Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,968 results · page 8 of 40
Jul 28, 2026Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar: Authorization bypassCVE-2026-17166 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.3.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to modify site-wide payment settings — including WooCommerce payment enablement, cart redirect behavior, login requirements for checkout, confirmation page ID, and confirmed ticket statuses — that govern how all event bookings are processed.
- Product
- Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar
- Affected
- up to 5.3.7
- What to do
- Affects up to 5.3.7. Update Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 28, 2026Wholesale for WooCommerce: Privilege EscalationCVE-2026-12144 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Wholesale for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.0.5. This is due to the `save_requests_meta()` function applying only `sanitize_text_field()` to the `user_role_set` POST parameter before passing it directly to `WP_User::add_role()`, with no allowlist validation against permitted wholesale roles and no capability check such as `current_user_can('promote_users')` or `current_user_can('manage_options')`. This makes it possible for authenticated attackers with author-level access and above to escalate their privileges to administrator by supplying `administrator` as the `user_role_set` value in a crafted request. The function is gated only by a nonce (`request_user_role_nonce`) that is rendered in the meta box on the `wwp_requests` post edit screen; because the post type is registered with `capability_type => 'post'`, any author-level user who has authored a `wwp_requests` post — such as one created via the wholesale registration form — can access this nonce and submit the role-assignment request.
- Product
- Wholesale for WooCommerce
- Affected
- up to 2.0.5
- What to do
- Affects up to 2.0.5. Update Wholesale for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 28, 2026WP Password Policy: Privilege EscalationCVE-2026-15992 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The WP Password Policy plugin for WordPress is vulnerable to Privilege Escalation in all versions up to and including 3.7.1. This is due to missing authorization checks and nonce verification in the `get_user()` function of the `Module_Password_Hint` class, which unconditionally calls `WP_User::set_role()` with the attacker-supplied `role` parameter on any account resolved via `$_POST['user_login']`, without confirming the requesting user holds the capability to assign roles. This makes it possible for authenticated attackers, with subscriber-level access and above, to escalate their own privileges to Administrator by submitting a crafted POST request — with `action` set to `createuser` and `role` set to `administrator` — to the password-reset form endpoint. The vulnerable code path is reachable via the `password_hint` filter hooked during the WordPress password-reset form render, meaning an attacker need only possess a valid password-reset cookie to reach the sink.
- Product
- WP Password Policy
- Affected
- up to 3.7.1
- What to do
- Affects up to 3.7.1. Update WP Password Policy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 28, 2026Eazy Plugin Manager – Powerful Plugin Management Solution for: Privilege EscalationCVE-2026-14328 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Eazy Plugin Manager – Powerful Plugin Management Solution for WordPress plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.4.1. This is due to insufficient authorization on the `wp_ajax_pos_get_option` AJAX handler, which verifies only a nonce that is localized to every logged-in admin-area user via `admin_enqueue_scripts` — without any capability check — before returning the value of any arbitrary WordPress option via `get_option()`, combined with the `admin_login_endpoint_handler` REST endpoint (`GET /wp-json/epm/v1/admin/login`) being registered as publicly accessible and authenticating callers solely by a whirlpool hash of values stored in those same options. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the `site_url`, `connection_key`, and `remote_user_id` values stored in the `eazywp_connecting_info` and `eazywp_connection` options, compute the required `auth_key`, call the `admin/login` REST endpoint to obtain Administrator authentication cookies, and fully take over the site. Exploitation requires the plugin's remote connection feature to have been configured, as the `
- Product
- Eazy Plugin Manager – Powerful Plugin Management Solution for
- Affected
- up to 4.4.1
- What to do
- Affects up to 4.4.1. Update Eazy Plugin Manager – Powerful Plugin Management Solution for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 27, 2026Unauthenticated Cross Site Scripting (XSS) in Booking Calendar <= 11.4.2 versions.CVE-2026-59558 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Booking Calendar <= 11.4.2 versions.
- Affected
- up to 11.4.2
- What to do
- Affects up to 11.4.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 27, 2026bookingpress-appointment-booking-pro: Does not correctly invoke its REST permission callbackCVE-2026-9830 · WordPress plugins & themes · reported by WPScanHigh 8.2
The bookingpress-appointment-booking-pro WordPress plugin before 5.7.3 does not correctly invoke its REST permission callback, leaving every route in one of its API namespaces reachable without authentication and allowing unauthenticated attackers to read customer booking data and modify other users' bookings.
