Vulnerability database

5,851 results · page 8 of 118

• Aug 19, 2026SAML Single Sign On: Does not verify the signature of a SAML response before storing the certificate it carriesCVE-2026-19842 · WordPress plugins & themes · reported by WPScanHigh 8.8

  The SAML Single Sign On WordPress plugin before 5.4.7 does not verify the signature of a SAML response before storing the certificate it carries, and offers an administrator a one-click control that promotes that stored certificate to the site's trusted signing certificate, allowing unauthenticated attackers to have a certificate of their own trusted and then authenticate as any user, including an administrator.

  Product

  SAML Single Sign On

  Fixed in

  5.4.7

  What to do

  Update SAML Single Sign On to 5.4.7 or newer.

  Full record and what to do →NVD recordwpscan.com

• Aug 19, 2026Membership For WooCommerce: Does not check that an API consumer secret has actually been generated before comparing it against the one supplied in a requestCVE-2026-19709 · WordPress plugins & themes · reported by WPScanMedium 5.3

  The Membership For WooCommerce WordPress plugin before 3.1.2 does not check that an API consumer secret has actually been generated before comparing it against the one supplied in a request, allowing unauthenticated attackers to reach its REST routes and disclose any user's membership plan details on sites where the API has been enabled but no keys were ever generated.

  Product

  Membership For WooCommerce

  Fixed in

  3.1.2

  What to do

  Update Membership For WooCommerce to 3.1.2 or newer.

  Full record and what to do →NVD recordwpscan.com

• Aug 19, 2026NextScripts: Social Networks Auto-Poster: Does not escape some of the query-string parameters it reflects back on one of its admin pagesCVE-2026-16570 · WordPress plugins & themes · reported by WPScanHigh 7.1

  The NextScripts: Social Networks Auto-Poster WordPress plugin before 4.4.8 does not escape some of the query-string parameters it reflects back on one of its admin pages, allowing attackers to perform Reflected Cross-Site Scripting attacks against logged-in users such as administrators who are tricked into opening a crafted link.

  Product

  NextScripts: Social Networks Auto-Poster

  Fixed in

  4.4.8

  What to do

  Update NextScripts: Social Networks Auto-Poster to 4.4.8 or newer.

  Full record and what to do →NVD recordwpscan.com

• Aug 19, 202610Web Booster: Does not correctly validate an access token on an unauthenticated request handler and does not escape attacker-supplied stylesheet content before rendering it into the page headCVE-2026-14287 · WordPress plugins & themes · reported by WPScanMedium 4.7

  The 10Web Booster WordPress plugin before 2.33.5 does not correctly validate an access token on an unauthenticated request handler and does not escape attacker-supplied stylesheet content before rendering it into the page head, allowing an unauthenticated attacker to store markup that executes as JavaScript in the browser of anonymous visitors to an affected page.

  Product

  10Web Booster

  Fixed in

  2.33.5

  What to do

  Update 10Web Booster to 2.33.5 or newer.

  Full record and what to do →NVD recordwpscan.com

• Aug 19, 2026Eventin: Does not verify the current user's permission to edit other users before assigning roles and updating user metadata during speaker creationCVE-2026-13173 · WordPress plugins & themes · reported by WPScanLow 2.7

  The Eventin WordPress plugin before 4.1.21 does not verify the current user's permission to edit other users before assigning roles and updating user metadata during speaker creation, allowing users with contributor-level access and above to modify other users' roles and metadata.

  Product

  Eventin

  Fixed in

  4.1.21

  What to do

  Update Eventin to 4.1.21 or newer.

  Full record and what to do →NVD recordwpscan.com

• Aug 18, 2026Media LIbrary Assistant: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-66591 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Lingren Media LIbrary Assistant allows Stored XSS. This issue affects Media LIbrary Assistant: from n/a through 3.39.

  Product

  Media LIbrary Assistant

  Affected

  up to 3.39

  What to do

  Affects up to 3.39. Update Media LIbrary Assistant to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 18, 2026PublishPress Series: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-27365 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PublishPress PublishPress Series allows Stored XSS. This issue affects PublishPress Series: from n/a through 2.17.0.

  Product

  PublishPress Series

  Affected

  up to 2.17.0

  What to do

  Affects up to 2.17.0. Update PublishPress Series to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 18, 2026Draft List: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-66603 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Artiss Draft List simple-draft-list allows Stored XSS. This issue affects Draft List: from n/a through 2.6.4.

