Updated 1 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

474new WordPress flaws this week

390,714entries in the database

1,932 results · page 8 of 39

Jul 2, 2026Unauthenticated Broken Access Control in NOWPayments for WooCommerce <= 1.4.0 versions.CVE-2026-39448 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in NOWPayments for WooCommerce <= 1.4.0 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jul 2, 2026Unauthenticated Broken Access Control in Woostify Sites Library <= 1.6.2 versions.CVE-2025-66076 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Broken Access Control in Woostify Sites Library <= 1.6.2 versions.
Affected
up to 1.6.2
What to do
Affects up to 1.6.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 29, 2026Unauthenticated Broken Access Control in Japanized For WooCommerce <= 2.9.12 versions.CVE-2026-57340 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Broken Access Control in Japanized For WooCommerce <= 2.9.12 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jun 29, 2026Unauthenticated Broken Access Control in Business Directory <= 6.4.23 versions.CVE-2026-57339 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Broken Access Control in Business Directory <= 6.4.23 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jun 29, 2026Subscriber Broken Access Control in Ads by WPQuads <= 3.0.3 versions.CVE-2026-57335 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Subscriber Broken Access Control in Ads by WPQuads <= 3.0.3 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jun 29, 2026Unauthenticated Broken Access Control in WP User Frontend <= 4.3.7 versions.CVE-2026-57334 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Broken Access Control in WP User Frontend <= 4.3.7 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jun 29, 2026Subscriber Broken Access Control in Wallet System for WooCommerce <= 2.7.6 versions.CVE-2026-57332 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Subscriber Broken Access Control in Wallet System for WooCommerce <= 2.7.6 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jun 29, 2026Subscriber Broken Access Control in MainWP <= 6.1.1 versions.CVE-2026-57327 · WordPress plugins & themes · reported by PatchstackMedium 6.3
Subscriber Broken Access Control in MainWP <= 6.1.1 versions.
Affected
up to 6.1.1
What to do
Affects up to 6.1.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 29, 2026Simple User Avatar: Authorization Bypass Through User-Controlled KeyCVE-2026-57676 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Authorization Bypass Through User-Controlled Key vulnerability in Matteo Manna Simple User Avatar allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Simple User Avatar: from n/a through 4.9.
Product
Simple User Avatar
Affected
up to 4.9
What to do
Affects up to 4.9. Update Simple User Avatar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 26, 2026Subscriber Broken Access Control in WPComplete <= 2.9.5.5 versions.CVE-2026-57661 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Subscriber Broken Access Control in WPComplete <= 2.9.5.5 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jun 26, 2026Unauthenticated Broken Access Control in Booking and Rental Manager <= 2.7.1 versions.CVE-2026-57660 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Broken Access Control in Booking and Rental Manager <= 2.7.1 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jun 26, 2026Affiliate Broken Access Control in Affiliates Manager <= 2.9.49 versions.CVE-2026-57654 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Affiliate Broken Access Control in Affiliates Manager <= 2.9.49 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jun 26, 2026Subscriber Broken Access Control in Shoppable Images Lite <= 1.3 versions.CVE-2026-57649 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Subscriber Broken Access Control in Shoppable Images Lite <= 1.3 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jun 26, 2026Contributor Broken Access Control in Nelio Content <= 4.3.4 versions.CVE-2026-57648 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Contributor Broken Access Control in Nelio Content <= 4.3.4 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jun 26, 2026newsletters_subscribers Broken Access Control in Newsletters <= 4.13 versions.CVE-2026-57645 · WordPress plugins & themes · reported by PatchstackHigh 8.1
newsletters_subscribers Broken Access Control in Newsletters <= 4.13 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jun 26, 2026Subscriber Broken Access Control in MasterStudy LMS <= 3.7.30 versions.CVE-2026-57640 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Subscriber Broken Access Control in MasterStudy LMS <= 3.7.30 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jun 26, 2026Subscriber Broken Access Control in Email Marketing for WooCommerce by Omnisend <= 1.19.0 versions.CVE-2026-57632 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Subscriber Broken Access Control in Email Marketing for WooCommerce by Omnisend <= 1.19.0 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jun 26, 2026Subscriber Broken Access Control in WPCafe <= 3.0.14 versions.CVE-2026-57622 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Subscriber Broken Access Control in WPCafe <= 3.0.14 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jun 26, 2026Contributor Broken Access Control in SEOPress PRO <= 9.1.1 versions.CVE-2026-57430 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Contributor Broken Access Control in SEOPress PRO <= 9.1.1 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jun 26, 2026Unauthenticated Broken Access Control in GIFT4U <= 1.0.10 versions.CVE-2026-57324 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Broken Access Control in GIFT4U <= 1.0.10 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jun 26, 2026Unauthenticated Broken Access Control in Flash & HTML5 Video <= 2.11.0 versions.CVE-2026-57323 · WordPress plugins & themes · reported by PatchstackMedium 5.8
