Updated 1 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

585new WordPress flaws this week

391,310entries in the database

1,203 results · page 7 of 25

Mar 13, 2026Elegant Pink: Missing AuthorizationCVE-2026-32371 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in raratheme Elegant Pink elegant-pink allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Elegant Pink: from n/a through <= 1.3.3.
Product
Elegant Pink
Affected
up to 1.3.3
What to do
Affects up to 1.3.3. Update Elegant Pink to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 13, 2026Corpiva: Cross-Site Request Forgery (CSRF)CVE-2026-32344 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in desertthemes Corpiva corpiva allows Cross Site Request Forgery.This issue affects Corpiva: from n/a through <= 1.0.96.
Product
Corpiva
Affected
up to 1.0.96
What to do
Affects up to 1.0.96. Update Corpiva to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 13, 2026wpDiscuz before 7.6.47 contains an email header injection vulnerability that allows attackers to manipulate mail recipients by injecting malicious data into theCVE-2026-22204 · WordPress plugins & themes · reported by VulnCheckMedium 6.3
wpDiscuz before 7.6.47 contains an email header injection vulnerability that allows attackers to manipulate mail recipients by injecting malicious data into the comment_author_email cookie. Attackers can craft a malicious cookie value that, when processed through urldecode() and passed to wp_mail() functions, enables header injection to alter email recipients or inject additional headers.
Fixed in
7.6.47
What to do
Update the plugin to 7.6.47 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Mar 13, 2026the getAllSubscriptions() function where string parameters lack proper quote escaping in SQL queries: WpDiscuz before 7.6.47 contains an SQL injectionCVE-2026-22193 · WordPress plugins & themes · reported by VulnCheckCritical 9.2
wpDiscuz before 7.6.47 contains an SQL injection vulnerability in the getAllSubscriptions() function where string parameters lack proper quote escaping in SQL queries. Attackers can inject malicious SQL code through email, activation_key, subscription_date, and imported_from parameters to manipulate database queries and extract sensitive information.
Product
the getAllSubscriptions() function where string parameters lack proper quote escaping in SQL queries
Fixed in
7.6.47
What to do
Update the getAllSubscriptions() function where string parameters lack proper quote escaping in SQL queries to 7.6.47 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Mar 5, 2026Pizza House: Deserialization of Untrusted DataCVE-2026-28074 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeREX Pizza House pizzahouse allows Object Injection.This issue affects Pizza House: from n/a through <= 1.4.0.
Product
Pizza House
Affected
up to 1.4.0
What to do
Affects up to 1.4.0. Update Pizza House to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 5, 2026pixfort Core: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-28072 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PixFort pixfort Core pixfort-core allows Reflected XSS.This issue affects pixfort Core: from n/a through <= 3.2.22.
Product
pixfort Core
Affected
up to 3.2.22
What to do
Affects up to 3.2.22. Update pixfort Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 5, 2026pixfort Core: Missing AuthorizationCVE-2026-28071 · WordPress plugins & themes · reported by PatchstackMedium 6.3
Missing Authorization vulnerability in PixFort pixfort Core pixfort-core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects pixfort Core: from n/a through <= 3.2.22.
Product
pixfort Core
Affected
up to 3.2.22
What to do
Affects up to 3.2.22. Update pixfort Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 4, 2026Mail Mint: Does not have authorization in one of its REST API endpointCVE-2026-2025 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Mail Mint WordPress plugin before 1.19.5 does not have authorization in one of its REST API endpoint, allowing unauthenticated users to call it and retrieve the email addresses of users on the blog
Product
Mail Mint
Fixed in
1.19.5
What to do
Update Mail Mint to 1.19.5 or newer.
