Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,454 results · page 8 of 30
Aug 19, 2026WPS Bidouille: Does not have proper authorisation checks in an AJAX actionCVE-2026-19782 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WPS Bidouille WordPress plugin before 1.33.5 does not have proper authorisation checks in an AJAX action, allowing any authenticated user, such as a subscriber, to retrieve the email addresses of all registered users.
- Product
- WPS Bidouille
- Fixed in
- 1.33.5
- What to do
- Update WPS Bidouille to 1.33.5 or newer.
Aug 19, 2026Membership For WooCommerce: Does not check that an API consumer secret has actually been generated before comparing it against the one supplied in a requestCVE-2026-19709 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Membership For WooCommerce WordPress plugin before 3.1.2 does not check that an API consumer secret has actually been generated before comparing it against the one supplied in a request, allowing unauthenticated attackers to reach its REST routes and disclose any user's membership plan details on sites where the API has been enabled but no keys were ever generated.
- Product
- Membership For WooCommerce
- Fixed in
- 3.1.2
- What to do
- Update Membership For WooCommerce to 3.1.2 or newer.
Aug 19, 2026Broken Link Checker: Does not limitCVE-2026-18937 · WordPress plugins & themes · reported by WPScanCritical 9
The Broken Link Checker WordPress plugin before 2.4.12 does not limit which query variables it accepts from user input on sites using plain permalinks, allowing unauthenticated users to overwrite arbitrary PHP global variables, and to execute arbitrary code on the server when a classic (non-block) is active.
- Product
- Broken Link Checker
- Fixed in
- 2.4.12
- What to do
- Update Broken Link Checker to 2.4.12 or newer.
Aug 19, 2026TrueBooker: Does not have proper authorisation checks in one of its AJAX actionsCVE-2026-18779 · WordPress plugins & themes · reported by WPScanMedium 5.3
The TrueBooker WordPress plugin before 1.2.7 does not have proper authorisation checks in one of its AJAX actions, allowing unauthenticated users to delete arbitrary appointment records along with their associated booking items and payment records.
- Product
- TrueBooker
- Fixed in
- 1.2.7
- What to do
- Update TrueBooker to 1.2.7 or newer.
Aug 19, 2026TrueBooker: Does not have proper authorisation checks in some of its AJAX actionsCVE-2026-18778 · WordPress plugins & themes · reported by WPScanMedium 5.3
The TrueBooker WordPress plugin before 1.2.7 does not have proper authorisation checks in some of its AJAX actions, allowing unauthenticated users to retrieve the personal information of customers who booked an appointment, including their name, email address, phone number and postal address.
- Product
- TrueBooker
- Fixed in
- 1.2.7
- What to do
- Update TrueBooker to 1.2.7 or newer.
Aug 19, 2026TrueBooker: Does not have proper authorisation checks in one of its AJAX actionsCVE-2026-18777 · WordPress plugins & themes · reported by WPScanMedium 5.3
The TrueBooker WordPress plugin before 1.2.7 does not have proper authorisation checks in one of its AJAX actions, allowing unauthenticated users to change the status of arbitrary appointments, as well as to trigger notification emails to the affected customers.
- Product
- TrueBooker
- Fixed in
- 1.2.7
- What to do
- Update TrueBooker to 1.2.7 or newer.
Aug 19, 2026TrueBooker: Does not have proper authorisation checks in some of its AJAX actionsCVE-2026-18776 · WordPress plugins & themes · reported by WPScanCritical 9.8
The TrueBooker WordPress plugin before 1.2.7 does not have proper authorisation checks in some of its AJAX actions, allowing unauthenticated users to change the email address of arbitrary users, including administrators, and subsequently take over their account via the password reset flow.
- Product
- TrueBooker
- Fixed in
- 1.2.7
- What to do
- Update TrueBooker to 1.2.7 or newer.
Aug 19, 2026WP Maps: Does not perform a capability checkCVE-2026-18466 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Maps WordPress plugin before 4.9.8 does not perform a capability check, nor validate a nonce, in one of its AJAX actions, allowing users with a Subscriber account to create an unlimited number of options in the database, each of which is loaded on every page request.
- Product
- WP Maps
- Fixed in
- 4.9.8
- What to do
- Update WP Maps to 4.9.8 or newer.