  Product

  Draft List

  Affected

  up to 2.6.4

  What to do

  Affects up to 2.6.4. Update Draft List to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 18, 2026Site Reviews: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-73382 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Gemini Labs Site Reviews site-reviews allows Stored XSS.This issue affects Site Reviews: from n/a through 8.2.0.

  Product

  Site Reviews

  Affected

  up to 8.2.0

  What to do

  Affects up to 8.2.0. Update Site Reviews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 18, 2026WPDM – Premium Packages: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-73190 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in W3 Eden WPDM – Premium Packages wpdm-premium-packages allows DOM-Based XSS.This issue affects WPDM – Premium Packages: from n/a through 7.0.5.

  Product

  WPDM – Premium Packages

  Affected

  up to 7.0.5

  What to do

  Affects up to 7.0.5. Update WPDM – Premium Packages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 18, 2026EasyTest – Simplify A/B Testing: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-68567 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Grids EasyTest – Simplify A/B Testing convertpro allows DOM-Based XSS.This issue affects EasyTest – Simplify A/B Testing: from n/a through 1.0.1.

  Product

  EasyTest – Simplify A/B Testing

  Affected

  up to 1.0.1

  What to do

  Affects up to 1.0.1. Update EasyTest – Simplify A/B Testing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 18, 2026Wise Chat: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-66636 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Marcin Wise Chat wise-chat allows Stored XSS.This issue affects Wise Chat: from n/a through 3.4.3.

  Product

  Wise Chat

  Affected

  up to 3.4.3

  What to do

  Affects up to 3.4.3. Update Wise Chat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 18, 2026Ultimate Dashboard Pro: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-66621 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ultimate Dashboard Ultimate Dashboard Pro ultimate-dashboard-pro allows DOM-Based XSS.This issue affects Ultimate Dashboard Pro: from n/a through 3.11.2.

  Product

  Ultimate Dashboard Pro

  Affected

  up to 3.11.2

  What to do

  Affects up to 3.11.2. Update Ultimate Dashboard Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 13, 2026Samex - Clean, Minimal Shop WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-28154 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in snstheme Samex - Clean, Minimal Shop WooCommerce WordPress Theme and snstheme M.Anh - Fashion WooCoommerce WordPress Theme allows Reflected XSS. This issue affects Samex - Clean, Minimal Shop WooCommerce WordPress Theme: from n/a through 2.5; M.Anh - Fashion WooCoommerce WordPress Theme: from n/a through 1.7.

  Product

  Samex - Clean, Minimal Shop WooCommerce

  Affected

  up to 2.5

  What to do

  Affects up to 2.5. Update Samex - Clean, Minimal Shop WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.compatchstack.com

• Aug 12, 2026Wallet System for WooCommerce: Does not validate a user-supplied wallet amount against the customer's actual stored balance during checkoutCVE-2026-15045 · WordPress plugins & themes · reported by WPScanMedium 6.5

  The Wallet System for WooCommerce WordPress plugin before 2.7.10 does not validate a user-supplied wallet amount against the customer's actual stored balance during checkout, allowing authenticated customers to arbitrarily reduce their own order total, including down to zero, and complete checkout without paying the merchant.

  Product

  Wallet System for WooCommerce

  Fixed in

  2.7.10

  What to do

  Update Wallet System for WooCommerce to 2.7.10 or newer.

  Full record and what to do →NVD recordwpscan.com

• Aug 10, 2026JetEngine: Does not sanitise uploaded SVG files before storing and serving themCVE-2026-17019 · WordPress plugins & themes · reported by WPScanMedium 6.1

  The JetEngine WordPress plugin before 3.8.13.1 does not sanitise uploaded SVG files before storing and serving them, and does not adequately restrict who can upload them, allowing unauthenticated attackers to upload a file containing malicious JavaScript that executes in the browser of any user who opens it (Stored Cross-Site Scripting).

  Product

  JetEngine

  Fixed in

  3.8.13.1

  What to do

  Update JetEngine to 3.8.13.1 or newer.

