Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
14,013 results · page 76 of 281
Aug 21, 2026Joomla Extension - yootheme.com - Unauthenticated stored XSS via user-controlled fields in Zoo < 4.1.66 - User supplied input in comments and user supplied fielCVE-2026-76612 · Websites & servers · reported by security@joomla.orgHigh 8.6
Joomla Extension - yootheme.com - Unauthenticated stored XSS via user-controlled fields in Zoo < 4.1.66 - User supplied input in comments and user supplied field elements weren't escaped, leading to a stored XSS vector.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 21, 2026Joomla Extension - yootheme.com - Unauthenticated arbitrary directory listing via the Gallery element in Zoo < 4.1.66.CVE-2026-76611 · Websites & servers · reported by security@joomla.orgMedium 6.9
Joomla Extension - yootheme.com - Unauthenticated arbitrary directory listing via the Gallery element in Zoo < 4.1.66.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 21, 2026Joomla Extension - yootheme.com - Authenticated, privileged arbitrary file read in YOOtheme Pro 2.3.0-5.0.40 - The Filesystem source's path filter is vulnerableCVE-2026-75115 · Websites & servers · reported by security@joomla.orgHigh 7
Joomla Extension - yootheme.com - Authenticated, privileged arbitrary file read in YOOtheme Pro 2.3.0-5.0.40 - The Filesystem source's path filter is vulnerable to glob-based pattern attacks, allowing authorized users to read arbitrary files.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 21, 2026Joomla Extension - yootheme.com - Missing CSRF tokens on front-end state changes in Zoo < 4.1.66CVE-2026-77029 · Websites & servers · reported by security@joomla.orgMedium 4.6
Joomla Extension - yootheme.com - Missing CSRF tokens on front-end state changes in Zoo < 4.1.66
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 21, 2026ProfilePress: Does not strip shortcodes from two of its profile fields before rendering them on public pagesCVE-2026-19848 · WordPress plugins & themes · reported by WPScanMedium 6.5
The ProfilePress WordPress plugin before 4.17.1 does not strip shortcodes from two of its profile fields before rendering them on public pages, allowing unauthenticated attackers to store shortcodes that are then executed when the page is viewed, disclosing a chosen user's email address, login and registration date.
- Product
- ProfilePress
- Fixed in
- 4.17.1
- What to do
- Update ProfilePress to 4.17.1 or newer.
Aug 21, 2026Limit Login Attempts Reloaded: Does not compare logins against its username denylist case-insensitively and does not account for the account's email addressCVE-2026-18356 · WordPress plugins & themes · reported by WPScanLow 3.7
The Limit Login Attempts Reloaded WordPress plugin before 3.3.5 does not compare logins against its username denylist case-insensitively and does not account for the account's email address, allowing an account an administrator intended to block from logging in to authenticate anyway.
- Product
- Limit Login Attempts Reloaded
- Fixed in
- 3.3.5
- What to do
- Update Limit Login Attempts Reloaded to 3.3.5 or newer.
Aug 21, 2026Passster: Does not correctly match its own public endpoint pathsCVE-2026-17559 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Passster WordPress plugin before 4.3.9 does not correctly match its own public endpoint paths when deciding which REST API requests may bypass global password protection, comparing them as an unanchored substring of the request URI rather than against the resolved route, allowing an unauthenticated attacker to read the content of globally password-protected posts and pages.
- Product
- Passster
- Fixed in
- 4.3.9
- What to do
- Update Passster to 4.3.9 or newer.
Aug 21, 2026Charitable: Does not verify the authenticity of incoming Square payment webhook events in a default configurationCVE-2026-16650 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Charitable WordPress plugin before 1.8.12 does not verify the authenticity of incoming Square payment webhook events in a default configuration, allowing unauthenticated attackers to forge webhook notifications that mark donations as paid without any real payment.
- Product
- Charitable
- Fixed in
- 1.8.12
- What to do
- Update Charitable to 1.8.12 or newer.
Aug 21, 2026myCred: Does not verify that the receiver of an incoming payment gateway notification matches the site's configured merchant accountCVE-2026-15150 · WordPress plugins & themes · reported by WPScanMedium 5.3
The myCred WordPress plugin before 3.2.5 does not verify that the receiver of an incoming payment gateway notification matches the site's configured merchant account, allowing unauthenticated attackers to have arbitrary amounts of the site's in-site currency credited to an account by completing a payment for the expected amount to a gateway account they control rather than the site's.
