Updated 4 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

479new WordPress flaws this week

390,525entries in the database

796 results · page 7 of 16

Mar 5, 2026Happy Baby: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-28062 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Happy Baby happy-baby allows PHP Local File Inclusion.This issue affects Happy Baby: from n/a through <= 1.2.12.
Product
Happy Baby
Affected
up to 1.2.12
What to do
Affects up to 1.2.12. Update Happy Baby to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 5, 2026BuddyApp: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-22465 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SeventhQueen BuddyApp buddyapp allows Reflected XSS.This issue affects BuddyApp: from n/a through <= 1.9.2.
Product
BuddyApp
Affected
up to 1.9.2
What to do
Affects up to 1.9.2. Update BuddyApp to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 2, 2026LatePoint – Calendar Booking Plugin for Appointments and Events: SQL InjectionCVE-2026-1487 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to SQL Injection via the JSON Import in all versions up to, and including, 5.2.7 due to insufficient validation on the user-supplied JSON data. This makes it possible for authenticated attackers, with Administrator-level access and above, to execute arbitrary SQL queries on the database that can be used to extract information via time-based techniques, drop tables, or modify data.
Product
LatePoint – Calendar Booking Plugin for Appointments and Events
Affected
up to 5.2.7
What to do
Affects up to 5.2.7. Update LatePoint – Calendar Booking Plugin for Appointments and Events to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 2, 2026LatePoint – Calendar Booking Plugin for Appointments and Events: Privilege escalationCVE-2026-1566 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to privilege escalation via password reset in all versions up to, and including, 5.2.7. This is due to the plugin allowing users with a LatePoint Agent role, who are creating new customers to set the 'wordpress_user_id' field. This makes it possible for authenticated attackers, with Agent-level access and above, to gain elevated privileges by linking a customer to the arbitrary user ID, including administrators, and then resetting the password.
Product
LatePoint – Calendar Booking Plugin for Appointments and Events
Affected
up to 5.2.7
What to do
Affects up to 5.2.7. Update LatePoint – Calendar Booking Plugin for Appointments and Events to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 28, 2026wpForo Forum 2.4.14 contains an information disclosure vulnerability that allows unauthenticated users to retrieve private and unapproved forum topics via the gCVE-2026-28559 · WordPress plugins & themes · reported by VulnCheckMedium 6.9
wpForo Forum 2.4.14 contains an information disclosure vulnerability that allows unauthenticated users to retrieve private and unapproved forum topics via the global RSS feed endpoint. Attackers request the RSS feed without a forum ID parameter, bypassing the privacy and status WHERE clauses that are only applied when a specific forum ID is present in the query.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record wordpress.org wordpress.org
Feb 28, 2026wpForo Forum 2.4.14 contains a missing authorization vulnerability that allows authenticated subscribers to approve or unapprove any forum post via the wpforo_aCVE-2026-28554 · WordPress plugins & themes · reported by VulnCheckMedium 5.3
wpForo Forum 2.4.14 contains a missing authorization vulnerability that allows authenticated subscribers to approve or unapprove any forum post via the wpforo_approve_ajax AJAX handler. Attackers exploit the nonce-only check by submitting a valid nonce with an arbitrary post ID to bypass moderation controls entirely.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record wordpress.org wordpress.org
Feb 20, 2026Applay - Shortcodes: Deserialization of Untrusted DataCVE-2026-22384 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in leafcolor Applay - Shortcodes applay-shortcodes allows Object Injection.This issue affects Applay - Shortcodes: from n/a through <= 3.7.
Product
Applay - Shortcodes
Affected
up to 3.7
What to do
Affects up to 3.7. Update Applay - Shortcodes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 20, 2026New User Approve: Missing AuthorizationCVE-2025-69063 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Missing Authorization vulnerability in Saad Iqbal New User Approve new-user-approve allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects New User Approve: from n/a through <= 3.2.0.
Product
New User Approve
Affected
up to 3.2.0
What to do
Affects up to 3.2.0. Update New User Approve to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 20, 2026HAPPY: Missing AuthorizationCVE-2025-67977 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Missing Authorization vulnerability in VillaTheme HAPPY happy-helpdesk-support-ticket-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HAPPY: from n/a through <= 1.0.8.
Product
HAPPY
Affected
up to 1.0.8
What to do
Affects up to 1.0.8. Update HAPPY to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 19, 2026PostmarkApp Email Integrator: Stored Cross-Site ScriptingCVE-2026-1043 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The PostmarkApp Email Integrator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin settings in versions up to, and including, 2.4. This is due to insufficient input sanitization and output escaping on the pma_api_key and pma_sender_address parameters. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the settings page.
