Vulnerability database

5,695 results · page 8 of 114

• Jul 23, 2026Unauthenticated Cross Site Request Forgery (CSRF) in Kwayy HTML Sitemap <= 4.0 versions.CVE-2026-65539 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Request Forgery (CSRF) in Kwayy HTML Sitemap <= 4.0 versions.

  Affected

  up to 4.0

  What to do

  Affects up to 4.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 23, 2026Unauthenticated Cross Site Request Forgery (CSRF) in افزونه حمل و نقل ووکامرس (پست پیشتاز و سفارشی، پیک موتوری) <= 4.4.5 versions.CVE-2026-65536 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Unauthenticated Cross Site Request Forgery (CSRF) in افزونه حمل و نقل ووکامرس (پست پیشتاز و سفارشی، پیک موتوری) <= 4.4.5 versions.

  Affected

  up to 4.4.5

  What to do

  Affects up to 4.4.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 23, 2026Unauthenticated Server Side Request Forgery (SSRF) in PeproDev Ultimate Invoice <= 2.2.6 versions.CVE-2026-65516 · WordPress plugins & themes · reported by PatchstackHigh 7.2

  Unauthenticated Server Side Request Forgery (SSRF) in PeproDev Ultimate Invoice <= 2.2.6 versions.

  Affected

  up to 2.2.6

  What to do

  Affects up to 2.2.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 23, 2026Melapress WP Activity Log and Melapress WP Activity Log Premium: Cross-Site request forgery (CSRF)CVE-2026-65512 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Cross-Site request forgery (CSRF) vulnerability in Melapress WP Activity Log and Melapress WP Activity Log Premium allows Cross Site Request Forgery. This issue affects WP Activity Log: through 5.6.4; WP Activity Log Premium: through 5.6.4.

  Product

  Melapress WP Activity Log and Melapress WP Activity Log Premium

  Affected

  up to 5.6.4

  What to do

  Affects up to 5.6.4. Update Melapress WP Activity Log and Melapress WP Activity Log Premium to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.compatchstack.com

• Jul 23, 2026Author Server Side Request Forgery (SSRF) in Complianz <= 7.5.0 versions.CVE-2026-65496 · WordPress plugins & themes · reported by PatchstackMedium 4.4

  Author Server Side Request Forgery (SSRF) in Complianz <= 7.5.0 versions.

  Affected

  up to 7.5.0

  What to do

  Affects up to 7.5.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 23, 2026LA-Studio Element Kit for Elementor: Cross-Site Request Forgery (CSRF)CVE-2026-65488 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in LA-Studio LA-Studio Element Kit for Elementor lastudio-element-kit allows Stored XSS.This issue affects LA-Studio Element Kit for Elementor: from n/a through 1.6.2.

  Product

  LA-Studio Element Kit for Elementor

  Affected

  up to 1.6.2

  What to do

  Affects up to 1.6.2. Update LA-Studio Element Kit for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 23, 2026Unauthenticated Cross Site Request Forgery (CSRF) in Avada Core <= 5.15.6 versions.CVE-2026-65471 · WordPress plugins & themes · reported by PatchstackCritical 9.6

  Unauthenticated Cross Site Request Forgery (CSRF) in Avada Core <= 5.15.6 versions.

  Affected

  up to 5.15.6

  What to do

  Affects up to 5.15.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 23, 2026Contributor Server Side Request Forgery (SSRF) in JetEngine <= 3.8.11 versions.CVE-2026-65467 · WordPress plugins & themes · reported by PatchstackMedium 4.9

  Contributor Server Side Request Forgery (SSRF) in JetEngine <= 3.8.11 versions.

  Affected

  up to 3.8.11

  What to do

  Affects up to 3.8.11. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 23, 2026Custom role Server Side Request Forgery (SSRF) in JetBooking <= 4.1.2 versions.CVE-2026-65466 · WordPress plugins & themes · reported by PatchstackMedium 4.9

  Custom role Server Side Request Forgery (SSRF) in JetBooking <= 4.1.2 versions.

