Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,841 results · page 7 of 57
Aug 4, 2026Nested Pages: Does not properly escape post titles before outputting them into HTML attributes on an administrative listing screenCVE-2026-15233 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Nested Pages WordPress plugin before 3.2.15 does not properly escape post titles before outputting them into HTML attributes on an administrative listing screen, allowing users with the Editor role (or Contributor/Author when the Nested Pages WordPress plugin before 3.2.15 is enabled for the post type) to inject arbitrary JavaScript that executes in the session of any higher-privileged user who views that screen.
- Product
- Nested Pages
- Fixed in
- 3.2.15
- What to do
- Update Nested Pages to 3.2.15 or newer.
Aug 3, 2026Classified Listing: Does not perform a capability or ownership check on an AJAX action that returns a post's contentCVE-2026-16274 · WordPress plugins & themes · reported by WPScanLow 2.7
The Classified Listing WordPress plugin before 5.4.4 does not perform a capability or ownership check on an AJAX action that returns a post's content, allowing users with contributor-level access and above to read the content of any post, page, or custom post type on the site — including drafts, pending, and private posts owned by other users — regardless of ownership.
- Product
- Classified Listing
- Fixed in
- 5.4.4
- What to do
- Update Classified Listing to 5.4.4 or newer.
Aug 3, 2026Contest Gallery: Does not perform per-object capability or nonce checks in one of its post-deletion handlersCVE-2026-16057 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Contest Gallery WordPress plugin before 30.0.7 does not perform per-object capability or nonce checks in one of its post-deletion handlers, gating it only by a coarse role-membership test, which allows any Author-level or higher user to permanently delete arbitrary posts, pages, and other content they do not own.
- Product
- Contest Gallery
- Fixed in
- 30.0.7
- What to do
- Update Contest Gallery to 30.0.7 or newer.
Aug 3, 2026Tag, Category, and Taxonomy Manager: Does not verify that a user is authorized to access a referenced post before processing it and returning derived dataCVE-2026-15231 · WordPress plugins & themes · reported by WPScanLow 2.7
The Tag, Category, and Taxonomy Manager WordPress plugin before 3.51.0 does not verify that a user is authorized to access a referenced post before processing it and returning derived data, allowing users with contributor privileges to disclose data from private or draft posts they do not own.
- Product
- Tag, Category, and Taxonomy Manager
- Fixed in
- 3.51.0
- What to do
- Update Tag, Category, and Taxonomy Manager to 3.51.0 or newer.
Aug 2, 2026Narrative Publisher: Does not restrict write access to a REST-exposed post meta field or escape itCVE-2026-16273 · WordPress plugins & themes · reported by WPScanMedium 4.6
The Narrative Publisher WordPress plugin through 1.0.7 does not restrict write access to a REST-exposed post meta field or escape it when rendering, allowing users with contributor-level access and above to store JavaScript that executes in the browser of any higher-privileged user who views the affected post.
- Product
- Narrative Publisher
- Affected
- up to 1.0.7
- What to do
- Affects up to 1.0.7. Update Narrative Publisher to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 2, 2026Event Booking Manager for WooCommerce: Does not sanitise or escape event timeline content submitted by users with post-editing access before storing it and rendering it on the public event pageCVE-2026-16063 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Event Booking Manager for WooCommerce WordPress plugin before 5.3.7 does not sanitise or escape event timeline content submitted by users with post-editing access before storing it and rendering it on the public event page, allowing users with the Author role and above to inject arbitrary JavaScript that executes in the browser of any visitor viewing the event, including administrators.
- Product
- Event Booking Manager for WooCommerce
- Fixed in
- 5.3.7
- What to do
- Update Event Booking Manager for WooCommerce to 5.3.7 or newer.
