Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
4,655 results · page 7 of 94
Jul 31, 2026Kirki: Does not properly sanitise and escape a value taken from the request before using it in a SQL statementCVE-2026-12721 · WordPress plugins & themes · reported by WPScanHigh 8.6
The Kirki WordPress plugin before 6.0.13 does not properly sanitise and escape a value taken from the request before using it in a SQL statement, allowing unauthenticated attackers to perform SQL injection attacks.
- Product
- Kirki
- Fixed in
- 6.0.13
- What to do
- Update Kirki to 6.0.13 or newer.
Jul 31, 2026wpForo Forum: Does not verify that an AI chat conversation belongs to the requesting user before deleting its messagesCVE-2026-12697 · WordPress plugins & themes · reported by WPScanMedium 5.4
The wpForo Forum WordPress plugin before 3.1.2 does not verify that an AI chat conversation belongs to the requesting user before deleting its messages, allowing users with a subscriber-level account to permanently delete the stored AI chat message history of any other user.
- Product
- wpForo Forum
- Fixed in
- 3.1.2
- What to do
- Update wpForo Forum to 3.1.2 or newer.
Jul 30, 2026FuseWP: Cross-Site Request ForgeryCVE-2026-5582 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The FuseWP plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.24.2. This is due to missing nonce verification on the toggle_sync_status() function. This makes it possible for unauthenticated attackers to toggle the status of sync rules (enable/disable) via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- FuseWP
- Affected
- up to 1.1.24.2
- What to do
- Affects up to 1.1.24.2. Update FuseWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 30, 2026RegistrationMagic: Does not properly validate that a one-time password presented in a cookie belongs to the identity being requested before returning front-end form submissionsCVE-2026-15255 · WordPress plugins & themes · reported by WPScanMedium 5.3
The RegistrationMagic WordPress plugin before 6.0.9.4 does not properly validate that a one-time password presented in a cookie belongs to the identity being requested before returning front-end form submissions, allowing unauthenticated attackers to read other users' form submission data, including personal information.
- Product
- RegistrationMagic
- Fixed in
- 6.0.9.4
- What to do
- Update RegistrationMagic to 6.0.9.4 or newer.
Jul 30, 2026Remote API: Does not authenticate a request before deserializing user-supplied inputCVE-2026-14602 · WordPress plugins & themes · reported by WPScanCritical 9
The Remote API WordPress plugin through 0.2 does not authenticate a request before deserializing user-supplied input, allowing unauthenticated attackers to inject arbitrary PHP objects, which can lead to remote code execution when a suitable gadget chain is present through another installed Remote API WordPress plugin through 0.2.
- Product
- Remote API
- Affected
- up to 0.2
- What to do
- Affects up to 0.2. Update Remote API to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 30, 2026Easy Appointments: Does not perform a per-request capability or nonce check on one of its customer-listing handlersCVE-2026-14188 · WordPress plugins & themes · reported by WPScanLow 2.7
The Easy Appointments WordPress plugin before 3.12.28 does not perform a per-request capability or nonce check on one of its customer-listing handlers, allowing authenticated users with contributor-level access to read every stored customer's personal information.
- Product
- Easy Appointments
- Fixed in
- 3.12.28
- What to do
- Update Easy Appointments to 3.12.28 or newer.
Jul 30, 2026Online Scheduling and Appointment Booking System: Does not sanitize or properly cast a user-supplied parameter from its unauthenticated front-end booking requests before using it in a SQL queryCVE-2026-13395 · WordPress plugins & themes · reported by WPScanHigh 8.6
The Online Scheduling and Appointment Booking System WordPress plugin before 27.8 does not sanitize or properly cast a user-supplied parameter from its unauthenticated front-end booking requests before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection attacks and extract sensitive data such as password hashes from the database.
- Product
- Online Scheduling and Appointment Booking System
- Fixed in
- 27.8
- What to do
- Update Online Scheduling and Appointment Booking System to 27.8 or newer.
Jul 30, 2026WP Travel: Does not verify that the booking requested on its customer account dashboard belongs to the current userCVE-2026-13145 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WP Travel WordPress plugin before 11.8.1 does not verify that the booking requested on its customer account dashboard belongs to the current user, allowing any logged-in user to read another customer's booking details, including billing address information, by supplying an arbitrary booking identifier.