Product
PostmarkApp Email Integrator
Affected
up to 2.4
What to do
Affects up to 2.4. Update PostmarkApp Email Integrator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 18, 2026Bookster – WordPress Appointment Booking: SQL InjectionCVE-2025-8781 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The Bookster – WordPress Appointment Booking Plugin plugin for WordPress is vulnerable to SQL Injection via the ‘raw’ parameter in all versions up to, and including, 2.1.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Bookster – WordPress Appointment Booking
Affected
up to 2.1.1
What to do
Affects up to 2.1.1. Update Bookster – WordPress Appointment Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 14, 2026LatePoint – Calendar Booking Plugin for Appointments and Events: Cross-Site Request ForgeryCVE-2025-14873 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.2.5. This is due to the 'call_by_route_name' function in the routing layer only validating user capabilities without enforcing nonce verification. This makes it possible for unauthenticated attackers to perform multiple administrative actions via forged requests granted they can trick a site administrator into performing an action such as clicking on a link.
Product
LatePoint – Calendar Booking Plugin for Appointments and Events
Affected
up to 5.2.5
What to do
Affects up to 5.2.5. Update LatePoint – Calendar Booking Plugin for Appointments and Events to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 14, 2026Appointment Booking Calendar Plugin – Bookr: Unauthorized modification of dataCVE-2026-1932 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Appointment Booking Calendar Plugin – Bookr plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the update-appointment REST API endpoint in all versions up to, and including, 1.0.2. This makes it possible for unauthenticated attackers to modify the status of any appointment.
Product
Appointment Booking Calendar Plugin – Bookr
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update Appointment Booking Calendar Plugin – Bookr to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 11, 2026LatePoint – Calendar Booking Plugin for Appointments and Events: Unauthorized access of dataCVE-2026-1537 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the load_step() function in all versions up to, and including, 5.2.6. This makes it possible for unauthenticated attackers to view booking information including customer names, email addresses, phone numbers, appointment times, and service details.
Product
LatePoint – Calendar Booking Plugin for Appointments and Events
Affected
up to 5.2.6
What to do
Affects up to 5.2.6. Update LatePoint – Calendar Booking Plugin for Appointments and Events to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 4, 2026Smart Appointment & Booking: Stored Cross-Site ScriptingCVE-2026-0742 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Smart Appointment & Booking plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the saab_save_form_data AJAX action in all versions up to, and including, 1.0.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Smart Appointment & Booking
Affected
up to 1.0.7
What to do
Affects up to 1.0.7. Update Smart Appointment & Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 3, 2026Happy Addons for Elementor: Stored Cross-Site ScriptingCVE-2026-1210 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '_elementor_data' meta field in all versions up to, and including, 3.20.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Happy Addons for Elementor
Affected
up to 3.20.7
What to do
Affects up to 3.20.7. Update Happy Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 3, 2026LatePoint – Calendar Booking Plugin for Appointments and Events: Stored Cross-Site ScriptingCVE-2026-0617 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the customer profile fields in all versions up to, and including, 5.2.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever an administrator views the customer's activity history.
Product
LatePoint – Calendar Booking Plugin for Appointments and Events
Affected
up to 5.2.5
What to do
Affects up to 5.2.5. Update LatePoint – Calendar Booking Plugin for Appointments and Events to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 28, 2026New User Approve: Unauthorized access of data and modification of dataCVE-2026-0832 · WordPress plugins & themes · reported by WordfenceHigh 7.3
The New User Approve plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a missing capability check on multiple REST API endpoints in all versions up to, and including, 3.2.2. This makes it possible for unauthenticated attackers to approve or deny user accounts, retrieve sensitive user information including emails and roles, and force logout of privileged users.
Product
New User Approve
Affected
up to 3.2.2
What to do
Affects up to 3.2.2. Update New User Approve to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 28, 2026Appointment Hour Booking – Booking Calendar: Stored Cross-Site ScriptingCVE-2026-1083 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Appointment Hour Booking – Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via form field configuration parameters in all versions up to, and including, 1.5.60 due to insufficient input sanitization and output escaping on the 'Min length/characters' and 'Max length/characters' field configuration values. This makes it possible for authenticated attackers, with administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the form builder interface. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
Appointment Hour Booking – Booking Calendar
Affected
up to 1.5.60
What to do
Affects up to 1.5.60. Update Appointment Hour Booking – Booking Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 22, 2026Form to Chat App: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-22463 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Micro.company Form to Chat App form-to-chat allows Stored XSS.This issue affects Form to Chat App: from n/a through <= 1.2.5.