  Affected

  up to 4.1.2

  What to do

  Affects up to 4.1.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 23, 2026Unauthenticated Cross Site Request Forgery (CSRF) in GiveWP <= 4.16.3 versions.CVE-2026-65464 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Unauthenticated Cross Site Request Forgery (CSRF) in GiveWP <= 4.16.3 versions.

  Affected

  up to 4.16.3

  What to do

  Affects up to 4.16.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 23, 2026Unauthenticated Cross Site Request Forgery (CSRF) in Zarinpal Gateway <= 5.1.0 versions.CVE-2026-65460 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Unauthenticated Cross Site Request Forgery (CSRF) in Zarinpal Gateway <= 5.1.0 versions.

  Affected

  up to 5.1.0

  What to do

  Affects up to 5.1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 23, 2026Unauthenticated Cross Site Request Forgery (CSRF) in Simple Link Directory Pro <= 15.0.8 versions.CVE-2026-61981 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Unauthenticated Cross Site Request Forgery (CSRF) in Simple Link Directory Pro <= 15.0.8 versions.

  Affected

  up to 15.0.8

  What to do

  Affects up to 15.0.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 23, 2026Unauthenticated Cross Site Request Forgery (CSRF) in ApusListing <= 1.2.63 versions.CVE-2026-57785 · WordPress plugins & themes · reported by PatchstackHigh 8.8

  Unauthenticated Cross Site Request Forgery (CSRF) in ApusListing <= 1.2.63 versions.

  Affected

  up to 1.2.63

  What to do

  Affects up to 1.2.63. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 23, 2026Unauthenticated Cross Site Request Forgery (CSRF) in Ninja Forms File Uploads Extension <= 3.3.26 versions.CVE-2026-57784 · WordPress plugins & themes · reported by PatchstackCritical 9.6

  Unauthenticated Cross Site Request Forgery (CSRF) in Ninja Forms File Uploads Extension <= 3.3.26 versions.

  Affected

  up to 3.3.26

  What to do

  Affects up to 3.3.26. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 23, 2026MailPoet: Cross-Site Request Forgery (CSRF)CVE-2026-57626 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in MailPoet allows Cross Site Request Forgery. This issue affects MailPoet: from 5.30.0 through 5.33.0.

  Product

  MailPoet

  Affected

  up to 5.33.0

  What to do

  Affects up to 5.33.0. Update MailPoet to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 23, 2026Author Server Side Request Forgery (SSRF) in Photo Block <= 1.7.1 versions.CVE-2026-24639 · WordPress plugins & themes · reported by PatchstackMedium 4.4

  Author Server Side Request Forgery (SSRF) in Photo Block <= 1.7.1 versions.

  Affected

  up to 1.7.1

  What to do

  Affects up to 1.7.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 23, 2026Unauthenticated Cross Site Request Forgery (CSRF) in WP Accessibility Helper (WAH) <= 0.6.6 versions.CVE-2026-24537 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Unauthenticated Cross Site Request Forgery (CSRF) in WP Accessibility Helper (WAH) <= 0.6.6 versions.

  Affected

  up to 0.6.6

  What to do

  Affects up to 0.6.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 21, 2026Classified Listing: Does not verify that the order targeted by its payment-receipt handler belongs to the requesting userCVE-2026-14183 · WordPress plugins & themes · reported by WPScanMedium 4.3

  The Classified Listing WordPress plugin before 5.3.9 does not verify that the order targeted by its payment-receipt handler belongs to the requesting user, allowing authenticated users with subscriber-level access to read the payment receipt details of any other user's order.

  Product

  Classified Listing

  Fixed in

  5.3.9

  What to do

  Update Classified Listing to 5.3.9 or newer.