- Product
- WP Travel
- Fixed in
- 11.8.1
- What to do
- Update WP Travel to 11.8.1 or newer.
Jul 29, 2026WP CTA: Server-Side Request ForgeryCVE-2026-6089 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The WP CTA plugin for WordPress is vulnerable to Server-Side Request Forgery via the 'sticky_s_media' parameter in imported JSON files in all versions up to, and including, 2.1.2. This is due to the import_sidebars() function passing user-supplied URLs from imported JSON data to file_get_contents() with only FILTER_VALIDATE_URL validation (which allows internal IPs). This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary locations originating from the web application, which can be used to query and modify information from internal services. The response content is saved as a WordPress media attachment, making this a full-read SSRF.
- Product
- WP CTA
- Affected
- up to 2.1.2
- What to do
- Affects up to 2.1.2. Update WP CTA to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 29, 2026Klubraum Membership Request: Unauthorized modification of dataCVE-2026-4604 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Klubraum Membership Request plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `kr_mr_store_settings()` function in all versions up to, and including, 1.1.0. This makes it possible for unauthenticated attackers to update the plugin's settings, including the Klubraum API token and introduction text, effectively hijacking the plugin's integration with the Klubraum service.
- Product
- Klubraum Membership Request
- Affected
- up to 1.1.0
- What to do
- Affects up to 1.1.0. Update Klubraum Membership Request to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 29, 2026Facturación Electrónica Costa Rica: Cross-Site Request ForgeryCVE-2026-9720 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Facturación Electrónica Costa Rica plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.2. This is due to missing or incorrect nonce validation on the (global scope, included by fvcr_admin_page_html) function. This makes it possible for unauthenticated attackers to modify the plugin's configuration, including API tokens, access tokens, economic activity, Hacienda environment mode, invoice and ticket emission flags, exchange rate, and branch settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Facturación Electrónica Costa Rica
- Affected
- up to 2.0.2
- What to do
- Affects up to 2.0.2. Update Facturación Electrónica Costa Rica to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 28, 2026Media Cleaner: Clean your WordPress!: Server-Side Request ForgeryCVE-2026-4912 · WordPress plugins & themes · reported by WordfenceMedium 4.1
The Media Cleaner: Clean your WordPress! plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 7.0.3. This is due to the `get_urls_from_html()` function using `DOMDocument::loadHTMLFile()` to fetch iframe source URLs with an insufficient hostname validation check that relies on a substring match against the site's server name. This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary locations originating from the web application, which can be used to query and interact with internal services.
- Product
- Media Cleaner: Clean your WordPress!
- Affected
- up to 7.0.3
- What to do
- Affects up to 7.0.3. Update Media Cleaner: Clean your WordPress! to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 28, 2026Cookie Banner for GDPR / CCPA – WPLP Cookie Consent: Cross-Site Request ForgeryCVE-2026-15136 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Cookie Banner for GDPR / CCPA – WPLP Cookie Consent plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.3.7. This is due to missing or incorrect nonce validation on the process_bulk_action function. This makes it possible for unauthenticated attackers to permanently delete or forcibly resolve arbitrary GDPR data request records stored in the wpl_data_req table via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Cookie Banner for GDPR / CCPA – WPLP Cookie Consent
- Affected
- up to 4.3.7
- What to do
- Affects up to 4.3.7. Update Cookie Banner for GDPR / CCPA – WPLP Cookie Consent to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 28, 2026FluentCart A New Era of eCommerce: Does not verify that a subscription belongs to the requesting customer in several of its payment-method endpointsCVE-2026-14926 · WordPress plugins & themes · reported by WPScanMedium 4.2
The FluentCart A New Era of eCommerce WordPress plugin before 1.4.0 does not verify that a subscription belongs to the requesting customer in several of its payment-method endpoints, allowing any authenticated customer to act on another customer's subscription (changing its payment method, or cancelling and re-binding it) when they know the target subscription identifier.
- Product
- FluentCart A New Era of eCommerce
- Fixed in
- 1.4.0
- What to do
- Update FluentCart A New Era of eCommerce to 1.4.0 or newer.
