Updated 8 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

343new WordPress flaws this week

390,080entries in the database

2,505 results · page 7 of 51

Jul 30, 2026Ultimate Addons for WPBakery Page Builder: Does not perform a capability or nonce check before deleting a site's custom-uploaded icon font packsCVE-2026-15382 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Ultimate Addons for WPBakery Page Builder WordPress plugin before 3.21.4 does not perform a capability or nonce check before deleting a site's custom-uploaded icon font packs, allowing unauthenticated attackers to permanently delete all of a site's custom icon fonts with a single request.
Product
Ultimate Addons for WPBakery Page Builder
Fixed in
3.21.4
What to do
Update Ultimate Addons for WPBakery Page Builder to 3.21.4 or newer.
Full record and what to do →NVD record wpscan.com
Jul 30, 2026Animation Addons for Elementor: Does not sanitise uploaded SVG/SVGZ filesCVE-2026-13330 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Animation Addons for Elementor WordPress plugin before 2.7.0 does not sanitise uploaded SVG/SVGZ files, which it adds to the list of allowed upload types, allowing users with the upload_files capability (Author and above) to upload files containing malicious JavaScript, leading to Stored Cross-Site Scripting.
Product
Animation Addons for Elementor
Fixed in
2.7.0
What to do
Update Animation Addons for Elementor to 2.7.0 or newer.
Full record and what to do →NVD record wpscan.com
Jul 30, 2026WP Travel: Does not verify that the booking requested on its customer account dashboard belongs to the current userCVE-2026-13145 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WP Travel WordPress plugin before 11.8.1 does not verify that the booking requested on its customer account dashboard belongs to the current user, allowing any logged-in user to read another customer's booking details, including billing address information, by supplying an arbitrary booking identifier.
Product
WP Travel
Fixed in
11.8.1
What to do
Update WP Travel to 11.8.1 or newer.
Full record and what to do →NVD record wpscan.com
Jul 29, 2026Extra Checkout Options (addon for Extra Product Options & Add-Ons for WooCommerce): Arbitrary File UploadCVE-2026-14270 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Extra Checkout Options (addon for Extra Product Options & Add-Ons for WooCommerce) plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.3.2. This is due to missing authorization and nonce validation in the eco_save_settings() function, which allows low-privileged authenticated users to modify the tc_eco_custom_file_types upload allowlist setting, combined with insufficient authorization on the wc_eco_upload_file AJAX action. This makes it possible for authenticated attackers, with Subscriber-level access and above, to allow PHP uploads, upload a PHP file using the frontend upload nonce exposed on cart and checkout pages, and achieve remote code execution. NOTE: This vulnerability was partially fixed in version 2.3.2.
Product
Extra Checkout Options (addon for Extra Product Options & Add-Ons for WooCommerce)
Affected
up to 2.3.2
Fixed in
2.3.2
What to do
Update Extra Checkout Options (addon for Extra Product Options & Add-Ons for WooCommerce) to 2.3.2 or newer.
