Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
14,013 results · page 75 of 281
Aug 22, 2026Joomla Extension - fabrikar.com - Unauthenticated modification of any comment in Fabrik < 4.7.2 - The onUpdateComment endpoint did not perform any access checksCVE-2026-76609 · Websites & servers · reported by security@joomla.orgMedium 6.9
Joomla Extension - fabrikar.com - Unauthenticated modification of any comment in Fabrik < 4.7.2 - The onUpdateComment endpoint did not perform any access checks.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 22, 2026Joomla Extension - fabrikar.com - Unauthenticated disclosure of any commenter's email address in Fabrik < 4.7.2 - The onGetEmail endpoint did not perform any acCVE-2026-76608 · Websites & servers · reported by security@joomla.orgMedium 6.9
Joomla Extension - fabrikar.com - Unauthenticated disclosure of any commenter's email address in Fabrik < 4.7.2 - The onGetEmail endpoint did not perform any access checks.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 22, 2026Joomla Extension - fabrikar.com - Missing ACL check in download element in Fabrik < 4.7.2.CVE-2026-76607 · Websites & servers · reported by security@joomla.orgCritical 10
Joomla Extension - fabrikar.com - Missing ACL check in download element in Fabrik < 4.7.2.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 22, 2026Joomla Extension - fabrikar.com - Path Traversal via image element in Fabrik < 4.7.2.CVE-2026-76606 · Websites & servers · reported by security@joomla.orgCritical 10
Joomla Extension - fabrikar.com - Path Traversal via image element in Fabrik < 4.7.2.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 22, 2026Joomla Extension - fabrikar.com - Remote code execution via image element in Fabrik < 4.7.2.CVE-2026-76605 · Websites & servers · reported by security@joomla.orgCritical 10
Joomla Extension - fabrikar.com - Remote code execution via image element in Fabrik < 4.7.2.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 22, 2026Joomla Extension - fabrikar.com - Unauthenticated remote code execution via PHP form element in Fabrik < 4.7.2 - The PHP form element is vulnerable to the execuCVE-2026-76604 · Websites & servers · reported by security@joomla.orgCritical 10
Joomla Extension - fabrikar.com - Unauthenticated remote code execution via PHP form element in Fabrik < 4.7.2 - The PHP form element is vulnerable to the execution of user provided codes.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 22, 2026Joomla Extension - fabrikar.com - Unauthenticated row disclosure via form.inlineedit in Fabrik < 4.7.2 - The inineedit form controller does not perform any acceCVE-2026-76603 · Websites & servers · reported by security@joomla.orgMedium 6.9
Joomla Extension - fabrikar.com - Unauthenticated row disclosure via form.inlineedit in Fabrik < 4.7.2 - The inineedit form controller does not perform any access checks, disclosing items to unauthorized users.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 22, 2026Joomla Extension - fabrikar.com - Unauthenticated SQL injection in ORDER BY in Fabrik < 4.7.2 - The order parameter in list models is used in queries without vaCVE-2026-76602 · Websites & servers · reported by security@joomla.orgCritical 9.3
Joomla Extension - fabrikar.com - Unauthenticated SQL injection in ORDER BY in Fabrik < 4.7.2 - The order parameter in list models is used in queries without validation, allowing read SQLi vectors.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 22, 2026Joomla Extension - fabrikar.com - Unauthenticated row reordering in Fabrik < 4.7.2 - The order plugin did not perform any access checks.CVE-2026-76601 · Websites & servers · reported by security@joomla.orgMedium 6.9
Joomla Extension - fabrikar.com - Unauthenticated row reordering in Fabrik < 4.7.2 - The order plugin did not perform any access checks.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 22, 2026Joomla Extension - fabrikar.com - Unauthenticated deletion of any comment in Fabrik < 4.7.2 - The DeleteComment endpoint did not perform any access checks.CVE-2026-76600 · Websites & servers · reported by security@joomla.orgMedium 6.9
Joomla Extension - fabrikar.com - Unauthenticated deletion of any comment in Fabrik < 4.7.2 - The DeleteComment endpoint did not perform any access checks.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 22, 2026Joomla Extension - fabrikar.com - Unauthenticated database table list and table-prefix disclosure in Fabrik < 4.7.2 - The ajax_tables method of the elements modCVE-2026-76599 · Websites & servers · reported by security@joomla.orgHigh 8.7
Joomla Extension - fabrikar.com - Unauthenticated database table list and table-prefix disclosure in Fabrik < 4.7.2 - The ajax_tables method of the elements model allows listings of arbitrary database tables including columns.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 22, 2026Joomla Extension - fabrikar.com - Unauthenticated arbitrary directory listing via onAjax_getFolders in Fabrik < 4.7.2 - The onAjax_getFolders method of the elemCVE-2026-76598 · Websites & servers · reported by security@joomla.orgHigh 8.7
