Updated 10 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,756exploited flaws on CISA’s list

33added in the last 30 days

299new WordPress flaws this week

14,013entries in the database

11,503 results · page 70 of 231

Aug 21, 2026NewPath WildApricotPress Add-on: Does not enforce its members-only field privacy on an unauthenticated REST routeCVE-2026-13736 · WordPress plugins & themes · reported by WPScanMedium 5.3
The NewPath WildApricotPress Add-on WordPress plugin through 1.0.0 does not enforce its members-only field privacy on an unauthenticated REST route, allowing anonymous visitors to read member email addresses and phone numbers that are configured to be visible to members only.
Product
NewPath WildApricotPress Add-on
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update NewPath WildApricotPress Add-on to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record wpscan.com
Aug 21, 2026Welcart e-Commerce: Does not regenerate the session identifier on authentication and sets the session identifier from a user-supplied request parameterCVE-2025-15671 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Welcart e-Commerce WordPress plugin before 2.12.1 does not regenerate the session identifier on authentication and sets the session identifier from a user-supplied request parameter, allowing an unauthenticated attacker to fixate a shop member's session and take over their customer account after the victim logs in through an attacker-crafted request.
Product
Welcart e-Commerce
Fixed in
2.12.1
What to do
Update Welcart e-Commerce to 2.12.1 or newer.
NVD record wpscan.com
Aug 21, 2026WPForms Pro: Stored Cross-Site ScriptingCVE-2026-18409 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The WPForms Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Single Line Text and Paragraph Text Field Values in all versions up to, and including, 2.0.0.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit relies on the plugin's own wp_kses_allowed_html filter widening the 'post' allowlist to permit iframe elements with a data-src attribute, which is not on WordPress's URI-attribute sanitization list, allowing a javascript: URI stored in data-src to survive kses processing and subsequently be promoted to a live src attribute by the bundled admin script view-entry.min.js.
Product
WPForms Pro
Affected
up to 2.0.0.2
What to do
Affects up to 2.0.0.2. Update WPForms Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record wpforms.com wordfence.com
Aug 20, 2026revmakx InfiniteWP Client: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-74011 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in revmakx InfiniteWP Client allows Blind SQL Injection. This issue affects InfiniteWP Client: from n/a through 1.13.9.
Product
revmakx InfiniteWP Client
Affected
up to 1.13.9
What to do
Affects up to 1.13.9. Update revmakx InfiniteWP Client to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record patchstack.com
Aug 20, 2026HashThemes Easy Elementor Addons: Cross-Site Request Forgery (CSRF)CVE-2026-28164 · WordPress plugins & themes · reported by PatchstackCritical 9.6
Cross-Site Request Forgery (CSRF) vulnerability in HashThemes Easy Elementor Addons allows Cross Site Request Forgery. This issue affects Easy Elementor Addons: from n/a through 2.3.7.
Product
HashThemes Easy Elementor Addons
Affected
up to 2.3.7
What to do
Affects up to 2.3.7. Update HashThemes Easy Elementor Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record patchstack.com
Aug 20, 2026myCred New User Approve: Missing AuthorizationCVE-2026-28163 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in myCred New User Approve allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects New User Approve: from n/a through 3.2.8.
Product
myCred New User Approve
Affected
up to 3.2.8
What to do
Affects up to 3.2.8. Update myCred New User Approve to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record patchstack.com
Aug 20, 2026Unauthenticated Broken Access Control in Chaplin <= 2.6.8 versions.CVE-2026-74021 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in Chaplin <= 2.6.8 versions.
What to do
Update the plugin to the newest version.
NVD record patchstack.com
Aug 20, 2026Unauthenticated Broken Access Control in Koji <= 2.2.1 versions.CVE-2026-74020 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in Koji <= 2.2.1 versions.