Full record and what to do →NVD record wpscan.com
Mar 3, 2026Morkva UA Shipping: Stored Cross-Site ScriptingCVE-2026-2292 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Morkva UA Shipping plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.7.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
Morkva UA Shipping
Affected
up to 1.7.9
What to do
Affects up to 1.7.9. Update Morkva UA Shipping to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 28, 2026Topics::get_topics() where the ORDER BY clause relies on ineffective esc_sql() sanitization on unquoted identifiers: WpForo 2.4.14 contains an unauthenticated SQL injectionCVE-2026-28562 · WordPress plugins & themes · reported by VulnCheckHigh 8.8
wpForo 2.4.14 contains an unauthenticated SQL injection vulnerability in Topics::get_topics() where the ORDER BY clause relies on ineffective esc_sql() sanitization on unquoted identifiers. Attackers exploit the wpfob parameter with CASE WHEN payloads to perform blind boolean extraction of credentials from the WordPress database.
Product
Topics::get_topics() where the ORDER BY clause relies on ineffective esc_sql() sanitization on unquoted identifiers
What to do
Update Topics::get_topics() where the ORDER BY clause relies on ineffective esc_sql() sanitization on unquoted identifiers to the newest version.
Full record and what to do →NVD record wordpress.org wordpress.org
Feb 28, 2026wpForo Forum 2.4.14 contains an information disclosure vulnerability that allows unauthenticated users to retrieve private and unapproved forum topics via the gCVE-2026-28559 · WordPress plugins & themes · reported by VulnCheckMedium 6.9
wpForo Forum 2.4.14 contains an information disclosure vulnerability that allows unauthenticated users to retrieve private and unapproved forum topics via the global RSS feed endpoint. Attackers request the RSS feed without a forum ID parameter, bypassing the privacy and status WHERE clauses that are only applied when a specific forum ID is present in the query.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record wordpress.org wordpress.org
Feb 28, 2026wpForo Forum 2.4.14 contains a missing authorization vulnerability that allows authenticated subscribers to move, merge, or split any forum topic via the topic_CVE-2026-28556 · WordPress plugins & themes · reported by VulnCheckMedium 5.3
wpForo Forum 2.4.14 contains a missing authorization vulnerability that allows authenticated subscribers to move, merge, or split any forum topic via the topic_move, topic_merge, and topic_split form action handlers. Attackers with a valid form nonce can reorganize arbitrary forum content without moderator permissions, including relocating topics to private forums.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record wordpress.org wordpress.org
Feb 28, 2026wpForo Forum 2.4.14 contains a missing authorization vulnerability that allows authenticated subscribers to close or reopen any forum topic via the wpforo_closeCVE-2026-28555 · WordPress plugins & themes · reported by VulnCheckMedium 5.3
wpForo Forum 2.4.14 contains a missing authorization vulnerability that allows authenticated subscribers to close or reopen any forum topic via the wpforo_close_ajax handler. Attackers submit a valid nonce with an arbitrary topic ID to bypass the moderator permission requirement and disrupt forum discussions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record wordpress.org wordpress.org
Feb 25, 2026WPGraphQL provides a GraphQL API for WordPress sites.CVE-2026-27938 · WordPress plugins & themes · reported by GitHubHigh 7.7
WPGraphQL provides a GraphQL API for WordPress sites. Prior to version 2.9.1, the `wp-graphql/wp-graphql` repository contains a GitHub Actions workflow (`release.yml`) vulnerable to OS command injection through direct use of `${{ github.event.pull_request.body }}` inside a `run:` shell block. When a pull request from `develop` to `master` is merged, the PR body is injected verbatim into a shell command, allowing arbitrary command execution on the Actions runner. Version 2.9.1 contains a fix for the vulnerability.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record github.com github.com
Feb 20, 2026PixelYourSite – Your smart PIXEL (TAG) Manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-27072 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PixelYourSite PixelYourSite – Your smart PIXEL (TAG) Manager pixelyoursite allows Stored XSS.This issue affects PixelYourSite – Your smart PIXEL (TAG) Manager: from n/a through <= 11.2.0.1.