- Product
- myCred
- Fixed in
- 3.2.5
- What to do
- Update myCred to 3.2.5 or newer.
Aug 21, 2026LitExtension: Does not verify a nonce before an administrative action that overwrites the store-migration connector's authentication tokenCVE-2026-15046 · WordPress plugins & themes · reported by WPScanMedium 4.2
The LitExtension WordPress plugin through 1.2.5 does not verify a nonce before an administrative action that overwrites the store-migration connector's authentication token, allowing attackers to take over the connector token by tricking a logged-in administrator into clicking a crafted link (CSRF).
- Product
- LitExtension
- Affected
- up to 1.2.5
- What to do
- Affects up to 1.2.5. Update LitExtension to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 21, 2026Eventin: Does not validate a user-supplied webhook URL stored on events nor verify event ownershipCVE-2026-13176 · WordPress plugins & themes · reported by WPScanLow 2.7
The Eventin WordPress plugin before 4.1.21 does not validate a user-supplied webhook URL stored on events nor verify event ownership, allowing users with contributor-level access and above to trigger blind server-side requests to arbitrary hosts.
- Product
- Eventin
- Fixed in
- 4.1.21
- What to do
- Update Eventin to 4.1.21 or newer.
Aug 21, 2026Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code: Authentication BypassCVE-2026-77264 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 4.8.6. This is due to the handle_email_otp_return() function returning the secret magic login token in the response to a publicly accessible OTP request, rather than only delivering it to the user's email address. This makes it possible for unauthenticated attackers to log in as any user on the site, including administrators, if they know that user's email address.
- Product
- Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code
- Affected
- up to 4.8.6
- What to do
- Affects up to 4.8.6. Update Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 21, 2026AI Engine: Does not verify that the requesting user is authorized to act on the targeted account before performing privileged user management operationsCVE-2026-75796 · WordPress plugins & themes · reported by WPScanHigh 7.2
The AI Engine WordPress plugin before 3.6.1 does not verify that the requesting user is authorized to act on the targeted account before performing privileged user management operations, allowing users with the Administrator role on a Multisite sub-site to take over any account on the network, including the Network Administrator's.
- Product
- AI Engine
- Fixed in
- 3.6.1
- What to do
- Update AI Engine to 3.6.1 or newer.
Aug 21, 2026Duplicate Post: Does not check the user's capabilities before returning post dataCVE-2026-19435 · WordPress plugins & themes · reported by WPScanLow 2.7
The Duplicate Post WordPress plugin before 1.5.6 does not check the user's capabilities before returning post data, allowing users with a delegated role to read the content, metadata and passwords of posts they are not allowed to access, including other users' private and draft content.
- Product
- Duplicate Post
- Fixed in
- 1.5.6
- What to do
- Update Duplicate Post to 1.5.6 or newer.
Aug 21, 2026Duplicate Post: Does not check that a user may read the content of a post before duplicating itCVE-2026-19085 · WordPress plugins & themes · reported by WPScanLow 2.7
The Duplicate Post WordPress plugin before 1.5.6 does not check that a user may read the content of a post before duplicating it, allowing users with a delegated role to republish another user's password-protected post as publicly readable.
- Product
- Duplicate Post
- Fixed in
- 1.5.6
- What to do
- Update Duplicate Post to 1.5.6 or newer.
Aug 21, 2026Drag and Drop Multiple File Upload for Contact Form 7: Does not validate the final name of an uploaded file after stripping characters from itCVE-2026-18781 · WordPress plugins & themes · reported by WPScanHigh 8.1
The Drag and Drop Multiple File Upload for Contact Form 7 WordPress plugin before 1.3.9.9 does not validate the final name of an uploaded file after stripping characters from it, allowing unauthenticated users to defeat its file type restrictions and execute arbitrary code on the server.
- Product
- Drag and Drop Multiple File Upload for Contact Form 7
- Fixed in
- 1.3.9.9
- What to do
- Update Drag and Drop Multiple File Upload for Contact Form 7 to 1.3.9.9 or newer.