Product
Form to Chat App
Affected
up to 1.2.5
What to do
Affects up to 1.2.5. Update Form to Chat App to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2026Simply Schedule Appointments: Missing AuthorizationCVE-2025-69315 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in NSquared Simply Schedule Appointments simply-schedule-appointments allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simply Schedule Appointments: from n/a through <= 1.6.9.15.
Product
Simply Schedule Appointments
Affected
up to 1.6.9.15
What to do
Affects up to 1.6.9.15. Update Simply Schedule Appointments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2026Happy Addons for Elementor: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-68999 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in HappyMonster Happy Addons for Elementor happy-elementor-addons allows Blind SQL Injection.This issue affects Happy Addons for Elementor: from n/a through <= 3.20.4.
Product
Happy Addons for Elementor
Affected
up to 3.20.4
What to do
Affects up to 3.20.4. Update Happy Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2026AppExperts: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-68881 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Saad Iqbal AppExperts appexperts allows SQL Injection.This issue affects AppExperts: from n/a through <= 1.4.5.
Product
AppExperts
Affected
up to 1.4.5
What to do
Affects up to 1.4.5. Update AppExperts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 14, 2026Appointment Booking Calendar — Simply Schedule Appointments Booking: Blind SQL InjectionCVE-2025-12166 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to blind SQL Injection via the `order` and `append_where_sql` parameters in all versions up to, and including, 1.6.9.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Appointment Booking Calendar — Simply Schedule Appointments Booking
Affected
up to 1.6.9.9
What to do
Affects up to 1.6.9.9. Update Appointment Booking Calendar — Simply Schedule Appointments Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 9, 2026Frontend Admin by DynamiApps: Stored Cross-Site ScriptingCVE-2025-14937 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'acff' parameter in the 'frontend_admin/forms/update_field' AJAX action in all versions up to, and including, 3.28.23 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Frontend Admin by DynamiApps
Affected
up to 3.28.23
What to do
Affects up to 3.28.23. Update Frontend Admin by DynamiApps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 9, 2026Frontend Admin by DynamiApps: Missing authorization to unauthorized data modification and deletionCVE-2025-14741 · WordPress plugins & themes · reported by WordfenceCritical 9.1
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to missing authorization to unauthorized data modification and deletion due to a missing capability check on the 'delete_object' function in all versions up to, and including, 3.28.25. This makes it possible for unauthenticated attackers to delete arbitrary posts, pages, products, taxonomy terms, and user accounts.
Product
Frontend Admin by DynamiApps
Affected
up to 3.28.25
What to do
Affects up to 3.28.25. Update Frontend Admin by DynamiApps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 9, 2026Frontend Admin by DynamiApps: Privilege EscalationCVE-2025-14736 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.28.29. This is due to insufficient validation of user-supplied role values in the 'validate_value', 'pre_update_value', and 'get_fields_display' functions. This makes it possible for unauthenticated attackers to register as administrators and gain complete control of the site, granted they can access a user registration form containing a Role field.
Product
Frontend Admin by DynamiApps
Affected
up to 3.28.29
What to do
Affects up to 3.28.29. Update Frontend Admin by DynamiApps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 9, 2026Booking for Appointments and Events Calendar – Amelia: Unauthorized accessCVE-2025-14720 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to unauthorized access due to missing capability checks on multiple AJAX actions in all versions up to, and including, 1.2.38. This makes it possible for unauthenticated attackers to mark payments as refunded, trigger sending of queued notifications (emails/SMS/WhatsApp), and access debug information among other things.
Product
Booking for Appointments and Events Calendar – Amelia
Affected
up to 1.2.38
What to do
Affects up to 1.2.38. Update Booking for Appointments and Events Calendar – Amelia to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 8, 2026WP App Bar: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68891 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ryan Sutana WP App Bar wp-app-bar allows Reflected XSS.This issue affects WP App Bar: from n/a through <= 1.5.
Product
WP App Bar
Affected
up to 1.5
What to do
Affects up to 1.5. Update WP App Bar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 7, 2026Smart App Banners: Stored Cross-Site ScriptingCVE-2025-13841 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Smart App Banners plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'size' and 'verticalalign' parameters of the 'app-store-download' shortcode in all versions up to, and including, 1.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Smart App Banners
Affected
up to 1.2
What to do
Affects up to 1.2. Update Smart App Banners to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 6, 2026Frappé: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-69083 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Elated-Themes Frappé frappe allows PHP Local File Inclusion.This issue affects Frappé: from n/a through <= 1.8.