Aug 19, 2026WP Directory Kit: Does not perform any authorization check on one of its public AJAX actions and returns unfiltered database rowsCVE-2026-18231 · WordPress plugins & themes · reported by WPScanMedium 5.3
The WP Directory Kit WordPress plugin before 1.5.7 does not perform any authorization check on one of its public AJAX actions and returns unfiltered database rows, allowing unauthenticated attackers to retrieve the usernames and email addresses of users holding the WP Directory Kit WordPress plugin before 1.5.7's own roles.
- Product
- WP Directory Kit
- Fixed in
- 1.5.7
- What to do
- Update WP Directory Kit to 1.5.7 or newer.
Aug 19, 2026SmartCrawl SEO checker, analyzer & optimizer: Does not perform capability checks on two of its AJAX actionsCVE-2026-16979 · WordPress plugins & themes · reported by WPScanMedium 4.3
The SmartCrawl SEO checker, analyzer & optimizer WordPress plugin before 3.16.3 does not perform capability checks on two of its AJAX actions, allowing users with at least the Subscriber role to read the titles of private and draft posts by ID and to enumerate stored post-meta key names.
- Product
- SmartCrawl SEO checker, analyzer & optimizer
- Fixed in
- 3.16.3
- What to do
- Update SmartCrawl SEO checker, analyzer & optimizer to 3.16.3 or newer.
Aug 19, 2026YayCurrency: Does not perform any capability or ownership check on several of its multi-vendor integration handlers that are reachable by unauthenticated usersCVE-2026-16058 · WordPress plugins & themes · reported by WPScanMedium 5.3
The YayCurrency WordPress plugin before 3.3.5 does not perform any capability or ownership check on several of its multi-vendor integration handlers that are reachable by unauthenticated users, allowing anyone to read the store's order totals and its vendors' earnings, balance ledgers, and withdrawal histories by iterating identifiers.
- Product
- YayCurrency
- Fixed in
- 3.3.5
- What to do
- Update YayCurrency to 3.3.5 or newer.
Aug 19, 2026Quiz and Survey Master (QSM): Does not perform a per-object ownership check on the REST routes that return a quiz's email-notification and results-page configurationCVE-2026-14826 · WordPress plugins & themes · reported by WPScanLow 2.7
The Quiz and Survey Master (QSM) WordPress plugin before 11.2.4 does not perform a per-object ownership check on the REST routes that return a quiz's email-notification and results-page configuration, allowing users with contributor-level access and above to read the configuration, including notification recipient addresses, of quizzes created by other users.
- Product
- Quiz and Survey Master (QSM)
- Fixed in
- 11.2.4
- What to do
- Update Quiz and Survey Master (QSM) to 11.2.4 or newer.
Aug 19, 2026Quiz and Survey Master (QSM): Does not perform a per-object ownership check before saving a quiz's front-end text settingsCVE-2026-14825 · WordPress plugins & themes · reported by WPScanLow 2.7
The Quiz and Survey Master (QSM) WordPress plugin before 11.2.4 does not perform a per-object ownership check before saving a quiz's front-end text settings, allowing users with contributor-level access and above to modify the text settings of quizzes created by other users.
- Product
- Quiz and Survey Master (QSM)
- Fixed in
- 11.2.4
- What to do
- Update Quiz and Survey Master (QSM) to 11.2.4 or newer.
Aug 19, 2026Advanced File Manager: Does not perform capability checks in several of its file management AJAX actionsCVE-2026-11565 · WordPress plugins & themes · reported by WPScanHigh 8.5
The Advanced File Manager WordPress plugin before 5.4.13 does not perform capability checks in several of its file management AJAX actions, allowing users with any role to which an administrator has granted file-manager access (as low as Subscriber) to read arbitrary files on the server — including sensitive configuration files — and to overwrite existing non-PHP files, which can be leveraged to compromise administrator accounts and the whole site.
- Product
- Advanced File Manager
- Fixed in
- 5.4.13
- What to do
- Update Advanced File Manager to 5.4.13 or newer.
Aug 17, 2026ShopSmart Loyalty for WooCommerce: Does not perform any authorization or ownership check on a phone-number lookup exposed to unauthenticated usersCVE-2026-14832 · WordPress plugins & themes · reported by WPScanMedium 5.3
The ShopSmart Loyalty for WooCommerce WordPress plugin through 1.0.0 does not perform any authorization or ownership check on a phone-number lookup exposed to unauthenticated users, allowing anyone who knows a customer's phone number to retrieve that customer's loyalty profile, including name, email, and account balance.