  Full record and what to do →NVD recordwpscan.com

• Jul 20, 2026Kirki: Does not validate a user-supplied URL before requesting it server-sideCVE-2026-13147 · WordPress plugins & themes · reported by WPScanCritical 9.1

  The Kirki WordPress plugin before 6.0.12 does not validate a user-supplied URL before requesting it server-side, allowing unauthenticated attackers to make the site issue HTTP requests to arbitrary hosts (Server-Side Request Forgery).

  Product

  Kirki

  Fixed in

  6.0.12

  What to do

  Update Kirki to 6.0.12 or newer.

  Full record and what to do →NVD recordwpscan.com

• Jul 20, 2026Kirki: Does not sanitise or escape the email subject and body values supplied in a request before including them in the password-reset email it sendsCVE-2026-12724 · WordPress plugins & themes · reported by WPScanMedium 4.3

  The Kirki WordPress plugin before 6.0.12 does not sanitise or escape the email subject and body values supplied in a request before including them in the password-reset email it sends as HTML, allowing unauthenticated users to inject arbitrary HTML into the message delivered to a registered user, which can be used for phishing.

  Product

  Kirki

  Fixed in

  6.0.12

  What to do

  Update Kirki to 6.0.12 or newer.

  Full record and what to do →NVD recordwpscan.com

• Jul 20, 2026Modern Event Calendar Pro WordPress plugin before 7.34.0, Modern Events Calendar Lite: Do not sanitise and escape a request parameter before using it in a SQL statementCVE-2026-11349 · WordPress plugins & themes · reported by WPScanHigh 8.6

  The Modern Event Calendar Pro WordPress plugin before 7.34.0, Modern Events Calendar Lite WordPress plugin before 7.34.0 do not sanitise and escape a request parameter before using it in a SQL statement, through an AJAX action available to unauthenticated users, leading to an unauthenticated SQL injection vulnerability that allows attackers to extract sensitive data from the database.

  Product

  Modern Event Calendar Pro WordPress plugin before 7.34.0, Modern Events Calendar Lite

  Fixed in

  7.34.0

  What to do

  Update Modern Event Calendar Pro WordPress plugin before 7.34.0, Modern Events Calendar Lite to 7.34.0 or newer.

  Full record and what to do →NVD recordwpscan.com

• Jul 18, 2026W3SC Elementor to Zoho CRM: Cross-Site Request ForgeryCVE-2026-9734 · WordPress plugins & themes · reported by WordfenceMedium 4.3

  The W3SC Elementor to Zoho CRM plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2.0. This is due to missing or incorrect nonce validation on the storeInfo function. This makes it possible for unauthenticated attackers to modify the plugin's Zoho CRM integration settings, replacing the configured data center, client ID, client secret, and user email credentials with attacker-controlled values via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

  Product

  W3SC Elementor to Zoho CRM

  Affected

  up to 2.2.0

  What to do

  Affects up to 2.2.0. Update W3SC Elementor to Zoho CRM to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Jul 17, 2026WPS Bookings for WooCommerce: Does not verify that a booking order belongs to the requesting user before cancelling itCVE-2026-12393 · WordPress plugins & themes · reported by WPScanMedium 5.4

  The WPS Bookings for WooCommerce WordPress plugin before 3.11.7 does not verify that a booking order belongs to the requesting user before cancelling it, allowing any authenticated user, such as a Subscriber or Customer, to cancel and void other customers' booking orders.

  Product

  WPS Bookings for WooCommerce

  Fixed in

  3.11.7

  What to do

  Update WPS Bookings for WooCommerce to 3.11.7 or newer.

  Full record and what to do →NVD recordwpscan.com

• Jul 16, 2026Loco Translate: Cross-Site Request ForgeryCVE-2026-15005 · WordPress plugins & themes · reported by WordfenceHigh 8.8

  The Loco Translate plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.8.5. This is due to missing or incorrect nonce validation on the execTemplate function. This makes it possible for unauthenticated attackers to execute arbitrary PHP code on the server by supplying a php://filter stream wrapper URI as the 'template' parameter, which bypasses path validation and is passed directly to the include sink in execTemplate() via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

  Product

  Loco Translate

  Affected

  up to 2.8.5

  What to do

  Affects up to 2.8.5. Update Loco Translate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Jul 16, 2026RTMKit: Does not perform a capability check in one of its AJAX actions and resolves a request-supplied post identifier directlyCVE-2026-12906 · WordPress plugins & themes · reported by WPScanLow 2.7

  The RTMKit WordPress plugin before 2.0.9 does not perform a capability check in one of its AJAX actions and resolves a request-supplied post identifier directly, allowing users with at least the Contributor role to read the titles of other users' private, draft, pending, scheduled and trashed posts.