Full record and what to do →NVD record codecanyon.net wordfence.com
Jul 29, 2026Easy Digital Downloads: Arbitrary File UploadCVE-2026-12476 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Easy Digital Downloads plugin for WordPress is vulnerable to Arbitrary File Upload in versions up to and including 3.6.9. This is due to insufficient file type validation in the edd_do_ajax_import_file_upload() function , which only checks the client-supplied $_FILES['edd-import-file']['type'] Content-Type header against an allow-list of CSV mime types, then uses raw move_uploaded_file() (bypassing wp_handle_upload()'s core MIME enforcement) to write the file under its original extension into the web-accessible wp-content/uploads/edd/exports/ directory. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
Easy Digital Downloads
Affected
up to 3.6.9
What to do
Affects up to 3.6.9. Update Easy Digital Downloads to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 28, 2026Taskbuilder – Project Management & Task Management Tool With Kanban Board: SQL InjectionCVE-2026-15267 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Taskbuilder – Project Management & Task Management Tool With Kanban Board plugin for WordPress is vulnerable to SQL Injection via the 'wppm_proj_filter' parameter in versions up to, and including, 5.0.9. This is due to insufficient escaping on the user-supplied parameter and the lack of sufficient preparation on the existing SQL query — the value is re-read at line 144 using only sanitize_text_field() (overwriting the earlier absint() result), then concatenated into the SQL WHERE clause as an unquoted numeric operand using only esc_sql(), which does not protect against injection in that context, and finally string-interpolated into the $wpdb->prepare() format string, bypassing parameterization entirely. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Taskbuilder – Project Management & Task Management Tool With Kanban Board
Affected
up to 5.0.9
What to do
Affects up to 5.0.9. Update Taskbuilder – Project Management & Task Management Tool With Kanban Board to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 28, 2026PDFDraft – Drag & Drop PDF Builder, PDF Viewer, Embed & Download PDF, Certificate & Invoice Designer: Unauthorized access of dataCVE-2026-12124 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The PDFDraft – Drag & Drop PDF Builder, PDF Viewer, Embed & Download PDF, Certificate & Invoice Designer plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the serveTemplatePdfAjax() function and the serveTemplatePdf() REST route (which is registered with `permission_callback => '__return_true'`) in versions up to, and including, 1.1.0. This makes it possible for unauthenticated attackers to download stored template PDFs — which may contain customer PII, invoice, order, and certificate data — by requesting the publicly registered admin-ajax action `pdfdraft_embed_pdf` or the REST endpoint `/wp-json/pdfdraft/v1/embed-pdf/templates/{slug}/pdf` with a known or guessable design slug, bypassing the plugin's own .
Product
PDFDraft – Drag & Drop PDF Builder, PDF Viewer, Embed & Download PDF, Certificate & Invoice Designer
Affected
up to 1.1.0
What to do
Affects up to 1.1.0. Update PDFDraft – Drag & Drop PDF Builder, PDF Viewer, Embed & Download PDF, Certificate & Invoice Designer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 27, 2026Administrator Arbitrary File Deletion in Easy Digital Downloads <= 3.6.9 versions.CVE-2026-66476 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Administrator Arbitrary File Deletion in Easy Digital Downloads <= 3.6.9 versions.
Affected
up to 3.6.9
What to do
Affects up to 3.6.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 27, 2026Download Manager: Does not bind its temporary download token to the requesting session nor expire it promptlyCVE-2026-14235 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Download Manager WordPress plugin before 3.3.62 does not bind its temporary download token to the requesting session nor expire it promptly, making the token a long-lived, multi-use, portable bearer token, so that an attacker who obtains one leaked download key can repeatedly download a role- or password-protected package file without authorization.
Product
Download Manager
Fixed in
3.3.62
What to do
Update Download Manager to 3.3.62 or newer.
Full record and what to do →NVD record wpscan.com
Jul 27, 2026Realtyna Organic IDX plugin + WPL Real Estate: Does not validate the type of uploaded filesCVE-2026-13714 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Realtyna Organic IDX plugin + WPL Real Estate WordPress plugin before 5.3.0 does not validate the type of uploaded files, and its file upload functionality is gated only by an API that is enabled by default and authenticated with hardcoded credentials shipped identically across all installations. This makes it possible for unauthenticated attackers to upload arbitrary PHP files and achieve remote code execution.
Product
Realtyna Organic IDX plugin + WPL Real Estate
Fixed in
5.3.0
What to do
Update Realtyna Organic IDX plugin + WPL Real Estate to 5.3.0 or newer.
Full record and what to do →NVD record wpscan.com
Jul 25, 2026Yoast SEO – Advanced SEO with real-time guidance and built-in AI: Stored Cross-Site ScriptingCVE-2026-15425 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Yoast SEO – Advanced SEO with real-time guidance and built-in AI plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Post Slug (post_name) in all versions up to, and including, 28.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires pretty permalinks to be enabled, as the exploit chain depends on get_permalink() embedding the stored percent-encoded post_name in the generated URL.