Product
PixelYourSite – Your smart PIXEL (TAG) Manager
Affected
up to 11.2.0.1
What to do
Affects up to 11.2.0.1. Update PixelYourSite – Your smart PIXEL (TAG) Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 20, 2026Mopinion Feedback Form: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68856 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in keeswolters Mopinion Feedback Form mopinion-feedback-form allows DOM-Based XSS.This issue affects Mopinion Feedback Form: from n/a through <= 1.1.1.
Product
Mopinion Feedback Form
Affected
up to 1.1.1
What to do
Affects up to 1.1.1. Update Mopinion Feedback Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 20, 2026UPI QR Code Payment Gateway for WooCommerce: Missing AuthorizationCVE-2025-67969 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in knitpay UPI QR Code Payment Gateway for WooCommerce upi-qr-code-payment-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects UPI QR Code Payment Gateway for WooCommerce: from n/a through <= 1.5.1.
Product
UPI QR Code Payment Gateway for WooCommerce
Affected
up to 1.5.1
What to do
Affects up to 1.5.1. Update UPI QR Code Payment Gateway for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 19, 2026Shopire: Unauthorized modification of dataCVE-2025-13091 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Shopire theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the shopire_admin_install_plugin() function in all versions up to, and including, 1.0.57. This makes it possible for authenticated attackers, with Subscriber-level access and above, to install the 'fable-extra' plugin.
Product
Shopire
Affected
up to 1.0.57
What to do
Affects up to 1.0.57. Update Shopire to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themes.svn.wordpress.org themes.svn.wordpress.org
Feb 19, 2026Smartsupp – live chat, AI shopping assistant and chatbots: Stored Cross-Site ScriptingCVE-2025-12448 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Smartsupp – live chat, AI shopping assistant and chatbots plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'code' parameter in all versions up to, and including, 3.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Smartsupp – live chat, AI shopping assistant and chatbots
Affected
up to 3.9.1
What to do
Affects up to 3.9.1. Update Smartsupp – live chat, AI shopping assistant and chatbots to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 14, 2026Ecwid by Lightspeed Ecommerce Shopping Cart: Privilege EscalationCVE-2026-1750 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Ecwid by Lightspeed Ecommerce Shopping Cart plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 7.0.7. This is due to a missing capability check in the 'save_custom_user_profile_fields' function. This makes it possible for authenticated attackers, with minimal permissions such as a subscriber, to supply the 'ec_store_admin_access' parameter during a profile update and gain store manager access to the site.
Product
Ecwid by Lightspeed Ecommerce Shopping Cart
Affected
up to 7.0.7
What to do
Affects up to 7.0.7. Update Ecwid by Lightspeed Ecommerce Shopping Cart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 13, 2026PixelYourSite PRO: Stored Cross-Site ScriptingCVE-2026-1844 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The PixelYourSite PRO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'pysTrafficSource' parameter and the 'pys_landing_page' parameter in all versions up to, and including, 12.4.0.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
PixelYourSite PRO
Affected
up to 12.4.0.2
What to do
Affects up to 12.4.0.2. Update PixelYourSite PRO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record pixelyoursite.com wordfence.com
Feb 13, 2026PixelYourSite – Your smart PIXEL (TAG) & API Manager: Stored Cross-Site ScriptingCVE-2026-1841 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The PixelYourSite – Your smart PIXEL (TAG) & API Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'pysTrafficSource' parameter and the 'pys_landing_page' parameter in all versions up to, and including, 11.2.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. CVE-2026-27072 is likely a duplicate of this issue.
Product
PixelYourSite – Your smart PIXEL (TAG) & API Manager
Affected
up to 11.2.0
What to do
Affects up to 11.2.0. Update PixelYourSite – Your smart PIXEL (TAG) & API Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 11, 2026Videospirecore Theme: Privilege escalationCVE-2025-15096 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The 'Videospirecore Theme Plugin' plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.0.6. This is due to the plugin not properly validating a user's identity prior to updating their details like email. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change arbitrary user's email addresses, including administrators, and leverage that to reset the user's password and gain access to their account.
