Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,380 results · page 8 of 48
Aug 11, 2026Kirki – Freeform Page Builder, Website Builder & Customizer: Stored Cross-Site ScriptingCVE-2026-16974 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the post_meta Shortcode in all versions up to, and including, 6.2.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Kirki – Freeform Page Builder, Website Builder & Customizer
- Affected
- up to 6.2.0
- What to do
- Affects up to 6.2.0. Update Kirki – Freeform Page Builder, Website Builder & Customizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Aug 10, 2026tar-rs versions 0.4.11 through 0.4.46 contain a symlink escape vulnerability in the Builder::append_dir_all() function that allows attackers to read files outsiCVE-2026-70622 · Other software · composefs · reported by VulnCheckHigh 7.1
tar-rs versions 0.4.11 through 0.4.46 contain a symlink escape vulnerability in the Builder::append_dir_all() function that allows attackers to read files outside the intended source root directory by planting symlinks in an attacker-controlled directory. When a privileged process archives an untrusted directory, the function follows symlinks without verifying that resolved targets remain within the source root, causing out-of-bounds files to be included in the archive as regular files and disclosed to the attacker.
- Product
- tar-rs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comvulncheck.com
Aug 8, 2026A security flaw has been discovered in adolfosalasgomez3011 slidev-builder-mcp 2.1.0.CVE-2026-19281 · Other software · adolfosalasgomez3011 · reported by VulDBLow 1.9
A security flaw has been discovered in adolfosalasgomez3011 slidev-builder-mcp 2.1.0. This affects the function generateChart of the file src/tools/generateAssets.ts of the component generateAssets Tool. Performing a manipulation of the argument outputDir results in command injection. The attack is only possible with local access. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- slidev-builder-mcp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 8, 2026YMC Filter: Does not sanitize and escape a layout builder setting before outputting it on a public endpointCVE-2026-16558 · WordPress plugins & themes · reported by WPScanMedium 5.4
The YMC Filter WordPress plugin before 3.12.8 does not sanitize and escape a layout builder setting before outputting it on a public endpoint, and does not verify object ownership when the setting is saved, allowing users with the Contributor role and above to store JavaScript that executes in the browser of any visitor viewing an affected filter.
- Product
- YMC Filter
- Fixed in
- 3.12.8
- What to do
- Update YMC Filter to 3.12.8 or newer.
Aug 7, 2026Joomla Extension - joomshaper.com - Unauthenticated stored XSS in Shapes API endpoint SP Page Builder < 6.7.0 - An unauthenticated attacker can store malicious CVE-2026-66494 · Websites & servers · reported by security@joomla.orgHigh 8.7
Joomla Extension - joomshaper.com - Unauthenticated stored XSS in Shapes API endpoint SP Page Builder < 6.7.0 - An unauthenticated attacker can store malicious JavaScript in a Joomla site's database via a single HTTP request. When an administrator opens the SP Page Builder editor, the JavaScript executes in their browser automatically..
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 6, 2026Unauthenticated Broken Access Control in Profile Builder <= 3.16.5 versions.CVE-2026-66701 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Broken Access Control in Profile Builder <= 3.16.5 versions.
- Affected
- up to 3.16.5
- What to do
- Affects up to 3.16.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 6, 2026Unauthenticated Broken Authentication in Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder <= 1.9.0 versions.CVE-2026-66425 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Broken Authentication in Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder <= 1.9.0 versions.
- Affected
- up to 1.9.0
- What to do
- Affects up to 1.9.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 6, 2026Unauthenticated Broken Access Control in JetFormBuilder <= 3.6.4.1 versions.CVE-2026-28140 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in JetFormBuilder <= 3.6.4.1 versions.