Product
Yoast SEO – Advanced SEO with real-time guidance and built-in AI
Affected
up to 28.0
What to do
Affects up to 28.0. Update Yoast SEO – Advanced SEO with real-time guidance and built-in AI to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 25, 2026WPForms Pro: Arbitrary File UploadCVE-2026-10818 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The WPForms Pro plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.10.1.1 via the ajax_chunk_upload_finalize function. This is due to the file type validation occurring after chunk metadata and file contents have already been written to disk, and the assembled file not being deleted upon validation failure. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible.
Product
WPForms Pro
Affected
up to 1.10.1.1
What to do
Affects up to 1.10.1.1. Update WPForms Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpforms.com wordfence.com
Jul 24, 2026SureDash – Community, Courses & Member Dashboard: Stored Cross-Site ScriptingCVE-2026-15821 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The SureDash – Community, Courses & Member Dashboard plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and including, 1.10.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
SureDash – Community, Courses & Member Dashboard
Affected
up to 1.10.0
What to do
Affects up to 1.10.0. Update SureDash – Community, Courses & Member Dashboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 23, 2026Subscriber Broken Access Control in Cyr to Lat reloaded – transliteration of links and file names <= 1.3.3 versions.CVE-2026-65537 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Subscriber Broken Access Control in Cyr to Lat reloaded – transliteration of links and file names <= 1.3.3 versions.
Affected
up to 1.3.3
What to do
Affects up to 1.3.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 23, 2026Administrator Arbitrary File Upload in Really Simple CSV Importer <= 1.3 versions.CVE-2026-65461 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Administrator Arbitrary File Upload in Really Simple CSV Importer <= 1.3 versions.
Affected
up to 1.3
What to do
Affects up to 1.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 23, 2026Administrator Arbitrary File Upload in MapSVG <= 8.14.0 versions.CVE-2026-65455 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Administrator Arbitrary File Upload in MapSVG <= 8.14.0 versions.
Affected
up to 8.14.0
What to do
Affects up to 8.14.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 23, 2026Unauthenticated Broken Authentication in Easy Digital Downloads <= 3.6.7 versions.CVE-2026-59524 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Broken Authentication in Easy Digital Downloads <= 3.6.7 versions.
Affected
up to 3.6.7
What to do
Affects up to 3.6.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 23, 2026Unauthenticated Cross Site Request Forgery (CSRF) in Ninja Forms File Uploads Extension <= 3.3.26 versions.CVE-2026-57784 · WordPress plugins & themes · reported by PatchstackCritical 9.6
Unauthenticated Cross Site Request Forgery (CSRF) in Ninja Forms File Uploads Extension <= 3.3.26 versions.
Affected
up to 3.3.26
What to do
Affects up to 3.3.26. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 23, 2026Unauthenticated Arbitrary File Deletion in Broadcast Live Video <= 7.2.4 versions.CVE-2026-57716 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Arbitrary File Deletion in Broadcast Live Video <= 7.2.4 versions.
Affected
up to 7.2.4
What to do
Affects up to 7.2.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 23, 2026Unauthenticated Cross Site Scripting (XSS) in Download Monitor - WPForms Lock <= 1.0.4 versions.CVE-2026-57427 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Download Monitor - WPForms Lock <= 1.0.4 versions.
Affected
up to 1.0.4
What to do
Affects up to 1.0.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 23, 2026Unauthenticated Cross Site Scripting (XSS) in Coaching <= 3.9.2 versions.CVE-2026-57397 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Coaching <= 3.9.2 versions.
Affected
up to 3.9.2
What to do
Affects up to 3.9.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 23, 2026Editor Arbitrary File Upload in Mailster <= 4.1.17 versions.CVE-2026-27064 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Editor Arbitrary File Upload in Mailster <= 4.1.17 versions.