  Full record and what to do →NVD recordwpscan.com

• Aug 10, 2026AutoNetTV Relay: Does not perform any capability or authentication check before setting a WordPress administrator authentication cookie during its scheduled content-synchronization taskCVE-2026-13600 · WordPress plugins & themes · reported by WPScanHigh 8.1

  The AutoNetTV Relay WordPress plugin before 3.0.14 does not perform any capability or authentication check before setting a WordPress administrator authentication cookie during its scheduled content-synchronization task. On server configurations where the scheduled task executes before the HTTP response is committed, an unauthenticated attacker who triggers the due task can receive the administrator's session cookie and gain administrator access without credentials.

  Product

  AutoNetTV Relay

  Fixed in

  3.0.14

  What to do

  Update AutoNetTV Relay to 3.0.14 or newer.

  Full record and what to do →NVD recordwpscan.com

• Aug 9, 2026Create: Does not perform an authorization check before rendering content over one of its public REST API routesCVE-2026-18037 · WordPress plugins & themes · reported by WPScanMedium 6.5

  The Create WordPress plugin before 2.5.4 does not perform an authorization check before rendering content over one of its public REST API routes, and that route additionally publishes the requested content as a side effect, allowing unauthenticated attackers to read unpublished content and to make it publicly available.

  Product

  Create

  Fixed in

  2.5.4

  What to do

  Update Create to 2.5.4 or newer.

  Full record and what to do →NVD recordwpscan.com

• Aug 9, 2026LWS Optimize: Does not properly escape a value submitted through an unauthenticated analytics endpoint before storing it and rendering it in an administrative dashboardCVE-2026-16032 · WordPress plugins & themes · reported by WPScanMedium 6.1

  The LWS Optimize WordPress plugin before 4.1.2 does not properly escape a value submitted through an unauthenticated analytics endpoint before storing it and rendering it in an administrative dashboard, allowing unauthenticated attackers to inject arbitrary web scripts that execute when an administrator views the affected dashboard page.

  Product

  LWS Optimize

  Fixed in

  4.1.2

  What to do

  Update LWS Optimize to 4.1.2 or newer.

  Full record and what to do →NVD recordwpscan.com

• Aug 7, 2026Subscriptions for WooCommerce: Does not verify that the requester owns the subscription being viewed before rendering its detailsCVE-2026-15214 · WordPress plugins & themes · reported by WPScanMedium 4.3

  The Subscriptions for WooCommerce WordPress plugin before 2.0.1 does not verify that the requester owns the subscription being viewed before rendering its details, allowing any authenticated customer to read another customer's subscription information (the subscribed product, status, and dates) by supplying that subscription's ID.

  Product

  Subscriptions for WooCommerce

  Fixed in

  2.0.1

  What to do

  Update Subscriptions for WooCommerce to 2.0.1 or newer.

  Full record and what to do →NVD recordwpscan.com

• Aug 6, 2026DataPress (Dataverse Integration): Does not properly restrict access to its template rendering feature and exposes the viewing user's data to itCVE-2026-5336 · WordPress plugins & themes · reported by WPScanMedium 6.8

  The DataPress (Dataverse Integration) WordPress plugin before 2.91 does not properly restrict access to its template rendering feature and exposes the viewing user's data to it, allowing users with a role as low as Contributor to disclose sensitive information, such as the session cookies of higher privileged users who view the affected content.

  Product

  DataPress (Dataverse Integration)

  Fixed in

  2.91

  What to do

  Update DataPress (Dataverse Integration) to 2.91 or newer.

  Full record and what to do →NVD recordwpscan.com

• Aug 6, 2026Event Booking Manager for WooCommerce (Pro): Does not validate the ticket price on the server during its native (non-WooCommerce) checkoutCVE-2026-16067 · WordPress plugins & themes · reported by WPScanMedium 5.3

  The Event Booking Manager for WooCommerce (Pro) WordPress plugin before 5.0.3 does not validate the ticket price on the server during its native (non-WooCommerce) checkout, trusting the per-ticket price supplied by the client instead of re-deriving the event's configured price. This allows unauthenticated users to book paid event tickets for free, obtaining completed bookings and valid tickets at no cost.

  Product

  Event Booking Manager for WooCommerce (Pro)

  Fixed in

  5.0.3

  What to do

  Update Event Booking Manager for WooCommerce (Pro) to 5.0.3 or newer.