Product
Videospirecore Theme
Affected
up to 1.0.6
What to do
Affects up to 1.0.6. Update Videospirecore Theme to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Feb 11, 2026OpenPix for WooCommerce: Allows any authenticated user to trigger AJAX actions that reset payment gateway configuration options without capability or nonce checksCVE-2025-15400 · WordPress plugins & themes · reported by WPScanMedium 6.5
The OpenPix for WooCommerce WordPress plugin through 2.13.3 allows any authenticated user to trigger AJAX actions that reset payment gateway configuration options without capability or nonce checks. This permits any authenticated users, such as subscribers to clear API credentials and webhook status, causing persistent disruption of OpenPix payment functionality.
Product
OpenPix for WooCommerce
Affected
up to 2.13.3
What to do
Affects up to 2.13.3. Update OpenPix for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Feb 5, 2026ShortPixel Image Optimizer: Arbitrary File ReadCVE-2026-1246 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The ShortPixel Image Optimizer plugin for WordPress is vulnerable to Arbitrary File Read via path traversal in the 'loadFile' parameter in all versions up to, and including, 6.4.2 due to insufficient path validation and sanitization in the 'loadLogFile' AJAX action. This makes it possible for authenticated attackers, with Editor-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information such as database credentials and authentication keys.
Product
ShortPixel Image Optimizer
Affected
up to 6.4.2
What to do
Affects up to 6.4.2. Update ShortPixel Image Optimizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 2, 2026Spirit Framework: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2024-54263 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Talemy Spirit Framework allows PHP Local File Inclusion.This issue affects Spirit Framework: from n/a through 1.2.13.
Product
Spirit Framework
Affected
up to 1.2.13
What to do
Affects up to 1.2.13. Update Spirit Framework to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 23, 2026Add Expires Headers & Optimized Minify: Missing AuthorizationCVE-2026-24633 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Passionate Brains Add Expires Headers & Optimized Minify add-expires-headers allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Add Expires Headers & Optimized Minify: from n/a through <= 3.2.0.
Product
Add Expires Headers & Optimized Minify
Affected
up to 3.2.0
What to do
Affects up to 3.2.0. Update Add Expires Headers & Optimized Minify to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 23, 2026Ecwid Shopping Cart: Missing AuthorizationCVE-2026-24613 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Ecwid by Lightspeed Ecommerce Shopping Cart Ecwid Shopping Cart ecwid-shopping-cart allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ecwid Shopping Cart: from n/a through <= 7.0.6.
Product
Ecwid Shopping Cart
Affected
up to 7.0.6
What to do
Affects up to 7.0.6. Update Ecwid Shopping Cart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 23, 2026Ecwid Shopping Cart: Missing AuthorizationCVE-2026-24580 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Ecwid by Lightspeed Ecommerce Shopping Cart Ecwid Shopping Cart ecwid-shopping-cart allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ecwid Shopping Cart: from n/a through <= 7.0.5.
Product
Ecwid Shopping Cart
Affected
up to 7.0.5
What to do
Affects up to 7.0.5. Update Ecwid Shopping Cart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 23, 2026Pie Register: Missing AuthorizationCVE-2026-24577 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Genetech Products Pie Register pie-register allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Pie Register: from n/a through <= 3.8.4.8.
Product
Pie Register
Affected
up to 3.8.4.8
What to do
Affects up to 3.8.4.8. Update Pie Register to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 23, 2026ABG Rich Pins: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-24558 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in antoniobg ABG Rich Pins abg-rich-pins allows Stored XSS.This issue affects ABG Rich Pins: from n/a through <= 1.1.