Aug 2, 2026JetEngine: Does not escape a post meta value before outputting it through one of its shortcodesCVE-2026-14864 · WordPress plugins & themes · reported by WPScanMedium 5.4
The JetEngine WordPress plugin before 3.8.12 does not escape a post meta value before outputting it through one of its shortcodes, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks that execute in the context of higher-privileged users such as administrators.
- Product
- JetEngine
- Fixed in
- 3.8.12
- What to do
- Update JetEngine to 3.8.12 or newer.
Aug 2, 2026Clever Mega Menu for Visual Composer: Does not perform a nonce or capability check in an AJAX action that updates navigation menu item metadataCVE-2026-11872 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Clever Mega Menu for Visual Composer WordPress plugin through 1.0.1 does not perform a nonce or capability check in an AJAX action that updates navigation menu item metadata, allowing any authenticated user, including Subscribers, to overwrite menu item content and settings that are rendered in the site's public navigation.
- Product
- Clever Mega Menu for Visual Composer
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update Clever Mega Menu for Visual Composer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 1, 2026PixelYourSite – Your smart PIXEL (TAG) & API Manager: Sensitive Information ExposureCVE-2026-18059 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The PixelYourSite – Your smart PIXEL (TAG) & API Manager plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 11.2.1 via the getWooPurchaseEventParams. This makes it possible for unauthenticated attackers to extract WooCommerce purchase metadata — including product names, product IDs, quantities, per-item prices, order totals, currency, and order/transaction IDs — for any existing order by supplying an invalid or arbitrary order key. This is exploitable against any known or enumerated order ID, as the plugin resolves the order from the URL path variable alone and emits the full woo_purchase tracking payload into the page HTML via the pysOptions JavaScript object across its Facebook, Google Analytics, and Google Tag Manager integrations regardless of key validity.
- Product
- PixelYourSite – Your smart PIXEL (TAG) & API Manager
- Affected
- up to 11.2.1
- What to do
- Affects up to 11.2.1. Update PixelYourSite – Your smart PIXEL (TAG) & API Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 1, 2026The Advanced Views – Display Custom Fields (ACF, Pods, MetaBox), Posts, CPT and Woo Products anywhere in Gutenberg, Elementor, Divi, Beaver… plugin for WordPresCVE-2026-17580 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Advanced Views – Display Custom Fields (ACF, Pods, MetaBox), Posts, CPT and Woo Products anywhere in Gutenberg, Elementor, Divi, Beaver… plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.9.1 via the register_rest_routes. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract sensitive admin-authored editor content — including template markup, CSS code, JavaScript code, and PHP controller variables — for any Layout or Post Selection post on the site.
- Affected
- up to 3.9.1
- What to do
- Affects up to 3.9.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 1, 2026Jeg Kit for Elementor: Sensitive Information ExposureCVE-2026-2916 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Jeg Kit for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.1.1 via the `enqueue_scripts()` method in `class/dashboard/class-dashboard.php`. The plugin injects a `JkitDashboardOption` JavaScript object containing full plugin inventory (names, versions, paths, active status), system environment details (WordPress version, PHP version, site URLs, server capabilities), and potentially third-party API credentials (Mailchimp API key via `jkit_user_data`) as an inline script on the `post.php` admin page. Because this data is output without any capability check beyond post editing access, any authenticated user with Contributor-level access or above can view this sensitive configuration data by inspecting the page source. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive site configuration data, installed plugin details, and potentially third-party API keys.
- Product
- Jeg Kit for Elementor
- Affected
- up to 3.1.1
- What to do
- Affects up to 3.1.1. Update Jeg Kit for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 1, 2026Mapster WP Maps: Does not perform any authorization or post-status check on a public REST endpointCVE-2026-14839 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Mapster WP Maps WordPress plugin before 1.24.0 does not perform any authorization or post-status check on a public REST endpoint, allowing unauthenticated users to retrieve the title and full content of any post regardless of its status, including unpublished (draft, pending, private, and trashed) posts.