- Affected
- up to 3.6.4.1
- What to do
- Affects up to 3.6.4.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 6, 2026FormGent – Next-Gen AI Form Builder for WordPress with Multi-Step, Quizzes, Payments & More: Stored Cross-Site ScriptingCVE-2025-15028 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The FormGent – Next-Gen AI Form Builder for WordPress with Multi-Step, Quizzes, Payments & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via form submission fields in all versions up to, and including, 1.9.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- FormGent – Next-Gen AI Form Builder for WordPress with Multi-Step, Quizzes, Payments & More
- Affected
- up to 1.9.2
- What to do
- Affects up to 1.9.2. Update FormGent – Next-Gen AI Form Builder for WordPress with Multi-Step, Quizzes, Payments & More to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Aug 6, 2026Forminator Forms – Contact Form, Payment Form & Custom Form Builder: Stored Cross-Site ScriptingCVE-2026-18325 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Forged Upload Record via Select Field in all versions up to, and including, 1.56.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit is possible because Forminator_Core::sanitize_array() skips all filtering for keys prefixed with 'select-', and set_field_data() treats a submitted 'return' member as a trusted internal flag — allowing an unauthenticated attacker to forge and persist a complete upload field record with an arbitrary file_url value without any sanitization or validation.
- Product
- Forminator Forms – Contact Form, Payment Form & Custom Form Builder
- Affected
- up to 1.56.1
- What to do
- Affects up to 1.56.1. Update Forminator Forms – Contact Form, Payment Form & Custom Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 5, 2026Koha's guided report builder (reports/guided_reports.pl) reads the CGI parameter and, for each value, a dynamically-named parameter, and concatenates both direcCVE-2026-71288 · Other software · Koha Community · reported by 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2cHigh 8.8
Koha's guided report builder (reports/guided_reports.pl) reads the CGI parameter and, for each value, a dynamically-named parameter, and concatenates both directly into an SQL ORDER BY clause with no allowlist or validation. Since ORDER BY columns cannot be bound via prepared-statement placeholders, this requires an explicit allowlist, which does not exist.
- Product
- Koha
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2026Cost Calculator Builder: Unauthorized access of sensitive dataCVE-2026-7753 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Cost Calculator Builder plugin for WordPress is vulnerable to unauthorized access of sensitive data due to a missing capability check on the `cost-calculator-custom-export-run` AJAX action (handler `CCBExportImport::export_calculators()`) in all versions up to, and including, 3.6.17. The handler only verifies a nonce, but the corresponding `ccb_export_nonce` is broadcast on every wp-admin page (including pages reachable to Subscribers, such as `/wp-admin/profile.php`) by the `ccb_add_admin_nonces` callback hooked to `admin_head`. This makes it possible for authenticated attackers, with Subscriber-level access and above, to export every calculator's full configuration — including stored Stripe secret keys, PayPal client secrets, Razorpay secret keys, webhook secret keys, and reCAPTCHA secret keys.
- Product
- Cost Calculator Builder
- Affected
- up to 3.6.17
- What to do
- Affects up to 3.6.17. Update Cost Calculator Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 1, 2026Kadence Blocks — Page Builder Toolkit for Gutenberg Editor: Stored Cross-Site ScriptingCVE-2026-18435 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Kadence Blocks — Page Builder Toolkit for Gutenberg Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'toggleIcon' Block Attribute in all versions up to, and including, 3.7.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Kadence Blocks — Page Builder Toolkit for Gutenberg Editor
- Affected
- up to 3.7.8
- What to do
- Affects up to 3.7.8. Update Kadence Blocks — Page Builder Toolkit for Gutenberg Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 1, 2026Kadence Blocks — Page Builder Toolkit for Gutenberg Editor: Stored Cross-Site ScriptingCVE-2026-18062 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Kadence Blocks — Page Builder Toolkit for Gutenberg Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Identity Block Inner Image Content in all versions up to, and including, 3.7.8.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability is only triggerable when the block's urlTransparent attribute is set to a non-empty value, as this is a required precondition for the vulnerable code path in build_html() to be reached.
- Product
- Kadence Blocks — Page Builder Toolkit for Gutenberg Editor
- Affected
- up to 3.7.8.1
- What to do
- Affects up to 3.7.8.1. Update Kadence Blocks — Page Builder Toolkit for Gutenberg Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 1, 2026Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder: Reflected Cross-Site ScriptingCVE-2026-17571 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'param' in all versions up to, and including, 6.2.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder
- Affected
- up to 6.2.8
- What to do
- Affects up to 6.2.8. Update Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 1, 2026Kali Forms — Contact Form & Drag-and-Drop Builder: Remote Code ExecutionCVE-2026-16144 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Kali Forms — Contact Form & Drag-and-Drop Builder plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.4.20 via the _save_data function. This is due to insufficient validation of the 'thisPermalink' field value before it overwrites a trusted callable placeholder, allowing attacker-controlled strings to reach call_user_func() in _save_data(). This makes it possible for unauthenticated attackers to execute code on the server. Exploitation requires the target form to define a field with a name matching one of the reserved placeholder keys ('thisPermalink', 'entryCounter', or 'submission_link'), as check_if_placeholders_changed() only processes POST keys present in the form's field_type_map.