Aug 21, 2026Tamara Checkout: Does not verify the order keyCVE-2026-16962 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Tamara Checkout WordPress plugin through 1.9.9.20 does not verify the order key, a nonce, or any capability on its public payment cancel/fail return URLs, changing a WooCommerce order's status based solely on an attacker-supplied numeric order id, so an unauthenticated attacker can cancel or fail arbitrary orders store-wide by enumerating ids (triggering downstream stock-release and notification side-effects).
- Product
- Tamara Checkout
- Affected
- up to 1.9.9.20
- What to do
- Affects up to 1.9.9.20. Update Tamara Checkout to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 21, 2026Media Library Assistant: Does not validate a search parameter before concatenating it into a SQL query in one of its media-library query handlersCVE-2026-16959 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Media Library Assistant WordPress plugin before 3.40 does not validate a search parameter before concatenating it into a SQL query in one of its media-library query handlers, allowing users with the Author role to perform SQL injection.
- Product
- Media Library Assistant
- Fixed in
- 3.40
- What to do
- Update Media Library Assistant to 3.40 or newer.
Aug 21, 2026Dokan: AI Powered WooCommerce Multivendor Marketplace Solution: Does not validate a client-supplied payment amount against the vendor's actual outstanding balanceCVE-2026-16577 · WordPress plugins & themes · reported by WPScanLow 2.7
The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14 does not validate a client-supplied payment amount against the vendor's actual outstanding balance when recording a reverse-withdrawal payment, allowing a vendor to credit their reverse-withdrawal ledger with an arbitrary amount and clear their real commission debt without paying.
- Product
- Dokan: AI Powered WooCommerce Multivendor Marketplace Solution
- Fixed in
- 5.0.14
- What to do
- Update Dokan: AI Powered WooCommerce Multivendor Marketplace Solution to 5.0.14 or newer.
Aug 21, 2026Dokan: AI Powered WooCommerce Multivendor Marketplace Solution: Does not correctly check user capabilities on some of its admin REST API routesCVE-2026-16576 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14 does not correctly check user capabilities on some of its admin REST API routes, checking only for a WooCommerce management capability instead of the Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14-installation capability, allowing users such as Shop Managers to install and activate arbitrary Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14 from WordPress.org.
- Product
- Dokan: AI Powered WooCommerce Multivendor Marketplace Solution
- Fixed in
- 5.0.14
- What to do
- Update Dokan: AI Powered WooCommerce Multivendor Marketplace Solution to 5.0.14 or newer.
Aug 21, 2026Dokan: AI Powered WooCommerce Multivendor Marketplace Solution: Does not restrict access to per-vendor commission configuration returned by one of its unauthenticated store REST endpointsCVE-2026-16575 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14 does not restrict access to per-vendor commission configuration returned by one of its unauthenticated store REST endpoints, allowing any unauthenticated user to disclose a vendor's commission type and, when category-based commission is configured, the per-category and default commission rates.
- Product
- Dokan: AI Powered WooCommerce Multivendor Marketplace Solution
- Fixed in
- 5.0.14
- What to do
- Update Dokan: AI Powered WooCommerce Multivendor Marketplace Solution to 5.0.14 or newer.
Aug 21, 2026Link Whisper Free: Does not properly sanitize and escape a parameter before using it in a SQL queryCVE-2026-14601 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Link Whisper Free WordPress plugin before 0.9.7 does not properly sanitize and escape a parameter before using it in a SQL query, allowing authenticated users with the Editor role or above to perform SQL injection attacks.
- Product
- Link Whisper Free
- Fixed in
- 0.9.7
- What to do
- Update Link Whisper Free to 0.9.7 or newer.
Aug 21, 2026Drag and Drop Multiple File Upload for Contact Form 7: Does not escape one of its settings before using itCVE-2026-14325 · WordPress plugins & themes · reported by WPScanLow 3.5
The Drag and Drop Multiple File Upload for Contact Form 7 WordPress plugin before 1.3.9.9 does not escape one of its settings before using it as an HTML tag name in front-end output, allowing users with administrator access to inject arbitrary web scripts that execute on any front-end page rendering its upload field.
- Product
- Drag and Drop Multiple File Upload for Contact Form 7
- Fixed in
- 1.3.9.9
- What to do
- Update Drag and Drop Multiple File Upload for Contact Form 7 to 1.3.9.9 or newer.
