reported by WPScanLow 2.7
The Booking for Appointments and Events Calendar WordPress plugin before 2.4.9 does not check that a user holds the required capability before letting them change an appointment's status, allowing customers to set arbitrary statuses on appointments they are booked on, including approving their own bookings that were left awaiting approval and overwriting another customer's booking status on a shared appointment.
- Product
- Booking for Appointments and Events Calendar
- Fixed in
- 2.4.9
- What to do
- Update Booking for Appointments and Events Calendar to 2.4.9 or newer.
Aug 29, 2026爱采集数据采集和发布插件: Does not require a per-install secret for one of its unauthenticated endpointsCVE-2026-77012 · WordPress plugins & themes · reported by WPScanCritical 9.3
The 爱采集数据采集和发布插件 WordPress plugin through 1.0.0 does not require a per-install secret for one of its unauthenticated endpoints, relying on a hardcoded default, and does not validate the URLs or destination paths it is given, allowing unauthenticated attackers to read arbitrary files from the server, force it to issue arbitrary requests and retrieve the responses, and write attacker-supplied content outside the uploads directory.
- Product
- 爱采集数据采集和发布插件
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update 爱采集数据采集和发布插件 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 29, 2026HEL Online Classroom: AI-powered Online Classrooms: Does not perform authorisation checks on its REST API routes and does not consistently enforce the per-class access codeCVE-2026-77010 · WordPress plugins & themes · reported by WPScanMedium 6.5
The HEL Online Classroom: AI-powered Online Classrooms WordPress plugin through 1.0.3 does not perform authorisation checks on its REST API routes and does not consistently enforce the per-class access code, allowing unauthenticated users to obtain a signed meeting join link for any classroom, including one protected by an access code, and to join it with moderator privileges.
- Product
- HEL Online Classroom: AI-powered Online Classrooms
- Affected
- up to 1.0.3
- What to do
- Affects up to 1.0.3. Update HEL Online Classroom: AI-powered Online Classrooms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 29, 2026HEL Online Classroom: AI-powered Online Classrooms: Does not have any authorisation or authentication checkCVE-2026-77008 · WordPress plugins & themes · reported by WPScanMedium 6.5
The HEL Online Classroom: AI-powered Online Classrooms WordPress plugin through 1.0.3 does not have any authorisation or authentication check when saving its settings, allowing unauthenticated users to overwrite them and repoint every online classroom, along with the shared secret those sessions are signed with, at infrastructure of their choosing.
- Product
- HEL Online Classroom: AI-powered Online Classrooms
- Affected
- up to 1.0.3
- What to do
- Affects up to 1.0.3. Update HEL Online Classroom: AI-powered Online Classrooms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 29, 2026HEL Online Classroom: AI-powered Online Classrooms: Does not perform any authorisation check on one of its REST API routesCVE-2026-77007 · WordPress plugins & themes · reported by WPScanHigh 7.5
The HEL Online Classroom: AI-powered Online Classrooms WordPress plugin through 1.0.3 does not perform any authorisation check on one of its REST API routes, allowing unauthenticated users to retrieve its stored settings, including the shared secret used to sign API requests to the connected BigBlueButton server.
- Product
- HEL Online Classroom: AI-powered Online Classrooms
- Affected
- up to 1.0.3
- What to do
- Affects up to 1.0.3. Update HEL Online Classroom: AI-powered Online Classrooms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 29, 2026Appointment Booking Calendar Plugin and Scheduling: Does not verify the amount actually paid against the server-side price staged for a bookingCVE-2026-76586 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Appointment Booking Calendar Plugin and Scheduling Plugin WordPress plugin before 1.6.3 does not verify the amount actually paid against the server-side price staged for a booking when confirming an online payment, allowing unauthenticated users to have a paid appointment approved for a fraction of its price.
- Product
- Appointment Booking Calendar Plugin and Scheduling
- Fixed in
- 1.6.3
- What to do
- Update Appointment Booking Calendar Plugin and Scheduling to 1.6.3 or newer.