  Product

  RTMKit

  Fixed in

  2.0.9

  What to do

  Update RTMKit to 2.0.9 or newer.

  Full record and what to do →NVD recordwpscan.com

• Jul 16, 2026Header Footer Builder for Elementor: Does not require an administrative capability for its dashboard template-import action (it allows any edit_posts user)CVE-2026-12869 · WordPress plugins & themes · reported by WPScanMedium 6.1

  The Header Footer Builder for Elementor WordPress plugin before 1.2.1 does not require an administrative capability for its dashboard template-import action (it allows any edit_posts user), so a Contributor can import a template containing an Elementor HTML widget configured to display site-wide, injecting JavaScript that executes in the session of any visitor or administrator who loads the site.

  Product

  Header Footer Builder for Elementor

  Fixed in

  1.2.1

  What to do

  Update Header Footer Builder for Elementor to 1.2.1 or newer.

  Full record and what to do →NVD recordwpscan.com

• Jul 16, 2026Abandoned Cart Lite for WooCommerce: Does not protect the integrity of its cart-recovery tokens or bind them to the requesting accountCVE-2026-12585 · WordPress plugins & themes · reported by WPScanHigh 8.1

  The Abandoned Cart Lite for WooCommerce WordPress plugin before 6.8.2 does not protect the integrity of its cart-recovery tokens or bind them to the requesting account, allowing unauthenticated attackers to forge a recovery link that logs them in as another user when the automatic-login option is enabled.

  Product

  Abandoned Cart Lite for WooCommerce

  Fixed in

  6.8.2

  What to do

  Update Abandoned Cart Lite for WooCommerce to 6.8.2 or newer.

  Full record and what to do →NVD recordwpscan.com

• Jul 16, 2026Appointment Booking: Does not validate a CSRF nonce on several state-changing actions handled by its central request dispatcherCVE-2026-11866 · WordPress plugins & themes · reported by WPScanMedium 5.4

  The Appointment Booking Plugin WordPress plugin before 5.6.3 does not validate a CSRF nonce on several state-changing actions handled by its central request dispatcher, allowing attackers to perform privileged actions, such as overwriting the booking-form configuration or disconnecting the connected payment gateway, via Cross-Site Request Forgery against a logged-in administrator.

  Product

  Appointment Booking

  Fixed in

  5.6.3

  What to do

  Update Appointment Booking to 5.6.3 or newer.

  Full record and what to do →NVD recordwpscan.com

• Jul 16, 2026Landing Page Builder – Coming Soon page, Maintenance Mode, Lead Page, WordPress Landing Pages: Cross-Site Request ForgeryCVE-2026-12409 · WordPress plugins & themes · reported by WordfenceMedium 4.3

  The Landing Page Builder – Coming Soon page, Maintenance Mode, Lead Page, WordPress Landing Pages plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5.3.6. This is due to missing or incorrect nonce validation on the ulpb_admin_ajax function. This makes it possible for unauthenticated attackers to create, update, retitle, or change the post status, slug, and type of arbitrary posts and write ULPB_DATA post meta via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. This attack requires the victim to hold an editor-level or administrator session, as the wp_ajax_ulpb_admin_data action enforces a capability check that the forged request must satisfy by inheriting the logged-in user's session cookies.