- Product
- ShopSmart Loyalty for WooCommerce
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update ShopSmart Loyalty for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 16, 2026CatFolders Document Gallery & PDF Library: Does not have authorisation checks in some of its REST API endpointsCVE-2026-19717 · WordPress plugins & themes · reported by WPScanHigh 7.5
The CatFolders Document Gallery & PDF Library WordPress plugin before 2.0.7 does not have authorisation checks in some of its REST API endpoints, allowing unauthenticated users to retrieve the title, type, size and URL of the media attachments assigned to any of its folders, including folders which are not published in any gallery on the site.
- Product
- CatFolders Document Gallery & PDF Library
- Fixed in
- 2.0.7
- What to do
- Update CatFolders Document Gallery & PDF Library to 2.0.7 or newer.
Aug 16, 2026ECS: Does not perform ownership or post-status checksCVE-2026-19613 · WordPress plugins & themes · reported by WPScanMedium 6.5
The ECS WordPress plugin before 4.3.10 does not perform ownership or post-status checks when one of its dynamic repeater data sources reads custom field values from a user-supplied post identifier, allowing users with a contributor-level account or above to read custom field values and post metadata from posts they do not own, including private and draft ones.
- Product
- ECS
- Fixed in
- 4.3.10
- What to do
- Update ECS to 4.3.10 or newer.
Aug 16, 2026Manual Image Crop: Does not perform any capability check or nonce verification on the authenticated AJAX action that crops attachment images; its only guard passes for any logged-in userCVE-2026-15384 · WordPress plugins & themes · reported by WPScanMedium 5.7
The Manual Image Crop WordPress plugin before 1.15 does not perform any capability check or nonce verification on the authenticated AJAX action that crops attachment images; its only guard passes for any logged-in user. A subscriber-level user can therefore supply an arbitrary attachment ID and overwrite that attachment's generated intermediate-size image (for example its thumbnail) and mutate its stored metadata, regardless of who owns the media. This is a cross-user integrity/defacement issue over the Media Library. The action also has no nonce, so it is additionally susceptible to CSRF.
- Product
- Manual Image Crop
- Fixed in
- 1.15
- What to do
- Update Manual Image Crop to 1.15 or newer.
Aug 15, 2026ECS: Does not have capability or ownership checks on its dynamic repeater actionsCVE-2026-18807 · WordPress plugins & themes · reported by WPScanMedium 4.3
The ECS WordPress plugin before 4.3.13 does not have capability or ownership checks on its dynamic repeater actions, relying only on a nonce available to any user who can open the page builder, allowing users with a contributor-level account or above to read, alter and delete the binding configuration of posts they do not own and to change the ECS WordPress plugin before 4.3.13's site-wide presets.
- Product
- ECS
- Fixed in
- 4.3.13
- What to do
- Update ECS to 4.3.13 or newer.
Aug 15, 2026Product Feed PRO for WooCommerce by AdTribes: Does not perform an authorization check on one of its REST read routesCVE-2026-16611 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Product Feed PRO for WooCommerce by AdTribes WordPress plugin before 13.5.7 does not perform an authorization check on one of its REST read routes, allowing unauthenticated users to disclose a store's feed configuration (rules, filters and field mapping) and to enumerate the full product category taxonomy.
- Product
- Product Feed PRO for WooCommerce by AdTribes
- Fixed in
- 13.5.7
- What to do
- Update Product Feed PRO for WooCommerce by AdTribes to 13.5.7 or newer.
Aug 15, 2026ECS: Does not perform capability or object-ownership checks on its Dynamic Repeater AJAX handlers (gated only by a capability-agnostic nonce that any edit_posts user obtains from the Elementor editor)CVE-2026-14230 · WordPress plugins & themes · reported by WPScanMedium 5.4
The ECS WordPress plugin before 4.3.8 does not perform capability or object-ownership checks on its Dynamic Repeater AJAX handlers (gated only by a capability-agnostic nonce that any edit_posts user obtains from the Elementor editor), so a Contributor can write a data-source binding into any post — including admin-authored pages — whose attacker-controlled values are rendered into a widget's repeater output without sanitization, executing JavaScript in the session of any visitor or administrator who views the page.