Affected
up to 4.1.17
What to do
Affects up to 4.1.17. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 23, 2026GoDAM – Organize WordPress Media Library & File Manager with Unlimited Folders for Images, Videos & more: Arbitrary file uploadsCVE-2026-14282 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The GoDAM – Organize WordPress Media Library & File Manager with Unlimited Folders for Images, Videos & more plugin for WordPress is vulnerable to arbitrary file uploads in versions up to, and including, 1.12.2. This is due to insufficient file type validation in the save_video_file() function hooked into WPForms' public wpforms_process_before_filter, which trusts the attacker-supplied multipart Content-Type header, preserves the original filename via wp_unique_filename(), and moves the raw upload with $wp_filesystem->move() into a web-served directory — bypassing wp_handle_upload()'s MIME/extension allowlist. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
GoDAM – Organize WordPress Media Library & File Manager with Unlimited Folders for Images, Videos & more
Affected
up to 1.12.2
What to do
Affects up to 1.12.2. Update GoDAM – Organize WordPress Media Library & File Manager with Unlimited Folders for Images, Videos & more to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 22, 2026Product Addons and Product Options With Custom Fields: Does not restrict an unauthenticated file-upload endpoint and accepts SVG files that are stored and served inlineCVE-2026-12968 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Product Addons and Product Options With Custom Fields WordPress plugin before 1.6.15 does not restrict an unauthenticated file-upload endpoint and accepts SVG files that are stored and served inline, allowing an unauthenticated attacker to upload a malicious SVG whose embedded script executes in the session of any user (such as an administrator) who later opens the file.
Product
Product Addons and Product Options With Custom Fields
Fixed in
1.6.15
What to do
Update Product Addons and Product Options With Custom Fields to 1.6.15 or newer.
Full record and what to do →NVD record wpscan.com
Jul 21, 2026MapSVG: Arbitrary file uploadsCVE-2026-1771 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The MapSVG plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the SVGFile constructor in all versions up to, and including, 8.14.0 This is due to an incorrect conditional check that prevents file validation from taking place. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
MapSVG
Affected
up to 8.14.0
What to do
Affects up to 8.14.0. Update MapSVG to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 21, 2026Free Builder for Elementor: Does not sanitise submitted contact form field values before storing them and outputting them in the admin dashboardCVE-2026-11767 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Free Builder for Elementor WordPress plugin before 1.6.7 does not sanitise submitted contact form field values before storing them and outputting them in the admin dashboard, allowing unauthenticated attackers to perform Stored Cross-Site Scripting attacks that execute when a logged-in administrator views the form submissions.
Product
Free Builder for Elementor
Fixed in
1.6.7
What to do
Update Free Builder for Elementor to 1.6.7 or newer.
Full record and what to do →NVD record wpscan.com
Jul 17, 2026AI Copilot: Does not bind OAuth access tokens to a WordPress userCVE-2026-9810 · WordPress plugins & themes · reported by WPScanCritical 9.8
The AI Copilot WordPress plugin before 1.5.4 does not bind OAuth access tokens to a WordPress user, and accepts any valid token as an administrator session, allowing unauthenticated attackers who complete the public OAuth flow to execute privileged MCP tools as an administrator, including arbitrary user creation and role escalation.
Product
AI Copilot
Fixed in
1.5.4
What to do
Update AI Copilot to 1.5.4 or newer.
Full record and what to do →NVD record wpscan.com
Jul 17, 2026NEX-Forms: Does not sanitise and escape some submitted form data before storing it and outputting it back in the admin dashboardCVE-2026-10525 · WordPress plugins & themes · reported by WPScanMedium 6.1
The NEX-Forms WordPress plugin before 9.2.3 does not sanitise and escape some submitted form data before storing it and outputting it back in the admin dashboard, leading to a Stored Cross-Site Scripting vulnerability which could allow unauthenticated users to perform Stored Cross-Site Scripting attacks against high privilege users such as administrators when they view the submitted entries.
Product
NEX-Forms
Fixed in
9.2.3
What to do
Update NEX-Forms to 9.2.3 or newer.
Full record and what to do →NVD record wpscan.com
Jul 17, 2026ChatHelp – Click to Chat Button, WooCommerce Chat to Order & Floating Chat Form: Stored Cross-Site ScriptingCVE-2026-15759 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The ChatHelp – Click to Chat Button, WooCommerce Chat to Order & Floating Chat Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'number' and 'group' Shortcode Attributes in all versions up to, and including, 3.5.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
ChatHelp – Click to Chat Button, WooCommerce Chat to Order & Floating Chat Form
Affected
up to 3.5.1
What to do
Affects up to 3.5.1. Update ChatHelp – Click to Chat Button, WooCommerce Chat to Order & Floating Chat Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 17, 2026Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress: Arbitrary File UploadCVE-2026-13352 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 4.16.18 via the allowed_mime_types function. This is due to the unconditional registration of an upload_mimes filter that adds executable file extensions (.exe, .apk, .msi) to the global WordPress MIME allowlist, without scoping the expansion to digital-product upload contexts. This makes it possible for authenticated attackers, with author-level access and above, to upload files that may be executable, which makes remote code execution possible. This filter is registered globally on every request regardless of whether the digital products feature is configured or in use, meaning the expanded MIME allowlist affects all WordPress upload contexts site-wide.