Aug 29, 2026User Profile Builder: Does not properly restrict its front-end file upload featureCVE-2026-76548 · WordPress plugins & themes · reported by WPScanHigh 8.2
The User Profile Builder WordPress plugin before 4.0.1 does not properly restrict its front-end file upload feature, granting unauthenticated visitors capabilities reserved to privileged roles. This allows them to list the site's media library and to modify unpublished posts, pages and media items belonging to other users.
- Product
- User Profile Builder
- Fixed in
- 4.0.1
- What to do
- Update User Profile Builder to 4.0.1 or newer.
Aug 29, 2026User Profile Builder: Does not validate the type of data being deserializedCVE-2026-76547 · WordPress plugins & themes · reported by WPScanMedium 6.6
The User Profile Builder WordPress plugin before 4.0.1 does not validate the type of data being deserialized when importing a configuration file, allowing high privilege users such as administrators to conduct PHP Object Injection. The affected feature is a free add-on which is disabled by default, and no POP chain is present in the User Profile Builder WordPress plugin before 4.0.1 itself, so further impact requires a suitable gadget from another installed User Profile Builder WordPress plugin before 4.0.1 or .
- Product
- User Profile Builder
- Fixed in
- 4.0.1
- What to do
- Update User Profile Builder to 4.0.1 or newer.
Aug 29, 2026User Profile Builder: Does not escape the output of one of its optional shortcodesCVE-2026-76546 · WordPress plugins & themes · reported by WPScanMedium 6.8
The User Profile Builder WordPress plugin before 4.0.1 does not escape the output of one of its optional shortcodes, allowing users with a role as low as contributor to perform Stored Cross-Site Scripting attacks against any user viewing the affected content, including administrators. The shortcode is not enabled by default.
- Product
- User Profile Builder
- Fixed in
- 4.0.1
- What to do
- Update User Profile Builder to 4.0.1 or newer.
Aug 29, 2026Catfolders Document Gallery Pro: Does not authorise some of its REST API routesCVE-2026-19430 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Catfolders Document Gallery Pro WordPress plugin before 2.0.7 does not authorise some of its REST API routes, and the token identifying the requested content is forgeable client side, allowing unauthenticated users to list and download the contents of folders that were never published on the site.
- Product
- Catfolders Document Gallery Pro
- Fixed in
- 2.0.7
- What to do
- Update Catfolders Document Gallery Pro to 2.0.7 or newer.
Aug 29, 2026MStore API: Does not verify that the order targeted by its wallet payment handling belongs to the requesterCVE-2026-18234 · WordPress plugins & themes · reported by WPScanMedium 6.5
The MStore API WordPress plugin before 4.21.1 does not verify that the order targeted by its wallet payment handling belongs to the requester, and does not deduct the wallet balance for most payment methods, allowing any authenticated user, including Subscribers, to mark arbitrary orders as paid without any payment being taken.
- Product
- MStore API
- Fixed in
- 4.21.1
- What to do
- Update MStore API to 4.21.1 or newer.
Aug 29, 2026MStore API: Does not verify that the order targeted by one of its delivery endpoints belongs to the requesterCVE-2026-18233 · WordPress plugins & themes · reported by WPScanMedium 6.5
The MStore API WordPress plugin before 4.21.1 does not verify that the order targeted by one of its delivery endpoints belongs to the requester, allowing any authenticated user, including Subscribers, to mark arbitrary orders as completed and paid without any payment being made.
- Product
- MStore API
- Fixed in
- 4.21.1
- What to do
- Update MStore API to 4.21.1 or newer.
Aug 29, 2026Newsletters: Does not perform any nonce or capability checkCVE-2026-17522 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Newsletters WordPress plugin before 4.17 does not perform any nonce or capability check when saving one of its settings screens, and writes every submitted parameter into its own options, allowing attackers to make a logged in administrator overwrite arbitrary Newsletters WordPress plugin before 4.17 settings, including the credential protecting its API, via a Cross-Site Request Forgery attack.