- Product
- Kali Forms — Contact Form & Drag-and-Drop Builder
- Affected
- up to 2.4.20
- What to do
- Affects up to 2.4.20. Update Kali Forms — Contact Form & Drag-and-Drop Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 1, 2026Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 600+ Patterns, 58 Blocks & Templates: Stored Cross-Site ScriptingCVE-2026-15950 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 600+ Patterns, 58 Blocks & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'layoutCircle.alignment' Block Attribute in all versions up to, and including, 2.2.11 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 600+ Patterns, 58 Blocks & Templates
- Affected
- up to 2.2.11
- What to do
- Affects up to 2.2.11. Update Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 600+ Patterns, 58 Blocks & Templates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 1, 2026Kirki – Freeform Page Builder, Website Builder & Customizer: Path Traversal (Zip Slip)CVE-2026-15601 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Path Traversal (Zip Slip) in all versions up to, and including, 6.0.13 via the extract_zip_file function. This makes it possible for authenticated attackers, with custom-level access and above, to write arbitrary files on the server, which can allow for remote code execution. The install_app, update_app, and get_kirki_template_from_zip code paths accept a user-supplied app src value to construct the download URL, and no sanitization is applied to prevent a crafted ZIP from being fetched and extracted with path-traversing entry names that escape the intended destination directory.
- Product
- Kirki – Freeform Page Builder, Website Builder & Customizer
- Affected
- up to 6.0.13
- What to do
- Affects up to 6.0.13. Update Kirki – Freeform Page Builder, Website Builder & Customizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 1, 2026Nex Forms – Ultimate Form Builder – Lite: Arbitrary file deletionCVE-2026-15450 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Nex Forms – Ultimate Form Builder – Lite plugin for WordPress is vulnerable to arbitrary file deletion via path traversal in versions up to, and including, 9.2.3. This is due to the delete_file() AJAX handler retrieving a file path from the database and passing it directly to unlink() with no validation (no realpath(), basename(), or allowlist check), combined with the insert_record() AJAX handler that lets the same authenticated user store an arbitrary value in the target 'location' column (wp_kses() only strips HTML tags and does not neutralize path traversal or absolute paths). This makes it possible for authenticated attackers, with admin-level access and above, to delete arbitrary files on the affected site's server, including wp-config. When the plugin's user-level option is configured to something else, this may be exploitable with lower privileges.
- Product
- Nex Forms – Ultimate Form Builder – Lite
- Affected
- up to 9.2.3
- What to do
- Affects up to 9.2.3. Update Nex Forms – Ultimate Form Builder – Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 1, 2026MailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builder: Stored Cross-Site ScriptingCVE-2026-15052 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The MailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Form Field Values in all versions up to, and including, 4.3.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- MailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builder
- Affected
- up to 4.3.3
- What to do
- Affects up to 4.3.3. Update MailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 1, 2026Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder: Authorization bypassCVE-2026-11995 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.9.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to modify the read/unread status of or permanently trash arbitrary form submission entries belonging to any form. The nonce issued by check_ajax_referer() does not function as an authorization barrier because the nonce action 'gutena_Forms' is emitted to unauthenticated visitors via wp_localize_script() on any public page that contains a Gutena Forms block, making it freely obtainable by anonymous attackers.
- Product
- Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder
- Affected
- up to 1.9.0
- What to do
- Affects up to 1.9.0. Update Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 1, 2026User Profile Builder: Does not correctly bind the automatic login performed after user registration to the newly created accountCVE-2026-15368 · WordPress plugins & themes · reported by WPScanHigh 8.1
The User Profile Builder WordPress plugin before 3.16.4 does not correctly bind the automatic login performed after user registration to the newly created account, allowing unauthenticated attackers to obtain an authenticated session for an arbitrary existing user, including administrators, on sites using a supported but non-default configuration.
- Product
- User Profile Builder
- Fixed in
- 3.16.4
- What to do
- Update User Profile Builder to 3.16.4 or newer.
