Updated 6 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,756exploited flaws on CISA’s list

33added in the last 30 days

299new WordPress flaws this week

14,013entries in the database

14,013 results · page 68 of 281

Sep 1, 2026Photo Gallery by Ays – Responsive Image Gallery: Generic SQL InjectionCVE-2026-76006 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The Photo Gallery by Ays – Responsive Image Gallery plugin for WordPress is vulnerable to generic SQL Injection via the 's' parameter in all versions up to, and including, 6.8.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The vulnerability exists across two execution paths — $wpdb->get_var() in record_count() and $wpdb->get_results() in prepare_items()/get_image_categories() — enabling both blind and UNION-based exfiltration techniques.
Product
Photo Gallery by Ays – Responsive Image Gallery
Affected
up to 6.8.2
What to do
Affects up to 6.8.2. Update Photo Gallery by Ays – Responsive Image Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 1, 2026User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor: Stored Cross-Site ScriptingCVE-2026-75965 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'date' Shortcode Attribute in all versions up to, and including, 4.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the wppb_toolbox_shortcodes_settings[format-date] option to be set to 'yes' by an administrator for the shortcode to be active and the vulnerability to be exploitable.
Product
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
Affected
up to 4.0.0
What to do
Affects up to 4.0.0. Update User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 1, 2026Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits: Arbitrary File UploadCVE-2026-75921 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.1.9 via the upload_template_kit function. This is due to incorrect authorization on the upload_template_kit() AJAX handler, which requires only upload_files capability instead of the manage_options required by all sibling handlers, combined with missing per-entry file type filtering after ZIP extraction. This makes it possible for authenticated attackers, with editor-level access and above, to upload files that may be executable, which makes remote code execution possible. Editors can satisfy the nonce requirement because the required nonces are localized on the standard Pages list screen, which is accessible to any user with the edit_pages capability.
Product
Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits
Affected
up to 3.1.9
What to do
Affects up to 3.1.9. Update Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 1, 2026Frontend Admin by DynamiApps: Arbitrary file deletionCVE-2026-19952 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the move_folders function in all versions up to, and including, 3.29.12. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). This is exploitable without authentication when a form is configured with public visibility (who_can_see='all'), as the required nonce is publicly obtainable from the rendered form.
Product
Frontend Admin by DynamiApps
Affected
up to 3.29.12
What to do
Affects up to 3.29.12. Update Frontend Admin by DynamiApps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 1, 2026Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 700+ Patterns, 58 Blocks & Templates: Authorization bypassCVE-2026-19948 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 700+ Patterns, 58 Blocks & Templates plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.2.17. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to retrieve the name, price, short description, image URL, permalink, stock status, and product type of draft, pending, private, and catalog-hidden WooCommerce products not intended to be publicly visible. The sidebarNonce value is emitted unconditionally into public page HTML by multiple block renderers with no login gate, allowing unauthenticated visitors to harvest a valid nonce and pass the only authentication check in the handler.
Product
Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 700+ Patterns, 58 Blocks & Templates
Affected
up to 2.2.17
What to do