- Product
- bookingpress-appointment-booking-pro
- Fixed in
- 5.7.3
- What to do
- Update bookingpress-appointment-booking-pro to 5.7.3 or newer.
Jul 27, 2026Calendar: Does not properly escape a user-supplied event field before outputting it inside an HTML attribute on a public-facing pageCVE-2026-14827 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Calendar WordPress plugin before 1.3.18 does not properly escape a user-supplied event field before outputting it inside an HTML attribute on a public-facing page, allowing users with the Contributor role to inject arbitrary JavaScript that executes in the browser of anyone viewing the calendar.
- Product
- Calendar
- Fixed in
- 1.3.18
- What to do
- Update Calendar to 1.3.18 or newer.
Jul 27, 2026Events Calendar: Does not perform an authorization check on one of its Event Aggregator import REST API routes and skips an integrity check for a particular status valueCVE-2026-13390 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Events Calendar WordPress plugin before 6.16.5.1 does not perform an authorization check on one of its Event Aggregator import REST API routes and skips an integrity check for a particular status value, allowing unauthenticated attackers to mark existing import records as failed and to store arbitrary content in a hidden comment record.
- Product
- Events Calendar
- Fixed in
- 6.16.5.1
- What to do
- Update Events Calendar to 6.16.5.1 or newer.
Jul 24, 2026Wpify Woo: Privilege EscalationCVE-2026-12736 · WordPress plugins & themes · reported by WordfenceHigh 8
The Wpify Woo plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 5.4.16. This is due to the SettingsApi::save_option() REST route (POST /wp-json/wpify-woo/v1/option) passing the request-supplied 'option' and 'data' parameters directly to update_option() without any option-name allowlist or value sanitization, while the permission_callback only verifies the manage_woocommerce capability. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to elevate their privileges to Administrator by overwriting arbitrary WordPress options (for example setting default_role to administrator and users_can_register to 1, or disabling security plugins via active_plugins).
- Product
- Wpify Woo
- Affected
- up to 5.4.16
- What to do
- Affects up to 5.4.16. Update Wpify Woo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 23, 2026Contributor Local File Inclusion in Vino <= 1.9 versions.CVE-2026-65481 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Contributor Local File Inclusion in Vino <= 1.9 versions.
- Affected
- up to 1.9
- What to do
- Affects up to 1.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026Contributor Local File Inclusion in Tonda Core <= 2.1.2 versions.CVE-2026-65477 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Contributor Local File Inclusion in Tonda Core <= 2.1.2 versions.
- Affected
- up to 2.1.2
- What to do
- Affects up to 2.1.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026Unauthenticated Privilege Escalation in TrueBooker <= 1.2.3 versions.CVE-2026-61951 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated Privilege Escalation in TrueBooker <= 1.2.3 versions.
- Affected
- up to 1.2.3
- What to do
- Affects up to 1.2.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026Subscriber Privilege Escalation in WP BASE Booking <= 6.3.1 versions.CVE-2026-59541 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Subscriber Privilege Escalation in WP BASE Booking <= 6.3.1 versions.
- Affected
- up to 6.3.1
- What to do
- Affects up to 6.3.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026Unauthenticated Privilege Escalation in SMS Alert Order Notifications <= 3.9.6 versions.CVE-2026-59540 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated Privilege Escalation in SMS Alert Order Notifications <= 3.9.6 versions.
- Affected
- up to 3.9.6
- What to do
- Affects up to 3.9.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026Booking Agent Broken Access Control in QuickCal - Appointment Booking Calendar for WordPress <= 1.0.16 versions.CVE-2026-27377 · WordPress plugins & themes · reported by PatchstackMedium 6.7
Booking Agent Broken Access Control in QuickCal - Appointment Booking Calendar for WordPress <= 1.0.16 versions.