Joomla Extension - fabrikar.com - Unauthenticated arbitrary directory listing via onAjax_getFolders in Fabrik < 4.7.2 - The onAjax_getFolders method of the elements model allows arbitrary directory listings.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 22, 2026Joomla Extension - fabrikar.com - Unauthenticated arbitrary file upload to web root via list email plugin in Fabrik < 4.7.2 - The list email plugin controller aCVE-2026-76597 · Websites & servers · reported by security@joomla.orgHigh 8.7
Joomla Extension - fabrikar.com - Unauthenticated arbitrary file upload to web root via list email plugin in Fabrik < 4.7.2 - The list email plugin controller allows to upload non-executable files to the webroot.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 22, 2026Joomla Extension - fabrikar.com - Unauthenticated table truncation via list.doempty in Fabrik < 4.7.2- The list controllers doemtpy endpoints lacks ACL gates, aCVE-2026-76596 · Websites & servers · reported by security@joomla.orgHigh 8.7
Joomla Extension - fabrikar.com - Unauthenticated table truncation via list.doempty in Fabrik < 4.7.2- The list controllers doemtpy endpoints lacks ACL gates, a plain GET empties the target list's table
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 22, 2026Joomla Extension - fabrikar.com - Unauthenticated SQL injection in list filter condition parameter in Fabrik < 4.7.2 - The condition parameter passed to a list CVE-2026-76571 · Websites & servers · reported by security@joomla.orgCritical 9.3
Joomla Extension - fabrikar.com - Unauthenticated SQL injection in list filter condition parameter in Fabrik < 4.7.2 - The condition parameter passed to a list filter is concatenated verbatim into the WHERE clause built by getFilterQuery(). An unauthenticated attacker can supply arbitrary SQL through the filter condition, giving full read of the database.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 22, 2026GreenShift – Animation and Page Builder Blocks: Unauthorized modification of dataCVE-2026-5093 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The GreenShift – Animation and Page Builder Blocks plugin for WordPress is vulnerable to unauthorized modification of data in versions up to, and including, 12.8.9. This is due to a missing capability check on the 'gspb_update_global_wp_settings' function that only verifies the 'edit_posts' capability instead of requiring administrative privileges. This makes it possible for authenticated attackers, with contributor-level access and above, to modify global WordPress theme color settings site-wide, leading to site defacement.
- Product
- GreenShift – Animation and Page Builder Blocks
- Affected
- up to 12.8.9
- What to do
- Affects up to 12.8.9. Update GreenShift – Animation and Page Builder Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 22, 2026MC4WP: Mailchimp for WordPress: Stored Cross-Site ScriptingCVE-2026-4561 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The MC4WP: Mailchimp for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the form response message post meta fields (e.g., 'text_subscribed', 'text_error') in all versions up to, and including, 4.12.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- MC4WP: Mailchimp for WordPress
- Affected
- up to 4.12.0
- What to do
- Affects up to 4.12.0. Update MC4WP: Mailchimp for WordPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 22, 2026Image Photo Gallery Final Tiles Grid: Stored Cross-Site ScriptingCVE-2026-4559 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Image Photo Gallery Final Tiles Grid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'delay' shortcode attribute in all versions up to, and including, 3.6.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Image Photo Gallery Final Tiles Grid
- Affected
- up to 3.6.12
- What to do
- Affects up to 3.6.12. Update Image Photo Gallery Final Tiles Grid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 22, 2026Advanced Product Fields (Product Addons) for WooCommerce: Improper Input ValidationCVE-2026-2996 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Advanced Product Fields (Product Addons) for WooCommerce plugin for WordPress is vulnerable to Improper Input Validation in all versions up to, and including, 1.6.21. This is due to a logic flaw in the 'validate_cart_data' function. This makes it possible for unauthenticated attackers to bypass required paid addons and complete purchases at the base product price only, effectively stealing products by paying a fraction of the intended total. The vulnerability was partially patched in version 1.6.19.