- Product
- Mapster WP Maps
- Fixed in
- 1.24.0
- What to do
- Update Mapster WP Maps to 1.24.0 or newer.
Aug 1, 2026Brizy: Does not properly verify authorization on a request handler before returning post contentCVE-2026-14195 · WordPress plugins & themes · reported by WPScanLow 2.7
The Brizy WordPress plugin before 2.8.18 does not properly verify authorization on a request handler before returning post content, allowing users with the Contributor role or higher to read the content of arbitrary posts, including other users' private, pending, and draft posts.
- Product
- Brizy
- Fixed in
- 2.8.18
- What to do
- Update Brizy to 2.8.18 or newer.
Jul 30, 2026Sync Post With Other Site: Does not correctly enforce the page-editing capability on a REST route that creates and updates postsCVE-2026-14923 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Sync Post With Other Site WordPress plugin before 1.9.3 does not correctly enforce the page-editing capability on a REST route that creates and updates posts, because of an operator-precedence flaw in its authorization check. An authenticated user holding only the post-editing capability (such as a Contributor) can create, publish, and overwrite arbitrary Pages, including modifying content authored by higher-privileged users.
- Product
- Sync Post With Other Site
- Fixed in
- 1.9.3
- What to do
- Update Sync Post With Other Site to 1.9.3 or newer.
Jul 30, 2026WP Travel: Does not verify PayPal Instant Payment Notifications through the PayPal post-back handshake before marking a booking paidCVE-2026-13143 · WordPress plugins & themes · reported by WPScanMedium 5.3
The WP Travel WordPress plugin before 11.8.1 does not verify PayPal Instant Payment Notifications through the PayPal post-back handshake before marking a booking paid, allowing unauthenticated attackers to forge a notification that flips an arbitrary pending booking to a paid and booked state at an attacker-chosen amount.
- Product
- WP Travel
- Fixed in
- 11.8.1
- What to do
- Update WP Travel to 11.8.1 or newer.
Jul 28, 2026WPBot – AI ChatBot for Live Support, Lead Generation, AI Services: Sensitive Information ExposureCVE-2026-16773 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WPBot – AI ChatBot for Live Support, Lead Generation, AI Services plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 8.5.9 via the wpbot_send_email_transcript_free. This makes it possible for unauthenticated attackers to exfiltrate full chat transcripts and associated user PII — including names, email addresses, and phone numbers — stored in the wpbot_user and wpbot_conversation tables to an attacker-controlled email address.
- Product
- WPBot – AI ChatBot for Live Support, Lead Generation, AI Services
- Affected
- up to 8.5.9
- What to do
- Affects up to 8.5.9. Update WPBot – AI ChatBot for Live Support, Lead Generation, AI Services to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 27, 2026Unauthenticated Sensitive Data Exposure in Exclusive Addons Elementor <= 2.8.0 versions.CVE-2026-66438 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Sensitive Data Exposure in Exclusive Addons Elementor <= 2.8.0 versions.
- Affected
- up to 2.8.0
- What to do
- Affects up to 2.8.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 27, 2026Contributor Broken Access Control in Visual Composer Website Builder <= 45.15.0 versions.CVE-2026-65568 · WordPress plugins & themes · reported by PatchstackMedium 5
Contributor Broken Access Control in Visual Composer Website Builder <= 45.15.0 versions.
- Affected
- up to 45.15.0
- What to do
- Affects up to 45.15.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 27, 2026Unauthenticated Sensitive Data Exposure in MapPress Maps for WordPress <= 2.97.6 versions.CVE-2026-65564 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Sensitive Data Exposure in MapPress Maps for WordPress <= 2.97.6 versions.
- Affected
- up to 2.97.6
- What to do
- Affects up to 2.97.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 27, 2026Subscriber Sensitive Data Exposure in ЮKassa для WooCommerce <= 2.16.1 versions.CVE-2026-65434 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Subscriber Sensitive Data Exposure in ЮKassa для WooCommerce <= 2.16.1 versions.
