Vulnerability database

5,812 results · page 8 of 117

• Jul 13, 2026Real Estate Manager Pro: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-57398 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WebCodingPlace Real Estate Manager Pro real-estate-manager-pro allows Reflected XSS.This issue affects Real Estate Manager Pro: from n/a through <= 12.8.3.

  Product

  Real Estate Manager Pro

  Affected

  up to 12.8.3

  What to do

  Affects up to 12.8.3. Update Real Estate Manager Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 13, 2026Free Gifts for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-57396 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Flintop Free Gifts for WooCommerce free-gifts-for-woocommerce allows Stored XSS.This issue affects Free Gifts for WooCommerce: from n/a through <= 13.1.0.

  Product

  Free Gifts for WooCommerce

  Affected

  up to 13.1.0

  What to do

  Affects up to 13.1.0. Update Free Gifts for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 13, 2026Newsletters: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-57394 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tribulant Software Newsletters newsletters-lite allows Reflected XSS.This issue affects Newsletters: from n/a through <= 4.14.

  Product

  Newsletters

  Affected

  up to 4.14

  What to do

  Affects up to 4.14. Update Newsletters to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 13, 2026Loops & Logic: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-57391 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tangible Loops & Logic tangible-loops-and-logic allows Stored XSS.This issue affects Loops & Logic: from n/a through <= 4.2.3.

  Product

  Loops & Logic

  Affected

  up to 4.2.3

  What to do

  Affects up to 4.2.3. Update Loops & Logic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 13, 2026Hydra Booking: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-57388 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themefic Hydra Booking hydra-booking allows Stored XSS.This issue affects Hydra Booking: from n/a through <= 1.1.44.

  Product

  Hydra Booking

  Affected

  up to 1.1.44

  What to do

  Affects up to 1.1.44. Update Hydra Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 13, 2026picu: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-57387 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in picu picu picu allows Stored XSS.This issue affects picu: from n/a through <= 3.5.1.

  Product

  picu

  Affected

  up to 3.5.1

  What to do

  Affects up to 3.5.1. Update picu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 13, 2026JobSearch: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-57383 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in eyecix JobSearch wp-jobsearch allows Stored XSS.This issue affects JobSearch: from n/a through <= 3.2.9.

  Product

  JobSearch

  Affected

  up to 3.2.9

  What to do

  Affects up to 3.2.9. Update JobSearch to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 13, 2026Simple File List: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-57382 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mitchell Bennis Simple File List simple-file-list allows Reflected XSS.This issue affects Simple File List: from n/a through <= 6.3.8.

  Product

  Simple File List

  Affected

  up to 6.3.8

  What to do

  Affects up to 6.3.8. Update Simple File List to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 13, 2026PropertyHive: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-57381 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Property Hive PropertyHive propertyhive allows Reflected XSS.This issue affects PropertyHive: from n/a through <= 2.2.3.

  Product

  PropertyHive

  Affected

  up to 2.2.3

  What to do

  Affects up to 2.2.3. Update PropertyHive to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 13, 2026Extensions for Leaflet Map: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-57380 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hupe13 Extensions for Leaflet Map extensions-leaflet-map allows DOM-Based XSS.This issue affects Extensions for Leaflet Map: from n/a through <= 5.1.

  Product

  Extensions for Leaflet Map

  Affected

  up to 5.1

  What to do

  Affects up to 5.1. Update Extensions for Leaflet Map to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 13, 2026FormyChat: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-57379 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPPOOL FormyChat social-contact-form allows Stored XSS.This issue affects FormyChat: from n/a through <= 2.15.3.

  Product

  FormyChat

  Affected

  up to 2.15.3

  What to do

  Affects up to 2.15.3. Update FormyChat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 13, 2026ElementInvader Addons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-57376 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Element Invader ElementInvader Addons for Elementor elementinvader-addons-for-elementor allows DOM-Based XSS.This issue affects ElementInvader Addons for Elementor: from n/a through <= 1.4.3.

  Product

  ElementInvader Addons for Elementor

  Affected

  up to 1.4.3

  What to do

  Affects up to 1.4.3. Update ElementInvader Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 13, 2026Themify Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-57369 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themifyme Themify Builder themify-builder allows Reflected XSS.This issue affects Themify Builder: from n/a through <= 7.7.4.