Jul 27, 2026Unauthenticated Server Side Request Forgery (SSRF) in FormCraft <= 3.9.15 versions.CVE-2026-65442 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Unauthenticated Server Side Request Forgery (SSRF) in FormCraft <= 3.9.15 versions.
- Affected
- up to 3.9.15
- What to do
- Affects up to 3.9.15. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 27, 2026Unauthenticated Server Side Request Forgery (SSRF) in Simple Link Directory Pro <= 15.0.6 versions.CVE-2026-61953 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Unauthenticated Server Side Request Forgery (SSRF) in Simple Link Directory Pro <= 15.0.6 versions.
- Affected
- up to 15.0.6
- What to do
- Affects up to 15.0.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 27, 2026Unauthenticated Cross Site Request Forgery (CSRF) in Insert Headers and Footers Code – HT Script <= 1.1.8 versions.CVE-2026-66474 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Unauthenticated Cross Site Request Forgery (CSRF) in Insert Headers and Footers Code – HT Script <= 1.1.8 versions.
- Affected
- up to 1.1.8
- What to do
- Affects up to 1.1.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 27, 2026Contributor Server Side Request Forgery (SSRF) in Feedzy <= 5.2.4 versions.CVE-2026-66437 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Contributor Server Side Request Forgery (SSRF) in Feedzy <= 5.2.4 versions.
- Affected
- up to 5.2.4
- What to do
- Affects up to 5.2.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 27, 2026Unauthenticated Cross Site Request Forgery (CSRF) in WP Google Review Slider <= 18.4 versions.CVE-2026-66428 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Unauthenticated Cross Site Request Forgery (CSRF) in WP Google Review Slider <= 18.4 versions.
- Affected
- up to 18.4
- What to do
- Affects up to 18.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 27, 2026Unauthenticated Server Side Request Forgery (SSRF) in AffiliateX <= 2.3.5 versions.CVE-2026-65558 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Unauthenticated Server Side Request Forgery (SSRF) in AffiliateX <= 2.3.5 versions.
- Affected
- up to 2.3.5
- What to do
- Affects up to 2.3.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 27, 2026Unauthenticated Server Side Request Forgery (SSRF) in 3D Flipbook PDF Viewer & Embedder <= 1.4.2 versions.CVE-2026-59552 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Unauthenticated Server Side Request Forgery (SSRF) in 3D Flipbook PDF Viewer & Embedder <= 1.4.2 versions.
- Affected
- up to 1.4.2
- What to do
- Affects up to 1.4.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 27, 2026FacturaONE para WooCommerce con VeriFactu: Does not authenticate one of its request handlersCVE-2026-14289 · WordPress plugins & themes · reported by WPScanCritical 9
The FacturaONE para WooCommerce con VeriFactu WordPress plugin before 5.37 does not authenticate one of its request handlers, whose only protection is derived from a cryptographic key that is empty in the default, unconfigured state, allowing unauthenticated attackers to write an arbitrary file into a web-accessible directory and achieve remote code execution.
- Product
- FacturaONE para WooCommerce con VeriFactu
- Fixed in
- 5.37
- What to do
- Update FacturaONE para WooCommerce con VeriFactu to 5.37 or newer.
Jul 27, 2026Download Manager: Does not bind its temporary download token to the requesting session nor expire it promptlyCVE-2026-14235 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Download Manager WordPress plugin before 3.3.62 does not bind its temporary download token to the requesting session nor expire it promptly, making the token a long-lived, multi-use, portable bearer token, so that an attacker who obtains one leaked download key can repeatedly download a role- or password-protected package file without authorization.
- Product
- Download Manager
- Fixed in
- 3.3.62
- What to do
- Update Download Manager to 3.3.62 or newer.
Jul 27, 2026Sina Extension for Elementor: Does not escape a value reconstructed from request input in one of its unauthenticated AJAX handlers before reflecting it into the HTML responseCVE-2026-14190 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Sina Extension for Elementor WordPress plugin before 3.10.2 does not escape a value reconstructed from request input in one of its unauthenticated AJAX handlers before reflecting it into the HTML response, allowing unauthenticated attackers to execute arbitrary JavaScript in the browser of anyone who triggers a crafted request.