What to do
Update the plugin to the newest version.
NVD record patchstack.com
Aug 20, 2026Unauthenticated Broken Access Control in EPROLO Dropshipping <= 2.4.2 versions.CVE-2026-74019 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Broken Access Control in EPROLO Dropshipping <= 2.4.2 versions.
What to do
Update the plugin to the newest version.
NVD record patchstack.com
Aug 20, 2026Subscriber Arbitrary File Upload in Warehouse Cargo <= 2.6.9 versions.CVE-2026-74018 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Subscriber Arbitrary File Upload in Warehouse Cargo <= 2.6.9 versions.
What to do
Update the plugin to the newest version.
NVD record patchstack.com
Aug 20, 2026Subscriber Arbitrary File Upload in Smart Cleaning <= 4.8.6 versions.CVE-2026-74016 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Subscriber Arbitrary File Upload in Smart Cleaning <= 4.8.6 versions.
What to do
Update the plugin to the newest version.
NVD record patchstack.com
Aug 20, 2026Subscriber Arbitrary File Upload in IT Residence <= 3.2.1 versions.CVE-2026-74014 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Subscriber Arbitrary File Upload in IT Residence <= 3.2.1 versions.
What to do
Update the plugin to the newest version.
NVD record patchstack.com
Aug 20, 2026Subscriber SQL Injection in eShipper Commerce <= 2.16.13 versions.CVE-2026-74013 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Subscriber SQL Injection in eShipper Commerce <= 2.16.13 versions.
What to do
Update the plugin to the newest version.
NVD record patchstack.com
Aug 20, 2026Unauthenticated Broken Authentication in User Registration & Membership Pro <= 5.4.5 versions.CVE-2026-74001 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated Broken Authentication in User Registration & Membership Pro <= 5.4.5 versions.
What to do
Update the plugin to the newest version.
NVD record patchstack.com
Aug 20, 2026Subscriber SQL Injection in WP w3all phpBB <= 3.0.5 versions.CVE-2026-73998 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Subscriber SQL Injection in WP w3all phpBB <= 3.0.5 versions.
What to do
Update the plugin to the newest version.
NVD record patchstack.com
Aug 20, 2026Unauthenticated PHP Object Injection in FundEngine <= 1.7.9 versions.CVE-2026-73993 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in FundEngine <= 1.7.9 versions.
What to do
Update the plugin to the newest version.
NVD record patchstack.com
Aug 20, 2026Subscriber Remote Code Execution (RCE) in Query Wrangler <= 1.5.57 versions.CVE-2026-73992 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Subscriber Remote Code Execution (RCE) in Query Wrangler <= 1.5.57 versions.
What to do
Update the plugin to the newest version.
NVD record patchstack.com
Aug 20, 2026Subscriber Cross Site Scripting (XSS) in WP BASE Booking <= 6.3.2 versions.CVE-2026-73402 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Subscriber Cross Site Scripting (XSS) in WP BASE Booking <= 6.3.2 versions.
What to do
Update the plugin to the newest version.
NVD record patchstack.com
Aug 20, 2026Unauthenticated SQL Injection in BookingPress Appointment Booking Pro <= 6.0.2 versions.CVE-2026-68566 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in BookingPress Appointment Booking Pro <= 6.0.2 versions.
What to do
Update the plugin to the newest version.
NVD record patchstack.com
Aug 20, 2026Unauthenticated Cross Site Scripting (XSS) in NotificationX Pro <= 3.1.4 versions.CVE-2026-68564 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in NotificationX Pro <= 3.1.4 versions.
What to do
Update the plugin to the newest version.
NVD record patchstack.com
Aug 20, 2026Unauthenticated Privilege Escalation in Abandoned Cart Pro for WooCommerce <= 10.4.0 versions.CVE-2026-66682 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated Privilege Escalation in Abandoned Cart Pro for WooCommerce <= 10.4.0 versions.
What to do
Update the plugin to the newest version.
NVD record patchstack.com
Aug 20, 2026Unauthenticated SQL Injection in Locatoraid Store Locator <= 3.9.72 versions.CVE-2026-66680 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in Locatoraid Store Locator <= 3.9.72 versions.
What to do
Update the plugin to the newest version.
NVD record patchstack.com