- Affected
- up to 1.0.16
- What to do
- Affects up to 1.0.16. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026MDJM Event Management: Privilege EscalationCVE-2026-15017 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The MDJM Event Management plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.7.8.4. This is due to missing capability checks and nonce verification in the `MDJM_Permissions::set_permissions()` and `MDJM_Employee_Manager::init()` functions, combined with the absence of server-side allow-list validation on the `employee_roles[]` and `new_role` POST parameters before they are passed to `mdjm_set_employee_role()` and `WP_User::set_role()`. This makes it possible for unauthenticated attackers to grant arbitrary MDJM capabilities — including `mdjm_employee` and `mdjm_employee_edit` — to any registered WordPress role, and subsequently leverage a subscriber-level account to escalate privileges to Administrator. `MDJM_Permissions::init()` is registered on the public WordPress `init` hook without any authentication gate, meaning the role-manipulation endpoint is reachable without any prior login.
- Product
- MDJM Event Management
- Affected
- up to 1.7.8.4
- What to do
- Affects up to 1.7.8.4. Update MDJM Event Management to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 23, 2026Registrations For The Events Calendar: SQL InjectionCVE-2026-13119 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Registrations For The Events Calendar plugin for WordPress is vulnerable to SQL Injection via JSON keys in the 'standard' parameter handled by the rtec_records_edit AJAX action in versions up to and including 3.2. The handler decodes attacker-controlled JSON from $_POST['standard'] and uses the JSON array keys directly as column identifiers in the SET clause of an UPDATE statement built inside RTEC_Db_Admin::update_entry(). Only esc_sql() (mysqli_real_escape_string) is applied to the identifier; that function escapes quotes, backslashes, and a few control characters but does not escape spaces, equals signs, parentheses, or hyphens, so an attacker can break out of the identifier context and inject subqueries (terminated with a SQL comment). This makes it possible for authenticated attackers, with Contributor-level access and above who can edit the targeted event, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- Registrations For The Events Calendar
- Affected
- up to 3.2
- What to do
- Affects up to 3.2. Update Registrations For The Events Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 21, 2026the render callback of the `ninja-forms/submissions-table` Gutenberg block that: Ninja Forms WordPress plugin version 3.14.8 and prior contains a missing authorizationCVE-2026-65050 · WordPress plugins & themes · reported by VulnCheckHigh 7.1
Ninja Forms WordPress plugin version 3.14.8 and prior contains a missing authorization vulnerability in the render callback of the `ninja-forms/submissions-table` Gutenberg block that allows authenticated attackers with Author-level privileges to expose stored form submissions to unauthenticated visitors by embedding the block with an arbitrary formID on a published post. Attackers can retrieve the signed bearer token injected into every page visitor's browser via `wp_localize_script` and use it against the REST API submissions endpoint to access all saved form submission field values, including sensitive personally identifiable information such as names, email addresses, and phone numbers.
- Product
- the render callback of the `ninja-forms/submissions-table` Gutenberg block that
- What to do
- Update the render callback of the `ninja-forms/submissions-table` Gutenberg block that to the newest version.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Jul 21, 2026Easy Form Builder by WhiteStudio: Unauthenticated Privilege Escalation to AdministratorCVE-2026-13439 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Easy Form Builder by WhiteStudio plugin for WordPress is vulnerable to Unauthenticated Privilege Escalation to Administrator in versions up to, and including, 4.0.11 This is due to the password recovery flow using the publicly-visible session identifier ('sid') as the password reset token stored in wp_emsfb_temp_links, combined with a publicly-accessible nonce refresh endpoint (Emsfb/v1/nonce/refresh) that issues valid WordPress REST nonces to unauthenticated visitors. This makes it possible for unauthenticated attackers to reset the password of any WordPress user — including administrators — by scraping the public sid from a published login form page, submitting a recovery request for any known user email via Emsfb/v1/forms/message/add, and then calling Emsfb/v1/forms/recovery/efb_set_password with the known sid to set an arbitrary new password and gain full administrator access.