Affects up to 2.2.17. Update Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 700+ Patterns, 58 Blocks & Templates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 1, 2026Support Genix – Helpdesk, AI Chatbot, Knowledge Base & Customer Support Ticketing System: Authentication Bypass leading to Administrator Account TakeoverCVE-2026-19806 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Support Genix – Helpdesk, AI Chatbot, Knowledge Base & Customer Support Ticketing System plugin for WordPress is vulnerable to Authentication Bypass leading to Administrator Account Takeover in all versions up to, and including, 1.4.52 via the `guest_ticket_login()` function and its `p` parameter. This is due to the site-wide AES-256-CBC encryption key being derived from only three two-digit `wp_rand(10, 99)` values and a Unix timestamp via `md5()` — yielding approximately 19.5 bits of entropy — combined with a deterministic IV derived from the password, no authentication tag on the ciphertext, and no capability check, nonce, or session validation on the publicly reachable `/sgnix/?p=<token>` endpoint. This makes it possible for authenticated attackers, with subscriber-level access and above, who can obtain a single legitimate guest ticket token as a known-plaintext oracle and bound the plugin activation timestamp, to exhaust the ~729,000-candidate keyspace entirely offline, recover the site-wide encryption key, and forge a self-consistent `{ticket_id, ticket_user}` token targeting any administrator-owned ticket. Submitting the forged token to the unprotected endpoint causes `w
Product
Support Genix – Helpdesk, AI Chatbot, Knowledge Base & Customer Support Ticketing System
Affected
up to 1.4.52
What to do
Affects up to 1.4.52. Update Support Genix – Helpdesk, AI Chatbot, Knowledge Base & Customer Support Ticketing System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 1, 2026Listdom: AI-powered Business Directory with Classifieds Ads Listings: Stored Cross-Site ScriptingCVE-2026-19796 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Listdom: AI-powered Business Directory with Classifieds Ads Listings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'lsd[displ][style]' Parameter in all versions up to, and including, 5.8.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the Listdom Pro add-on to be active and the 'Display Options Per Listing' displ setting to be enabled, both of which are non-default configurations.
Product
Listdom: AI-powered Business Directory with Classifieds Ads Listings
Affected
up to 5.8.1
What to do
Affects up to 5.8.1. Update Listdom: AI-powered Business Directory with Classifieds Ads Listings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 1, 2026Affiliate Super Assistent: Stored Cross-Site ScriptingCVE-2026-19573 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Affiliate Super Assistent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘doCommentShortcode’ function in all versions up to, and including, 1.10.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Affiliate Super Assistent
Affected
up to 1.10.2
What to do
Affects up to 1.10.2. Update Affiliate Super Assistent to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 1, 2026Persistent Login: Generic SQL InjectionCVE-2026-18752 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Persistent Login plugin for WordPress is vulnerable to generic SQL Injection via 'wppl_device_id' Cookie in all versions up to, and including, 3.1.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This vulnerability is only exploitable when the plugin's Login History feature is enabled.
Product
Persistent Login
Affected
up to 3.1.0
What to do
Affects up to 3.1.0. Update Persistent Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 1, 2026Shopping Cart & eCommerce Store: Generic SQL InjectionCVE-2026-17589 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The Shopping Cart & eCommerce Store plugin for WordPress is vulnerable to generic SQL Injection via the 'product_order' parameter in all versions up to, and including, 5.9.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This is a second-order SQL injection: the payload is written to the ec_pageoption table via the ec_ajax_save_page_options handler — which applies no sanitization to raw $_POST values — and is later retrieved with stripslashes() (bypassing WordPress magic-quotes protection) before being concatenated directly into SQL on every store page render.
Product
Shopping Cart & eCommerce Store
Affected
up to 5.9.2
What to do