Product
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress
Affected
up to 4.16.18
What to do
Affects up to 4.16.18. Update Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 16, 2026Header Footer Builder for Elementor: Does not require an administrative capability for its dashboard template-import action (it allows any edit_posts user)CVE-2026-12869 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Header Footer Builder for Elementor WordPress plugin before 1.2.1 does not require an administrative capability for its dashboard template-import action (it allows any edit_posts user), so a Contributor can import a template containing an Elementor HTML widget configured to display site-wide, injecting JavaScript that executes in the session of any visitor or administrator who loads the site.
Product
Header Footer Builder for Elementor
Fixed in
1.2.1
What to do
Update Header Footer Builder for Elementor to 1.2.1 or newer.
Full record and what to do →NVD record wpscan.com
Jul 16, 2026RPB Chessboard: Stored Cross-Site ScriptingCVE-2026-13042 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The RPB Chessboard plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to, and including, 8.1.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. WordPress's save-time kses sanitization does not mitigate this issue because the crafted payload uses only kses-allowed tags and attributes (such as an <a> element with title and href), and the dangerous attribute-breaking HTML is synthesized entirely at render time by the plugin's own comment_text filter.
Product
RPB Chessboard
Affected
up to 8.1.2
What to do
Affects up to 8.1.2. Update RPB Chessboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 15, 2026Kali Forms — Contact Form & Drag-and-Drop Builder: Does not verify that a file upload is made against an existing form configured with a file-upload fieldCVE-2026-11579 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.17 does not verify that a file upload is made against an existing form configured with a file-upload field, accepting uploads regardless of whether any such form exists, which allows unauthenticated users to upload files to the WordPress Media Library; the uploads are limited to WordPress's default-allowed MIME types, so this does not lead to code execution.
Product
Kali Forms — Contact Form & Drag-and-Drop Builder
Fixed in
2.4.17
What to do
Update Kali Forms — Contact Form & Drag-and-Drop Builder to 2.4.17 or newer.
Full record and what to do →NVD record wpscan.com
Jul 14, 2026Podlove Podcast Publisher: Arbitrary file uploadsCVE-2026-13001 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Podlove Podcast Publisher plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'podlove_handle_cache_files' function in all versions up to, and including, 4.5.1. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
Podlove Podcast Publisher
Affected
up to 4.5.1
What to do
Affects up to 4.5.1. Update Podlove Podcast Publisher to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Jul 14, 2026AI Engine: Does not sanitize a user-supplied filename before using it to write a downloaded fileCVE-2026-12511 · WordPress plugins & themes · reported by WPScanHigh 8.1
The AI Engine WordPress plugin before 3.5.5 does not sanitize a user-supplied filename before using it to write a downloaded file, allowing authenticated users with editor-level access to write attacker-controlled bytes to an arbitrary location on the server via path traversal.
Product
AI Engine
Fixed in
3.5.5
What to do
Update AI Engine to 3.5.5 or newer.
Full record and what to do →NVD record wpscan.com
Jul 13, 2026Aimogen Pro: Unrestricted Upload of File with Dangerous TypeCVE-2026-57719 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in CodeRevolution Aimogen Pro aimogen-pro allows Using Malicious Files.This issue affects Aimogen Pro: from n/a through <= 2.8.3.
Product
Aimogen Pro
Affected
up to 2.8.3
What to do
Affects up to 2.8.3. Update Aimogen Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 13, 2026WoowBot Pro Max: Unrestricted Upload of File with Dangerous TypeCVE-2026-57710 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in quantumcloud WoowBot Pro Max woowbot-pro-max allows Using Malicious Files.This issue affects WoowBot Pro Max: from n/a through <= 14.1.7.