Aug 1, 2026Codeless Page Builder: Does not sanitize or validate a shortcode attribute before using itCVE-2026-15234 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Codeless Page Builder WordPress plugin through 1.1.4 does not sanitize or validate a shortcode attribute before using it as an HTML tag name when rendering content, allowing users with contributor-level access and above to inject arbitrary HTML and JavaScript that executes in the session of any higher-privileged user (such as an administrator) who views the content.
- Product
- Codeless Page Builder
- Affected
- up to 1.1.4
- What to do
- Affects up to 1.1.4. Update Codeless Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 1, 2026Builderall for: Does not bind the state value of its public OAuth authentication routes to the initiating user sessionCVE-2026-11882 · WordPress plugins & themes · reported by WPScanLow 3.7
The Builderall for WordPress plugin before 3.0.2 does not bind the state value of its public OAuth authentication routes to the initiating user session, allowing unauthenticated attackers to complete the connection flow and overwrite the stored third-party integration access token. A durable overwrite requires the site to already be connected to a paid account.
- Product
- Builderall for
- Fixed in
- 3.0.2
- What to do
- Update Builderall for to 3.0.2 or newer.
Jul 31, 2026SureForms – Contact Form, Payment Form & Other Custom Form Builder: Stored Cross-Site ScriptingCVE-2026-7623 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The SureForms – Contact Form, Payment Form & Other Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'headingWrapper' parameter in all versions up to, and including, 2.8.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- SureForms – Contact Form, Payment Form & Other Custom Form Builder
- Affected
- up to 2.8.1
- What to do
- Affects up to 2.8.1. Update SureForms – Contact Form, Payment Form & Other Custom Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 31, 2026Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder: Insecure Direct Object ReferenceCVE-2026-17567 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.2.8 via the 'transaction' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to brute-force valid transaction hashes and view sensitive payment receipt data including customer name, email address, billing address, order items, payment method, and payment status belonging to other users. Because submission ID, form ID, and transaction creation time are either observable or guessable by an attacker, the effective brute-force space is bounded to approximately 900 candidates per second per (submission, form) pair, making exploitation practical without any prior authentication or account.
- Product
- Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder
- Affected
- up to 6.2.8
- What to do
- Affects up to 6.2.8. Update Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 31, 2026The Ultimate Addons for WPBakery Page Builder WordPress plugin before 3.21.5's shared link-rendering function, Ultimate_VC_Addons::uavc_link_init(),CVE-2026-14921 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Ultimate Addons for WPBakery Page Builder WordPress plugin before 3.21.5's shared link-rendering function, Ultimate_VC_Addons::uavc_link_init(),
- Product
- Ultimate Addons for WPBakery Page Builder
- Fixed in
- 3.21.5
- What to do
- Update Ultimate Addons for WPBakery Page Builder to 3.21.5 or newer.
Jul 30, 2026Ultimate Addons for WPBakery Page Builder: Does not perform a capability or nonce check before deleting a site's custom-uploaded icon font packsCVE-2026-15382 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Ultimate Addons for WPBakery Page Builder WordPress plugin before 3.21.4 does not perform a capability or nonce check before deleting a site's custom-uploaded icon font packs, allowing unauthenticated attackers to permanently delete all of a site's custom icon fonts with a single request.
- Product
- Ultimate Addons for WPBakery Page Builder
- Fixed in
- 3.21.4
- What to do
- Update Ultimate Addons for WPBakery Page Builder to 3.21.4 or newer.
Jul 29, 2026A vulnerability in the `zipx.Unzip` extraction routine of Develar's app-builder allows an attacker to overwrite arbitrary files on macOS APFS by exploiting a UnCVE-2026-13723 · Other software · Develar · reported by cret@cert.orgMedium 6.5
A vulnerability in the `zipx.Unzip` extraction routine of Develar's app-builder allows an attacker to overwrite arbitrary files on macOS APFS by exploiting a Unicode Normalization Collision combined with symlink following behavior. APFS treats certain Unicode equivalent filenames as identical (e.g., ß ↔ ss), while app builder performs no canonical normalization before validating or writing paths. As a result, a crafted ZIP archive containing: • a symlink entry named ss pointing to a target file, and • a regular file named ß containing attacker controlled data, will cause the second write to follow the symlink and overwrite the target file.