Affects up to 5.9.2. Update Shopping Cart & eCommerce Store to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 1, 2026Live Composer – Free WordPress Website Builder: Stored Cross-Site ScriptingCVE-2026-16787 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'dslc_custom_field' Shortcode in all versions up to, and including, 2.1.19 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Live Composer – Free WordPress Website Builder
Affected
up to 2.1.19
What to do
Affects up to 2.1.19. Update Live Composer – Free WordPress Website Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 1, 2026Live Composer – Free WordPress Website Builder: Stored Cross-Site ScriptingCVE-2026-13203 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'custom_id' shortcode attribute of the dslc_modules_section and dslc_modules_area shortcodes in versions up to, and including, 2.1.19. This is due to insufficient input sanitization and output escaping on the user-supplied attribute, which is concatenated into the HTML id="" attribute of the rendered <div> element in the dslc_modules_section_front() and dslc_modules_area_front() functions without esc_attr(). This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Live Composer – Free WordPress Website Builder
Affected
up to 2.1.19
What to do
Affects up to 2.1.19. Update Live Composer – Free WordPress Website Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 1, 2026Frontend Admin by DynamiApps: Stored Cross-Site ScriptingCVE-2026-12747 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'tag' Shortcode Attribute in all versions up to, and including, 3.29.11 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Frontend Admin by DynamiApps
Affected
up to 3.29.11
What to do
Affects up to 3.29.11. Update Frontend Admin by DynamiApps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 31, 2026WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode: Arbitrary file uploadCVE-2026-75865 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode plugin for WordPress is vulnerable to arbitrary file upload due to missing file type validation in the saas_upload_logo() function combined with an authorization bypass on the WPLP connector REST endpoints in all versions up to, and including, 4.4.1. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode
Affected
up to 4.4.1
What to do
Affects up to 4.4.1. Update WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org wordfence.com
Aug 31, 2026Eval injection in cPanel 11.138.0.0 and earlier allows remote authenticated users to execute arbitrary code as root.CVE-2026-65643 · Websites & servers · reported by support@hackerone.comHigh 8.7
Eval injection in cPanel 11.138.0.0 and earlier allows remote authenticated users to execute arbitrary code as root.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
NVD record support.cpanel.net
Aug 31, 2026Unauthenticated Server Side Request Forgery (SSRF) in MapSVG <= 8.15.0 versions.CVE-2026-82852 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Unauthenticated Server Side Request Forgery (SSRF) in MapSVG <= 8.15.0 versions.
What to do
Update the plugin to the newest version.
NVD record patchstack.com
Aug 31, 2026Unauthenticated Cross Site Scripting (XSS) in WordPress Social Login and Register <= 7.8.2 versions.CVE-2026-82229 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in WordPress Social Login and Register <= 7.8.2 versions.
What to do
Update the plugin to the newest version.
NVD record patchstack.com
Aug 31, 2026SiteGround Security <= 1: Unauthenticated BypassCVE-2026-82228 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Bypass Vulnerability in SiteGround Security <= 1.6.6 versions.
Product
SiteGround Security <= 1
What to do
Update SiteGround Security <= 1 to the newest version.
NVD record patchstack.com
Aug 31, 2026Unauthenticated PHP Object Injection in Tickera <= 3.6.0.2 versions.CVE-2026-82226 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in Tickera <= 3.6.0.2 versions.
What to do
Update the plugin to the newest version.
NVD record patchstack.com
Aug 31, 2026Unauthenticated Broken Authentication in RegistrationMagic <= 6.0.9.8 versions.CVE-2026-82225 · WordPress plugins & themes · reported by PatchstackHigh 7.4
Unauthenticated Broken Authentication in RegistrationMagic <= 6.0.9.8 versions.
What to do
Update the plugin to the newest version.
NVD record patchstack.com
Aug 31, 2026Unauthenticated Cross Site Scripting (XSS) in SliceWP <= 1.2.10 versions.CVE-2026-82224 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in SliceWP <= 1.2.10 versions.
What to do
Update the plugin to the newest version.
NVD record patchstack.com