Aug 21, 2026NewPath WildApricotPress Add-on: Does not enforce its members-only field privacy on an unauthenticated REST routeCVE-2026-13736 · WordPress plugins & themes · reported by WPScanMedium 5.3
The NewPath WildApricotPress Add-on WordPress plugin through 1.0.0 does not enforce its members-only field privacy on an unauthenticated REST route, allowing anonymous visitors to read member email addresses and phone numbers that are configured to be visible to members only.
- Product
- NewPath WildApricotPress Add-on
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update NewPath WildApricotPress Add-on to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 21, 2026Welcart e-Commerce: Does not regenerate the session identifier on authentication and sets the session identifier from a user-supplied request parameterCVE-2025-15671 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Welcart e-Commerce WordPress plugin before 2.12.1 does not regenerate the session identifier on authentication and sets the session identifier from a user-supplied request parameter, allowing an unauthenticated attacker to fixate a shop member's session and take over their customer account after the victim logs in through an attacker-crafted request.
- Product
- Welcart e-Commerce
- Fixed in
- 2.12.1
- What to do
- Update Welcart e-Commerce to 2.12.1 or newer.
Aug 21, 2026WPForms Pro: Stored Cross-Site ScriptingCVE-2026-18409 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The WPForms Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Single Line Text and Paragraph Text Field Values in all versions up to, and including, 2.0.0.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit relies on the plugin's own wp_kses_allowed_html filter widening the 'post' allowlist to permit iframe elements with a data-src attribute, which is not on WordPress's URI-attribute sanitization list, allowing a javascript: URI stored in data-src to survive kses processing and subsequently be promoted to a live src attribute by the bundled admin script view-entry.min.js.
- Product
- WPForms Pro
- Affected
- up to 2.0.0.2
- What to do
- Affects up to 2.0.0.2. Update WPForms Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 20, 2026revmakx InfiniteWP Client: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-74011 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in revmakx InfiniteWP Client allows Blind SQL Injection. This issue affects InfiniteWP Client: from n/a through 1.13.9.
- Product
- revmakx InfiniteWP Client
- Affected
- up to 1.13.9
- What to do
- Affects up to 1.13.9. Update revmakx InfiniteWP Client to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 20, 2026HashThemes Easy Elementor Addons: Cross-Site Request Forgery (CSRF)CVE-2026-28164 · WordPress plugins & themes · reported by PatchstackCritical 9.6
Cross-Site Request Forgery (CSRF) vulnerability in HashThemes Easy Elementor Addons allows Cross Site Request Forgery. This issue affects Easy Elementor Addons: from n/a through 2.3.7.
- Product
- HashThemes Easy Elementor Addons
- Affected
- up to 2.3.7
- What to do
- Affects up to 2.3.7. Update HashThemes Easy Elementor Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 20, 2026myCred New User Approve: Missing AuthorizationCVE-2026-28163 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in myCred New User Approve allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects New User Approve: from n/a through 3.2.8.
- Product
- myCred New User Approve
- Affected
- up to 3.2.8
- What to do
- Affects up to 3.2.8. Update myCred New User Approve to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 20, 2026Unauthenticated Broken Access Control in Chaplin <= 2.6.8 versions.CVE-2026-74021 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in Chaplin <= 2.6.8 versions.
- What to do
- Update the plugin to the newest version.
Aug 20, 2026Unauthenticated Broken Access Control in Koji <= 2.2.1 versions.CVE-2026-74020 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in Koji <= 2.2.1 versions.
- What to do
- Update the plugin to the newest version.
Aug 20, 2026Unauthenticated Broken Access Control in EPROLO Dropshipping <= 2.4.2 versions.CVE-2026-74019 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Broken Access Control in EPROLO Dropshipping <= 2.4.2 versions.
- What to do
- Update the plugin to the newest version.
Aug 20, 2026Subscriber Arbitrary File Upload in Warehouse Cargo <= 2.6.9 versions.CVE-2026-74018 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Subscriber Arbitrary File Upload in Warehouse Cargo <= 2.6.9 versions.
- What to do
- Update the plugin to the newest version.
Aug 20, 2026Subscriber Arbitrary File Upload in Smart Cleaning <= 4.8.6 versions.CVE-2026-74016 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Subscriber Arbitrary File Upload in Smart Cleaning <= 4.8.6 versions.
- What to do
- Update the plugin to the newest version.