Product
ABG Rich Pins
Affected
up to 1.1
What to do
Affects up to 1.1. Update ABG Rich Pins to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2026IMGspider: Server-Side Request Forgery (SSRF)CVE-2026-22482 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Server-Side Request Forgery (SSRF) vulnerability in wbolt.com IMGspider imgspider allows Server Side Request Forgery.This issue affects IMGspider: from n/a through <= 2.3.12.
Product
IMGspider
Affected
up to 2.3.12
What to do
Affects up to 2.3.12. Update IMGspider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2026WP MapIt: Missing AuthorizationCVE-2026-22466 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Chandni Patel WP MapIt wp-mapit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP MapIt: from n/a through <= 3.0.3.
Product
WP MapIt
Affected
up to 3.0.3
What to do
Affects up to 3.0.3. Update WP MapIt to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2026Apimo Connector: Missing AuthorizationCVE-2026-22445 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Proptech Plugin Apimo Connector apimo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Apimo Connector: from n/a through <= 2.6.5.2.
Product
Apimo Connector
Affected
up to 2.6.5.2
What to do
Affects up to 2.6.5.2. Update Apimo Connector to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2026Hospital Doctor Directory: Missing AuthorizationCVE-2025-69186 · WordPress plugins & themes · reported by PatchstackHigh 7.3
Missing Authorization vulnerability in e-plugins Hospital Doctor Directory hospital-doctor-directory allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Hospital Doctor Directory: from n/a through <= 1.3.9.
Product
Hospital Doctor Directory
Affected
up to 1.3.9
What to do
Affects up to 1.3.9. Update Hospital Doctor Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2026Hospital Doctor Directory: Incorrect Privilege AssignmentCVE-2025-69183 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Incorrect Privilege Assignment vulnerability in e-plugins Hospital Doctor Directory hospital-doctor-directory allows Privilege Escalation.This issue affects Hospital Doctor Directory: from n/a through <= 1.3.9.
Product
Hospital Doctor Directory
Affected
up to 1.3.9
What to do
Affects up to 1.3.9. Update Hospital Doctor Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2026Piqes: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-69073 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Piqes piqes allows PHP Local File Inclusion.This issue affects Piqes: from n/a through <= 1.0.11.
Product
Piqes
Affected
up to 1.0.11
What to do
Affects up to 1.0.11. Update Piqes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2026Pippo: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-69037 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in goalthemes Pippo pippo allows PHP Local File Inclusion.This issue affects Pippo: from n/a through <= 1.2.3.
Product
Pippo
Affected
up to 1.2.3
What to do
Affects up to 1.2.3. Update Pippo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2026Depicter Slider: Missing AuthorizationCVE-2025-68558 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in averta Depicter Slider depicter allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Depicter Slider: from n/a through <= 4.0.4.
Product
Depicter Slider
Affected
up to 4.0.4
What to do
Affects up to 4.0.4. Update Depicter Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2026Hospital Doctor Directory: Missing AuthorizationCVE-2025-68057 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Missing Authorization vulnerability in e-plugins Hospital Doctor Directory hospital-doctor-directory allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Hospital Doctor Directory: from n/a through <= 1.3.9.
Product
Hospital Doctor Directory
Affected
up to 1.3.9
What to do
Affects up to 1.3.9. Update Hospital Doctor Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2026GLS Shipping for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68011 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GLS GLS Shipping for WooCommerce gls-shipping-for-woocommerce allows Reflected XSS.This issue affects GLS Shipping for WooCommerce: from n/a through <= 1.4.0.
Product
GLS Shipping for WooCommerce
Affected
up to 1.4.0
What to do
Affects up to 1.4.0. Update GLS Shipping for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2026JupiterX Core: Deserialization of Untrusted DataCVE-2025-50004 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in artbees JupiterX Core jupiterx-core allows Object Injection.This issue affects JupiterX Core: from n/a through <= 4.10.1.