Aug 31, 2026Unauthenticated Cross Site Scripting (XSS) in RegistrationMagic <= 6.0.9.8 versions.CVE-2026-82221 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in RegistrationMagic <= 6.0.9.8 versions.
What to do
Update the plugin to the newest version.
NVD record patchstack.com
Aug 31, 2026Unauthenticated Arbitrary File Upload in Hash Form <= 1.4.2 versions.CVE-2026-81780 · WordPress plugins & themes · reported by PatchstackCritical 10
Unauthenticated Arbitrary File Upload in Hash Form <= 1.4.2 versions.
What to do
Update the plugin to the newest version.
NVD record patchstack.com
Aug 31, 2026Silk Themes Newspapers X: Improper Validation of Specified Quantity in InputCVE-2026-81779 · WordPress plugins & themes · reported by PatchstackCritical 10
Improper Validation of Specified Quantity in Input vulnerability in Silk Themes Newspapers X allows Malicious Software Implanted. This issue affects Newspapers X: from 1.0.46 through 1.0.48.
Product
Silk Themes Newspapers X
Affected
up to 1.0.48
What to do
Affects up to 1.0.48. Update Silk Themes Newspapers X to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record patchstack.com
Aug 31, 2026Subscriber Cross Site Scripting (XSS) in Kalles Addons <= 1.0.6 versions.CVE-2026-81778 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Subscriber Cross Site Scripting (XSS) in Kalles Addons <= 1.0.6 versions.
What to do
Update the plugin to the newest version.
NVD record patchstack.com
Aug 31, 2026Unauthenticated Cross Site Scripting (XSS) in Super Store Finder <= 7.10 versions.CVE-2026-81768 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Super Store Finder <= 7.10 versions.
What to do
Update the plugin to the newest version.
NVD record patchstack.com
Aug 31, 2026Unauthenticated Cross Site Scripting (XSS) in Tailored Tools <= 3.0.2 versions.CVE-2026-81765 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Tailored Tools <= 3.0.2 versions.
What to do
Update the plugin to the newest version.
NVD record patchstack.com
Aug 31, 2026Unauthenticated Cross Site Scripting (XSS) in Email Essentials <= 6.0.6 versions.CVE-2026-81764 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Email Essentials <= 6.0.6 versions.
What to do
Update the plugin to the newest version.
NVD record patchstack.com
Aug 31, 2026Unauthenticated SQL Injection in Throws SPAM Away <= 3.8.2 versions.CVE-2026-81763 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in Throws SPAM Away <= 3.8.2 versions.
What to do
Update the plugin to the newest version.
NVD record patchstack.com
Aug 31, 2026Subscriber Broken Access Control in Booking and Rental Manager <= 2.7.6 versions.CVE-2026-81762 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Subscriber Broken Access Control in Booking and Rental Manager <= 2.7.6 versions.
What to do
Update the plugin to the newest version.
NVD record patchstack.com
Aug 31, 2026Subscriber Broken Access Control in OwnerRez API <= 1.2.6 versions.CVE-2026-81758 · WordPress plugins & themes · reported by PatchstackMedium 6.3
Subscriber Broken Access Control in OwnerRez API <= 1.2.6 versions.
What to do
Update the plugin to the newest version.
NVD record patchstack.com
Aug 31, 2026Unauthenticated SQL Injection in Smart Marketing SMS and Newsletters Forms <= 5.1.24 versions.CVE-2026-81756 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in Smart Marketing SMS and Newsletters Forms <= 5.1.24 versions.
What to do
Update the plugin to the newest version.
NVD record patchstack.com
Aug 31, 2026Unauthenticated Cross Site Scripting (XSS) in LeadConnector <= 4.0.5 versions.CVE-2026-81298 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in LeadConnector <= 4.0.5 versions.
What to do
Update the plugin to the newest version.
NVD record patchstack.com
Aug 31, 2026Subscriber Privilege Escalation in Fluent Forms Pro Add On Pack <= 6.2.12 versions.CVE-2026-81297 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Subscriber Privilege Escalation in Fluent Forms Pro Add On Pack <= 6.2.12 versions.
What to do
Update the plugin to the newest version.
NVD record patchstack.com
Aug 31, 2026Unauthenticated Broken Access Control in Fluent Forms Pro Add On Pack <= 6.2.12 versions.CVE-2026-81296 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in Fluent Forms Pro Add On Pack <= 6.2.12 versions.
What to do
Update the plugin to the newest version.
NVD record patchstack.com
Aug 31, 2026Unauthenticated SQL Injection in WP Data Access <= 5.5.81 versions.CVE-2026-81293 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in WP Data Access <= 5.5.81 versions.