Unauthenticated Broken Access Control in Flash & HTML5 Video <= 2.11.0 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jun 26, 2026Unauthenticated Broken Access Control in MailChimp Block <= 1.1.15 versions.CVE-2026-56063 · WordPress plugins & themes · reported by PatchstackHigh 8.3
Unauthenticated Broken Access Control in MailChimp Block <= 1.1.15 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jun 26, 2026Unauthenticated Broken Access Control in Subscriptions for WooCommerce <= 1.9.5 versions.CVE-2026-56061 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in Subscriptions for WooCommerce <= 1.9.5 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jun 26, 2026Unauthenticated Broken Access Control in Paymob for WooCommerce <= 4.1.2 versions.CVE-2026-56025 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in Paymob for WooCommerce <= 4.1.2 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jun 26, 2026Unauthenticated Broken Access Control in Stylish Cost Calculator <= 8.3.9 versions.CVE-2026-54847 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in Stylish Cost Calculator <= 8.3.9 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jun 26, 2026Unauthenticated Broken Access Control in Syncee Premium Dropshipping & Wholesale <= 1.0.27 versions.CVE-2026-54846 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in Syncee Premium Dropshipping & Wholesale <= 1.0.27 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jun 26, 2026Unauthenticated Broken Access Control in Newsletters <= 4.13 versions.CVE-2026-54840 · WordPress plugins & themes · reported by PatchstackHigh 7.3
Unauthenticated Broken Access Control in Newsletters <= 4.13 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jun 26, 2026Unauthenticated Broken Access Control in Intranet & Private Site – All-In-One Intranet <= 1.8.1 versions.CVE-2026-54837 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in Intranet & Private Site – All-In-One Intranet <= 1.8.1 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jun 26, 2026Unauthenticated Broken Access Control in Five Star Restaurant Menu <= 2.5.2 versions.CVE-2026-54835 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in Five Star Restaurant Menu <= 2.5.2 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jun 26, 2026Unauthenticated Broken Access Control in Gutenverse Companion <= 2.5.0 versions.CVE-2026-54832 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in Gutenverse Companion <= 2.5.0 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jun 26, 2026Unauthenticated Broken Access Control in User Registration <= 5.2.2 versions.CVE-2026-52701 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Broken Access Control in User Registration <= 5.2.2 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jun 26, 2026Unauthenticated Broken Access Control in SiteGround Email Marketing <= 1.7.5 versions.CVE-2026-24547 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Broken Access Control in SiteGround Email Marketing <= 1.7.5 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jun 26, 2026Unauthenticated Broken Access Control in Donation Thermometer <= 2.2.7 versions.CVE-2025-64636 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Broken Access Control in Donation Thermometer <= 2.2.7 versions.
Affected
up to 2.2.7
What to do
Affects up to 2.2.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 26, 2026Contributor Broken Access Control in Live Copy Paste for Elementor <= 1.5.3 versions.CVE-2025-63079 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Contributor Broken Access Control in Live Copy Paste for Elementor <= 1.5.3 versions.
Affected
up to 1.5.3
What to do
Affects up to 1.5.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 26, 2026Subscriber Broken Access Control in Restaurant Menu by MotoPress <= 2.4.11 versions.CVE-2025-63078 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Subscriber Broken Access Control in Restaurant Menu by MotoPress <= 2.4.11 versions.
Affected
up to 2.4.11
What to do
Affects up to 2.4.11. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 26, 2026Contributor Broken Access Control in Forget About Shortcode Buttons <= 2.1.3 versions.CVE-2025-63041 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Contributor Broken Access Control in Forget About Shortcode Buttons <= 2.1.3 versions.
Affected
up to 2.1.3
What to do
Affects up to 2.1.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 25, 2026Contributor Broken Access Control in Slim SEO <= 4.6.2 versions.CVE-2026-57429 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Broken Access Control in Slim SEO <= 4.6.2 versions.