  Product

  Landing Page Builder – Coming Soon page, Maintenance Mode, Lead Page, WordPress Landing Pages

  Affected

  up to 1.5.3.6

  What to do

  Affects up to 1.5.3.6. Update Landing Page Builder – Coming Soon page, Maintenance Mode, Lead Page, WordPress Landing Pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Jul 13, 2026Auto Featured Image (Auto Post Thumbnail): Server-Side Request Forgery (SSRF)CVE-2026-61970 · WordPress plugins & themes · reported by PatchstackMedium 4.9

  Server-Side Request Forgery (SSRF) vulnerability in Themeisle Auto Featured Image (Auto Post Thumbnail) auto-post-thumbnail allows Server Side Request Forgery.This issue affects Auto Featured Image (Auto Post Thumbnail): from n/a through <= 5.0.4.

  Product

  Auto Featured Image (Auto Post Thumbnail)

  Affected

  up to 5.0.4

  What to do

  Affects up to 5.0.4. Update Auto Featured Image (Auto Post Thumbnail) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 13, 2026ووسلام &#8211; همگام سازی ووکامرس و باسلام: Cross-Site Request Forgery (CSRF)CVE-2026-61956 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in hamsalam ووسلام &#8211; همگام سازی ووکامرس و باسلام sync-basalam allows Cross Site Request Forgery.This issue affects ووسلام &#8211; همگام سازی ووکامرس و باسلام: from n/a through <= 1.9.1.

  Product

  ووسلام &#8211; همگام سازی ووکامرس و باسلام

  Affected

  up to 1.9.1

  What to do

  Affects up to 1.9.1. Update ووسلام &#8211; همگام سازی ووکامرس و باسلام to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 13, 2026Tonda: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-57805 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Select-Themes Tonda tonda allows PHP Local File Inclusion.This issue affects Tonda: from n/a through <= 2.5.

  Product

  Tonda

  Affected

  up to 2.5

  What to do

  Affects up to 2.5. Update Tonda to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 13, 2026TheGem Theme Elements (for Elementor): Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-57804 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in CodexThemes TheGem Theme Elements (for Elementor) allows PHP Local File Inclusion. This issue affects TheGem Theme Elements (for Elementor): from n/a before 5.12.1.1.

  Product

  TheGem Theme Elements (for Elementor)

  Fixed in

  5.12.1.1

  What to do

  Update TheGem Theme Elements (for Elementor) to 5.12.1.1 or newer.

  Full record and what to do →NVD recordpatchstack.com

• Jul 13, 2026Struktur Core: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-57803 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Select-Themes Struktur Core allows PHP Local File Inclusion. This issue affects Struktur Core: from n/a before 2.7.

  Product

  Struktur Core

  Fixed in

  2.7

  What to do

  Update Struktur Core to 2.7 or newer.

  Full record and what to do →NVD recordpatchstack.com

• Jul 13, 2026Struktur: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-57802 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Select-Themes Struktur allows PHP Local File Inclusion. This issue affects Struktur: from n/a before 2.7.

  Product

  Struktur

  Fixed in

  2.7

  What to do

  Update Struktur to 2.7 or newer.

  Full record and what to do →NVD recordpatchstack.com

• Jul 13, 2026SetSail: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-57801 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Select-Themes SetSail setsail allows PHP Local File Inclusion.This issue affects SetSail: from n/a through <= 2.1.

  Product

  SetSail

  Affected

  up to 2.1

  What to do

  Affects up to 2.1. Update SetSail to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 13, 2026Overworld: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-57800 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Edge-Themes Overworld overworld allows PHP Local File Inclusion.This issue affects Overworld: from n/a through <= 1.5.

  Product

  Overworld

  Affected

  up to 1.5

  What to do

  Affects up to 1.5. Update Overworld to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 13, 2026Nuss: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-57799 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in uxper Nuss nuss allows PHP Local File Inclusion.This issue affects Nuss: from n/a through <= 1.3.6.