  Full record and what to do →NVD recordwpscan.com

• Aug 6, 2026Ninja Forms: Does not prevent user-supplied query-string inputCVE-2026-15256 · WordPress plugins & themes · reported by WPScanMedium 4.8

  The Ninja Forms WordPress plugin before 3.14.10 does not prevent user-supplied query-string input, used to pre-populate a form field's default value, from being processed as a shortcode, allowing unauthenticated attackers to execute arbitrary shortcodes registered on the site when a form so configured is embedded on a public page.

  Product

  Ninja Forms

  Fixed in

  3.14.10

  What to do

  Update Ninja Forms to 3.14.10 or newer.

  Full record and what to do →NVD recordwpscan.com

• Aug 6, 2026Easy Appointments: Does not correctly validate shortcode input in one of its block-rendering actionsCVE-2026-14225 · WordPress plugins & themes · reported by WPScanLow 2.7

  The Easy Appointments WordPress plugin before 3.12.28 does not correctly validate shortcode input in one of its block-rendering actions, checking only the first tag of the supplied string against an allowlist while rendering the entire string, allowing users with contributor-level access to execute arbitrary registered shortcodes.

  Product

  Easy Appointments

  Fixed in

  3.12.28

  What to do

  Update Easy Appointments to 3.12.28 or newer.

  Full record and what to do →NVD recordwpscan.com

• Aug 6, 2026Events Manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-66457 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pixelite Events Manager events-manager allows Reflected XSS.This issue affects Events Manager: from n/a through 7.4.2.

  Product

  Events Manager

  Affected

  up to 7.4.2

  What to do

  Affects up to 7.4.2. Update Events Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 6, 2026Popup Maker: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-28177 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Code Atlantic LLC Popup Maker popup-maker allows DOM-Based XSS.This issue affects Popup Maker: from n/a through 1.23.0.

  Product

  Popup Maker

  Affected

  up to 1.23.0

  What to do

  Affects up to 1.23.0. Update Popup Maker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 5, 2026Bit Form: Does not sanitize an uploaded signature image before storing itCVE-2026-16573 · WordPress plugins & themes · reported by WPScanHigh 7.5

  The Bit Form WordPress plugin before 3.2.0 does not sanitize an uploaded signature image before storing it, allowing unauthenticated attackers to upload a crafted SVG file containing JavaScript that executes when the file is viewed, leading to Stored Cross-Site Scripting.

  Product

  Bit Form

  Fixed in

  3.2.0

  What to do

  Update Bit Form to 3.2.0 or newer.

  Full record and what to do →NVD recordwpscan.com

• Aug 5, 2026miniOrange 2FA: Does not bind the second factor being configured during the pre-login two-factor challenge to the target account's existing factorCVE-2026-16036 · WordPress plugins & themes · reported by WPScanHigh 7.5

  The miniOrange 2FA WordPress plugin before 6.2.7 does not bind the second factor being configured during the pre-login two-factor challenge to the target account's existing factor, allowing an attacker who knows a user's password to rebind that user's second factor to an attacker-controlled destination, complete the challenge, and take over the account, including administrator accounts.

  Product

  miniOrange 2FA

  Fixed in

  6.2.7

  What to do

  Update miniOrange 2FA to 6.2.7 or newer.

  Full record and what to do →NVD recordwpscan.com

• Aug 4, 2026Brizy: Does not sanitize or escape featured-image focal-point coordinates submitted through one of its AJAX actions before storing them and later echoing them into HTML attributes in the post editor's Featured Image metaCVE-2026-16069 · WordPress plugins & themes · reported by WPScanMedium 6.8

  The Brizy WordPress plugin before 2.8.19 does not sanitize or escape featured-image focal-point coordinates submitted through one of its AJAX actions before storing them and later echoing them into HTML attributes in the post editor's Featured Image meta box, allowing users with the Contributor role or above to inject arbitrary web scripts that execute in the session of a higher-privileged user who opens the post for review.

  Product

  Brizy

  Fixed in

  2.8.19

  What to do

  Update Brizy to 2.8.19 or newer.

  Full record and what to do →NVD recordwpscan.com

• Aug 3, 2026Import and export users and customers: Does not enforce WordPress's role-assignment and per-user edit permissions during CSV importCVE-2026-16534 · WordPress plugins & themes · reported by WPScanCritical 9.1

  The Import and export users and customers WordPress plugin before 2.4.2 does not enforce WordPress's role-assignment and per-user edit permissions during CSV import, allowing a user holding only the user-creation capability to create an administrator account and to overwrite an existing administrator's password or email.