- Product
- Advanced Product Fields (Product Addons) for WooCommerce
- Affected
- up to 1.6.21
- What to do
- Affects up to 1.6.21. Update Advanced Product Fields (Product Addons) for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 22, 2026Post Duplicator: Unauthorized modification of dataCVE-2026-4244 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Post Duplicator plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `duplicate_post()` function in all versions up to, and including, 3.0.11. This is due to the function not verifying that the user has `edit_others_posts` capability before accepting a `selectedAuthorId` parameter via the `duplicate-post` REST endpoint. This makes it possible for authenticated attackers, with Contributor-level access and above, to create duplicated posts attributed to any user, including administrators.
- Product
- Post Duplicator
- Affected
- up to 3.0.11
- What to do
- Affects up to 3.0.11. Update Post Duplicator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 22, 2026Joomla Extension - joomgalleryfriends.net - Stored XSS in JoomGallery < 4.4.0 - An authenticated, privileged can store an XSS payload in any image causing JS exCVE-2026-66917 · Websites & servers · reported by security@joomla.orgHigh 8.6
Joomla Extension - joomgalleryfriends.net - Stored XSS in JoomGallery < 4.4.0 - An authenticated, privileged can store an XSS payload in any image causing JS execution in every visitor's browser.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 22, 2026Joomla Extension - joomgalleryfriends.net - Password-Protected Category Bypass via JSON Format in JoomGallery < 4.4.0- An unauthenticated access control bypass CVE-2026-66916 · Websites & servers · reported by security@joomla.orgMedium 6.9
Joomla Extension - joomgalleryfriends.net - Password-Protected Category Bypass via JSON Format in JoomGallery < 4.4.0- An unauthenticated access control bypass exists in JoomGallery's category JSON view. When a gallery category is protected with a password, the HTML view correctly enforces the password gate - but the JSON view ( format=json ) skips this check entirely.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 22, 2026Post Duplicator: Authorization bypassCVE-2026-4245 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Post Duplicator plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.0.11. This is due to the `duplicate_post_permissions()` permission callback only verifying the `duplicate_posts` capability without checking whether the requesting user holds `publish_posts` or other status-gated capabilities. This makes it possible for authenticated attackers, with Contributor-level access and above, to create duplicate posts with `future` (scheduled, auto-publishes) or `private` status, bypassing editorial review. Additionally, the REST endpoint does not enforce administrator-configured post-type duplication restrictions, allowing duplication of post types that have been explicitly disabled.
- Product
- Post Duplicator
- Affected
- up to 3.0.11
- What to do
- Affects up to 3.0.11. Update Post Duplicator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 22, 2026The kk Star Ratings – Rate Post & Collect User Feedbacks: Arbitrary shortcode executionCVE-2026-3424 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The The kk Star Ratings – Rate Post & Collect User Feedbacks plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.4.10.3. This is due to the software allowing users to execute an action that does not properly validate the 'payload' value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
- Product
- The kk Star Ratings – Rate Post & Collect User Feedbacks
- Affected
- up to 5.4.10.3
- What to do
- Affects up to 5.4.10.3. Update The kk Star Ratings – Rate Post & Collect User Feedbacks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 22, 2026Mailgun for WordPress: Server-Side Request Forgery (SSRF)CVE-2026-78003 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Mailgun for WordPress plugin for WordPress is vulnerable to Server-Side Request Forgery (SSRF) via path traversal in versions up to and including 2.2.0. This is due to insufficient input validation in the add_list() function, which accepts user-controlled array keys from $_POST['addresses'], passes them through sanitize_text_field(). This makes it possible for unauthenticated attackers to make authenticated POST requests to any Mailgun API endpoint using the WordPress site's API key, including creating inbound email-forwarding routes that can intercept password reset emails, leading to administrator account takeover.
- Product
- Mailgun for WordPress
- Affected
- up to 2.2.0
- What to do
- Affects up to 2.2.0. Update Mailgun for WordPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 22, 2026SmilePass Selfie Login: Does not perform any server-side verification of the identity it is asked to authenticateCVE-2026-77002 · WordPress plugins & themes · reported by WPScanCritical 9.8
The SmilePass Selfie Login WordPress plugin through 1.0.2 does not perform any server-side verification of the identity it is asked to authenticate, allowing unauthenticated users to log in as any registered account, including administrators.