What to do
Update the plugin to the newest version.
NVD record patchstack.com
Aug 31, 2026Unauthenticated Cross Site Scripting (XSS) in Uncode <= 2.12.7 versions.CVE-2026-81291 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Uncode <= 2.12.7 versions.
What to do
Update the plugin to the newest version.
NVD record patchstack.com
Aug 31, 2026Unauthenticated Cross Site Scripting (XSS) in Email Subscribers & Newsletters <= 5.9.33 versions.CVE-2026-81290 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Email Subscribers & Newsletters <= 5.9.33 versions.
What to do
Update the plugin to the newest version.
NVD record patchstack.com
Aug 31, 2026Subscriber SQL Injection in Charitable <= 1.8.12.1 versions.CVE-2026-81287 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Subscriber SQL Injection in Charitable <= 1.8.12.1 versions.
What to do
Update the plugin to the newest version.
NVD record patchstack.com
Aug 31, 2026Subscriber Sensitive Data Exposure in Print Barcode Labels for your WooCommerce products/orders <= 4.0.0 versions.CVE-2026-81280 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Subscriber Sensitive Data Exposure in Print Barcode Labels for your WooCommerce products/orders <= 4.0.0 versions.
What to do
Update the plugin to the newest version.
NVD record patchstack.com
Aug 31, 2026WPExperts Post SMTP: Missing AuthorizationCVE-2026-81278 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in WPExperts Post SMTP allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Post SMTP: from 4.0.0 through beta.1.
Product
WPExperts Post SMTP
What to do
Update WPExperts Post SMTP to the newest version.
NVD record patchstack.com
Aug 31, 2026Keep Backup Daily: Sensitive information exposureCVE-2026-75133 · WordPress plugins & themes · reported by VulnCheckHigh 8.7
Keep Backup Daily plugin for WordPress before 2.1.4 contains a sensitive information exposure vulnerability that allows unauthenticated attackers to trigger a full MySQL database dump by accessing the publicly exposed `kbd_cron_process` parameter without authentication. Attackers can predict the partially predictable dump filename based on the database name, a limited random range, and the current Unix timestamp to download the generated backup from the publicly accessible uploads directory.
Product
Keep Backup Daily
Fixed in
2.1.4
What to do
Update Keep Backup Daily to 2.1.4 or newer.
NVD record wordpress.org vulncheck.com
Aug 31, 2026WP Legal Pages WP Cookie Notice for GDPR, CCPA & ePrivacy Consent: Unrestricted Upload of File with Dangerous TypeCVE-2026-82970 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in WP Legal Pages WP Cookie Notice for GDPR, CCPA & ePrivacy Consent allows Using Malicious Files. This issue affects WP Cookie Notice for GDPR, CCPA & ePrivacy Consent: from n/a through 4.4.1.
Product
WP Legal Pages WP Cookie Notice for GDPR, CCPA & ePrivacy Consent
Affected
up to 4.4.1
What to do
Affects up to 4.4.1. Update WP Legal Pages WP Cookie Notice for GDPR, CCPA & ePrivacy Consent to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record patchstack.com
Aug 31, 2026ProfilePress (wp-user-avatar) WordPress plugin before 4.17.2 contains an unauthenticated remote code execution vulnerability that allows unauthenticated attackeCVE-2026-66047 · WordPress plugins & themes · reported by VulnCheckCritical 9.2
ProfilePress (wp-user-avatar) WordPress plugin before 4.17.2 contains an unauthenticated remote code execution vulnerability that allows unauthenticated attackers to install and activate arbitrary plugins by brute-forcing a weak 32-bit connect token via the ppress_connect_process AJAX handler. Attackers can supply a caller-controlled URL through the file request parameter to trigger silent plugin installation and activation, achieving PHP code execution as the web-server user.
Fixed in
4.17.2
What to do
Update the plugin to 4.17.2 or newer.
NVD record profilepress.com wordpress.org
Aug 31, 2026Joomla Extension - joomshaper.com - Open Redirect via Base64 Return Parameter in Helix Ultimate < 2.2.10 - Return redirect parameters accepted arbitrary Base64 CVE-2026-78079 · Websites & servers · reported by security@joomla.orgMedium 5.3
Joomla Extension - joomshaper.com - Open Redirect via Base64 Return Parameter in Helix Ultimate < 2.2.10 - Return redirect parameters accepted arbitrary Base64 strings without verifying whether the resolved target was an internal site URL via Uri::isInternal.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