- Product
- Sina Extension for Elementor
- Fixed in
- 3.10.2
- What to do
- Update Sina Extension for Elementor to 3.10.2 or newer.
Jul 27, 2026微信二维码登陆: Does not properly validate WeChat webhook requestsCVE-2026-13597 · WordPress plugins & themes · reported by WPScanCritical 9.1
The 微信二维码登陆 WordPress plugin through 1.3 does not properly validate WeChat webhook requests, as its signature check always passes, and it discloses the generated login code in the webhook response. This allows an unauthenticated attacker to forge a login event for any existing username, read the login code, and redeem it through an unauthenticated AJAX action to log in as that user, including an administrator, without a password.
- Product
- 微信二维码登陆
- Affected
- up to 1.3
- What to do
- Affects up to 1.3. Update 微信二维码登陆 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 27, 2026MainWP Child: Does not verify the requester's identity in its site-registration request handlerCVE-2026-12255 · WordPress plugins & themes · reported by WPScanHigh 8.1
The MainWP Child WordPress plugin before 6.1.2 does not verify the requester's identity in its site-registration request handler when password authentication has been disabled for the targeted account, allowing an unauthenticated attacker to obtain a valid authentication session as that account, including an administrator, by naming its login in a single registration request.
- Product
- MainWP Child
- Fixed in
- 6.1.2
- What to do
- Update MainWP Child to 6.1.2 or newer.
Jul 23, 2026WPO365 | Login: Cross-Site Request ForgeryCVE-2026-15212 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The WPO365 | Login plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 43.2. This is due to the Ajax_Service::verify_ajax_request() helper gating its wp_verify_nonce() call behind the boolean option 'enable_nonce_check', which is absent from the default 'wpo365_options' array and therefore evaluates to false via get_global_boolean_var(); as a result, the wp_ajax_wpo365_update_settings handler (Ajax_Service::update_settings) accepts POSTs from cross-origin pages and forwards the attacker-supplied 'settings' payload (base64/JSON) to Options_Service::update_options(), which merges every key/value into wpo365_options without a key allowlist. This makes it possible for unauthenticated attackers to overwrite arbitrary plugin options — including enabling the SCIM REST endpoint (enable_scim), planting an attacker-known scim_secret_token, and setting new_usr_default_role to 'administrator' — via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- WPO365 | Login
- Affected
- up to 43.2
- What to do
- Affects up to 43.2. Update WPO365 | Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 23, 2026Unauthenticated Cross Site Request Forgery (CSRF) in Popup for CF7 with Sweet Alert <= 1.6.5 versions.CVE-2026-65540 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Request Forgery (CSRF) in Popup for CF7 with Sweet Alert <= 1.6.5 versions.
- Affected
- up to 1.6.5
- What to do
- Affects up to 1.6.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026Unauthenticated Cross Site Request Forgery (CSRF) in Kwayy HTML Sitemap <= 4.0 versions.CVE-2026-65539 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Request Forgery (CSRF) in Kwayy HTML Sitemap <= 4.0 versions.
- Affected
- up to 4.0
- What to do
- Affects up to 4.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026Unauthenticated Cross Site Request Forgery (CSRF) in افزونه حمل و نقل ووکامرس (پست پیشتاز و سفارشی، پیک موتوری) <= 4.4.5 versions.CVE-2026-65536 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Cross Site Request Forgery (CSRF) in افزونه حمل و نقل ووکامرس (پست پیشتاز و سفارشی، پیک موتوری) <= 4.4.5 versions.
- Affected
- up to 4.4.5
- What to do
- Affects up to 4.4.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026Unauthenticated Server Side Request Forgery (SSRF) in PeproDev Ultimate Invoice <= 2.2.6 versions.CVE-2026-65516 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Unauthenticated Server Side Request Forgery (SSRF) in PeproDev Ultimate Invoice <= 2.2.6 versions.