  Product

  Import and export users and customers

  Fixed in

  2.4.2

  What to do

  Update Import and export users and customers to 2.4.2 or newer.

  Full record and what to do →NVD recordwpscan.com

• Aug 3, 2026Simple Membership: Does not verify whether user creation failed during registration before using the returned valueCVE-2026-15930 · WordPress plugins & themes · reported by WPScanCritical 9.4

  The Simple Membership WordPress plugin before 4.7.8 does not verify whether user creation failed during registration before using the returned value as a user ID to update an account, allowing unauthenticated attackers to overwrite the primary administrator's account data (including the email address) and take over that account through the password reset flow.

  Product

  Simple Membership

  Fixed in

  4.7.8

  What to do

  Update Simple Membership to 4.7.8 or newer.

  Full record and what to do →NVD recordwpscan.com

• Aug 3, 2026Import and export users and customers: Does not restrict the path of a file it reads and displays during a CSV importCVE-2025-15673 · WordPress plugins & themes · reported by WPScanMedium 4.9

  The Import and export users and customers WordPress plugin before 2.4.3 does not restrict the path of a file it reads and displays during a CSV import, allowing high-privileged users to read arbitrary files on the server.

  Product

  Import and export users and customers

  Fixed in

  2.4.3

  What to do

  Update Import and export users and customers to 2.4.3 or newer.

  Full record and what to do →NVD recordwpscan.com

• Aug 2, 2026Event Booking Manager for WooCommerce: Does not sanitise or escape event timeline content submitted by users with post-editing access before storing it and rendering it on the public event pageCVE-2026-16063 · WordPress plugins & themes · reported by WPScanMedium 5.4

  The Event Booking Manager for WooCommerce WordPress plugin before 5.3.7 does not sanitise or escape event timeline content submitted by users with post-editing access before storing it and rendering it on the public event page, allowing users with the Author role and above to inject arbitrary JavaScript that executes in the browser of any visitor viewing the event, including administrators.

  Product

  Event Booking Manager for WooCommerce

  Fixed in

  5.3.7

  What to do

  Update Event Booking Manager for WooCommerce to 5.3.7 or newer.

  Full record and what to do →NVD recordwpscan.com

• Aug 2, 2026LWS Optimize: Does not perform a capability check on its cache-clearing actionsCVE-2026-16042 · WordPress plugins & themes · reported by WPScanMedium 4.3

  The LWS Optimize WordPress plugin before 3.4 does not perform a capability check on its cache-clearing actions, allowing any authenticated user, including Subscribers, to flush the site's caches and force repeated cache rebuilds.

  Product

  LWS Optimize

  Fixed in

  3.4

  What to do

  Update LWS Optimize to 3.4 or newer.

  Full record and what to do →NVD recordwpscan.com

• Aug 1, 2026Everest Toolkit: Does not validate the type of files uploaded during demo-content import (the WordPress file-type test is disabled)CVE-2026-13158 · WordPress plugins & themes · reported by WPScanHigh 7.2

  The Everest Toolkit WordPress plugin through 1.2.3 does not validate the type of files uploaded during demo-content import (the WordPress file-type test is disabled), allowing high-privilege users (Administrator by default, including non-super-admin site administrators on multisite) to upload executable PHP files to the uploads directory.

  Product

  Everest Toolkit

  Affected

  up to 1.2.3

  What to do

  Affects up to 1.2.3. Update Everest Toolkit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordwpscan.com

• Aug 1, 2026Demo Import: Does not validate the type of files uploaded during demo-content import (the WordPress file-type test is disabled)CVE-2026-13157 · WordPress plugins & themes · reported by WPScanHigh 7.2

  The Demo Import WordPress plugin through 1.1.3 does not validate the type of files uploaded during demo-content import (the WordPress file-type test is disabled), allowing high-privilege users (Administrator by default, including non-super-admin site administrators on multisite) to upload executable PHP files to the uploads directory.

  Product

  Demo Import

  Affected

  up to 1.1.3

  What to do

  Affects up to 1.1.3. Update Demo Import to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordwpscan.com

• Aug 1, 2026Bit Form: Does not sanitise one of its conversational-form display settings before rendering it on the public-facing formCVE-2025-15669 · WordPress plugins & themes · reported by WPScanMedium 4.8

  The Bit Form WordPress plugin before 3.1.4 does not sanitise one of its conversational-form display settings before rendering it on the public-facing form, allowing high-privilege users (such as administrators, who do not hold the unfiltered_html capability on multisite) to store JavaScript that executes in the browser of any visitor who views the form.