- Affected
- up to 2.16.1
- What to do
- Affects up to 2.16.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 27, 2026Unauthenticated Sensitive Data Exposure in Byteflows Travel & Hotel Booking <= 1.0.0 versions.CVE-2026-59548 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Sensitive Data Exposure in Byteflows Travel & Hotel Booking <= 1.0.0 versions.
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 27, 2026Unauthenticated Broken Access Control in Post My CF7 Form <= 6.2.0 versions.CVE-2026-59534 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in Post My CF7 Form <= 6.2.0 versions.
- Affected
- up to 6.2.0
- What to do
- Affects up to 6.2.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 27, 2026Unauthenticated Sensitive Data Exposure in Ebook Store <= 6.19 versions.CVE-2026-59529 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Sensitive Data Exposure in Ebook Store <= 6.19 versions.
- Affected
- up to 6.19
- What to do
- Affects up to 6.19. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 27, 2026Subscriber Sensitive Data Exposure in ShipTime: Discounted Shipping Rates <= 1.1.1 versions.CVE-2026-59528 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Subscriber Sensitive Data Exposure in ShipTime: Discounted Shipping Rates <= 1.1.1 versions.
- Affected
- up to 1.1.1
- What to do
- Affects up to 1.1.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 27, 2026User Frontend: AI Powered Frontend Post Submission, User Directory, User Profile, Membership & User Registration: Does not correctly verify ownership before deleting an attachmentCVE-2026-14568 · WordPress plugins & themes · reported by WPScanMedium 6.5
The User Frontend: AI Powered Frontend Post Submission, User Directory, User Profile, Membership & User Registration WordPress plugin before 4.3.8 does not correctly verify ownership before deleting an attachment, allowing unauthenticated attackers to permanently delete author-less attachments such as guest uploads and User Frontend: AI Powered Frontend Post Submission, User Directory, User Profile, Membership & User Registration WordPress plugin before 4.3.8-installed placeholder media.
- Product
- User Frontend: AI Powered Frontend Post Submission, User Directory, User Profile, Membership & User Registration
- Fixed in
- 4.3.8
- What to do
- Update User Frontend: AI Powered Frontend Post Submission, User Directory, User Profile, Membership & User Registration to 4.3.8 or newer.
Jul 27, 2026Smart Manager: Does not properly encode a post field before rendering it into an HTML attribute in its management gridCVE-2026-14203 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Smart Manager WordPress plugin before 8.92.0 does not properly encode a post field before rendering it into an HTML attribute in its management grid, allowing users with the Contributor role or above to inject JavaScript that executes in the browser session of an administrator who views the grid.
- Product
- Smart Manager
- Fixed in
- 8.92.0
- What to do
- Update Smart Manager to 8.92.0 or newer.
Jul 24, 2026Post Grid Gutenberg Blocks – PostX: Stored Cross-Site ScriptingCVE-2026-15100 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Post Grid Gutenberg Blocks – PostX plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'searchnoresult' Block Attribute in all versions up to, and including, 5.0.32 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is particularly concerning in a cross-privilege scenario where a Contributor creates a pending or draft post containing the malicious block attribute, which then executes arbitrary JavaScript in the browser session of an Editor or Administrator who previews that post.
- Product
- Post Grid Gutenberg Blocks – PostX
- Affected
- up to 5.0.32
- What to do
- Affects up to 5.0.32. Update Post Grid Gutenberg Blocks – PostX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 24, 2026Participants Database: Sensitive Information ExposureCVE-2026-11354 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Participants Database plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.7.8.3 via the 'id' parameter. This makes it possible for unauthenticated attackers to overwrite arbitrary participant records by numeric ID and redirect the private_id-bearing record-access link to an attacker-controlled email address, granting full read and edit access to the victim's stored personally identifiable information including names, email addresses, phone numbers, and any other fields collected in the participant database. An attacker can harvest a valid nonce with a plain unauthenticated GET request to any page rendering the public signup or record form, then POST action=update with an arbitrary id value to overwrite any record; chaining a subsequent action=retrieve then delivers the private-access link to the attacker-controlled mailbox.