- Product
- app-builder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 29, 2026Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder: Stored Cross-Site ScriptingCVE-2026-16655 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Name Field Nested `password` Member in all versions up to, and including, 6.2.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder
- Affected
- up to 6.2.7
- What to do
- Affects up to 6.2.7. Update Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 29, 2026Cost Calculator Builder PRO: Remote Code ExecutionCVE-2026-14900 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Cost Calculator Builder PRO plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.0.3 via the js_to_php function. This is due to insufficient sanitization of the orderDetails[*].originalValue field, which is injected verbatim into a calculator formula string passed to PHP eval() inside js_to_php(), with the regex allow-list in evaluateFormula() only filtering alphanumeric tokens and leaving non-word punctuation characters intact. This makes it possible for unauthenticated attackers to execute code on the server. The only authentication barrier is a nonce check, but the required nonce is publicly emitted on every front-end page via the wp_head hook, making it freely obtainable by unauthenticated visitors. Payloads must be non-word XOR gadgets to bypass sanitization.
- Product
- Cost Calculator Builder PRO
- Affected
- up to 4.0.3
- What to do
- Affects up to 4.0.3. Update Cost Calculator Builder PRO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordstylemixthemes.comwordfence.com
Jul 28, 2026WowStore – Store Builder & Product Blocks for WooCommerce: Stored Cross-Site ScriptingCVE-2026-17162 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WowStore – Store Builder & Product Blocks for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'currentPostId' Block Attribute in all versions up to, and including, 4.4.24 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- WowStore – Store Builder & Product Blocks for WooCommerce
- Affected
- up to 4.4.24
- What to do
- Affects up to 4.4.24. Update WowStore – Store Builder & Product Blocks for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 28, 2026WowStore – Store Builder & Product Blocks for WooCommerce: Stored Cross-Site ScriptingCVE-2026-17161 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WowStore – Store Builder & Product Blocks for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'filterMobileText' Block Attribute in all versions up to, and including, 4.4.24 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The save-time wp_kses_post sanitization is ineffective because the payload is stored inside a Gutenberg block delimiter comment as JSON, which wp_kses_post preserves, allowing an attribute-breakout string to survive to the server-side render_callback.
- Product
- WowStore – Store Builder & Product Blocks for WooCommerce
- Affected
- up to 4.4.24
- What to do
- Affects up to 4.4.24. Update WowStore – Store Builder & Product Blocks for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 28, 2026A flaw has been found in nextlevelbuilder GoClaw up to 3.13.2.CVE-2026-18038 · Other software · nextlevelbuilder · reported by VulDBLow 2.1
A flaw has been found in nextlevelbuilder GoClaw up to 3.13.2. Affected by this vulnerability is the function ExecTool.Execute of the file goclaw/internal/http/tools_invoke.go of the component jq Handler. Executing a manipulation can lead to information disclosure. The attack can be launched remotely. The exploit has been published and may be used. This patch is called 1230. It is advisable to implement a patch to correct this issue.
- Product
- GoClaw
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 28, 2026Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 600+ Patterns, 58 Blocks & Templates: Stored Cross-Site ScriptingCVE-2026-15393 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 600+ Patterns, 58 Blocks & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'postMeta.font.size' Block Attribute in all versions up to, and including, 2.2.11 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 600+ Patterns, 58 Blocks & Templates
- Affected
- up to 2.2.11
- What to do
- Affects up to 2.2.11. Update Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 600+ Patterns, 58 Blocks & Templates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 28, 2026Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder: Missing AuthorizationCVE-2026-15025 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 7.3.2 via the automator_google_contacts_fetch_labels, automator_mautic_segment_fetch, automator_mautic_tags_fetch, and automator_mautic_render_contact_fields AJAX actions due to a missing capability check and missing nonce verification in the corresponding handlers (ajax_fetch_labels, segments_fetch, tags_fetch, and render_contact_fields). This makes it possible for authenticated attackers, with Subscriber-level access and above, to enumerate sensitive Google Contacts groups/labels and Mautic segments, tags, and contact-field definitions retrieved via integration credentials configured by an administrator, and to consume third-party API quota.