Product
WoowBot Pro Max
Affected
up to 14.1.7
What to do
Affects up to 14.1.7. Update WoowBot Pro Max to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 11, 2026Swiss Toolkit For WP: Arbitrary file uploadCVE-2026-2354 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Swiss Toolkit For WP plugin for WordPress is vulnerable to arbitrary file upload due to a flawed file type validation bypass in the `upload_extension_files()` function in all versions up to, and including, 1.4.6. The `upload_extension_files()` function hooks into WordPress's `wp_check_filetype_and_ext` filter and uses `strpos()` to check if a filename contains a configured extension string, rather than verifying the actual file extension. This makes it possible for authenticated attackers, with Author-level access and above, to upload arbitrary files (including PHP) on the affected site's server which may make remote code execution possible, granted the "Enhanced Multi-Format Image Support" feature is enabled with at least one extension (e.g., avif) in the allowed formats.
Product
Swiss Toolkit For WP
Affected
up to 1.4.6
What to do
Affects up to 1.4.6. Update Swiss Toolkit For WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 11, 2026Starboard Suite Reservation Calendars: Stored Cross-Site ScriptingCVE-2025-13968 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Starboard Suite Reservation Calendars plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcode attributes in the [starboard-suite-lightbox] shortcode in all versions up to, and including, 3.1.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Starboard Suite Reservation Calendars
Affected
up to 3.1.4
What to do
Affects up to 3.1.4. Update Starboard Suite Reservation Calendars to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 11, 2026Mux Video Uploader: Sensitive Information ExposureCVE-2026-7544 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Mux Video Uploader plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.1.4 via the muxvideo_enqueue_settings_script. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract sensitive data including Mux API credentials.
Product
Mux Video Uploader
Affected
up to 1.1.4
What to do
Affects up to 1.1.4. Update Mux Video Uploader to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 11, 2026Lockme OAuth2 calendars integration: Stored Cross-Site ScriptingCVE-2026-3367 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Lockme OAuth2 calendars integration plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'App ID' setting in all versions up to, and including, 2.11.0. This is due to insufficient input sanitization and output escaping. The register_setting() call on line 197 lacks a sanitize callback, allowing unsanitized data to be stored via update_option(). When the settings page is rendered, the stored value is echoed directly into an HTML input's value attribute without esc_attr() on line 212. This makes it possible for authenticated attackers, with administrator-level access and above, to inject arbitrary web scripts in the settings page that will execute whenever a user accesses the plugin settings page. Multiple fields are affected: App ID (client_id), App Secret (client_secret), Bookings ID prefix (id_prefix), and API domain (api_domain). This vulnerability is particularly impactful in WordPress multisite installations where administrators of individual sites should not be able to execute JavaScript affecting other users.
Product
Lockme OAuth2 calendars integration
Affected
up to 2.11.0
What to do
Affects up to 2.11.0. Update Lockme OAuth2 calendars integration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 10, 2026OAuth Single Sign On - SSO (OAuth Client): Authentication Bypass Using an Alternate Path or ChannelCVE-2026-57807 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Authentication Bypass Using an Alternate Path or Channel vulnerability in miniOrange Security Software Pvt Ltd. OAuth Single Sign On - SSO (OAuth Client) allows Password Recovery Exploitation. This issue affects OAuth Single Sign On - SSO (OAuth Client): from n/a through 38.5.8.
Product
OAuth Single Sign On - SSO (OAuth Client)
Affected
up to 38.5.8
What to do
Affects up to 38.5.8. Update OAuth Single Sign On - SSO (OAuth Client) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 10, 2026WordPress Infinite Scroll – Ajax Load More: Stored Cross-Site ScriptingCVE-2026-15295 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The WordPress Infinite Scroll – Ajax Load More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 7.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
WordPress Infinite Scroll – Ajax Load More
Affected
up to 7.0.1
What to do
Affects up to 7.0.1. Update WordPress Infinite Scroll – Ajax Load More to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jul 10, 2026Easy Upload Files During Checkout: Unauthorized accessCVE-2026-6802 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Easy Upload Files During Checkout plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 3.0.1. This is due to missing authorization checks in the ufdc_custom_init() function, which processes the 'eufdc-delete' parameter without any nonce verification, capability check, or attachment ownership validation. This makes it possible for unauthenticated attackers to permanently delete arbitrary media library attachments from the WordPress site.