- Product
- Participants Database
- Affected
- up to 2.7.8.3
- What to do
- Affects up to 2.7.8.3. Update Participants Database to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 23, 2026Contributor Sensitive Data Exposure in TinyMCE Templates <= 4.8.1 versions.CVE-2026-65535 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Contributor Sensitive Data Exposure in TinyMCE Templates <= 4.8.1 versions.
- Affected
- up to 4.8.1
- What to do
- Affects up to 4.8.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026Unauthenticated Sensitive Data Exposure in WP Social Ninja <= 4.3.0 versions.CVE-2026-65521 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Sensitive Data Exposure in WP Social Ninja <= 4.3.0 versions.
- Affected
- up to 4.3.0
- What to do
- Affects up to 4.3.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026Unauthenticated Sensitive Data Exposure in Ultimate Store Kit Elementor Addons <= 3.0.5 versions.CVE-2026-65505 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Sensitive Data Exposure in Ultimate Store Kit Elementor Addons <= 3.0.5 versions.
- Affected
- up to 3.0.5
- What to do
- Affects up to 3.0.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026Unauthenticated Sensitive Data Exposure in Complianz <= 7.5.0 versions.CVE-2026-65498 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Sensitive Data Exposure in Complianz <= 7.5.0 versions.
- Affected
- up to 7.5.0
- What to do
- Affects up to 7.5.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026Create: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2026-65490 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in John-Michael L'Allier Create mediavine-create allows Retrieve Embedded Sensitive Data.This issue affects Create: from n/a through 2.6.0.
- Product
- Create
- Affected
- up to 2.6.0
- What to do
- Affects up to 2.6.0. Update Create to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026Unauthenticated Broken Access Control in Event post <= 6.0.1 versions.CVE-2026-65486 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Broken Access Control in Event post <= 6.0.1 versions.
- Affected
- up to 6.0.1
- What to do
- Affects up to 6.0.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026Unauthenticated Sensitive Data Exposure in Ninja Tables <= 5.2.10 versions.CVE-2026-65474 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Sensitive Data Exposure in Ninja Tables <= 5.2.10 versions.
- Affected
- up to 5.2.10
- What to do
- Affects up to 5.2.10. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026Chouby Polylang and Chouby Polylang Pro: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2026-65458 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Chouby Polylang and Chouby Polylang Pro allows Retrieve Embedded Sensitive Data. This issue affects Polylang: through 3.8.5; Polylang Pro: through 3.8.5.
- Product
- Chouby Polylang and Chouby Polylang Pro
- Affected
- up to 3.8.5
- What to do
- Affects up to 3.8.5. Update Chouby Polylang and Chouby Polylang Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026WooCommerce Product Stock Alert: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2026-61945 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in MultiVendorX WooCommerce Product Stock Alert allows Retrieve Embedded Sensitive Data. This issue affects WooCommerce Product Stock Alert: from n/a through 3.0.6.
- Product
- WooCommerce Product Stock Alert
- Affected
- up to 3.0.6
- What to do
- Affects up to 3.0.6. Update WooCommerce Product Stock Alert to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026Unauthenticated Sensitive Data Exposure in PeproDev Ultimate Invoice <= 2.2.6 versions.CVE-2026-27372 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Sensitive Data Exposure in PeproDev Ultimate Invoice <= 2.2.6 versions.