  Product

  Themify Builder

  Affected

  up to 7.7.4

  What to do

  Affects up to 7.7.4. Update Themify Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 13, 2026Jobmonster: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-57368 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NooTheme Jobmonster noo-jobmonster allows Reflected XSS.This issue affects Jobmonster: from n/a through <= 4.8.5.

  Product

  Jobmonster

  Affected

  up to 4.8.5

  What to do

  Affects up to 4.8.5. Update Jobmonster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 13, 2026reCAPTCHA (v2 & v3) for Asgaros Forum: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-57365 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Hitesh Chandwani reCAPTCHA (v2 & v3) for Asgaros Forum recaptcha-for-asgaros-forum allows DOM-Based XSS.This issue affects reCAPTCHA (v2 & v3) for Asgaros Forum: from n/a through <= 1.1.0.

  Product

  reCAPTCHA (v2 & v3) for Asgaros Forum

  Affected

  up to 1.1.0

  What to do

  Affects up to 1.1.0. Update reCAPTCHA (v2 & v3) for Asgaros Forum to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 13, 2026Better Payment – Instant Payments, Donations, Fundraising with Subscriptions & More: Improper Validation of Specified Quantity in InputCVE-2026-57364 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Validation of Specified Quantity in Input vulnerability in WPDeveloper Better Payment – Instant Payments, Donations, Fundraising with Subscriptions & More better-payment allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Better Payment – Instant Payments, Donations, Fundraising with Subscriptions & More: from n/a through <= 2.2.0.

  Product

  Better Payment – Instant Payments, Donations, Fundraising with Subscriptions & More

  Affected

  up to 2.2.0

  What to do

  Affects up to 2.2.0. Update Better Payment – Instant Payments, Donations, Fundraising with Subscriptions & More to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 13, 2026ChatBot: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-57363 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in QuantumCloud ChatBot chatbot allows Stored XSS.This issue affects ChatBot: from n/a through <= 8.3.7.

  Product

  ChatBot

  Affected

  up to 8.3.7

  What to do

  Affects up to 8.3.7. Update ChatBot to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 10, 2026SureForms – Drag and Drop Form Builder for: Improper Input ValidationCVE-2026-15288 · WordPress plugins & themes · reported by WordfenceHigh 7.5

  The SureForms – Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to Improper Input Validation in all versions up to, and including, 2.2.1. This is due to the plugin accepting the payment amount directly from user-controlled POST data in the 'create_payment_intent' and 'create_subscription_intent' functions without validating it against the form's configured price. This makes it possible for unauthenticated attackers to modify the payment amount to any arbitrary value when submitting a Stripe payment form, potentially purchasing products or services at significantly reduced prices.

  Product

  SureForms – Drag and Drop Form Builder for

  Affected

  up to 2.2.1

  What to do

  Affects up to 2.2.1. Update SureForms – Drag and Drop Form Builder for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Jul 9, 2026LoginPress Pro: Authentication bypassCVE-2026-12598 · WordPress plugins & themes · reported by WordfenceHigh 8.1

  The LoginPress Pro plugin for WordPress is vulnerable to authentication bypass in versions up to and including 6.2.3 via the Spotify Social Login addon. This is due to the loginpress_on_spotify_login() function trusting the unverified 'email' field returned by Spotify's /v1/me endpoint and using it directly with get_user_by('email', $profile['email']) to identify and log in an existing WordPress account, without confirming that the Spotify user actually owns the email address (Spotify documents that the profile email is unverified) and without requiring the user to prove ownership of the matching WordPress account. This makes it possible for unauthenticated attackers to log in as any existing WordPress user, including Administrators, by registering a Spotify account using the targeted user's email address and authenticating via the Spotify provider.

  Product

  LoginPress Pro

  Affected

  up to 6.2.3

  What to do

  Affects up to 6.2.3. Update LoginPress Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordloginpress.prowordfence.com

• Jul 9, 2026LoginPress Pro: Authentication BypassCVE-2026-12597 · WordPress plugins & themes · reported by WordfenceHigh 8.1

  The LoginPress Pro plugin for WordPress is vulnerable to Authentication Bypass via the GitHub OAuth callback in versions up to, and including, 6.2.3. The vulnerability exists in the loginpress_on_github_login() function, which blindly trusts the first element (profile[0]['email']) of the array returned by GitHub's /user/emails endpoint as an account-binding identifier without verifying that the email carries a verified === true status. This makes it possible for unauthenticated attackers to log in as any existing WordPress user, including administrators, by adding an unverified email address matching a local account to their GitHub profile and triggering the OAuth callback via a crafted code parameter — causing the plugin to call get_user_by('email', ...) and establish an authenticated session for the matched account. Practical exploitation is conditional on GitHub returning the attacker-added unverified email at index 0 of the /user/emails response, as GitHub typically prioritizes the primary verified address first; nonetheless, the absence of any email verification check in the plugin constitutes a fundamental authentication bypass flaw.