Product
JupiterX Core
Affected
up to 4.10.1
What to do
Affects up to 4.10.1. Update JupiterX Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 17, 2026Spin Wheel: Client-side prize manipulationCVE-2026-0808 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Spin Wheel plugin for WordPress is vulnerable to client-side prize manipulation in all versions up to, and including, 2.1.0. This is due to the plugin trusting client-supplied prize selection data without server-side validation or randomization. This makes it possible for unauthenticated attackers to manipulate which prize they win by modifying the 'prize_index' parameter sent to the server, allowing them to always select the most valuable prizes.
Product
Spin Wheel
Affected
up to 2.1.0
What to do
Affects up to 2.1.0. Update Spin Wheel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 16, 2026Poll, Survey & Quiz Maker Plugin by Opinion Stage Wordpress plugin versions prior to 19.6.25 contain a stored cross-site scripting (XSS) vulnerability via multiCVE-2019-25297 · WordPress plugins & themes · reported by VulnCheckMedium 5.1
Poll, Survey & Quiz Maker Plugin by Opinion Stage Wordpress plugin versions prior to 19.6.25 contain a stored cross-site scripting (XSS) vulnerability via multiple parameters due to insufficient input validation and output escaping. An unauthenticated attacker can inject arbitrary script into content that executes when a victim views an affected page.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record plugins.trac.wordpress.org web.archive.org
Jan 16, 2026Rede Itaú for WooCommerce — Payment PIX, Credit Card and Debit: Unauthorized modification of dataCVE-2026-0942 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Rede Itaú for WooCommerce — Payment PIX, Credit Card and Debit plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the clearOrderLogs() function in all versions up to, and including, 5.1.5. This makes it possible for unauthenticated attackers to delete the Rede Order Logs metadata from all WooCommerce orders.
Product
Rede Itaú for WooCommerce — Payment PIX, Credit Card and Debit
Affected
up to 5.1.5
What to do
Affects up to 5.1.5. Update Rede Itaú for WooCommerce — Payment PIX, Credit Card and Debit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 14, 2026Shipping Rate By Cities: SQL InjectionCVE-2025-14770 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Shipping Rate By Cities plugin for WordPress is vulnerable to SQL Injection via the 'city' parameter in all versions up to, and including, 2.0.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Shipping Rate By Cities
Affected
up to 2.0.0
What to do
Affects up to 2.0.0. Update Shipping Rate By Cities to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 14, 2026Flat Shipping Rate by City for WooCommerce: Time-based SQL InjectionCVE-2026-0678 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The Flat Shipping Rate by City for WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via the 'cities' parameter in all versions up to, and including, 1.0.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Flat Shipping Rate by City for WooCommerce
Affected
up to 1.0.3
What to do
Affects up to 1.0.3. Update Flat Shipping Rate by City for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 14, 2026Crush.pics Image Optimizer - Image Compression and Optimization: Unauthorized modification of dataCVE-2025-14482 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Crush.pics Image Optimizer - Image Compression and Optimization plugin for WordPress is vulnerable to unauthorized modification of data due to missing capability checks on multiple functions in all versions up to, and including, 1.8.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify plugin settings including disabling auto-compression and changing image quality settings.
Product
Crush.pics Image Optimizer - Image Compression and Optimization
Affected
up to 1.8.7
What to do
Affects up to 1.8.7. Update Crush.pics Image Optimizer - Image Compression and Optimization to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 14, 2026SpiceForms Form Builder: Stored Cross-Site ScriptingCVE-2025-12178 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The SpiceForms Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'spiceforms' shortcode in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
SpiceForms Form Builder
Affected
up to 1.0
What to do
Affects up to 1.0. Update SpiceForms Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 8, 2026Pinpoll: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68889 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pinpoll Pinpoll pinpoll allows Reflected XSS.This issue affects Pinpoll: from n/a through <= 4.0.0.
Product
Pinpoll
Affected
up to 4.0.0
What to do
Affects up to 4.0.0. Update Pinpoll to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.