NVD record joomshaper.com
Aug 31, 2026Joomla Extension - joomshaper.com - Privileged File Upload Bypass via Content Spoofing in Helix Ultimate < 2.2.10 - Image uploads previously validated only fileCVE-2026-78078 · Websites & servers · reported by security@joomla.orgHigh 8.9
Joomla Extension - joomshaper.com - Privileged File Upload Bypass via Content Spoofing in Helix Ultimate < 2.2.10 - Image uploads previously validated only file extension and basic size parameters. Non-image files disguised with raster extensions could be uploaded. Added strict MIME verification and GD binary raster decoding (imagecreatefromstring) to reject invalid/malformed images fail-closed.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
NVD record joomshaper.com
Aug 31, 2026Joomla Extension - joomshaper.com - Stored Cross-Site Scripting (XSS) in MegaMenu Layout Container & Embed Inputs in Helix Ultimate < 2.2.10 - Unsanitized coluCVE-2026-78077 · Websites & servers · reported by security@joomla.orgHigh 8.6
Joomla Extension - joomshaper.com - Stored Cross-Site Scripting (XSS) in MegaMenu Layout Container & Embed Inputs in Helix Ultimate < 2.2.10 - Unsanitized column and item configuration values stored within the MegaMenu layout JSON were rendered without complete contextual escaping, allowing injection of malicious HTML/JS. Stricter sanitization and tag allowlists via `InputFilter` and `htmlspecialchars` were implemented.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
NVD record joomshaper.com
Aug 31, 2026Joomla Extension - joomshaper.com - Broken Access Control & Missing Authorization in MegaMenu Settings in Helix Ultimate < 2.2.10 - The AJAX endpoint save-megamCVE-2026-78076 · Websites & servers · reported by security@joomla.orgMedium 5.1
Joomla Extension - joomshaper.com - Broken Access Control & Missing Authorization in MegaMenu Settings in Helix Ultimate < 2.2.10 - The AJAX endpoint save-megamenu-settings failed to enforce item-level and menu-level edit permissions (core.edit on com_menus.item.{id} or core.admin). An authenticated user could submit modified layout parameters for arbitrary menu items without proper authorization.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
NVD record joomshaper.com
Aug 31, 2026Joomla Extension - joomshaper.com - Broken Object-Level Authorization in Blog Image Deletion in Helix Ultimate < 2.2.10 - `Blog::remove_image()` checked whetherCVE-2026-78075 · Websites & servers · reported by security@joomla.orgMedium 5.1
Joomla Extension - joomshaper.com - Broken Object-Level Authorization in Blog Image Deletion in Helix Ultimate < 2.2.10 - `Blog::remove_image()` checked whether the user was authorized to edit the article ID passed in the request, but did not verify whether the specified image path (src) belonged to that article. On Joomla 3 builds where physical file deletion was triggered, an author could supply their own article ID alongside an arbitrary file path under the `/images/` directory to delete arbitrary files.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
NVD record joomshaper.com
Aug 31, 2026Joomla Extension - miniorgange.com - Unauthenticated arbitrary extension deinstallation via various miniOrange extensions - a missing authentication check allowCVE-2026-78074 · Websites & servers · reported by security@joomla.orgHigh 8.8
Joomla Extension - miniorgange.com - Unauthenticated arbitrary extension deinstallation via various miniOrange extensions - a missing authentication check allows unauthenticated actors to delete arbitrary installed extensions. Only the free versions of the miniOrange plugins are affected.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
NVD record miniorange.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. The WordPress, CMS and hosting-panel entries come from the National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan and others); we show who. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Start a project

Tell us what you're building.

A website, a booking system, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.

01The person who'll build it writes back

02A planning call, then a written plan with the price and the date

03A preview on your phone while it's being built

04Launch night handled: redirects, email, Google

843-331-6339

Not ready to talk yet? Run the free website check and see what Google sees.