- Product
- Newsletters
- Fixed in
- 4.17
- What to do
- Update Newsletters to 4.17 or newer.
Aug 29, 2026Newsletters: Does not generate its API key using a sufficiently random sourceCVE-2026-17520 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Newsletters WordPress plugin before 4.17 does not generate its API key using a sufficiently random source, deriving it from a publicly known value, allowing unauthenticated attackers to compute the key and perform privileged actions such as adding and deleting subscribers and sending emails, when the optional API has been enabled.
- Product
- Newsletters
- Fixed in
- 4.17
- What to do
- Update Newsletters to 4.17 or newer.
Aug 29, 2026Total processing card payments for WooCommerce: Does not validate a user-supplied path before using it to build a server-side verification requestCVE-2026-16947 · WordPress plugins & themes · reported by WPScanCritical 9.1
The Total processing card payments for WooCommerce WordPress plugin through 7.3 does not validate a user-supplied path before using it to build a server-side verification request, and does not verify the authenticity of the response, allowing unauthenticated attackers to redirect that request to an arbitrary host (disclosing the merchant's payment-gateway credentials) and to forge a success response that marks arbitrary WooCommerce orders as paid.
- Product
- Total processing card payments for WooCommerce
- Affected
- up to 7.3
- What to do
- Affects up to 7.3. Update Total processing card payments for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 29, 2026SmartAIPress: Does not perform a capability check on one of its AJAX actions and does not validate a user-supplied URL before fetching it server-sideCVE-2026-16600 · WordPress plugins & themes · reported by WPScanHigh 7.7
The SmartAIPress WordPress plugin through 1.2.0 does not perform a capability check on one of its AJAX actions and does not validate a user-supplied URL before fetching it server-side, allowing users with subscriber-level access and above to make the site retrieve arbitrary internal or external URLs and read the response, resulting in a full-read Server-Side Request Forgery.
- Product
- SmartAIPress
- Affected
- up to 1.2.0
- What to do
- Affects up to 1.2.0. Update SmartAIPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 29, 2026Uix UserCenter: Does not verify that the account being modified through an unauthenticated profile-update action belongs to the requesterCVE-2026-16259 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Uix UserCenter WordPress plugin through 1.0.3 does not verify that the account being modified through an unauthenticated profile-update action belongs to the requester, and it authenticates that action with a token whose signing key is hardcoded and identical across every install, allowing unauthenticated attackers to forge a token for any user, overwrite an administrator's email and password, and take over the account.
- Product
- Uix UserCenter
- Affected
- up to 1.0.3
- What to do
- Affects up to 1.0.3. Update Uix UserCenter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 29, 2026Rest Routes: Does not sanitize and validate a value taken from the URL of one of its public REST routes before using it in a SQL queryCVE-2026-16061 · WordPress plugins & themes · reported by WPScanHigh 8.6
The Rest Routes WordPress plugin through 5.5.5 does not sanitize and validate a value taken from the URL of one of its public REST routes before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection attacks.
- Product
- Rest Routes
- Affected
- up to 5.5.5
- What to do
- Affects up to 5.5.5. Update Rest Routes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 29, 2026MemberHero: Does not restrictCVE-2026-10522 · WordPress plugins & themes · reported by WPScanCritical 9.8
The MemberHero WordPress plugin through 6.9 does not restrict which account fields can be supplied during its frontend registration process, allowing unauthenticated attackers to register a new user with an arbitrary role, including Administrator, leading to a full site takeover. Version 6.9 is advertised as resolving this issue, but the fix is incomplete and the current version remains exploitable by unauthenticated attackers to obtain administrator access and to take over existing accounts. No version that fully addresses the issue is available at the time of this advisory. Mitigation: deactivate and remove the MemberHero WordPress plugin through 6.9 until a version that fully resolves this issue is released. If the MemberHero WordPress plugin through 6.9 must stay active, disable public registration, restrict access to the registration functionality, and monitor the site for unexpected administrator accounts.