- Product
- ECS
- Fixed in
- 4.3.8
- What to do
- Update ECS to 4.3.8 or newer.
Aug 15, 2026ECS: Does not check the post status or any capabilityCVE-2026-14229 · WordPress plugins & themes · reported by WPScanMedium 5.3
The ECS WordPress plugin before 4.3.8 does not check the post status or any capability when rendering an Elementor document requested through one of its AJAX actions, allowing unauthenticated users to retrieve the rendered content of unpublished (private, draft, pending) documents by supplying their identifier.
- Product
- ECS
- Fixed in
- 4.3.8
- What to do
- Update ECS to 4.3.8 or newer.
Aug 13, 2026Unauthenticated Broken Access Control in Anti Spam and list cleaner – AcyChecker <= 2.0.0 versions.CVE-2026-66689 · WordPress plugins & themes · reported by PatchstackMedium 6.3
Unauthenticated Broken Access Control in Anti Spam and list cleaner – AcyChecker <= 2.0.0 versions.
- Affected
- up to 2.0.0
- What to do
- Affects up to 2.0.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 13, 2026Unauthenticated Broken Access Control in StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart <= 2.1.1 versiCVE-2026-66466 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart <= 2.1.1 versions.
- Affected
- up to 2.1.1
- What to do
- Affects up to 2.1.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 13, 2026Ecwid by Lightspeed Ecommerce Shopping Cart: Does not perform a capability check or nonce verification on one of its store-management actionsCVE-2026-14332 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Ecwid by Lightspeed Ecommerce Shopping Cart WordPress plugin before 7.0.9 does not perform a capability check or nonce verification on one of its store-management actions, allowing any authenticated user, such as a subscriber, to disconnect the store and take the storefront offline until an administrator reconnects it.
- Product
- Ecwid by Lightspeed Ecommerce Shopping Cart
- Fixed in
- 7.0.9
- What to do
- Update Ecwid by Lightspeed Ecommerce Shopping Cart to 7.0.9 or newer.
Aug 13, 2026Food Menu: Does not perform any capability or ownership check on its reservation-status update actionCVE-2026-13328 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Food Menu WordPress plugin before 6.0.2 does not perform any capability or ownership check on its reservation-status update action, which is also exposed to unauthenticated users and gated only by a nonce that is publicly available to visitors, allowing unauthenticated attackers to change the status of arbitrary reservations.
- Product
- Food Menu
- Fixed in
- 6.0.2
- What to do
- Update Food Menu to 6.0.2 or newer.
Aug 12, 2026Wallet System for WooCommerce: Does not validate a user-supplied wallet amount against the customer's actual stored balance during checkoutCVE-2026-15045 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Wallet System for WooCommerce WordPress plugin before 2.7.10 does not validate a user-supplied wallet amount against the customer's actual stored balance during checkout, allowing authenticated customers to arbitrarily reduce their own order total, including down to zero, and complete checkout without paying the merchant.
- Product
- Wallet System for WooCommerce
- Fixed in
- 2.7.10
- What to do
- Update Wallet System for WooCommerce to 2.7.10 or newer.
Aug 12, 2026Order Sync with Zendesk for WooCommerce: Does not perform any capability check on one of its REST API endpointsCVE-2026-19073 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Order Sync with Zendesk for WooCommerce WordPress plugin before 2.2.3 does not perform any capability check on one of its REST API endpoints, and does not verify that the requester owns the account being queried, allowing unauthenticated attackers to retrieve the order history and purchase totals of any customer whose email address they know or can enumerate.
- Product
- Order Sync with Zendesk for WooCommerce
- Fixed in
- 2.2.3
- What to do
- Update Order Sync with Zendesk for WooCommerce to 2.2.3 or newer.
Aug 12, 2026ProSolution WP Client: Does not perform capability checks on two administrative AJAX actionsCVE-2026-19052 · WordPress plugins & themes · reported by WPScanMedium 4.3
The ProSolution WP Client WordPress plugin before 2.0.9 does not perform capability checks on two administrative AJAX actions, and the nonce they rely on is published on its public frontend, allowing any authenticated user, such as a subscriber, to trigger an administrative data synchronisation and to clear the ProSolution WP Client WordPress plugin before 2.0.9's activity records.