- Product
- Easy Form Builder by WhiteStudio
- Affected
- up to 4.0.11
- What to do
- Affects up to 4.0.11. Update Easy Form Builder by WhiteStudio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 20, 2026Modern Event Calendar Pro WordPress plugin before 7.34.0, Modern Events Calendar Lite: Do not sanitise and escape a request parameter before using it in a SQL statementCVE-2026-11349 · WordPress plugins & themes · reported by WPScanHigh 8.6
The Modern Event Calendar Pro WordPress plugin before 7.34.0, Modern Events Calendar Lite WordPress plugin before 7.34.0 do not sanitise and escape a request parameter before using it in a SQL statement, through an AJAX action available to unauthenticated users, leading to an unauthenticated SQL injection vulnerability that allows attackers to extract sensitive data from the database.
- Product
- Modern Event Calendar Pro WordPress plugin before 7.34.0, Modern Events Calendar Lite
- Fixed in
- 7.34.0
- What to do
- Update Modern Event Calendar Pro WordPress plugin before 7.34.0, Modern Events Calendar Lite to 7.34.0 or newer.
Jul 17, 2026User Registration & Membership: Does not perform a capability check for unauthenticated callers on one of its membership payment actions and acts on a caller-supplied user identifierCVE-2026-11966 · WordPress plugins & themes · reported by WPScanMedium 5.3
The User Registration & Membership WordPress plugin before 5.2.3 does not perform a capability check for unauthenticated callers on one of its membership payment actions and acts on a caller-supplied user identifier, allowing unauthenticated attackers to delete recently-registered, payment-pending user accounts.
- Product
- User Registration & Membership
- Fixed in
- 5.2.3
- What to do
- Update User Registration & Membership to 5.2.3 or newer.
Jul 17, 2026PhonePe Payment Solutions: Does not properly verify the authenticity of incoming payment callbacks: the secret used to validate the callback signature is empty on sites configured through the current setup flowCVE-2026-11575 · WordPress plugins & themes · reported by WPScanHigh 7.5
The PhonePe Payment Solutions WordPress plugin before 3.1.0 does not properly verify the authenticity of incoming payment callbacks: the secret used to validate the callback signature is empty on sites configured through the current setup flow, so the expected signature reduces to an unkeyed hash of the request body that anyone can compute. This allows unauthenticated attackers to forge a payment-success notification and mark unpaid WooCommerce orders as paid without any payment being made.
- Product
- PhonePe Payment Solutions
- Fixed in
- 3.1.0
- What to do
- Update PhonePe Payment Solutions to 3.1.0 or newer.
Jul 17, 2026Aimogen Pro - All-in-One AI Content Writer, Editor, ChatBot & Automation Toolkit: Privilege EscalationCVE-2026-15982 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Aimogen Pro - All-in-One AI Content Writer, Editor, ChatBot & Automation Toolkit plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.8.4. This is due to due to a missing capability check on the 'aiomatic_call_google_ai_function' function. This makes it possible for unauthenticated attackers to leverage the 'aimogen_wp_god_mode' tool to clear function blacklists and execute arbitrary PHP functions, such as creating administrator accounts.
- Product
- Aimogen Pro - All-in-One AI Content Writer, Editor, ChatBot & Automation Toolkit
- Affected
- up to 2.8.4
- What to do
- Affects up to 2.8.4. Update Aimogen Pro - All-in-One AI Content Writer, Editor, ChatBot & Automation Toolkit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcoderevolution.rowordfence.com
Jul 16, 2026Bricksforge: Privilege EscalationCVE-2026-14956 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Bricksforge plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.1.8.6. This is due to improper validation of the fieldIds parameter in the Pro Forms registration action, which allows attacker-supplied field IDs to be added to the trusted form-field whitelist. This makes it possible for unauthenticated attackers to register a new administrator account by submitting a crafted request to a publicly accessible Bricksforge Pro Forms registration form. Successful exploitation requires that the site has a public Bricksforge Pro Forms element configured with the User Registration action.