- Product
- Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder
- Affected
- up to 7.3.2
- What to do
- Affects up to 7.3.2. Update Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 28, 2026Taskbuilder – Project Management & Task Management Tool With Kanban Board: SQL InjectionCVE-2026-15267 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Taskbuilder – Project Management & Task Management Tool With Kanban Board plugin for WordPress is vulnerable to SQL Injection via the 'wppm_proj_filter' parameter in versions up to, and including, 5.0.9. This is due to insufficient escaping on the user-supplied parameter and the lack of sufficient preparation on the existing SQL query — the value is re-read at line 144 using only sanitize_text_field() (overwriting the earlier absint() result), then concatenated into the SQL WHERE clause as an unquoted numeric operand using only esc_sql(), which does not protect against injection in that context, and finally string-interpolated into the $wpdb->prepare() format string, bypassing parameterization entirely. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- Taskbuilder – Project Management & Task Management Tool With Kanban Board
- Affected
- up to 5.0.9
- What to do
- Affects up to 5.0.9. Update Taskbuilder – Project Management & Task Management Tool With Kanban Board to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 28, 2026PDFDraft – Drag & Drop PDF Builder, PDF Viewer, Embed & Download PDF, Certificate & Invoice Designer: Unauthorized access of dataCVE-2026-12124 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The PDFDraft – Drag & Drop PDF Builder, PDF Viewer, Embed & Download PDF, Certificate & Invoice Designer plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the serveTemplatePdfAjax() function and the serveTemplatePdf() REST route (which is registered with `permission_callback => '__return_true'`) in versions up to, and including, 1.1.0. This makes it possible for unauthenticated attackers to download stored template PDFs — which may contain customer PII, invoice, order, and certificate data — by requesting the publicly registered admin-ajax action `pdfdraft_embed_pdf` or the REST endpoint `/wp-json/pdfdraft/v1/embed-pdf/templates/{slug}/pdf` with a known or guessable design slug, bypassing the plugin's own .
- Product
- PDFDraft – Drag & Drop PDF Builder, PDF Viewer, Embed & Download PDF, Certificate & Invoice Designer
- Affected
- up to 1.1.0
- What to do
- Affects up to 1.1.0. Update PDFDraft – Drag & Drop PDF Builder, PDF Viewer, Embed & Download PDF, Certificate & Invoice Designer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 27, 2026Contributor Broken Access Control in Visual Composer Website Builder <= 45.15.0 versions.CVE-2026-65568 · WordPress plugins & themes · reported by PatchstackMedium 5
Contributor Broken Access Control in Visual Composer Website Builder <= 45.15.0 versions.
- Affected
- up to 45.15.0
- What to do
- Affects up to 45.15.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 27, 2026Subscriber Broken Access Control in RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg <= 1.5.1 versions.CVE-2026-65433 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Subscriber Broken Access Control in RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg <= 1.5.1 versions.
- Affected
- up to 1.5.1
- What to do
- Affects up to 1.5.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 27, 2026Subscriber Cross Site Scripting (XSS) in RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg <= 1.5.1 versions.CVE-2026-59559 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Subscriber Cross Site Scripting (XSS) in RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg <= 1.5.1 versions.