- Affected
- up to 2.2.6
- What to do
- Affects up to 2.2.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026Melapress WP Activity Log and Melapress WP Activity Log Premium: Cross-Site request forgery (CSRF)CVE-2026-65512 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site request forgery (CSRF) vulnerability in Melapress WP Activity Log and Melapress WP Activity Log Premium allows Cross Site Request Forgery. This issue affects WP Activity Log: through 5.6.4; WP Activity Log Premium: through 5.6.4.
- Product
- Melapress WP Activity Log and Melapress WP Activity Log Premium
- Affected
- up to 5.6.4
- What to do
- Affects up to 5.6.4. Update Melapress WP Activity Log and Melapress WP Activity Log Premium to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jul 23, 2026Author Server Side Request Forgery (SSRF) in Complianz <= 7.5.0 versions.CVE-2026-65496 · WordPress plugins & themes · reported by PatchstackMedium 4.4
Author Server Side Request Forgery (SSRF) in Complianz <= 7.5.0 versions.
- Affected
- up to 7.5.0
- What to do
- Affects up to 7.5.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026LA-Studio Element Kit for Elementor: Cross-Site Request Forgery (CSRF)CVE-2026-65488 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in LA-Studio LA-Studio Element Kit for Elementor lastudio-element-kit allows Stored XSS.This issue affects LA-Studio Element Kit for Elementor: from n/a through 1.6.2.
- Product
- LA-Studio Element Kit for Elementor
- Affected
- up to 1.6.2
- What to do
- Affects up to 1.6.2. Update LA-Studio Element Kit for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026Unauthenticated Cross Site Request Forgery (CSRF) in Avada Core <= 5.15.6 versions.CVE-2026-65471 · WordPress plugins & themes · reported by PatchstackCritical 9.6
Unauthenticated Cross Site Request Forgery (CSRF) in Avada Core <= 5.15.6 versions.
- Affected
- up to 5.15.6
- What to do
- Affects up to 5.15.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026Contributor Server Side Request Forgery (SSRF) in JetEngine <= 3.8.11 versions.CVE-2026-65467 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Contributor Server Side Request Forgery (SSRF) in JetEngine <= 3.8.11 versions.
- Affected
- up to 3.8.11
- What to do
- Affects up to 3.8.11. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026Custom role Server Side Request Forgery (SSRF) in JetBooking <= 4.1.2 versions.CVE-2026-65466 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Custom role Server Side Request Forgery (SSRF) in JetBooking <= 4.1.2 versions.
- Affected
- up to 4.1.2
- What to do
- Affects up to 4.1.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026Unauthenticated Cross Site Request Forgery (CSRF) in GiveWP <= 4.16.3 versions.CVE-2026-65464 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Unauthenticated Cross Site Request Forgery (CSRF) in GiveWP <= 4.16.3 versions.
- Affected
- up to 4.16.3
- What to do
- Affects up to 4.16.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026Unauthenticated Cross Site Request Forgery (CSRF) in Zarinpal Gateway <= 5.1.0 versions.CVE-2026-65460 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Unauthenticated Cross Site Request Forgery (CSRF) in Zarinpal Gateway <= 5.1.0 versions.
- Affected
- up to 5.1.0
- What to do
- Affects up to 5.1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026Unauthenticated Cross Site Request Forgery (CSRF) in Simple Link Directory Pro <= 15.0.8 versions.CVE-2026-61981 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Unauthenticated Cross Site Request Forgery (CSRF) in Simple Link Directory Pro <= 15.0.8 versions.
- Affected
- up to 15.0.8
- What to do
- Affects up to 15.0.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026Unauthenticated Cross Site Request Forgery (CSRF) in ApusListing <= 1.2.63 versions.CVE-2026-57785 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Unauthenticated Cross Site Request Forgery (CSRF) in ApusListing <= 1.2.63 versions.
- Affected
- up to 1.2.63
- What to do
- Affects up to 1.2.63. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026Unauthenticated Cross Site Request Forgery (CSRF) in Ninja Forms File Uploads Extension <= 3.3.26 versions.CVE-2026-57784 · WordPress plugins & themes · reported by PatchstackCritical 9.6
Unauthenticated Cross Site Request Forgery (CSRF) in Ninja Forms File Uploads Extension <= 3.3.26 versions.