- Product
- Bricksforge
- Affected
- up to 3.1.8.6
- What to do
- Affects up to 3.1.8.6. Update Bricksforge to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordbricksforge.iowordfence.com
Jul 16, 2026Booking for Appointments and Events Calendar – Amelia: SQL InjectionCVE-2026-14782 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to SQL Injection via the Customer Import in all versions up to, and including, 2.4.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with wpamelia-manager role, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- Booking for Appointments and Events Calendar – Amelia
- Affected
- up to 2.4.3
- What to do
- Affects up to 2.4.3. Update Booking for Appointments and Events Calendar – Amelia to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jul 16, 2026WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell: Privilege EscalationCVE-2026-15103 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell plugin for WordPress is vulnerable to Privilege Escalation via arbitrary option update in all versions up to, and including, 3.12.8. This is due to the `update_settings()` REST callback failing to validate the `group_id` path parameter against an allowlist of permitted option names before passing it directly to `get_option()` and `update_option()`, allowing the built-in `wp_user_roles` option — which satisfies the route's loose `[\w-]+` regex — to be targeted. This makes it possible for authenticated attackers with the `wpf_manage_funnels` capability and above to elevate their privileges to administrator by writing a crafted role definition containing arbitrary capabilities into the `wp_user_roles` option, thereby granting any WordPress role full site administrator access. The `wpf_manage_funnels` capability is typically assigned to the Funnel Manager custom role created by the plugin, meaning this role is the minimum required to exploit the vulnerability.
- Product
- WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell
- Affected
- up to 3.12.8
- What to do
- Affects up to 3.12.8. Update WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 16, 2026Digits: WordPress Mobile Number Signup and Login: Privilege EscalationCVE-2026-13741 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Digits: WordPress Mobile Number Signup and Login plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 9.1.0.5. This is due to missing authorization and role validation in the `dig_update_wpwc_custom_fields()` function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to escalate their privileges to Administrator by submitting a forged `digits_reg_userrole` value during profile update, granted the site administrator has configured the built-in DIGITS User Role field.
- Product
- Digits: WordPress Mobile Number Signup and Login
- Affected
- up to 9.1.0.5
- What to do
- Affects up to 9.1.0.5. Update Digits: WordPress Mobile Number Signup and Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recorddigits.unitedover.comwordfence.com
Jul 14, 2026SureForms: Does not properly validate the payment amount on forms that use a dynamically-sourced (variable/hidden) payment amountCVE-2026-11567 · WordPress plugins & themes · reported by WPScanMedium 5.9
The SureForms WordPress plugin before 2.11.1 does not properly validate the payment amount on forms that use a dynamically-sourced (variable/hidden) payment amount, allowing unauthenticated users to underpay for the configured product or subscription. Forms using a fixed configured price are not affected.
- Product
- SureForms
- Fixed in
- 2.11.1
- What to do
- Update SureForms to 2.11.1 or newer.
Jul 13, 2026ICS Calendar: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-59516 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Room 34 Creative Services, LLC ICS Calendar ics-calendar allows Reflected XSS.This issue affects ICS Calendar: from n/a through <= 12.1.1.
- Product
- ICS Calendar
- Affected
- up to 12.1.1
- What to do
- Affects up to 12.1.1. Update ICS Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 13, 2026Booking calendar, Appointment Booking System: Missing AuthorizationCVE-2026-57778 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in wpdevart Booking calendar, Appointment Booking System booking-calendar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booking calendar, Appointment Booking System: from n/a through <= 3.2.36.
- Product
- Booking calendar, Appointment Booking System
- Affected
- up to 3.2.36
- What to do
- Affects up to 3.2.36. Update Booking calendar, Appointment Booking System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 13, 2026User Registration & Membership: Does not perform an authorization check on a membership-upgrade action and derives the user to modify from a caller-supplied identifier instead of the current userCVE-2026-11963 · WordPress plugins & themes · reported by WPScanHigh 8.1
The User Registration & Membership WordPress plugin before 5.2.2 does not perform an authorization check on a membership-upgrade action and derives the user to modify from a caller-supplied identifier instead of the current user, allowing any authenticated user such as a subscriber to change another user's WordPress role and membership tier.
- Product
- User Registration & Membership
- Fixed in
- 5.2.2
- What to do
- Update User Registration & Membership to 5.2.2 or newer.
Jul 11, 2026Cost Calculator Builder: Sensitive Information ExposureCVE-2026-10865 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Cost Calculator Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.0.11 via the (template body). This makes it possible for unauthenticated attackers to extract the plaintext Stripe secret key, Razorpay secret key, and PayPal client_secret embedded in the page source of any page containing a calculator, enabling full control of the merchant's payment gateway accounts. This exposure only occurs when the 'use in all calculators' option is enabled for one or more payment gateways in the plugin's global settings.