Product
Easy Upload Files During Checkout
Affected
up to 3.0.1
What to do
Affects up to 3.0.1. Update Easy Upload Files During Checkout to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 10, 2026Instant Appointment: Arbitrary file uploadsCVE-2026-15282 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Instant Appointment plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'insapp_upload_image_as_attachment' function in all versions up to, and including, 1.2. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
Instant Appointment
Affected
up to 1.2
What to do
Affects up to 1.2. Update Instant Appointment to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 10, 2026Super Forms – Drag & Drop Form Builder: Arbitrary File UploadCVE-2026-14894 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 6.3.313 via the submit_form function. This is due to missing file type validation and the absence of any capability check on the submit_form nopriv AJAX handler, whose only barrier is a session nonce freely obtainable by unauthenticated visitors via a separate nopriv endpoint. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. The nonce requirement is trivially bypassed because the super_create_nonce nopriv AJAX action allows any unauthenticated visitor to mint a valid sf_nonce and session cookie in a single prior request, reducing exploitation to two unauthenticated HTTP requests.
Product
Super Forms – Drag & Drop Form Builder
Affected
up to 6.3.313
What to do
Affects up to 6.3.313. Update Super Forms – Drag & Drop Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wordfence.com
Jul 10, 2026Post Export Import with Media: Arbitrary File UploadCVE-2026-13430 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Post Export Import with Media plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.13.1 via the import_media_file_secure function. This is due to insufficient file extension validation caused by a trailing-dot filename bypass, where the extension allow-list check in ajax_import_media_start() uses pathinfo() on the raw ZIP entry name (e.g., 'shell.php.'), which returns an empty string for the extension, causing the allow-list guard to be skipped and the file to be extracted to a temporary location, after which import_media_file_secure() copies it into the WordPress uploads directory without re-validating the extension. This makes it possible for authenticated attackers, with administrator-level access and above, to upload files that may be executable, which makes remote code execution possible.
Product
Post Export Import with Media
Affected
up to 1.13.1
What to do
Affects up to 1.13.1. Update Post Export Import with Media to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 9, 2026Blocksy Companion: Arbitrary File UploadCVE-2026-15158 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Blocksy Companion plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.1.46 via the save_attachments function. This is due to the Custom Fonts extension registering a wp_check_filetype_and_ext filter that approves any filename containing .woff2 or .ttf as a substring via strpos() rather than validating that those strings appear as the final extension via PATHINFO_EXTENSION — allowing double-extension filenames such as shell.woff2.php to pass MIME validation and be handled as permitted font files. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. This vulnerability is only exploitable when the premium version of the plugin (blocksy-companion-pro) is installed with both the WooCommerce Extra (Advanced Reviews) and Custom Fonts extensions active; the free blocksy-companion plugin does not contain the vulnerable code paths.
Product
Blocksy Companion
Affected
up to 2.1.46
What to do
Affects up to 2.1.46. Update Blocksy Companion to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 9, 2026Download Manager: Stored Cross-Site ScriptingCVE-2026-14343 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'note_before' and 'note_after' Shortcode Attributes in all versions up to, and including, 3.3.61 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Because wp_kses_post filters post content on save for users without unfiltered_html, only kses-allowed tag and attribute payloads that survive save-time filtering will reach the unescaped sink; however, the sink itself remains unsafe and such payloads can still execute in the browser when a user renders the shortcode.
Product
Download Manager
Affected
up to 3.3.61
What to do
Affects up to 3.3.61. Update Download Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 9, 2026Mang Board WP: Reflected Cross-Site ScriptingCVE-2026-13334 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Mang Board WP plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'stag' parameter in all versions up to, and including, 2.3.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Mang Board WP
Affected
up to 2.3.4
What to do
Affects up to 2.3.4. Update Mang Board WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.