- Affected
- up to 2.2.6
- What to do
- Affects up to 2.2.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026WCPOS – Point of Sale (POS) plugin for WooCommerce: Directory TraversalCVE-2026-16078 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The WCPOS – Point of Sale (POS) plugin for WooCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.9.8 via the 'type' parameter parameter. This makes it possible for authenticated attackers, with shop manager-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. Successful exploitation requires supplying context=edit in the request, which bypasses the content-stripping logic in prepare_item_for_response() and returns the traversed file verbatim in the REST API response.
- Product
- WCPOS – Point of Sale (POS) plugin for WooCommerce
- Affected
- up to 1.9.8
- What to do
- Affects up to 1.9.8. Update WCPOS – Point of Sale (POS) plugin for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 23, 2026Post Status Notifier Lite: Does not properly escape the `mod` URL parameter before reflecting it into the admin settings page (`adminCVE-2026-9577 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Post Status Notifier Lite WordPress plugin before 1.13.0 does not properly escape the `mod` URL parameter before reflecting it into the admin settings page (`admin.php?page=post-status-notifier-lite`), leading to a Reflected Cross-Site Scripting vulnerability that fires in the administrator's session when they are tricked into following a crafted URL.
- Product
- Post Status Notifier Lite
- Fixed in
- 1.13.0
- What to do
- Update Post Status Notifier Lite to 1.13.0 or newer.
Jul 21, 2026bpost-shipping-platform: Does not properly sanitize a parameter before using it in a SQL query during WooCommerce order submissionCVE-2026-8082 · WordPress plugins & themes · reported by WPScanHigh 7.5
The bpost-shipping-platform WordPress plugin before 3.2.3 does not properly sanitize a parameter before using it in a SQL query during WooCommerce order submission, allowing unauthenticated attackers to perform time-based blind SQL injection on stores running this bpost-shipping-platform WordPress plugin before 3.2.3.
- Product
- bpost-shipping-platform
- Fixed in
- 3.2.3
- What to do
- Update bpost-shipping-platform to 3.2.3 or newer.
Jul 20, 2026Elementor Website Builder: Does not properly check user permissions before returning post data through one of its REST endpointsCVE-2026-8825 · WordPress plugins & themes · reported by WPScanMedium 4.9
The Elementor Website Builder WordPress plugin before 4.1.4 does not properly check user permissions before returning post data through one of its REST endpoints, allowing authenticated users with Contributor-level access and above to retrieve the title, body and metadata of private posts, private pages and drafts authored by other users (including administrators).
- Product
- Elementor Website Builder
- Fixed in
- 4.1.4
- What to do
- Update Elementor Website Builder to 4.1.4 or newer.
Jul 17, 2026HubSpot All-In-One Marketing – Forms, Popups, Live Chat: Sensitive Information ExposureCVE-2026-9656 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The HubSpot All-In-One Marketing – Forms, Popups, Live Chat plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 11.3.62 via the wp_localize_script() / window.leadinConfig JavaScript object. This makes it possible for authenticated attackers, with contributor-level access and above, to extract the site's plaintext HubSpot OAuth refresh token exposed via the window.leadinConfig JavaScript object, which can then be used to access or modify data in the connected HubSpot tenant. Although the refresh token is stored at rest with AES-256-CTR encryption, decryption occurs server-side before the plaintext value is passed to wp_localize_script(), rendering the at-rest encryption ineffective against this exposure path.
- Product
- HubSpot All-In-One Marketing – Forms, Popups, Live Chat
- Affected
- up to 11.3.62
- What to do
- Affects up to 11.3.62. Update HubSpot All-In-One Marketing – Forms, Popups, Live Chat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 17, 2026Royal Addons for Elementor: Does not check the post status of menu items or the templates they reference in one of its REST endpointsCVE-2026-13402 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Royal Addons for Elementor WordPress plugin before 1.7.1063 does not check the post status of menu items or the templates they reference in one of its REST endpoints, allowing unauthenticated users to retrieve the rendered HTML content of private or draft Elementor templates linked from non-public navigation menu items.