  Product

  LoginPress Pro

  Affected

  up to 6.2.3

  What to do

  Affects up to 6.2.3. Update LoginPress Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordloginpress.prowordfence.com

• Jul 9, 2026LoginPress Pro: Authentication BypassCVE-2026-12595 · WordPress plugins & themes · reported by WordfenceHigh 8.1

  The LoginPress Pro plugin for WordPress is vulnerable to Authentication Bypass via Unverified OAuth Email in all versions up to and including 6.2.3. The vulnerability exists in the loginpress_on_discord_login() Discord OAuth callback handler, which accepts the email field returned by Discord's /users/@me endpoint without ever checking that the profile's verified flag is true, then directly maps that email to a local WordPress account via get_user_by('email', $profile['email']) and issues an authenticated session cookie via wp_set_auth_cookie(). This makes it possible for unauthenticated attackers to take over any existing WordPress account — including administrator accounts — by registering a Discord account configured with an unverified email address that matches the target user's registered WordPress email and completing the standard Discord OAuth flow.

  Product

  LoginPress Pro

  Affected

  up to 6.2.3

  What to do

  Affects up to 6.2.3. Update LoginPress Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordloginpress.prowordfence.com

• Jul 8, 2026LatePoint – Calendar Booking Plugin for Appointments and Events: Improper Input ValidationCVE-2026-5356 · WordPress plugins & themes · reported by WordfenceHigh 7.5

  The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Improper Input Validation in all versions up to, and including, 5.4.0. This is due to the plugin's Stripe Connect payment processor accepting a client-supplied PaymentIntent ID. This makes it possible for unauthenticated attackers to pay an arbitrary amount by supplying a previously succeeded PaymentIntent token.

  Product

  LatePoint – Calendar Booking Plugin for Appointments and Events

  Affected

  up to 5.4.0

  What to do

  Affects up to 5.4.0. Update LatePoint – Calendar Booking Plugin for Appointments and Events to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com

• Jul 7, 2026Frontend File Manager: Does not validate a file path derived from user input before deleting the referenced fileCVE-2026-12277 · WordPress plugins & themes · reported by WPScanHigh 8.7

  The Frontend File Manager Plugin WordPress plugin through 23.6 does not validate a file path derived from user input before deleting the referenced file, allowing unauthenticated users to delete arbitrary files on the server (such as wp-config.php) when guest upload mode is enabled. Deleting wp-config.php forces the site into its setup routine, which can be leveraged toward a full site takeover.

  Product

  Frontend File Manager

  Affected

  up to 23.6

  What to do

  Affects up to 23.6. Update Frontend File Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordwpscan.com

• Jul 2, 2026Slider Revolution: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-57678 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemePunch Slider Revolution allows Reflected XSS. This issue affects Slider Revolution: from 7.0.0 through 7.0.16.

  Product

  Slider Revolution

  Affected

  up to 7.0.16

  What to do

  Affects up to 7.0.16. Update Slider Revolution to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 2, 2026imithemes NativeChurch nativechurch: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-27408 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in imithemes NativeChurch nativechurch allows Reflected XSS.This issue affects NativeChurch: from n/a before 4.9.5.

  Product

  imithemes NativeChurch nativechurch

  Fixed in

  4.9.5

  What to do

  Update imithemes NativeChurch nativechurch to 4.9.5 or newer.

  Full record and what to do →NVD recordpatchstack.com

• Jul 1, 2026Averta LTD Shortcodes and extra features for Phlox theme auxin-elements: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-57737 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Averta LTD Shortcodes and extra features for Phlox theme auxin-elements allows DOM-Based XSS.This issue affects Shortcodes and extra features for Phlox theme: from n/a through 2.17.22.

  Product

  Averta LTD Shortcodes and extra features for Phlox theme auxin-elements

  Affected

  up to 2.17.22

  What to do

  Affects up to 2.17.22. Update Averta LTD Shortcodes and extra features for Phlox theme auxin-elements to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 1, 2026Enable Media Replace: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-57722 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ShortPixel Enable Media Replace allows Stored XSS. This issue affects Enable Media Replace: from n/a through 4.2.1.