- Product
- ProSolution WP Client
- Fixed in
- 2.0.9
- What to do
- Update ProSolution WP Client to 2.0.9 or newer.
Aug 12, 2026WP Photo Album Plus: Does not check that the current user is allowed to upload into the album they targetCVE-2026-18962 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WP Photo Album Plus WordPress plugin before 9.2.09.002 does not check that the current user is allowed to upload into the album they target when it processes a front-end upload, allowing any authenticated user, such as a Subscriber, to upload files into albums owned by other users or by the administrator. Exploitation requires the WP Photo Album Plus WordPress plugin before 9.2.09.002's front-end user upload feature to be enabled, which is not the default.
- Product
- WP Photo Album Plus
- Fixed in
- 9.2.09.002
- What to do
- Update WP Photo Album Plus to 9.2.09.002 or newer.
Aug 12, 2026WPC Admin Columns: Does not have authorisation checks in one of its AJAX actionsCVE-2026-18943 · WordPress plugins & themes · reported by WPScanMedium 6.5
The WPC Admin Columns WordPress plugin before 2.3.4 does not have authorisation checks in one of its AJAX actions, allowing users with a role as low as subscriber to read arbitrary user, post and term metadata, including data belonging to administrators.
- Product
- WPC Admin Columns
- Fixed in
- 2.3.4
- What to do
- Update WPC Admin Columns to 2.3.4 or newer.
Aug 12, 2026WP Photo Album Plus: Does not perform any capability or nonce check on one of its public endpoint actions and builds an option name from a client-supplied value without restricting it to its own optionsCVE-2026-18049 · WordPress plugins & themes · reported by WPScanHigh 7.5
The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not perform any capability or nonce check on one of its public endpoint actions and builds an option name from a client-supplied value without restricting it to its own options, allowing unauthenticated users to read the value of other autoloaded options whose names end in a matching suffix.
- Product
- WP Photo Album Plus
- Fixed in
- 9.2.07.002
- What to do
- Update WP Photo Album Plus to 9.2.07.002 or newer.
Aug 12, 2026Cookie Consent: Does not correctly enforce its intended administrator-only capability check on the REST route that stores its geolocation service license keyCVE-2026-18046 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Cookie Consent WordPress plugin before 0.0.10 does not correctly enforce its intended administrator-only capability check on the REST route that stores its geolocation service license key, so the route falls back to an authentication-only gate, allowing any authenticated user such as a subscriber to overwrite the stored key and disrupt the Cookie Consent WordPress plugin before 0.0.10's geolocation-based consent banner targeting.
- Product
- Cookie Consent
- Fixed in
- 0.0.10
- What to do
- Update Cookie Consent to 0.0.10 or newer.
Aug 12, 2026WP Travel Engine: Does not perform authorization or ownership checksCVE-2026-16737 · WordPress plugins & themes · reported by WPScanMedium 5.3
The WP Travel Engine WordPress plugin before 6.8.5 does not perform authorization or ownership checks when loading a caller-supplied booking identifier in one of its unauthenticated cart actions, allowing unauthenticated attackers to disclose any customer's booking order details and their stored billing information, and to overwrite that customer's booking record with their own data.
- Product
- WP Travel Engine
- Fixed in
- 6.8.5
- What to do
- Update WP Travel Engine to 6.8.5 or newer.
Aug 12, 2026Cookie Consent: Does not correctly enforce its intended administrator-only capability check on its consent-settings REST routesCVE-2026-15388 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Cookie Consent WordPress plugin before 0.0.10 does not correctly enforce its intended administrator-only capability check on its consent-settings REST routes, so they fall back to an authentication-only gate, allowing any authenticated user such as a subscriber to update the Cookie Consent WordPress plugin before 0.0.10's consent settings and, on sites connected to the vendor's paid plan, read stored visitor consent logs.
- Product
- Cookie Consent
- Fixed in
- 0.0.10
- What to do
- Update Cookie Consent to 0.0.10 or newer.
Aug 12, 2026Import WP: Does not perform any authorization check on one of its export-file download handlersCVE-2026-14925 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Import WP WordPress plugin before 2.14.23 does not perform any authorization check on one of its export-file download handlers, allowing unauthenticated attackers to download export files generated by administrators, which may contain user personal data such as email addresses, login names and roles. Exploitation requires an unconsumed export to already exist and a low-entropy, time-based download key to be obtained.