  Product

  Bit Form

  Fixed in

  3.1.4

  What to do

  Update Bit Form to 3.1.4 or newer.

  Full record and what to do →NVD recordwpscan.com

• Jul 31, 2026FluentCart A New Era of eCommerce: Does not perform any authorization or ownership check before rendering customer order documents keyed on a sequential numeric identifierCVE-2026-14927 · WordPress plugins & themes · reported by WPScanLow 3.7

  The FluentCart A New Era of eCommerce WordPress plugin before 1.5.3 does not perform any authorization or ownership check before rendering customer order documents keyed on a sequential numeric identifier, allowing unauthenticated visitors to enumerate and disclose customer personal data (names, email addresses, billing and shipping postal addresses, and order details) across the store.

  Product

  FluentCart A New Era of eCommerce

  Fixed in

  1.5.3

  What to do

  Update FluentCart A New Era of eCommerce to 1.5.3 or newer.

  Full record and what to do →NVD recordwpscan.com

• Jul 31, 2026The Ultimate Addons for WPBakery Page Builder WordPress plugin before 3.21.5's shared link-rendering function, Ultimate_VC_Addons::uavc_link_init(),CVE-2026-14921 · WordPress plugins & themes · reported by WPScanMedium 6.1

  The Ultimate Addons for WPBakery Page Builder WordPress plugin before 3.21.5's shared link-rendering function, Ultimate_VC_Addons::uavc_link_init(),

  Product

  Ultimate Addons for WPBakery Page Builder

  Fixed in

  3.21.5

  What to do

  Update Ultimate Addons for WPBakery Page Builder to 3.21.5 or newer.

  Full record and what to do →NVD recordwpscan.com

• Jul 31, 2026NewStatPress: Does not sanitise and escape data derived from unauthenticated visitor requests before storing it and later outputting it in one of its widgetsCVE-2026-14845 · WordPress plugins & themes · reported by WPScanMedium 6.1

  The NewStatPress WordPress plugin before 1.4.5 does not sanitise and escape data derived from unauthenticated visitor requests before storing it and later outputting it in one of its widgets, which could allow unauthenticated attackers to perform Stored Cross-Site Scripting attacks against users viewing the affected widget.

  Product

  NewStatPress

  Fixed in

  1.4.5

  What to do

  Update NewStatPress to 1.4.5 or newer.

  Full record and what to do →NVD recordwpscan.com

• Jul 31, 2026Lightbox with PhotoSwipe: Does not sanitise or escape a link data attribute before rendering it into the image lightbox caption in the browserCVE-2026-14833 · WordPress plugins & themes · reported by WPScanMedium 6.8

  The Lightbox with PhotoSwipe WordPress plugin before 5.9.0 does not sanitise or escape a link data attribute before rendering it into the image lightbox caption in the browser, allowing users with author-level access and above (who lack the unfiltered_html capability) to store JavaScript that runs when a visitor or administrator opens the lightbox.

  Product

  Lightbox with PhotoSwipe

  Fixed in

  5.9.0

  What to do

  Update Lightbox with PhotoSwipe to 5.9.0 or newer.

  Full record and what to do →NVD recordwpscan.com

• Jul 31, 2026GiveWP: Does not properly restrict access to a REST API endpoint that returns recurring-donation recordsCVE-2026-14319 · WordPress plugins & themes · reported by WPScanHigh 7.5

  The GiveWP WordPress plugin before 4.16.3 does not properly restrict access to a REST API endpoint that returns recurring-donation records, allowing unauthenticated users to retrieve information about anonymous recurring donors, including their name and subscription details.

  Product

  GiveWP

  Fixed in

  4.16.3

  What to do

  Update GiveWP to 4.16.3 or newer.

  Full record and what to do →NVD recordwpscan.com

• Jul 31, 2026ElementsKit Elementor Addons: Does not sanitize or escape certain megamenu menu-item settings before storing them and outputting them on the front endCVE-2026-13393 · WordPress plugins & themes · reported by WPScanLow 3.5

  The ElementsKit Elementor Addons WordPress plugin before 3.10.01 does not sanitize or escape certain megamenu menu-item settings before storing them and outputting them on the front end, and does not require the unfiltered_html capability to save them, allowing users with administrative capabilities to store malicious JavaScript; on a multisite network this lets a non-super subsite Administrator, who is denied unfiltered_html, plant a stored Cross-Site Scripting payload that executes in the sessions of the network Super Admin and site visitors.