- Product
- MemberHero
- Affected
- up to 6.9
- What to do
- Affects up to 6.9. Update MemberHero to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 28, 2026WordPress plugin (Spiffy Plugin) before 5.0.9 is affected by Stored Cross-Site Scripting in Event Title field.CVE-2026-39071 · WordPress plugins & themes · reported by MITREMedium 5.4
WordPress plugin (Spiffy Plugin) before 5.0.9 is affected by Stored Cross-Site Scripting in Event Title field. An authenticated attacker with the lowest privileged role (contributor) can exploit this to redirect user to malicious site or control the account.
- Fixed in
- 5.0.9
- What to do
- Update the plugin to 5.0.9 or newer.
Aug 28, 2026WordPress plugin (Bit Assist) before 1.7.2 is affected by Stored Cross-Site Scripting in Call-To-Action feature.CVE-2026-39070 · WordPress plugins & themes · reported by MITREMedium 4.8
WordPress plugin (Bit Assist) before 1.7.2 is affected by Stored Cross-Site Scripting in Call-To-Action feature. An authenticated attacker with the privileged role (admin) can exploit this to redirect user to malicious site or control the account.
- Fixed in
- 1.7.2
- What to do
- Update the plugin to 1.7.2 or newer.
Aug 28, 2026Contributor SQL Injection in WPBulky <= 1.2.2 versions.CVE-2026-82227 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Contributor SQL Injection in WPBulky <= 1.2.2 versions.
- What to do
- Update the plugin to the newest version.
Aug 28, 2026Unauthenticated Other Vulnerability Type in Forminator <= 1.57.1 versions.CVE-2026-82220 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Other Vulnerability Type in Forminator <= 1.57.1 versions.
- What to do
- Update the plugin to the newest version.
Aug 28, 2026Unauthenticated Broken Access Control in Simple Payment <= 2.5.2 versions.CVE-2026-81767 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in Simple Payment <= 2.5.2 versions.
- What to do
- Update the plugin to the newest version.
Aug 28, 2026Subscriber Broken Access Control in WpEvently <= 5.5.0 versions.CVE-2026-81761 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Subscriber Broken Access Control in WpEvently <= 5.5.0 versions.
- What to do
- Update the plugin to the newest version.
Aug 28, 2026Crocoblock JetEngine: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-81760 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetEngine allows Reflected XSS. This issue affects JetEngine: from n/a through 3.8.14.2.
- Product
- Crocoblock JetEngine
- Affected
- up to 3.8.14.2
- What to do
- Affects up to 3.8.14.2. Update Crocoblock JetEngine to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 28, 2026Contributor Broken Access Control in WpEvently <= 5.5.0 versions.CVE-2026-81759 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Contributor Broken Access Control in WpEvently <= 5.5.0 versions.
- What to do
- Update the plugin to the newest version.
Aug 28, 2026Author Remote Code Execution (RCE) in Rank Math SEO <= 1.0.276 versions.CVE-2026-81757 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Author Remote Code Execution (RCE) in Rank Math SEO <= 1.0.276 versions.
- What to do
- Update the plugin to the newest version.
Aug 28, 2026Subscriber Insecure Direct Object References (IDOR) in WP Job Portal <= 2.5.9 versions.CVE-2026-81299 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Subscriber Insecure Direct Object References (IDOR) in WP Job Portal <= 2.5.9 versions.
- What to do
- Update the plugin to the newest version.
Aug 28, 2026Unauthenticated Denial of Service Attack in Smush Image Compression and Optimization <= 4.2.0 versions.CVE-2026-81285 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Denial of Service Attack in Smush Image Compression and Optimization <= 4.2.0 versions.
- What to do
- Update the plugin to the newest version.
Aug 28, 2026Contributor Broken Access Control in ACF Extended <= 0.9.2.6 versions.CVE-2026-81284 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Contributor Broken Access Control in ACF Extended <= 0.9.2.6 versions.
- What to do
- Update the plugin to the newest version.