Product
Frappé
Affected
up to 1.8
What to do
Affects up to 1.8. Update Frappé to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 6, 2026Appointment Booking and Scheduling Calendar Plugin – WP Timetics: Unauthorized access and modification of dataCVE-2025-5919 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Appointment Booking and Scheduling Calendar Plugin – WP Timetics plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability check on the update and register_routes functions in all versions up to, and including, 1.0.36. This makes it possible for unauthenticated attackers to view and modify booking details.
Product
Appointment Booking and Scheduling Calendar Plugin – WP Timetics
Affected
up to 1.0.36
What to do
Affects up to 1.0.36. Update Appointment Booking and Scheduling Calendar Plugin – WP Timetics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 5, 2026Appointment Booking Calendar — Simply Schedule Appointments Booking: Sensitive Information ExposureCVE-2025-11723 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.6.9.5 via the hash() function due to use of a hardcoded fall-back salt. This makes it possible for unauthenticated attackers to generate a valid token across sites running the plugin that have not manually set a salt in the wp-config.php file and access booking information that will allow them to make modifications.
Product
Appointment Booking Calendar — Simply Schedule Appointments Booking
Affected
up to 1.6.9.5
What to do
Affects up to 1.6.9.5. Update Appointment Booking Calendar — Simply Schedule Appointments Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 31, 2025Blappsta Mobile App Plugin – Your native, mobile iPhone App and Android App: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-50053 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in nebelhorn Blappsta Mobile App Plugin – Your native, mobile iPhone App and Android App yournewsapp allows Reflected XSS.This issue affects Blappsta Mobile App Plugin – Your native, mobile iPhone App and Android App: from n/a through <= 0.8.8.8.
Product
Blappsta Mobile App Plugin – Your native, mobile iPhone App and Android App
Affected
up to 0.8.8.8
What to do
Affects up to 0.8.8.8. Update Blappsta Mobile App Plugin – Your native, mobile iPhone App and Android App to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 31, 2025Appender: Missing AuthorizationCVE-2025-66150 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in merkulove Appender appender allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Appender: from n/a through <= 1.1.1.
Product
Appender
Affected
up to 1.1.1
What to do
Affects up to 1.1.1. Update Appender to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 31, 2025Appointify: Cross-Site Request Forgery (CSRF)CVE-2025-59130 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in appointify Appointify appointify allows Cross Site Request Forgery.This issue affects Appointify: from n/a through <= 1.0.8.
Product
Appointify
Affected
up to 1.0.8
What to do
Affects up to 1.0.8. Update Appointify to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 31, 2025Knowband Mobile App Builder: Does not have authorisationCVE-2025-13029 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Knowband Mobile App Builder WordPress plugin before 3.0.0 does not have authorisation when deleting users via its REST API, allowing unauthenticated attackers to delete arbitrary users.
Product
Knowband Mobile App Builder
Fixed in
3.0.0
What to do
Update Knowband Mobile App Builder to 3.0.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 30, 2025Appointify: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-59129 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in appointify Appointify appointify allows Blind SQL Injection.This issue affects Appointify: from n/a through <= 1.0.8.
Product
Appointify
Affected
up to 1.0.8
What to do
Affects up to 1.0.8. Update Appointify to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 30, 2025E-Invoice App Malaysia: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-68988 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in o2oe E-Invoice App Malaysia einvoiceapp-malaysia allows Retrieve Embedded Sensitive Data.This issue affects E-Invoice App Malaysia: from n/a through <= 1.3.0.
Product
E-Invoice App Malaysia
Affected
up to 1.3.0
What to do
Affects up to 1.3.0. Update E-Invoice App Malaysia to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 24, 2025Wappointment: Missing AuthorizationCVE-2025-68575 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Wappointment team Wappointment wappointment allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Wappointment: from n/a through <= 2.7.6.
Product
Wappointment
Affected
up to 2.7.6
What to do
Affects up to 2.7.6. Update Wappointment to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 23, 2025HAPPY: Missing AuthorizationCVE-2025-68556 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in VillaTheme HAPPY happy-helpdesk-support-ticket-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HAPPY: from n/a through <= 1.0.9.