  Product

  Enable Media Replace

  Affected

  up to 4.2.1

  What to do

  Affects up to 4.2.1. Update Enable Media Replace to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 26, 2026weDevs weMail wemail: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-57322 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in weDevs weMail wemail allows Reflected XSS.This issue affects weMail: from n/a through 2.1.2.

  Product

  weDevs weMail wemail

  Affected

  up to 2.1.2

  What to do

  Affects up to 2.1.2. Update weDevs weMail wemail to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 26, 2026Exclusive Addons Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-57620 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tim Strifler Exclusive Addons Elementor allows Stored XSS. This issue affects Exclusive Addons Elementor: from n/a through 2.7.9.8.

  Product

  Exclusive Addons Elementor

  Affected

  up to 2.7.9.8

  What to do

  Affects up to 2.7.9.8. Update Exclusive Addons Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 25, 2026Master Slider: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-56014 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Averta Master Slider master-slider allows Reflected XSS.This issue affects Master Slider: from n/a through 3.11.5.

  Product

  Master Slider

  Affected

  up to 3.11.5

  What to do

  Affects up to 3.11.5. Update Master Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 25, 2026WP Activity Log: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-56005 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Melapress WP Activity Log wp-security-audit-log allows Stored XSS.This issue affects WP Activity Log: from n/a through 5.6.3.1.

  Product

  WP Activity Log

  Affected

  up to 5.6.3.1

  What to do

  Affects up to 5.6.3.1. Update WP Activity Log to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 25, 2026InPost PL: Does not verify that the request originates from the legitimate buyer before allowing the WooCommerce order parcel-locker destination to be updatedCVE-2026-9702 · WordPress plugins & themes · reported by WPScanHigh 7.5

  The InPost PL WordPress plugin before 1.9.1 does not verify that the request originates from the legitimate buyer before allowing the WooCommerce order parcel-locker destination to be updated, allowing unauthenticated attackers to silently redirect the shipping destination of any pending or processing order on the site.

  Product

  InPost PL

  Fixed in

  1.9.1

  What to do

  Update InPost PL to 1.9.1 or newer.

  Full record and what to do →NVD recordwpscan.com

• Jun 23, 2026Simple Basic Contact Form: Does not escape user-supplied input before reflecting it into the contact form output on validation errorsCVE-2026-8172 · WordPress plugins & themes · reported by WPScanHigh 7.1

  The Simple Basic Contact Form WordPress plugin through 20250114 does not escape user-supplied input before reflecting it into the contact form output on validation errors, leading to a Reflected Cross-Site Scripting vulnerability that unauthenticated attackers can exploit against site visitors via a crafted link or cross-site form submission.

  Product

  Simple Basic Contact Form

  Affected

  up to 20250114

  What to do

  Affects up to 20250114. Update Simple Basic Contact Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordwpscan.com

• Jun 18, 2026Bricksable for Bricks Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-56009 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bricksable for Bricks Builder allows Stored XSS. This issue affects Bricksable for Bricks Builder: from n/a through 1.6.83.

  Product

  Bricksable for Bricks Builder

  Affected

  up to 1.6.83

  What to do

  Affects up to 1.6.83. Update Bricksable for Bricks Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 18, 2026Ocean Product Sharing: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-56007 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in OceanWP Ocean Product Sharing allows Stored XSS. This issue affects Ocean Product Sharing: from n/a through 2.2.2.

  Product

  Ocean Product Sharing

  Affected

  up to 2.2.2

  What to do

  Affects up to 2.2.2. Update Ocean Product Sharing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 17, 2026Unauthenticated Privilege Escalation in LoginPress Pro <= 6.2.2 versions.CVE-2026-49058 · WordPress plugins & themes · reported by PatchstackCritical 9.8

  Unauthenticated Privilege Escalation in LoginPress Pro <= 6.2.2 versions.

  Affected

  up to 6.2.2

  What to do

  Affects up to 6.2.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 17, 2026Themify Folo: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31013 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themify Folo allows Reflected XSS. This issue affects Themify Folo: from n/a through 1.9.6.