- Product
- Cost Calculator Builder
- Affected
- up to 4.0.11
- What to do
- Affects up to 4.0.11. Update Cost Calculator Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 11, 2026SureCart: Privilege escalationCVE-2026-7655 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The SureCart plugin for WordPress is vulnerable to privilege escalation via account takeover in versions up to, and including, 4.2.3. This is due to the plugin not properly validating a user's identity prior to updating their details like email during customer profile synchronization from webhook events. This makes it possible for unauthenticated attackers to change linked user's email addresses, including administrators if the administrator account is linked to a SureCart customer record, and leverage that to reset the user's password and gain access to their account if the customer ID is known.
- Product
- SureCart
- Affected
- up to 4.2.3
- What to do
- Affects up to 4.2.3. Update SureCart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jul 11, 2026Planyo Online Reservation System: Server-Side Request Forgery leading to Local File InclusionCVE-2026-3576 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Planyo Online Reservation System plugin for WordPress is vulnerable to Server-Side Request Forgery leading to Local File Inclusion in all versions up to, and including, 3.0. The ulap.php file acts as an AJAX proxy and is directly accessible without WordPress bootstrapping or any authentication. The send_http_post() function validates the host of the provided URL against an allowlist that includes 'localhost', but critically fails to validate the URL scheme/protocol. This makes it possible for unauthenticated attackers to supply a file:// URL (e.g., file://localhost/etc/passwd) which bypasses the host allowlist check because parse_url() returns 'localhost' as the host. The URL is then passed to curl_init() or fopen(), both of which support the file:// protocol, allowing the attacker to read arbitrary local files on the server and have their contents returned in the HTTP response. This can lead to disclosure of sensitive files such as /etc/passwd, wp-config.php (containing database credentials and authentication keys), and other server-side files.
- Product
- Planyo Online Reservation System
- Affected
- up to 3.0
- What to do
- Affects up to 3.0. Update Planyo Online Reservation System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 11, 2026Simple JWT Login – Allows you to use JWT on REST endpoints.: Authentication Bypass to Privilege EscalationCVE-2026-14262 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Simple JWT Login – Allows you to use JWT on REST endpoints. plugin for WordPress is vulnerable to Authentication Bypass to Privilege Escalation in all versions up to, and including, 3.6.6 via the `payload` parameter. The vulnerability exists because `AuthenticateService::generatePayload()` only overwrites JWT payload keys whose names appear in the admin-configured `jwt_payload` list — leaving any attacker-supplied identity claims such as `email`, `id`, or `username` intact and signed into the JWT with the site's HS256 secret. This makes it possible for authenticated attackers, with subscriber-level access and above, to escalate their privileges to that of an Administrator by injecting a target administrator's email address into the `payload` parameter at the `/wp-json/simple-jwt-login/v1/auth` endpoint, then redeeming the resulting JWT at the `/autologin` endpoint to obtain a fully authenticated session as that administrator.
- Product
- Simple JWT Login – Allows you to use JWT on REST endpoints.
- Affected
- up to 3.6.6
- What to do
- Affects up to 3.6.6. Update Simple JWT Login – Allows you to use JWT on REST endpoints. to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 11, 2026Starboard Suite Reservation Calendars: Stored Cross-Site ScriptingCVE-2025-13968 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Starboard Suite Reservation Calendars plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcode attributes in the [starboard-suite-lightbox] shortcode in all versions up to, and including, 3.1.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Starboard Suite Reservation Calendars
- Affected
- up to 3.1.4
- What to do
- Affects up to 3.1.4. Update Starboard Suite Reservation Calendars to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 11, 2026Lockme OAuth2 calendars integration: Stored Cross-Site ScriptingCVE-2026-3367 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Lockme OAuth2 calendars integration plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'App ID' setting in all versions up to, and including, 2.11.0. This is due to insufficient input sanitization and output escaping. The register_setting() call on line 197 lacks a sanitize callback, allowing unsanitized data to be stored via update_option(). When the settings page is rendered, the stored value is echoed directly into an HTML input's value attribute without esc_attr() on line 212. This makes it possible for authenticated attackers, with administrator-level access and above, to inject arbitrary web scripts in the settings page that will execute whenever a user accesses the plugin settings page. Multiple fields are affected: App ID (client_id), App Secret (client_secret), Bookings ID prefix (id_prefix), and API domain (api_domain). This vulnerability is particularly impactful in WordPress multisite installations where administrators of individual sites should not be able to execute JavaScript affecting other users.