- Product
- Import WP
- Fixed in
- 2.14.23
- What to do
- Update Import WP to 2.14.23 or newer.
Aug 12, 2026WP Crowdfunding: Does not check the campaign-submission capability in one of its AJAX actionsCVE-2026-14859 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WP Crowdfunding WordPress plugin before 2.2.1 does not check the campaign-submission capability in one of its AJAX actions, allowing any authenticated users such as Subscribers to create crowdfunding campaign posts despite not being granted that permission.
- Product
- WP Crowdfunding
- Fixed in
- 2.2.1
- What to do
- Update WP Crowdfunding to 2.2.1 or newer.
Aug 12, 2026Eventin: Does not perform an authorization check on its waiting-list registration handlerCVE-2026-13171 · WordPress plugins & themes · reported by WPScanHigh 8.2
The Eventin WordPress plugin before 4.1.20 does not perform an authorization check on its waiting-list registration handler, allowing unauthenticated users to create WordPress user accounts for arbitrary email addresses and inject order records.
- Product
- Eventin
- Fixed in
- 4.1.20
- What to do
- Update Eventin to 4.1.20 or newer.
Aug 11, 2026Ray Enterprise Translation: Does not perform any capability or nonce checks on one of its AJAX actionsCVE-2026-14549 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Ray Enterprise Translation WordPress plugin through 1.7.3 does not perform any capability or nonce checks on one of its AJAX actions, allowing any authenticated user, including Subscribers, to add or delete the site's configured languages.
- Product
- Ray Enterprise Translation
- Affected
- up to 1.7.3
- What to do
- Affects up to 1.7.3. Update Ray Enterprise Translation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 11, 2026Ray Enterprise Translation: Does not perform any capability or nonce checks on one of its AJAX actionsCVE-2026-14548 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Ray Enterprise Translation WordPress plugin through 1.7.3 does not perform any capability or nonce checks on one of its AJAX actions, allowing any authenticated user, including Subscribers, to overwrite the administrator-configured translation API token with an arbitrary value.
- Product
- Ray Enterprise Translation
- Affected
- up to 1.7.3
- What to do
- Affects up to 1.7.3. Update Ray Enterprise Translation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 10, 2026Duplicate Post: Does not perform per-object authorisation checks in its bulk copy and delete operationsCVE-2026-19077 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Duplicate Post WordPress plugin before 1.5.5 does not perform per-object authorisation checks in its bulk copy and delete operations, allowing any user whose role an administrator has granted Duplicate Post WordPress plugin before 1.5.5 access to permanently delete arbitrary posts on the site, including those belonging to other users.
- Product
- Duplicate Post
- Fixed in
- 1.5.5
- What to do
- Update Duplicate Post to 1.5.5 or newer.
Aug 10, 2026CheckView: Does not restrict its REST API authentication filter to its own routes and unconditionally discards the authentication error raised for any request whose URI merely contains a CheckView WordPress plugin beforeCVE-2026-18786 · WordPress plugins & themes · reported by WPScanHigh 8.8
The CheckView WordPress plugin before 2.3.2 does not restrict its REST API authentication filter to its own routes and unconditionally discards the authentication error raised for any request whose URI merely contains a CheckView WordPress plugin before 2.3.2-specific string, making it possible for unauthenticated attackers to bypass the REST nonce check and perform any REST action available to a logged-in administrator, such as creating a new administrator account, via a crafted link an administrator is tricked into opening.
- Product
- CheckView
- Fixed in
- 2.3.2
- What to do
- Update CheckView to 2.3.2 or newer.
Aug 10, 2026File Manager: Does not perform any capability check on one of its file manager connector endpointsCVE-2026-17542 · WordPress plugins & themes · reported by WPScanHigh 7.5
The File Manager WordPress plugin before 6.9.1 does not perform any capability check on one of its file manager connector endpoints, allowing any authenticated user, such as a subscriber, to browse the entire WordPress installation directory and download files of certain types from it, including archives and documents which may contain sensitive data.
- Product
- File Manager
- Fixed in
- 6.9.1
- What to do
- Update File Manager to 6.9.1 or newer.