  Product

  Themify Folo

  Affected

  up to 1.9.6

  What to do

  Affects up to 1.9.6. Update Themify Folo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 16, 2026Unauthenticated SQL Injection in InPost Gallery <= 2.1.4.6 versions.CVE-2026-39574 · WordPress plugins & themes · reported by PatchstackCritical 9.3

  Unauthenticated SQL Injection in InPost Gallery <= 2.1.4.6 versions.

  Affected

  up to 2.1.4.6

  What to do

  Affects up to 2.1.4.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 11, 2026SliceWP: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-42653 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in iova.Mihai SliceWP allows Stored XSS. This issue affects SliceWP: from n/a through 1.2.6.

  Product

  SliceWP

  Affected

  up to 1.2.6

  What to do

  Affects up to 1.2.6. Update SliceWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 11, 2026WP Mail Log: Improper neutralization of input during web page generation ('cross-site scripting')CVE-2023-33999 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in WPVibes WP Mail Log allows DOM-Based XSS. This issue affects WP Mail Log: from n/a through 1.0.2.

  Product

  WP Mail Log

  Affected

  up to 1.0.2

  What to do

  Affects up to 1.0.2. Update WP Mail Log to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 10, 2026WPZOOM Portfolio: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-49069 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPZOOM Portfolio allows Reflected XSS. This issue affects WPZOOM Portfolio: from n/a through 1.4.21.

  Product

  WPZOOM Portfolio

  Affected

  up to 1.4.21

  What to do

  Affects up to 1.4.21. Update WPZOOM Portfolio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 5, 2026Product Slider Pro for WooCommerce: Improper Validation of Specified Quantity in InputCVE-2026-49777 · WordPress plugins & themes · reported by PatchstackCritical 10

  Improper Validation of Specified Quantity in Input vulnerability in ShapedPlugin, LLC Product Slider Pro for WooCommerce allows Malicious Software Implanted. This issue affects Product Slider Pro for WooCommerce: from n/a before 3.5.4.

  Product

  Product Slider Pro for WooCommerce

  Fixed in

  3.5.4

  What to do

  Update Product Slider Pro for WooCommerce to 3.5.4 or newer.

  Full record and what to do →NVD recordpatchstack.com

• Jun 3, 2026Prague: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-15654 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Fox-themes Prague allows Reflected XSS. This issue affects Prague: from n/a through 2.2.8.

  Product

  Prague

  Affected

  up to 2.2.8

  What to do

  Affects up to 2.2.8. Update Prague to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 2, 2026Progress Planner: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-28116 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Emilia Projects Progress Planner allows Stored XSS. This issue affects Progress Planner: from n/a through 1.9.0.

  Product

  Progress Planner

  Affected

  up to 1.9.0

  What to do

  Affects up to 1.9.0. Update Progress Planner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 2, 2026WP Job Portal: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-42685 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ahmad WP Job Portal allows Reflected XSS. This issue affects WP Job Portal: from n/a through 2.5.1.

  Product

  WP Job Portal

  Affected

  up to 2.5.1

  What to do

  Affects up to 2.5.1. Update WP Job Portal to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 2, 2026Accordion FAQ: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-52759 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in UnboundStudio Accordion FAQ allows Reflected XSS. This issue affects Accordion FAQ: from n/a through 2.2.1.

  Product

  Accordion FAQ

  Affected

  up to 2.2.1

  What to do

  Affects up to 2.2.1. Update Accordion FAQ to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 1, 2026GiveWP: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-42678 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / StellarWP GiveWP allows DOM-Based XSS. This issue affects GiveWP: from n/a through 4.14.5.

  Product

  GiveWP

  Affected

  up to 4.14.5

  What to do

  Affects up to 4.14.5. Update GiveWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 1, 2026myCred: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-42676 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in myCred allows Stored XSS. This issue affects myCred: from n/a through 3.0.4.

  Product

  myCred

  Affected

  up to 3.0.4

  What to do

  Affects up to 3.0.4. Update myCred to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 1, 2026LearnPress: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-48865 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThimPress LearnPress allows Reflected XSS. This issue affects LearnPress: from n/a through 4.3.6.

  Product

  LearnPress

  Affected

  up to 4.3.6

  What to do

  Affects up to 4.3.6. Update LearnPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 1, 2026WP Statistics: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-48839 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VeronaLabs WP Statistics allows DOM-Based XSS. This issue affects WP Statistics: from n/a through 14.16.6.

  Product

  WP Statistics

  Affected

  up to 14.16.6

  What to do

  Affects up to 14.16.6. Update WP Statistics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.