Aug 20, 2026Subscriber Arbitrary File Upload in IT Residence <= 3.2.1 versions.CVE-2026-74014 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Subscriber Arbitrary File Upload in IT Residence <= 3.2.1 versions.
- What to do
- Update the plugin to the newest version.
Aug 20, 2026Subscriber SQL Injection in eShipper Commerce <= 2.16.13 versions.CVE-2026-74013 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Subscriber SQL Injection in eShipper Commerce <= 2.16.13 versions.
- What to do
- Update the plugin to the newest version.
Aug 20, 2026Unauthenticated Broken Authentication in User Registration & Membership Pro <= 5.4.5 versions.CVE-2026-74001 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated Broken Authentication in User Registration & Membership Pro <= 5.4.5 versions.
- What to do
- Update the plugin to the newest version.
Aug 20, 2026Subscriber SQL Injection in WP w3all phpBB <= 3.0.5 versions.CVE-2026-73998 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Subscriber SQL Injection in WP w3all phpBB <= 3.0.5 versions.
- What to do
- Update the plugin to the newest version.
Aug 20, 2026Unauthenticated PHP Object Injection in FundEngine <= 1.7.9 versions.CVE-2026-73993 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in FundEngine <= 1.7.9 versions.
- What to do
- Update the plugin to the newest version.
Aug 20, 2026Subscriber Remote Code Execution (RCE) in Query Wrangler <= 1.5.57 versions.CVE-2026-73992 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Subscriber Remote Code Execution (RCE) in Query Wrangler <= 1.5.57 versions.
- What to do
- Update the plugin to the newest version.
Aug 20, 2026Subscriber Cross Site Scripting (XSS) in WP BASE Booking <= 6.3.2 versions.CVE-2026-73402 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Subscriber Cross Site Scripting (XSS) in WP BASE Booking <= 6.3.2 versions.
- What to do
- Update the plugin to the newest version.
Aug 20, 2026Unauthenticated SQL Injection in BookingPress Appointment Booking Pro <= 6.0.2 versions.CVE-2026-68566 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in BookingPress Appointment Booking Pro <= 6.0.2 versions.
- What to do
- Update the plugin to the newest version.
Aug 20, 2026Unauthenticated Cross Site Scripting (XSS) in NotificationX Pro <= 3.1.4 versions.CVE-2026-68564 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in NotificationX Pro <= 3.1.4 versions.
- What to do
- Update the plugin to the newest version.
Aug 20, 2026Unauthenticated Privilege Escalation in Abandoned Cart Pro for WooCommerce <= 10.4.0 versions.CVE-2026-66682 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated Privilege Escalation in Abandoned Cart Pro for WooCommerce <= 10.4.0 versions.
- What to do
- Update the plugin to the newest version.
Aug 20, 2026Unauthenticated SQL Injection in Locatoraid Store Locator <= 3.9.72 versions.CVE-2026-66680 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in Locatoraid Store Locator <= 3.9.72 versions.
- What to do
- Update the plugin to the newest version.
Aug 20, 2026Subscriber Broken Authentication in Leyka <= 3.32.3 versions.CVE-2026-66677 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Subscriber Broken Authentication in Leyka <= 3.32.3 versions.
- What to do
- Update the plugin to the newest version.
Aug 20, 2026Unauthenticated Cross Site Scripting (XSS) in Flatastic <= 2.0 versions.CVE-2026-66673 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Flatastic <= 2.0 versions.
- What to do
- Update the plugin to the newest version.
Aug 20, 2026Unauthenticated PHP Object Injection in Flatastic <= 2.0 versions.CVE-2026-66672 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in Flatastic <= 2.0 versions.
- What to do
- Update the plugin to the newest version.
Aug 20, 2026Unauthenticated SQL Injection in Directory Pro <= 2.5.8 versions.CVE-2026-66649 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in Directory Pro <= 2.5.8 versions.
- What to do
- Update the plugin to the newest version.
Aug 20, 2026Subscriber Broken Access Control in Homlisti <= 3.1.2 versions.CVE-2026-66647 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Subscriber Broken Access Control in Homlisti <= 3.1.2 versions.
- What to do
- Update the plugin to the newest version.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. The WordPress, CMS and hosting-panel entries come from the National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan and others); we show who. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, a booking system, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.