- Product
- SmilePass Selfie Login
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update SmilePass Selfie Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 22, 2026Social Login & Sharing buttons with Analytics By SoClever: Does not perform any authenticationCVE-2026-77001 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Social Login & Sharing buttons with Analytics By SoClever WordPress plugin through 1.2.0 does not perform any authentication, authorisation or nonce checks in one of its publicly accessible login handlers, allowing unauthenticated attackers to obtain a valid session as any existing user, including administrators. In the default case a session as the site's original administrator account is obtained without needing to know any account details at all.
- Product
- Social Login & Sharing buttons with Analytics By SoClever
- Affected
- up to 1.2.0
- What to do
- Affects up to 1.2.0. Update Social Login & Sharing buttons with Analytics By SoClever to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 22, 2026WP Social Media Login: Does not verify that a social login was actually completed with the identity provider before authenticating a visitorCVE-2026-77000 · WordPress plugins & themes · reported by WPScanCritical 9.8
The WP Social Media Login WordPress plugin through 1.0.6 does not verify that a social login was actually completed with the identity provider before authenticating a visitor, allowing unauthenticated attackers to log in as any existing user, including administrators, by supplying that user's email address.
- Product
- WP Social Media Login
- Affected
- up to 1.0.6
- What to do
- Affects up to 1.0.6. Update WP Social Media Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 22, 2026Firebase Authentication: Does not require the email address in an authentication token to be verified before matching it to a WordPress account and issuing a sessionCVE-2026-76793 · WordPress plugins & themes · reported by WPScanHigh 8.1
The Firebase Authentication WordPress plugin before 1.7.1 does not require the email address in an authentication token to be verified before matching it to a WordPress account and issuing a session, allowing unauthenticated attackers to log in as any user, including administrators.
- Product
- Firebase Authentication
- Fixed in
- 1.7.1
- What to do
- Update Firebase Authentication to 1.7.1 or newer.
Aug 22, 2026Slider Hero with Video Background, Animation: Does not have authorisation and nonce checks on two of its request handlersCVE-2026-76789 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Slider Hero with Video Background, Animation WordPress plugin before 9.1.3 does not have authorisation and nonce checks on two of its request handlers, and does not escape a stored setting before outputting it, allowing unauthenticated users to store malicious JavaScript which will be executed in the context of an administrator viewing the Slider Hero with Video Background, Animation WordPress plugin before 9.1.3's admin area, as well as any visitor of a page embedding a slider.
- Product
- Slider Hero with Video Background, Animation
- Fixed in
- 9.1.3
- What to do
- Update Slider Hero with Video Background, Animation to 9.1.3 or newer.
Aug 22, 2026Forminator Forms: Does not consistently enforce the role restriction it applies to registration formsCVE-2026-19222 · WordPress plugins & themes · reported by WPScanMedium 6.6
The Forminator Forms WordPress plugin before 1.57.0.7 does not consistently enforce the role restriction it applies to registration forms, allowing users who are permitted to build forms to configure one that assigns the administrator role to any visitor who registers through it.
- Product
- Forminator Forms
- Fixed in
- 1.57.0.7
- What to do
- Update Forminator Forms to 1.57.0.7 or newer.
Aug 22, 2026Forminator Forms: Does not restrict a network-wide setting to network administratorsCVE-2026-19221 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Forminator Forms WordPress plugin before 1.57.0.5 does not restrict a network-wide setting to network administrators, allowing an administrator of any single site on a multisite network to execute arbitrary code across the entire network.
- Product
- Forminator Forms
- Fixed in
- 1.57.0.5
- What to do
- Update Forminator Forms to 1.57.0.5 or newer.
Aug 22, 2026Tutor LMS: Does not validate a stored file path before using it to stream mediaCVE-2026-19093 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Tutor LMS WordPress plugin before 4.0.6 does not validate a stored file path before using it to stream media, allowing users with the instructor role to read arbitrary files on the server, including files outside the web root. The readable files include the WordPress configuration file, which exposes the database credentials and the authentication keys and salts, so authentication cookies can be forged.
- Product
- Tutor LMS
- Fixed in
- 4.0.6
- What to do
- Update Tutor LMS to 4.0.6 or newer.
Aug 22, 2026ManageWP Worker: Does not bind the account being logged in to the signatureCVE-2026-18052 · WordPress plugins & themes · reported by WPScanHigh 8.1
The ManageWP Worker WordPress plugin before 4.9.37 does not bind the account being logged in to the signature which authorises the login, nor prevent an already used login link from being replayed, allowing attackers who obtain such a link to gain a session as any user on the site, including an administrator.