- Affected
- up to 3.3.26
- What to do
- Affects up to 3.3.26. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026MailPoet: Cross-Site Request Forgery (CSRF)CVE-2026-57626 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in MailPoet allows Cross Site Request Forgery. This issue affects MailPoet: from 5.30.0 through 5.33.0.
- Product
- MailPoet
- Affected
- up to 5.33.0
- What to do
- Affects up to 5.33.0. Update MailPoet to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026Author Server Side Request Forgery (SSRF) in Photo Block <= 1.7.1 versions.CVE-2026-24639 · WordPress plugins & themes · reported by PatchstackMedium 4.4
Author Server Side Request Forgery (SSRF) in Photo Block <= 1.7.1 versions.
- Affected
- up to 1.7.1
- What to do
- Affects up to 1.7.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026Unauthenticated Cross Site Request Forgery (CSRF) in WP Accessibility Helper (WAH) <= 0.6.6 versions.CVE-2026-24537 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Unauthenticated Cross Site Request Forgery (CSRF) in WP Accessibility Helper (WAH) <= 0.6.6 versions.
- Affected
- up to 0.6.6
- What to do
- Affects up to 0.6.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 21, 2026Classified Listing: Does not verify that the order targeted by its payment-receipt handler belongs to the requesting userCVE-2026-14183 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Classified Listing WordPress plugin before 5.3.9 does not verify that the order targeted by its payment-receipt handler belongs to the requesting user, allowing authenticated users with subscriber-level access to read the payment receipt details of any other user's order.
- Product
- Classified Listing
- Fixed in
- 5.3.9
- What to do
- Update Classified Listing to 5.3.9 or newer.
Jul 20, 2026Kirki: Does not validate a user-supplied URL before requesting it server-sideCVE-2026-13147 · WordPress plugins & themes · reported by WPScanCritical 9.1
The Kirki WordPress plugin before 6.0.12 does not validate a user-supplied URL before requesting it server-side, allowing unauthenticated attackers to make the site issue HTTP requests to arbitrary hosts (Server-Side Request Forgery).
- Product
- Kirki
- Fixed in
- 6.0.12
- What to do
- Update Kirki to 6.0.12 or newer.
Jul 20, 2026Kirki: Does not sanitise or escape the email subject and body values supplied in a request before including them in the password-reset email it sendsCVE-2026-12724 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Kirki WordPress plugin before 6.0.12 does not sanitise or escape the email subject and body values supplied in a request before including them in the password-reset email it sends as HTML, allowing unauthenticated users to inject arbitrary HTML into the message delivered to a registered user, which can be used for phishing.
- Product
- Kirki
- Fixed in
- 6.0.12
- What to do
- Update Kirki to 6.0.12 or newer.
Jul 20, 2026Modern Event Calendar Pro WordPress plugin before 7.34.0, Modern Events Calendar Lite: Do not sanitise and escape a request parameter before using it in a SQL statementCVE-2026-11349 · WordPress plugins & themes · reported by WPScanHigh 8.6
The Modern Event Calendar Pro WordPress plugin before 7.34.0, Modern Events Calendar Lite WordPress plugin before 7.34.0 do not sanitise and escape a request parameter before using it in a SQL statement, through an AJAX action available to unauthenticated users, leading to an unauthenticated SQL injection vulnerability that allows attackers to extract sensitive data from the database.
- Product
- Modern Event Calendar Pro WordPress plugin before 7.34.0, Modern Events Calendar Lite
- Fixed in
- 7.34.0
- What to do
- Update Modern Event Calendar Pro WordPress plugin before 7.34.0, Modern Events Calendar Lite to 7.34.0 or newer.
Jul 18, 2026W3SC Elementor to Zoho CRM: Cross-Site Request ForgeryCVE-2026-9734 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The W3SC Elementor to Zoho CRM plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2.0. This is due to missing or incorrect nonce validation on the storeInfo function. This makes it possible for unauthenticated attackers to modify the plugin's Zoho CRM integration settings, replacing the configured data center, client ID, client secret, and user email credentials with attacker-controlled values via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- W3SC Elementor to Zoho CRM
- Affected
- up to 2.2.0
- What to do
- Affects up to 2.2.0. Update W3SC Elementor to Zoho CRM to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.