Affected
up to 4.6.2
What to do
Affects up to 4.6.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 25, 2026PPOM for WooCommerce: Improper Access ControlCVE-2026-56050 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Access Control vulnerability in Themeisle PPOM for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects PPOM for WooCommerce: from n/a through 33.0.18.
Product
PPOM for WooCommerce
Affected
up to 33.0.18
What to do
Affects up to 33.0.18. Update PPOM for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 25, 2026Customer Broken Access Control in UPI QR Code Payment Gateway for WooCommerce <= 1.6.2 versions.CVE-2026-56023 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Customer Broken Access Control in UPI QR Code Payment Gateway for WooCommerce <= 1.6.2 versions.
Affected
up to 1.6.2
What to do
Affects up to 1.6.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 25, 2026Unauthenticated Broken Access Control in CheckView Automated Testing <= 2.1.0 versions.CVE-2026-54844 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in CheckView Automated Testing <= 2.1.0 versions.
Affected
up to 2.1.0
What to do
Affects up to 2.1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 25, 2026Unauthenticated Broken Access Control in Five Star Restaurant Reservations <= 2.7.19 versions.CVE-2026-54830 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in Five Star Restaurant Reservations <= 2.7.19 versions.
Affected
up to 2.7.19
What to do
Affects up to 2.7.19. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 25, 2026Unauthenticated Broken Access Control in Motors <= 1.4.109 versions.CVE-2026-54828 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in Motors <= 1.4.109 versions.
Affected
up to 1.4.109
What to do
Affects up to 1.4.109. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 25, 2026Unauthenticated Broken Access Control in MainWP Child <= 6.1.1 versions.CVE-2026-27366 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in MainWP Child <= 6.1.1 versions.
Affected
up to 6.1.1
What to do
Affects up to 6.1.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 25, 2026Masteriyo LMS: Does not perform authorization checks in a course-progress REST API controllerCVE-2026-10824 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Masteriyo LMS WordPress plugin before 2.2.1 does not perform authorization checks in a course-progress REST API controller, allowing unauthenticated users to read and permanently delete any user's course-progress records.
Product
Masteriyo LMS
Fixed in
2.2.1
What to do
Update Masteriyo LMS to 2.2.1 or newer.
Full record and what to do →NVD record wpscan.com
Jun 17, 2026Advanced Ads: Improper Control of Generation of Code ('Code Injection')CVE-2026-54816 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Generation of Code ('Code Injection') vulnerability in Monetizemore Advanced Ads allows Remote Code Inclusion. This issue affects Advanced Ads: from n/a through 2.0.21.
Product
Advanced Ads
Affected
up to 2.0.21
What to do
Affects up to 2.0.21. Update Advanced Ads to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 17, 2026Motors: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-54814 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in StylemixThemes Motors allows PHP Local File Inclusion. This issue affects Motors: from n/a through 1.4.109.
Product
Motors
Affected
up to 1.4.109
What to do
Affects up to 1.4.109. Update Motors to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 17, 2026WP Magnific Popup: Does not properly escape user-controlled link URLs before injecting them into the DOMCVE-2026-7850 · WordPress plugins & themes · reported by WPScanMedium 5.9
The WP Magnific Popup WordPress plugin through 1.0 does not properly escape user-controlled link URLs before injecting them into the DOM when displaying image load error messages, allowing authenticated attackers with Author-level access or above to perform Stored Cross-Site Scripting attacks against any visiting user.
Product
WP Magnific Popup
Affected
up to 1.0
What to do
Affects up to 1.0. Update WP Magnific Popup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Jun 17, 2026Unauthenticated Broken Access Control in User Registration Stripe <= 1.3.12 versions.CVE-2026-49081 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Unauthenticated Broken Access Control in User Registration Stripe <= 1.3.12 versions.
Affected
up to 1.3.12
What to do
Affects up to 1.3.12. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 17, 2026Unauthenticated Broken Access Control in WooCommerce Anti-Fraud <= 7.2.6 versions.CVE-2026-49072 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Broken Access Control in WooCommerce Anti-Fraud <= 7.2.6 versions.
Affected
up to 7.2.6
What to do
Affects up to 7.2.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 17, 2026Unauthenticated Broken Access Control in JobSearch <= 3.2.7 versions.CVE-2026-49057 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in JobSearch <= 3.2.7 versions.
Affected
up to 3.2.7
What to do
Affects up to 3.2.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.