- Product
- ManageWP Worker
- Fixed in
- 4.9.37
- What to do
- Update ManageWP Worker to 4.9.37 or newer.
Aug 22, 2026Conekta Payment Gateway: Does not verify the authenticity of incoming payment gateway webhook notificationsCVE-2026-16738 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Conekta Payment Gateway WordPress plugin before 6.2.2 does not verify the authenticity of incoming payment gateway webhook notifications, nor bind the confirmed payment to the targeted order or verify its amount, allowing unauthenticated attackers to mark arbitrary orders as paid without payment.
- Product
- Conekta Payment Gateway
- Fixed in
- 6.2.2
- What to do
- Update Conekta Payment Gateway to 6.2.2 or newer.
Aug 22, 2026FiboSearch: Does not consistently exclude password-protected products from its unauthenticated AJAX endpointsCVE-2026-16612 · WordPress plugins & themes · reported by WPScanMedium 5.3
The FiboSearch WordPress plugin before 1.34.1 does not consistently exclude password-protected products from its unauthenticated AJAX endpoints, allowing unauthenticated users to disclose and enumerate password-protected products and their metadata without entering the product password. Two endpoints are affected: the autocomplete search endpoint (dgwt_wcas_ajax_search) and the Details Panel endpoint (dgwt_wcas_result_details) when queried for taxonomy details.
- Product
- FiboSearch
- Fixed in
- 1.34.1
- What to do
- Update FiboSearch to 1.34.1 or newer.
Aug 22, 2026Post Grid, Slider & Carousel Ultimate: Does not sanitise and escape one of its custom post type settings before outputting it in an HTML attribute on the admin edit screenCVE-2026-16260 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Post Grid, Slider & Carousel Ultimate WordPress plugin before 1.8.1 does not sanitise and escape one of its custom post type settings before outputting it in an HTML attribute on the admin edit screen, allowing users with the Contributor role and above to inject JavaScript that executes in the session of any administrator who opens the affected item.
- Product
- Post Grid, Slider & Carousel Ultimate
- Fixed in
- 1.8.1
- What to do
- Update Post Grid, Slider & Carousel Ultimate to 1.8.1 or newer.
Aug 22, 2026Tutor LMS: Does not enforce per-object ownership checks on its course content typeCVE-2026-14187 · WordPress plugins & themes · reported by WPScanLow 2.7
The Tutor LMS WordPress plugin before 4.0.6 does not enforce per-object ownership checks on its course content type, allowing any user with the instructor role to read the content of private courses belonging to other instructors.
- Product
- Tutor LMS
- Fixed in
- 4.0.6
- What to do
- Update Tutor LMS to 4.0.6 or newer.
Aug 22, 2026AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress: Authorization bypassCVE-2026-76074 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.8.4. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to retrieve the site's configured Campaign Monitor mailing list catalog, including all list IDs and names, that should be restricted to users with the plugin's manager capability. The required nonce is emitted unconditionally on every WordPress admin page via wp_localize_script, meaning any subscriber visiting /wp-admin/profile.php can obtain it without any elevated access.
- Product
- AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress
- Affected
- up to 5.8.4
- What to do
- Affects up to 5.8.4. Update AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 22, 2026AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress: Authorization bypassCVE-2026-76057 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.8.4. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to retrieve all ConvertKit form data configured by the site's manager account, exposing integration details intended to be restricted to plugin managers. The required nonce is localized on every admin page load, making it accessible to any authenticated user who can reach /wp-admin.
- Product
- AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress
- Affected
- up to 5.8.4
- What to do
- Affects up to 5.8.4. Update AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 22, 2026Themify Builder: Authorization bypassCVE-2026-75027 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Themify Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.8.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to modify the stored Themify Builder styling data (padding and margin properties) of arbitrary posts, including private and draft posts, by supplying an attacker-controlled post ID and JSON styling payload. The nonce required by the handler is automatically emitted to all frontend pages rendered by the builder via wp_localize_script, meaning any unauthenticated visitor can trivially retrieve a valid nonce from page source and satisfy the only access control in place.