Product
HAPPY
Affected
up to 1.0.9
What to do
Affects up to 1.0.9. Update HAPPY to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 23, 2025Happy Addons for Elementor: Stored Cross-Site ScriptingCVE-2025-14635 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ha_page_custom_js' parameter in all versions up to, and including, 3.20.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page, despite the intended role restriction of Custom JS to Administrators.
Product
Happy Addons for Elementor
Affected
up to 3.20.3
What to do
Affects up to 3.20.3. Update Happy Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 20, 2025HappyFiles Pro: Missing AuthorizationCVE-2023-25446 · WordPress plugins & themes · reported by PatchstackHigh 7.7
Missing Authorization vulnerability in HappyFiles HappyFiles Pro happyfiles-pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HappyFiles Pro: from n/a through 1.8.1.
Product
HappyFiles Pro
Affected
up to 1.8.1
What to do
Affects up to 1.8.1. Update HappyFiles Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record vdp.patchstack.com
Dec 20, 2025HappyFiles Pro: Missing AuthorizationCVE-2023-25445 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in HappyFiles HappyFiles Pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HappyFiles Pro: from n/a through 1.8.1.
Product
HappyFiles Pro
Affected
up to 1.8.1
What to do
Affects up to 1.8.1. Update HappyFiles Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record vdp.patchstack.com
Dec 19, 2025Appointment Booking Calendar — Simply Schedule Appointments Booking: Sensitive Information ExposureCVE-2025-13754 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.6.9.16. This is due to the plugin exposing its admin embed endpoint at `/wp-json/ssa/v1/embed-inner-admin` without authentication, which leaks plugin settings including staff names, business names, and configuration data that are not publicly displayed on the booking form. This makes it possible for unauthenticated attackers to extract private business configuration. In premium versions with integrations configured, this might also expose other sensitive data including API keys for external services.
Product
Appointment Booking Calendar — Simply Schedule Appointments Booking
Affected
up to 1.6.9.16
What to do
Affects up to 1.6.9.16. Update Appointment Booking Calendar — Simply Schedule Appointments Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 13, 2025HAPPY – Helpdesk Support Ticket System: Authorization bypassCVE-2025-14581 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The HAPPY – Helpdesk Support Ticket System plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the 'submit_form_reply' AJAX action in all versions up to, and including, 1.0.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to submit replies to arbitrary support tickets by manipulating the 'happy_topic_id' parameter, regardless of whether they are the ticket owner or have been assigned to the ticket.
Product
HAPPY – Helpdesk Support Ticket System
Affected
up to 1.0.9
What to do
Affects up to 1.0.9. Update HAPPY – Helpdesk Support Ticket System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 12, 2025Hippoo Mobile App for WooCommerce: Arbitrary file writeCVE-2025-12655 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Hippoo Mobile App for WooCommerce plugin for WordPress is vulnerable to arbitrary file write via a missing authorization check in all versions up to, and including, 1.7.1. This is due to the REST API endpoint `/wp-json/hippoo/v1/wc/token/save_callback/{token_id}` being registered with `permission_callback => '__return_true'`, which allows unauthenticated access. This makes it possible for unauthenticated attackers to write arbitrary JSON content to the server's publicly accessible upload directory via the vulnerable endpoint.
Product
Hippoo Mobile App for WooCommerce
Affected
up to 1.7.1
What to do
Affects up to 1.7.1. Update Hippoo Mobile App for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 11, 2025App Landing Template Blocks for WPBakery (Visual Composer) Page Builder: Stored Cross-Site ScriptingCVE-2025-14119 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The App Landing Template Blocks for WPBakery (Visual Composer) Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'atvc_video_play' shortcode in all versions up to, and including, 2.0.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
App Landing Template Blocks for WPBakery (Visual Composer) Page Builder
Affected
up to 2.0.2
What to do
Affects up to 2.0.2. Update App Landing Template Blocks for WPBakery (Visual Composer) Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 10, 2025Hippoo Mobile App for WooCommerce: Path TraversalCVE-2025-13339 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Hippoo Mobile App for WooCommerce plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.7.1 via the template_redirect() function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information.
Product
Hippoo Mobile App for WooCommerce
Affected
up to 1.7.1
What to do
Affects up to 1.7.1. Update Hippoo Mobile App for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 9, 2025Booking calendar, Appointment Booking System: Missing AuthorizationCVE-2025-67574 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in wpdevart Booking calendar, Appointment Booking System booking-calendar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booking calendar, Appointment Booking System: from n/a through <= 3.2.30.
Product
Booking calendar, Appointment Booking System
Affected
up to 3.2.30
What to do
Affects up to 3.2.30. Update Booking calendar, Appointment Booking System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.