Aug 10, 2026File Manager: Does not have authorisation checks on one of its REST API routesCVE-2026-17541 · WordPress plugins & themes · reported by WPScanHigh 7.5
The File Manager WordPress plugin before 6.9.1 does not have authorisation checks on one of its REST API routes, allowing unauthenticated users to read its file activity log, disclosing the file operations performed on the site, the paths involved and the name of the user who performed them.
- Product
- File Manager
- Fixed in
- 6.9.1
- What to do
- Update File Manager to 6.9.1 or newer.
Aug 10, 2026Salon Booking System: Does not perform any capability check or validate an OAuth state value on its Google Calendar authorization callbackCVE-2026-17023 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Salon Booking System WordPress plugin through 10.30.33 does not perform any capability check or validate an OAuth state value on its Google Calendar authorization callback, which is also hooked for unauthenticated users, allowing an unauthenticated attacker to overwrite the site's stored Google Calendar connection tokens with attacker-controlled ones and hijack the integration. Exploitation requires the site to have configured its own Google OAuth client for the calendar feature.
- Product
- Salon Booking System
- Affected
- up to 10.30.33
- What to do
- Affects up to 10.30.33. Update Salon Booking System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 10, 2026CubeWP Framework: Does not perform a per-object read authorization checkCVE-2026-17018 · WordPress plugins & themes · reported by WPScanMedium 4.9
The CubeWP Framework WordPress plugin through 1.1.30 does not perform a per-object read authorization check, nor restrict which metadata keys may be requested, on one of its REST API endpoints, allowing users with the Contributor role and above to read arbitrary post metadata (including that of other users' draft, pending, private, and password-protected posts) and arbitrary user metadata of any user, including administrators.
- Product
- CubeWP Framework
- Affected
- up to 1.1.30
- What to do
- Affects up to 1.1.30. Update CubeWP Framework to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 10, 2026MotoPress Hotel Booking: Does not perform any authorization or ownership check on a REST endpoint that creates payment recordsCVE-2026-15237 · WordPress plugins & themes · reported by WPScanMedium 5.3
The MotoPress Hotel Booking WordPress plugin before 6.2.3 does not perform any authorization or ownership check on a REST endpoint that creates payment records, allowing unauthenticated users to create completed payment records against arbitrary bookings and falsely mark them as paid.
- Product
- MotoPress Hotel Booking
- Fixed in
- 6.2.3
- What to do
- Update MotoPress Hotel Booking to 6.2.3 or newer.
Aug 10, 2026Customer Reviews for WooCommerce: Does not perform nonce or capability checks on several settings-related AJAX actionsCVE-2026-14941 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Customer Reviews for WooCommerce WordPress plugin before 5.116.0 does not perform nonce or capability checks on several settings-related AJAX actions, allowing users with minimal permissions such as Subscribers to invoke administrative settings handlers, update Customer Reviews for WooCommerce WordPress plugin before 5.116.0 options, and disclose store configuration.
- Product
- Customer Reviews for WooCommerce
- Fixed in
- 5.116.0
- What to do
- Update Customer Reviews for WooCommerce to 5.116.0 or newer.
Aug 10, 2026Autopay: Does not perform any capability or nonce check before saving a styling option from a public requestCVE-2026-14293 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Autopay WordPress plugin before 5.0.1 does not perform any capability or nonce check before saving a styling option from a public request, and does not escape that value when it is later output on the checkout page, allowing unauthenticated attackers to store JavaScript that executes in the browser of any user, including administrators, who loads the checkout page.
- Product
- Autopay
- Fixed in
- 5.0.1
- What to do
- Update Autopay to 5.0.1 or newer.
Aug 10, 2026vitepos WordPress plugin before 3.6.0, Vitepos: Do not perform a per-target authorization check in their point-of-sale password-reset API and grant the custom Outlet Manager role an over-broad password-reset capability bCVE-2026-14237 · WordPress plugins & themes · reported by WPScanHigh 7.2
The vitepos WordPress plugin before 3.6.0, Vitepos WordPress plugin before 3.5.0 do not perform a per-target authorization check in their point-of-sale password-reset API and grant the custom Outlet Manager role an over-broad password-reset capability by default, allowing an Outlet Manager to reset any user's password, including an administrator's, and take over the account.
- Product
- vitepos WordPress plugin before 3.6.0, Vitepos
- Fixed in
- 3.6.0
- What to do
- Update vitepos WordPress plugin before 3.6.0, Vitepos to 3.6.0 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.