- Product
- Lockme OAuth2 calendars integration
- Affected
- up to 2.11.0
- What to do
- Affects up to 2.11.0. Update Lockme OAuth2 calendars integration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 11, 2026LA-Studio Element Kit for Elementor: Local File InclusionCVE-2026-15338 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The LA-Studio Element Kit for Elementor plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.6.1 via the get_type_template function. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. The wp_normalize_path function used in get_template only normalizes directory separators and does not resolve or reject path traversal sequences, while the extension check is trivially bypassed because the caller already appends the required extension to the traversal payload.
- Product
- LA-Studio Element Kit for Elementor
- Affected
- up to 1.6.1
- What to do
- Affects up to 1.6.1. Update LA-Studio Element Kit for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 10, 2026WP Grid Builder: Privilege EscalationCVE-2026-13756 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The WP Grid Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.3.3. This is due to missing authorization and meta key validation in the `update()` handler for the `/wp-json/wpgb/v2/metadata` REST endpoint. This makes it possible for authenticated attackers, with Subscriber-level access and above, to elevate their privileges to Administrator by updating their own `wp_capabilities` user meta with a crafted nested array payload.
- Product
- WP Grid Builder
- Affected
- up to 2.3.3
- What to do
- Affects up to 2.3.3. Update WP Grid Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recorddocs.wpgridbuilder.comwordfence.com
Jul 10, 2026Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered): Authorization bypassCVE-2026-13039 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress is vulnerable to authorization bypass due to a regression in versions from 4.0.26 up to and including 4.1.15. This is due to the plugin not properly verifying that a user is authorized to perform an action in the payment_complete() function of PaymentController.php. This makes it possible for unauthenticated attackers to mark unpaid ticket orders as completed by submitting a fabricated SureCart checkout ID or FluentCart cart hash, granting themselves paid event access, QR-code attendee tickets, and order confirmation emails without making any real payment. The wp_rest nonce required to reach the vulnerable endpoint is embedded in every public event page, meaning no WordPress session or credentials are needed to obtain it. This vulnerability represents a regression — the same function and endpoint were previously patched but the fix did not persist through subsequent releases.
- Product
- Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered)
- Affected
- up to 4.1.15
- What to do
- Affects up to 4.1.15. Update Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jul 10, 2026ICS Calendar: Reflected Cross-Site ScriptingCVE-2026-9838 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The ICS Calendar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'htmltagtitle' parameter in all versions up to, and including, 12.0.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. The vulnerability is reachable via the unauthenticated wp_ajax_nopriv_r34ics_ajax AJAX action, which accepts attacker-controlled js_args values merged over stored shortcode configuration without nonce verification, allowing the htmltagtitle key to bypass the normal shortcode allowlist check.
- Product
- ICS Calendar
- Affected
- up to 12.0.9
- What to do
- Affects up to 12.0.9. Update ICS Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 10, 2026Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered): Stored Cross-Site ScriptingCVE-2026-12924 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'etn_faq_content' parameter in all versions up to, and including, 4.1.15 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered)
- Affected
- up to 4.1.15
- What to do
- Affects up to 4.1.15. Update Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 10, 2026Happyforms – Form Builder for WordPress: Drag & Drop Contact Forms, Surveys, Payments & Multipurpose Forms: Local File InclusionCVE-2025-11977 · WordPress plugins & themes · reported by WordfenceMedium 6.6
The Happyforms – Form Builder for WordPress: Drag & Drop Contact Forms, Surveys, Payments & Multipurpose Forms plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.26.12 via the happyforms_get_form_partial() function. This makes it possible for authenticated attackers, with Administrator-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.