Aug 20, 2026Subscriber Broken Authentication in Leyka <= 3.32.3 versions.CVE-2026-66677 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Subscriber Broken Authentication in Leyka <= 3.32.3 versions.
What to do
Update the plugin to the newest version.
NVD record patchstack.com
Aug 20, 2026Unauthenticated Cross Site Scripting (XSS) in Flatastic <= 2.0 versions.CVE-2026-66673 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Flatastic <= 2.0 versions.
What to do
Update the plugin to the newest version.
NVD record patchstack.com
Aug 20, 2026Unauthenticated PHP Object Injection in Flatastic <= 2.0 versions.CVE-2026-66672 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in Flatastic <= 2.0 versions.
What to do
Update the plugin to the newest version.
NVD record patchstack.com
Aug 20, 2026Unauthenticated SQL Injection in Directory Pro <= 2.5.8 versions.CVE-2026-66649 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in Directory Pro <= 2.5.8 versions.
What to do
Update the plugin to the newest version.
NVD record patchstack.com
Aug 20, 2026Subscriber Broken Access Control in Homlisti <= 3.1.2 versions.CVE-2026-66647 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Subscriber Broken Access Control in Homlisti <= 3.1.2 versions.
What to do
Update the plugin to the newest version.
NVD record patchstack.com
Aug 20, 202610Web Form Maker by 10Web form-maker: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-66616 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 10Web Form Maker by 10Web form-maker allows Stored XSS.This issue affects Form Maker by 10Web: from n/a through 1.15.49.
Product
10Web Form Maker by 10Web form-maker
Affected
up to 1.15.49
What to do
Affects up to 1.15.49. Update 10Web Form Maker by 10Web form-maker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record patchstack.com
Aug 20, 2026Unauthenticated Cross Site Scripting (XSS) in Podlove Podcast Publisher <= 4.5.4 versions.CVE-2026-66615 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Podlove Podcast Publisher <= 4.5.4 versions.
What to do
Update the plugin to the newest version.
NVD record patchstack.com
Aug 20, 2026Unauthenticated Cross Site Scripting (XSS) in SEO Plugin by Squirrly SEO <= 14.2.2 versions.CVE-2026-66614 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in SEO Plugin by Squirrly SEO <= 14.2.2 versions.
What to do
Update the plugin to the newest version.
NVD record patchstack.com
Aug 20, 2026Unauthenticated Cross Site Scripting (XSS) in Aora <= 1.3.19 versions.CVE-2026-66612 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Aora <= 1.3.19 versions.
What to do
Update the plugin to the newest version.
NVD record patchstack.com
Aug 20, 2026Unauthenticated Cross Site Scripting (XSS) in Paymob for WooCommerce <= 4.1.10 versions.CVE-2026-66611 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Paymob for WooCommerce <= 4.1.10 versions.
What to do
Update the plugin to the newest version.
NVD record patchstack.com
Aug 20, 2026Unauthenticated SQL Injection in TheGem (Elementor) <= 5.12.3 versions.CVE-2026-66609 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in TheGem (Elementor) <= 5.12.3 versions.
What to do
Update the plugin to the newest version.
NVD record patchstack.com
Aug 20, 2026Unauthenticated Cross Site Scripting (XSS) in Advance Product Search <= 1.4.8 versions.CVE-2026-66607 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Advance Product Search <= 1.4.8 versions.
What to do
Update the plugin to the newest version.
NVD record patchstack.com
Aug 20, 2026Unauthenticated Cross Site Scripting (XSS) in SmartSMTP <= 1.2.0 versions.CVE-2026-66606 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in SmartSMTP <= 1.2.0 versions.
What to do
Update the plugin to the newest version.
NVD record patchstack.com
Aug 20, 2026Unauthenticated Cross Site Scripting (XSS) in Swatchly – WooCommerce Variation Swatches for Products <= 1.4.13 versions.CVE-2026-66605 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Swatchly – WooCommerce Variation Swatches for Products <= 1.4.13 versions.
What to do
Update the plugin to the newest version.
NVD record patchstack.com
Aug 20, 2026Unauthenticated Cross Site Scripting (XSS) in GeoDirectory <= 2.8.173 versions.CVE-2026-66604 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in GeoDirectory <= 2.8.173 versions.
What to do
Update the plugin to the newest version.
NVD record patchstack.com