Aug 28, 2026Customer Reviews for WooCommerce: Stored Cross-Site ScriptingCVE-2026-6176 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the aggregated review form submission in versions up to and including 5.106.0. This is due to insufficient input sanitization and output escaping on user-supplied review comment text. The plugin accepts review submissions from unauthenticated users through the 'cr_local_forms_submit' AJAX action without sanitizing HTML content before storing it via wp_insert_comment(), and later renders this stored content on product pages through comment_text() without proper escaping. This makes it possible for unauthenticated attackers with a valid review form URL (obtainable through review reminder emails sent to customers who placed orders) to inject arbitrary web scripts in pages that will execute whenever a user accesses the affected product page.
- Product
- Customer Reviews for WooCommerce
- Affected
- up to 5.106.0
- What to do
- Affects up to 5.106.0. Update Customer Reviews for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 28, 2026WP Rocket: Stored Cross-Site ScriptingCVE-2026-5934 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The WP Rocket plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.21.0.1. This is due to insufficient input sanitization and output escaping of user-supplied data via the rocket_beacon AJAX endpoint. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- WP Rocket
- Affected
- up to 3.21.0.1
- What to do
- Affects up to 3.21.0.1. Update WP Rocket to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 28, 2026Everest Forms: Server-Side Request ForgeryCVE-2026-5096 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Everest Forms plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.4.4. This is due to the `load_previous_field_value()` method in `class-evf-form-task.php` accepting arbitrary URL values from `$_POST` data for upload fields without domain restriction, which are then passed to `wp_remote_head()` in the `get_local_file_size()` method of `class-evf-form-fields-upload.php`. This makes it possible for unauthenticated attackers to force the WordPress server to make outbound HTTP HEAD requests to arbitrary URLs by submitting a form with an upload field containing a malicious URL while leaving a required field empty to trigger form re-rendering.
- Product
- Everest Forms
- Affected
- up to 3.4.4
- What to do
- Affects up to 3.4.4. Update Everest Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 28, 2026Envira Gallery: Stored Cross-Site ScriptingCVE-2026-3423 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Envira Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the gallery 'description' configuration field in all versions up to, and including, 1.12.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses a page displaying the gallery with a description enabled.
- Product
- Envira Gallery
- Affected
- up to 1.12.4
- What to do
- Affects up to 1.12.4. Update Envira Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 28, 2026Liquid Web / StellarWP GiveWP: Deserialization of Untrusted DataCVE-2026-82222 · WordPress plugins & themes · reported by PatchstackCritical 10
Deserialization of Untrusted Data vulnerability in Liquid Web / StellarWP GiveWP allows Object Injection. This issue affects GiveWP: from n/a through 4.16.7.1.
- Product
- Liquid Web / StellarWP GiveWP
- Affected
- up to 4.16.7.1
- What to do
- Affects up to 4.16.7.1. Update Liquid Web / StellarWP GiveWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 28, 2026WPDeveloper Essential Addons for Elementor: Authentication Bypass by SpoofingCVE-2026-81777 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Authentication Bypass by Spoofing vulnerability in WPDeveloper Essential Addons for Elementor allows Identity Spoofing. This issue affects Essential Addons for Elementor: from n/a through 6.8.0.
- Product
- WPDeveloper Essential Addons for Elementor
- Affected
- up to 6.8.0
- What to do
- Affects up to 6.8.0. Update WPDeveloper Essential Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 28, 2026All-in-One WP Migration Unlimited Extension: Stored Cross-Site ScriptingCVE-2026-6128 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The All-in-One WP Migration Unlimited Extension plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ai1wm_backups_path' parameter in all versions up to, and including, 2.84. This is due to insufficient input sanitization and output escaping on user-supplied attributes combined with missing authorization checks on the settings() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever an administrator accesses the plugin settings page. The vulnerability was partially patched in version 2.84.
- Product
- All-in-One WP Migration Unlimited Extension
- Affected
- up to 2.84
- What to do
- Affects up to 2.84. Update All-in-One WP Migration Unlimited Extension to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. The WordPress, CMS and hosting-panel entries come from the National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan and others); we show who. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, a booking system, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.