- Product
- Happyforms – Form Builder for WordPress: Drag & Drop Contact Forms, Surveys, Payments & Multipurpose Forms
- Affected
- up to 1.26.12
- What to do
- Affects up to 1.26.12. Update Happyforms – Form Builder for WordPress: Drag & Drop Contact Forms, Surveys, Payments & Multipurpose Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.svn.wordpress.orgplugins.svn.wordpress.org
Jul 10, 2026Booking calendar, Appointment Booking System: Time-based SQL InjectionCVE-2026-15289 · WordPress plugins & themes · reported by WordfenceMedium 5.9
The Booking calendar, Appointment Booking System plugin for WordPress is vulnerable to time-based SQL Injection via the ‘wpdevart_id’ parameter in all versions up to, and including, 3.2.17 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. In order to exploit the vulnerability, the Pro version of the plugin must be installed and activated, with the 'Delete previous dates' option checked.
- Product
- Booking calendar, Appointment Booking System
- Affected
- up to 3.2.17
- What to do
- Affects up to 3.2.17. Update Booking calendar, Appointment Booking System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 9, 2026Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder: Arbitrary file deletionCVE-2026-14372 · WordPress plugins & themes · reported by WordfenceHigh 7.1
The Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the deleteFiles function in all versions up to, and including, 3.1.1 This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config).
- Product
- Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder
- Affected
- up to 3.1.1
- What to do
- Affects up to 3.1.1. Update Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 9, 2026EventPrime – Events Calendar, Bookings and Tickets: Stored Cross-Site ScriptingCVE-2026-13441 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'new_event_type_background_color' parameter in all versions up to, and including, 4.3.4.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with custom-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the plugin's Guest Submissions setting (allow_submission_by_anonymous_user) to be enabled, which allows unauthenticated attackers to submit event types via the frontend form; when that setting is disabled, exploitation requires at minimum a subscriber-level authenticated account.
- Product
- EventPrime – Events Calendar, Bookings and Tickets
- Affected
- up to 4.3.4.2
- What to do
- Affects up to 4.3.4.2. Update EventPrime – Events Calendar, Bookings and Tickets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 9, 2026Hydra Booking – Appointment Scheduling & Booking Calendar: Insecure Direct Object ReferenceCVE-2026-12433 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Hydra Booking – Appointment Scheduling & Booking Calendar plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 1.2.1 via the /wp-json/hydra-booking/v1/booking/details/{id} REST endpoint. This is due to the getBookingDetails() callback only enforcing the tfhb_manage_options capability via tfhb_manage_options_permission(), without verifying that the requested booking belongs to the currently authenticated host (the lookup in getBookingDetailsData() filters solely on the booking id supplied in the URL). This makes it possible for authenticated attackers, with Hydra Host-level access and above (a role created by the plugin which grants tfhb_manage_options), to view sensitive booking records belonging to other hosts, including attendee names, emails, phone numbers, addresses, meeting details, payment method and status, transaction history, and internal notes by iterating booking IDs.
- Product
- Hydra Booking – Appointment Scheduling & Booking Calendar
- Affected
- up to 1.2.1
- What to do
- Affects up to 1.2.1. Update Hydra Booking – Appointment Scheduling & Booking Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 9, 2026WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell: Local File InclusionCVE-2026-13080 · WordPress plugins & themes · reported by WordfenceMedium 6.6
The WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.12.7 via the 'logKey' parameter parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.
- Product
- WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell
- Affected
- up to 3.12.7
- What to do
- Affects up to 3.12.7. Update WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 8, 2026LatePoint – Calendar Booking Plugin for Appointments and Events: Improper Input ValidationCVE-2026-5356 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Improper Input Validation in all versions up to, and including, 5.4.0. This is due to the plugin's Stripe Connect payment processor accepting a client-supplied PaymentIntent ID. This makes it possible for unauthenticated attackers to pay an arbitrary amount by supplying a previously succeeded PaymentIntent token.
- Product
- LatePoint – Calendar Booking Plugin for Appointments and Events
- Affected
- up to 5.4.0
- What to do
- Affects up to 5.4.0. Update LatePoint – Calendar Booking Plugin for Appointments and Events to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jul 8, 2026My Calendar – Accessible Event Manager: Time-based blind SQL InjectionCVE-2026-6854 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'mc_auth' parameter in all versions up to, and including, 3.7.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- My Calendar – Accessible Event Manager
- Affected
- up to 3.7.8
- What to do
- Affects up to 3.7.8. Update My Calendar – Accessible Event Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.