  Product

  ElementsKit Elementor Addons

  Fixed in

  3.10.01

  What to do

  Update ElementsKit Elementor Addons to 3.10.01 or newer.

  Full record and what to do →NVD recordwpscan.com

• Jul 30, 2026WP Real IP-based Access Control: Does not perform any capability or nonce checks before storing one of its option valuesCVE-2026-14592 · WordPress plugins & themes · reported by WPScanMedium 6.1

  The WP Real IP-based Access Control WordPress plugin through 1.3.1 does not perform any capability or nonce checks before storing one of its option values, and does not escape that value on output on its settings page, allowing unauthenticated users to store arbitrary JavaScript that executes in the context of any administrator who views the page.

  Product

  WP Real IP-based Access Control

  Affected

  up to 1.3.1

  What to do

  Affects up to 1.3.1. Update WP Real IP-based Access Control to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordwpscan.com

• Jul 30, 2026LifterLMS: Does not strip event-handler attributes from a course pricing field before storing and rendering itCVE-2026-14207 · WordPress plugins & themes · reported by WPScanMedium 6.1

  The LifterLMS WordPress plugin before 10.0.10 does not strip event-handler attributes from a course pricing field before storing and rendering it, allowing users with a course-editing role to inject JavaScript that executes in the session of an administrator who views the course.

  Product

  LifterLMS

  Fixed in

  10.0.10

  What to do

  Update LifterLMS to 10.0.10 or newer.

  Full record and what to do →NVD recordwpscan.com

• Jul 29, 2026Link Library: Improper neutralization of input during web page generation ('cross-site scripting')CVE-2026-18197 · WordPress plugins & themes · reported by vulnreport@tenable.comMedium 6.4

  Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Link Library allows Cross-Site Scripting (XSS). This issue affects Link Library: before 7.9.4.

  Product

  Link Library

  Fixed in

  7.9.4

  What to do

  Update Link Library to 7.9.4 or newer.

  Full record and what to do →NVD recordtenable.comwordpress.org

• Jul 27, 2026Smart Manager: Does not properly encode a post field before rendering it into an HTML attribute in its management gridCVE-2026-14203 · WordPress plugins & themes · reported by WPScanMedium 4.8

  The Smart Manager WordPress plugin before 8.92.0 does not properly encode a post field before rendering it into an HTML attribute in its management grid, allowing users with the Contributor role or above to inject JavaScript that executes in the browser session of an administrator who views the grid.

  Product

  Smart Manager

  Fixed in

  8.92.0

  What to do

  Update Smart Manager to 8.92.0 or newer.

  Full record and what to do →NVD recordwpscan.com

• Jul 27, 2026MemberGlut: Does not validate the role chosen during front-end registrationCVE-2026-12394 · WordPress plugins & themes · reported by WPScanCritical 9.8

  The MemberGlut WordPress plugin before 1.1.5 does not validate the role chosen during front-end registration, allowing unauthenticated users to register an account with an arbitrary role, including administrator, leading to full site compromise.

  Product

  MemberGlut

  Fixed in

  1.1.5

  What to do

  Update MemberGlut to 1.1.5 or newer.

  Full record and what to do →NVD recordwpscan.com

• Jul 23, 2026Dokan Pro: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-65492 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in weDevs Dokan Pro allows Reflected XSS. This issue affects Dokan Pro: from n/a before 5.0.7.

  Product

  Dokan Pro

  Fixed in

  5.0.7

  What to do

  Update Dokan Pro to 5.0.7 or newer.

  Full record and what to do →NVD recordpatchstack.com

• Jul 23, 2026LA-Studio Element Kit for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-65482 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LA-Studio LA-Studio Element Kit for Elementor lastudio-element-kit allows DOM-Based XSS.This issue affects LA-Studio Element Kit for Elementor: from n/a through 1.6.3.

  Product

  LA-Studio Element Kit for Elementor

  Affected

  up to 1.6.3

  What to do

  Affects up to 1.6.3. Update LA-Studio Element Kit for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.