- Affected
- up to 1.5.1
- What to do
- Affects up to 1.5.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 27, 2026Joomla Extension - joomshaper.com - Unauthenticated mail relay via a hardcoded, product-wide secret in SP Page Builder < 6.7.1 - A hardcoded secret allowed attaCVE-2026-65879 · Websites & servers · reported by security@joomla.orgCritical 9.8
Joomla Extension - joomshaper.com - Unauthenticated mail relay via a hardcoded, product-wide secret in SP Page Builder < 6.7.1 - A hardcoded secret allowed attackers to forge the mail from address of forms.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmysites.gurujoomshaper.com
Jul 27, 2026Joomla Extension - joomshaper.com - Authenticated arbitrary file delete in SP Page Builder < 6.7.1- Improper path validation and ACL checks lead to a file deletCVE-2026-65878 · Websites & servers · reported by security@joomla.orgHigh 8.3
Joomla Extension - joomshaper.com - Authenticated arbitrary file delete in SP Page Builder < 6.7.1- Improper path validation and ACL checks lead to a file deletion vector in the media manager.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmysites.gurujoomshaper.com
Jul 27, 2026Joomla Extension - joomshaper.com - Authenticated SQL injection in SP Page Builder < 6.7.1 - Improper validation of various parameters in the media manager seaCVE-2026-65877 · Websites & servers · reported by security@joomla.orgHigh 8.2
Joomla Extension - joomshaper.com - Authenticated SQL injection in SP Page Builder < 6.7.1 - Improper validation of various parameters in the media manager search and date filters lead to an SQL injection vector.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmysites.gurujoomshaper.com
Jul 27, 2026Joomla Extension - joomshaper.com - Unauthenticated SQL injection in SP Page Builder < 6.8.0 - Improper validation of catid parameters in the loadMoreArticles CVE-2026-65876 · Websites & servers · reported by security@joomla.orgCritical 9.2
Joomla Extension - joomshaper.com - Unauthenticated SQL injection in SP Page Builder < 6.8.0 - Improper validation of catid parameters in the loadMoreArticles endpoint leads to an SQL injection vector.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 27, 2026Joomla Extension - joomshaper.com - Unauthenticated SQL injection in SP Page Builder < 6.7.1 - Improper validation of order parameters in the Dynamic Content eCVE-2026-65766 · Websites & servers · reported by security@joomla.orgCritical 9.2
Joomla Extension - joomshaper.com - Unauthenticated SQL injection in SP Page Builder < 6.7.1 - Improper validation of order parameters in the Dynamic Content endpoint leads to an SQL injection vector.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmysites.gurujoomshaper.com
Jul 25, 2026In the Linux kernel, the following vulnerability has been resolved: rust: block: fix GenDisk cleanup paths GenDiskBuilder::build() still has fallible work aftCVE-2026-64509 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
In the Linux kernel, the following vulnerability has been resolved: rust: block: fix GenDisk cleanup paths GenDiskBuilder::build() still has fallible work after __blk_mq_alloc_disk(), but its error path only recovers the foreign queue data. That leaks the temporary gendisk and request_queue until later teardown. If the caller moved the last Arc<TagSet<T>> into build(), the leaked queue can retain blk-mq state after the tag set is dropped. Fix the pre-registration failure path by dropping the temporary gendisk reference with put_disk() before recovering queue_data, so disk_release() can tear down the owned queue. Also pair GenDisk::drop() with put_disk() after del_gendisk(). Once a Rust GenDisk has been added with device_add_disk(), del_gendisk() only unregisters it; the final gendisk reference still has to be dropped to complete the release path.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Jul 24, 2026Datasets through 5.0.0, fixed in commit f989ef9, contains a path traversal vulnerability in folder-based dataset builders where the file_name metadata field is CVE-2026-66007 · Other software · huggingface · reported by VulnCheckMedium 6.9
Datasets through 5.0.0, fixed in commit f989ef9, contains a path traversal vulnerability in folder-based dataset builders where the file_name metadata field is not properly validated before being joined to the dataset directory. Attackers can supply crafted file_name values with directory traversal sequences to read arbitrary local files, which are then embedded into output when save_to_disk or push_to_hub is called.
- Product
- datasets
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 24, 2026Ninja Forms – The Contact Form Builder That Grows With You: Generic SQL InjectionCVE-2026-15663 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to generic SQL Injection via Import File 'settings' Key in all versions up to, and including, 3.14.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The vulnerable keys originate from the 'settings' object in an attacker-controlled import file processed via file_get_contents() or base64-decoded/JSON-decoded blobs, bypassing wp_magic_quotes protections entirely; two distinct sinks are affected — _save_setting() in Model.php and insert_form_meta() in ImportForm.php — as only the value side is escaped while the key side receives no sanitization or parameterization at any point in the call chain.
- Product
- Ninja Forms – The Contact Form Builder That Grows With You
- Affected
- up to 3.14.9
- What to do
- Affects up to 3.14.9. Update Ninja Forms – The Contact Form Builder That Grows With You to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 24, 2026Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 600+ Patterns, 58 Blocks & Templates: Stored Cross-Site ScriptingCVE-2026-15334 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 600+ Patterns, 58 Blocks & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'icon.view' Block Attribute in all versions up to, and including, 2.2.11 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 600+ Patterns, 58 Blocks & Templates
- Affected
- up to 2.2.11
- What to do
- Affects up to 2.2.11. Update Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 600+ Patterns, 58 Blocks & Templates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.