- Product
- Themify Builder
- Affected
- up to 7.8.0
- What to do
- Affects up to 7.8.0. Update Themify Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 21, 2026WPeMatico RSS Feed Fetcher: Unauthorized modification of data that can lead to privilege escalationCVE-2026-19883 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The WPeMatico RSS Feed Fetcher plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the wpematico_import_settings function in all versions up to, and including, 2.8.24. This makes it possible for authenticated attackers, with subscriber-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access.
- Product
- WPeMatico RSS Feed Fetcher
- Affected
- up to 2.8.24
- What to do
- Affects up to 2.8.24. Update WPeMatico RSS Feed Fetcher to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 21, 2026Joomla Extension - j2commerce.com - Stored XSS in Guest checkout in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - J2Commerce 4.1.5 is vulnerable to Stored CCVE-2026-74252 · Websites & servers · reported by security@joomla.orgHigh 8.6
Joomla Extension - j2commerce.com - Stored XSS in Guest checkout in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - J2Commerce 4.1.5 is vulnerable to Stored Cross-Site Scripting (XSS) through the guest checkout billing address fields. An unauthenticated attacker exploits a filter bypass in Joomla's Input::getArray() combined with PHP's variables_order=EGPCS (Cookie overrides POST in $_REQUEST ) to store unsanitized HTML in fields such as billing_first_name.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 21, 2026Joomla Extension - j2commerce.com - Open redirect in cart controller in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - Four task handlers accepted a base64-eCVE-2026-67362 · Websites & servers · reported by security@joomla.orgMedium 5.1
Joomla Extension - j2commerce.com - Open redirect in cart controller in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - Four task handlers accepted a base64-encoded URL from user input and redirected to it without validating the destination host, enabling phishing using the shop's trusted domain. No authentication required.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 21, 2026Joomla Extension - j2commerce.com - Unauthenticated file upload with missing directory protection in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - The file CVE-2026-67361 · Websites & servers · reported by security@joomla.orgMedium 6.9
Joomla Extension - j2commerce.com - Unauthenticated file upload with missing directory protection in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - The file upload endpoint accepted POST requests from unauthenticated visitors with no CSRF token. Compounding this, the installer manifest omitted the upload and invoices directories, causing fresh installs to deploy those directories without .htaccess/web.config protection, making uploaded files directly web-accessible.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 21, 2026Joomla Extension - j2commerce.com - Cross-customer order replication in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - An authenticated user could supply anoCVE-2026-67360 · Websites & servers · reported by security@joomla.orgMedium 6.3
Joomla Extension - j2commerce.com - Cross-customer order replication in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - An authenticated user could supply another customer's order_id to copy their cart contents and address data into the attacker's session. The CSRF token was validated but ownership was not checked.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 21, 2026Joomla Extension - j2commerce.com - Order content disclosure J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - An unauthenticated visitor could supply any orderCVE-2026-67359 · Websites & servers · reported by security@joomla.orgHigh 8.7
Joomla Extension - j2commerce.com - Order content disclosure J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - An unauthenticated visitor could supply any order_id as a query parameter to render the full checkout confirmation page for that order, including line items, prices, and totals.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 21, 2026Joomla Extension - j2commerce.com - Download quota manipulation in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - An authenticated user with a valid order toCVE-2026-67358 · Websites & servers · reported by security@joomla.orgMedium 5.3
Joomla Extension - j2commerce.com - Download quota manipulation in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - An authenticated user with a valid order token could increment the download limit counter on a download record belonging to a different order. The endpoint also lacked a CSRF token.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 21, 2026Joomla Extension - yootheme.com - Reflected XSS and open redirect via the submission redirect parameter in Zoo < 4.1.66CVE-2026-77028 · Websites & servers · reported by security@joomla.orgMedium 5.3
Joomla Extension - yootheme.com - Reflected XSS and open redirect via the submission redirect parameter in Zoo < 4.1.66
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 21, 2026Joomla Extension - yootheme.com - Authenticated, privileged SQL injection in YOOtheme Pro 1.0.0-5.0.40 - An SQL injection allowed any contributor-level user to CVE-2026-76613 · Websites & servers · reported by security@joomla.orgHigh 8.6
Joomla Extension - yootheme.com - Authenticated, privileged SQL injection in YOOtheme Pro 1.0.0-5.0.40 - An SQL injection allowed any contributor-level user to inject own content into SQL queries.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. The WordPress, CMS and hosting-panel entries come from the National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan and others); we show who. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, a booking system, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.