- Product
- Royal Addons for Elementor
- Fixed in
- 1.7.1063
- What to do
- Update Royal Addons for Elementor to 1.7.1063 or newer.
Jul 17, 2026pCloud WP Backup: Sensitive Information ExposureCVE-2026-14503 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The pCloud WP Backup plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.0.3 via the wp2pcl_ajax_process_request_inner. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract force generation of a full-site backup archive written to a publicly accessible directory, exposing wp-config.php database credentials, WordPress secret salts, and the complete PHP source tree. The resulting archive is deposited in the plugin's unprotected tmp/ directory at a predictable URL, making the extracted data accessible to unauthenticated visitors once the backup is triggered.
- Product
- pCloud WP Backup
- Affected
- up to 2.0.3
- What to do
- Affects up to 2.0.3. Update pCloud WP Backup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 17, 2026LearnPress – WordPress LMS Plugin for Create and Sell Online Courses: Sensitive Information ExposureCVE-2026-13765 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.4.1 via the check_answer. This makes it possible for unauthenticated attackers to extract the correct-answer markers, full option lists, explanations, and question content for any quiz question on the site — including questions belonging to paid courses the attacker is not enrolled in.
- Product
- LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
- Affected
- up to 4.4.1
- What to do
- Affects up to 4.4.1. Update LearnPress – WordPress LMS Plugin for Create and Sell Online Courses to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 16, 2026RTMKit: Does not perform a capability check in one of its AJAX actions and resolves a request-supplied post identifier directlyCVE-2026-12906 · WordPress plugins & themes · reported by WPScanLow 2.7
The RTMKit WordPress plugin before 2.0.9 does not perform a capability check in one of its AJAX actions and resolves a request-supplied post identifier directly, allowing users with at least the Contributor role to read the titles of other users' private, draft, pending, scheduled and trashed posts.
- Product
- RTMKit
- Fixed in
- 2.0.9
- What to do
- Update RTMKit to 2.0.9 or newer.
Jul 16, 2026Header Footer Builder for Elementor: Does not require an administrative capability for its dashboard template-import action (it allows any edit_posts user)CVE-2026-12869 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Header Footer Builder for Elementor WordPress plugin before 1.2.1 does not require an administrative capability for its dashboard template-import action (it allows any edit_posts user), so a Contributor can import a template containing an Elementor HTML widget configured to display site-wide, injecting JavaScript that executes in the session of any visitor or administrator who loads the site.
- Product
- Header Footer Builder for Elementor
- Fixed in
- 1.2.1
- What to do
- Update Header Footer Builder for Elementor to 1.2.1 or newer.
Jul 16, 2026List category posts: Sensitive Information ExposureCVE-2026-12434 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The List category posts plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 0.95.0 via the sanitize_status. This makes it possible for authenticated attackers, with contributor-level access and above, to extract titles, full content, excerpts, dates, authors, and custom-field metadata of other users' pending-review, scheduled, and trashed posts by embedding a crafted [catlist] shortcode in their own draft and previewing it. This vulnerability is a bypass of the incomplete fix introduced for CVE-2025-11377 in version 0.93.0.
- Product
- List category posts
- Affected
- up to 0.95.0
- What to do
- Affects up to 0.95.0. Update List category posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 15, 2026Kali Forms — Contact Form & Drag-and-Drop Builder: Does not perform a per-object capability check in its post-duplication AJAX actionCVE-2026-11580 · WordPress plugins & themes · reported by WPScanMedium 5.5
The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.17 does not perform a per-object capability check in its post-duplication AJAX action, allowing users with Contributor-level access or above to duplicate any post (regardless of owner, post type, or status) into a published post they own and read its private post metadata, including secrets stored by other Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.17.
- Product
- Kali Forms — Contact Form & Drag-and-Drop Builder
- Fixed in
- 2.4.17
- What to do
- Update Kali Forms — Contact Form & Drag-and-Drop Builder to 2.4.17 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.