  Product

  Nuss

  Affected

  up to 1.3.6

  What to do

  Affects up to 1.3.6. Update Nuss to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 13, 2026NewsPlus Shortcodes: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-57798 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in SaurabhSharma NewsPlus Shortcodes newsplus-shortcodes allows PHP Local File Inclusion.This issue affects NewsPlus Shortcodes: from n/a through <= 4.2.0.

  Product

  NewsPlus Shortcodes

  Affected

  up to 4.2.0

  What to do

  Affects up to 4.2.0. Update NewsPlus Shortcodes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 13, 2026Leedo: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-57796 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in VLThemes Leedo leedo allows PHP Local File Inclusion.This issue affects Leedo: from n/a through <= 3.0.0.

  Product

  Leedo

  Affected

  up to 3.0.0

  What to do

  Affects up to 3.0.0. Update Leedo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 13, 2026Kitchor: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-57795 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in themelexus Kitchor kitchor allows PHP Local File Inclusion.This issue affects Kitchor: from n/a through <= 1.4.3.

  Product

  Kitchor

  Affected

  up to 1.4.3

  What to do

  Affects up to 1.4.3. Update Kitchor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 13, 2026Golo Framework: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-57794 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in uxper Golo Framework golo-framework allows PHP Local File Inclusion.This issue affects Golo Framework: from n/a through <= 1.7.3.

  Product

  Golo Framework

  Affected

  up to 1.7.3

  What to do

  Affects up to 1.7.3. Update Golo Framework to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 13, 2026Flow: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-57793 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Elated-Themes Flow flow allows PHP Local File Inclusion.This issue affects Flow: from n/a through <= 1.8.

  Product

  Flow

  Affected

  up to 1.8

  What to do

  Affects up to 1.8. Update Flow to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 13, 2026Dør: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-57792 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Dør dor allows PHP Local File Inclusion.This issue affects Dør: from n/a through <= 2.4.1.

  Product

  Dør

  Affected

  up to 2.4.1

  What to do

  Affects up to 2.4.1. Update Dør to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 13, 2026Brook: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-57791 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove Brook brook allows PHP Local File Inclusion.This issue affects Brook: from n/a through <= 2.9.0.

  Product

  Brook

  Affected

  up to 2.9.0

  What to do

  Affects up to 2.9.0. Update Brook to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 13, 2026Billey: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-57790 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove Billey billey allows PHP Local File Inclusion.This issue affects Billey: from n/a through <= 2.1.8.

  Product

  Billey

  Affected

  up to 2.1.8

  What to do

  Affects up to 2.1.8. Update Billey to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 13, 2026Aqua: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-57789 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in jwsthemes Aqua aqua allows PHP Local File Inclusion.This issue affects Aqua: from n/a through <= 5.1.2.

  Product

  Aqua

  Affected

  up to 5.1.2

  What to do

  Affects up to 5.1.2. Update Aqua to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 13, 2026Aalto: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-57788 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Edge-Themes Aalto aalto allows PHP Local File Inclusion.This issue affects Aalto: from n/a through <= 1.8.

  Product

  Aalto

  Affected

  up to 1.8

  What to do

  Affects up to 1.8. Update Aalto to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 13, 2026WorkScout-Core: Cross-Site Request Forgery (CSRF)CVE-2026-57786 · WordPress plugins & themes · reported by PatchstackHigh 8.8

  Cross-Site Request Forgery (CSRF) vulnerability in purethemes WorkScout-Core workscout-core allows Authentication Bypass.This issue affects WorkScout-Core: from n/a through <= 1.7.08.

  Product

  WorkScout-Core

  Affected

  up to 1.7.08

  What to do

  Affects up to 1.7.08. Update WorkScout-Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 13, 2026RT-Theme 18 | Extensions: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-57743 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in stmcan RT-Theme 18 | Extensions rt18-extensions allows PHP Local File Inclusion.This issue affects RT-Theme 18 | Extensions: from n/a through <= 2.5.

  Product

  RT-Theme 18 | Extensions

  Affected

  up to 2.5

  What to do

  Affects up to 2.5. Update RT-Theme 18 | Extensions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.