Aug 20, 2026Subscriber Cross Site Scripting (XSS) in Media LIbrary Assistant <= 3.39 versions.CVE-2026-66601 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Subscriber Cross Site Scripting (XSS) in Media LIbrary Assistant <= 3.39 versions.
What to do
Update the plugin to the newest version.
NVD record patchstack.com
Aug 20, 2026Author Arbitrary File Upload in Media LIbrary Assistant <= 3.39 versions.CVE-2026-66600 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Author Arbitrary File Upload in Media LIbrary Assistant <= 3.39 versions.
What to do
Update the plugin to the newest version.
NVD record patchstack.com
Aug 20, 2026Unauthenticated Cross Site Scripting (XSS) in B2BKing Premium <= 5.6.07 versions.CVE-2026-66598 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in B2BKing Premium <= 5.6.07 versions.
What to do
Update the plugin to the newest version.
NVD record patchstack.com
Aug 20, 2026Unauthenticated Cross Site Scripting (XSS) in wpDataTables <= 6.5.1.4 versions.CVE-2026-66597 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in wpDataTables <= 6.5.1.4 versions.
What to do
Update the plugin to the newest version.
NVD record patchstack.com
Aug 20, 2026Unauthenticated Broken Access Control in WP Data Access <= 5.5.80 versions.CVE-2026-66595 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Unauthenticated Broken Access Control in WP Data Access <= 5.5.80 versions.
What to do
Update the plugin to the newest version.
NVD record patchstack.com
Aug 20, 2026Subscriber SQL Injection in WordPress Persistent Login <= 3.1.0 versions.CVE-2026-66594 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Subscriber SQL Injection in WordPress Persistent Login <= 3.1.0 versions.
What to do
Update the plugin to the newest version.
NVD record patchstack.com
Aug 20, 2026Unauthenticated SQL Injection in Security & Malware scan by CleanTalk <= 2.184 versions.CVE-2026-66593 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in Security & Malware scan by CleanTalk <= 2.184 versions.
What to do
Update the plugin to the newest version.
NVD record patchstack.com
Aug 20, 2026Unauthenticated SQL Injection in rtMedia for WordPress, BuddyPress and bbPress <= 4.7.11 versions.CVE-2026-66592 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in rtMedia for WordPress, BuddyPress and bbPress <= 4.7.11 versions.
What to do
Update the plugin to the newest version.
NVD record patchstack.com
Aug 20, 2026Unauthenticated Cross Site Scripting (XSS) in Tagembed <= 7.4 versions.CVE-2026-66590 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Tagembed <= 7.4 versions.
What to do
Update the plugin to the newest version.
NVD record patchstack.com
Aug 20, 2026Author Local File Inclusion in WP Cafe Pro < 3.0.15 versions.CVE-2026-66586 · WordPress plugins & themes · reported by PatchstackMedium 6.6
Author Local File Inclusion in WP Cafe Pro < 3.0.15 versions.
What to do
Update the plugin to the newest version.
NVD record patchstack.com
Aug 20, 2026Unauthenticated PHP Object Injection in Forminator <= 1.57.0 versions.CVE-2026-66583 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in Forminator <= 1.57.0 versions.
What to do
Update the plugin to the newest version.
NVD record patchstack.com
Aug 20, 2026Unauthenticated Cross Site Scripting (XSS) in TranslatePress <= 3.3.2 versions.CVE-2026-66582 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in TranslatePress <= 3.3.2 versions.
What to do
Update the plugin to the newest version.
NVD record patchstack.com
Aug 20, 2026Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.14.1 versions.CVE-2026-66581 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.14.1 versions.
What to do
Update the plugin to the newest version.
NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. The WordPress, CMS and hosting-panel entries come from the National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan and others); we show who. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Start a project

Tell us what you're building.

A website, a booking system, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.

01The person who'll build it writes back

02A planning call, then a written plan with the price and the date

03A preview on your phone while it's being built

04Launch night handled: redirects, email, Google

843-331-6339

Not ready to talk yet? Run the free website check and see what Google sees.