Updated 7 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

35added in the last 30 days

585new WordPress flaws this week

391,310entries in the database

3,650 results · page 8 of 73

Sep 2, 2026MasterStudy LMS: Does not properly verify ownership of quiz question identifiersCVE-2026-81196 · WordPress plugins & themes · reported by WPScanLow 2.7
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not properly verify ownership of quiz question identifiers, allowing users with instructor access to read other instructors' quiz questions, including the correct answers and explanations.
Product
MasterStudy LMS
Fixed in
3.7.46
What to do
Update MasterStudy LMS to 3.7.46 or newer.
Full record and what to do →NVD record wpscan.com
Sep 2, 2026Social Media Share Buttons & Social Sharing Icons: Does not properly escape a value taken from the incoming request before outputting it in an inline JavaScript event handlerCVE-2026-19723 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Social Media Share Buttons & Social Sharing Icons WordPress plugin before 3.0.1 does not properly escape a value taken from the incoming request before outputting it in an inline JavaScript event handler, leading to Reflected Cross-Site Scripting which is triggered when a user interacts with the affected button. Exploitation requires the Social Media Share Buttons & Social Sharing Icons WordPress plugin before 3.0.1 to be running a non-default icon display configuration.
Product
Social Media Share Buttons & Social Sharing Icons
Fixed in
3.0.1
What to do
Update Social Media Share Buttons & Social Sharing Icons to 3.0.1 or newer.
Full record and what to do →NVD record wpscan.com
Sep 2, 2026Social Media Share Buttons & Social Sharing Icons: Does not escape the post title before outputting it in an inline JavaScript event handlerCVE-2026-19719 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Social Media Share Buttons & Social Sharing Icons WordPress plugin before 3.0.1 does not escape the post title before outputting it in an inline JavaScript event handler, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks which are triggered when a visitor interacts with the affected button. Exploitation requires the Social Media Share Buttons & Social Sharing Icons WordPress plugin before 3.0.1 to be running a non-default icon display configuration.
Product
Social Media Share Buttons & Social Sharing Icons
Fixed in
3.0.1
What to do
Update Social Media Share Buttons & Social Sharing Icons to 3.0.1 or newer.
Full record and what to do →NVD record wpscan.com
Sep 2, 2026MotoPress Appointment Booking: Does not perform an authorization or ownership checkCVE-2026-15232 · WordPress plugins & themes · reported by WPScanMedium 5.3
The MotoPress Appointment Booking WordPress plugin before 2.4.8 does not perform an authorization or ownership check when handling a user-supplied booking identifier on an unauthenticated endpoint, allowing unauthenticated attackers to permanently delete other users' reservations. This is an incomplete fix of CVE-2026-9180: the deletion remains reachable on sites using payment confirmation, confirmed through version 2.4.7.
Product
MotoPress Appointment Booking
Fixed in
2.4.8
What to do
Update MotoPress Appointment Booking to 2.4.8 or newer.
Full record and what to do →NVD record wpscan.com
Sep 2, 2026Photo Gallery by 10Web: Does not escape two request parameters before reflecting them into input-attribute values on its admin pages (one on the Shortcode pageCVE-2026-12865 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Photo Gallery by 10Web WordPress plugin before 1.8.44 does not escape two request parameters before reflecting them into input-attribute values on its admin pages (one on the Shortcode page, one on the Galleries/Albums list page), so an unauthenticated attacker can craft a link that, when opened by a logged-in administrator (or, for the first sink, a contributor), executes arbitrary JavaScript in the victim's authenticated session via an auto-firing onfocus handler. The Galleries/Albums sink renders only when the site has more than 20 galleries/albums (the normal state of a populated install).
Product
Photo Gallery by 10Web
Fixed in
1.8.44
What to do
Update Photo Gallery by 10Web to 1.8.44 or newer.
Full record and what to do →NVD record wpscan.com
Sep 1, 2026Simple Membership: Authentication Bypass leading to Administrator Account TakeoverCVE-2026-77194 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Simple Membership plugin for WordPress is vulnerable to Authentication Bypass leading to Administrator Account Takeover in versions up to, and including, 4.8.0. This is due to improper identity verification during the public registration flow in WordPress Multisite environments, where the plugin binds new Simple Membership records to existing global WordPress users based solely on matching username and email, without requiring password verification or ownership proof, and fails to properly detect Administrator roles on child sites. This makes it possible for unauthenticated attackers to take over Administrator accounts on child sites in a Multisite network by registering a Simple Membership account with a victim's credentials on a site where public registration is enabled, then updating the victim's global WordPress password through the profile edit functionality. The vulnerability was partially patched in version 4.8.1.
Product
Simple Membership
Affected
up to 4.8.0
What to do
Affects up to 4.8.0. Update Simple Membership to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 1, 2026MW WP Form: Does not prevent shortcodes in user-submitted values from being executedCVE-2026-78363 · WordPress plugins & themes · reported by WPScanMedium 4.8
The MW WP Form WordPress plugin before 5.1.5 does not prevent shortcodes in user-submitted values from being executed when it merges those values into a message that it later processes for shortcodes, allowing unauthenticated users to run any shortcode registered on the site. Exploitation requires the site to have been configured to echo a submitted value back to the visitor after submission.
Product
MW WP Form
Fixed in
5.1.5
What to do
Update MW WP Form to 5.1.5 or newer.
Full record and what to do →NVD record wpscan.com
Sep 1, 2026Shopping Cart & eCommerce Store: Generic SQL InjectionCVE-2026-17589 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The Shopping Cart & eCommerce Store plugin for WordPress is vulnerable to generic SQL Injection via the 'product_order' parameter in all versions up to, and including, 5.9.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This is a second-order SQL injection: the payload is written to the ec_pageoption table via the ec_ajax_save_page_options handler — which applies no sanitization to raw $_POST values — and is later retrieved with stripslashes() (bypassing WordPress magic-quotes protection) before being concatenated directly into SQL on every store page render.
Product
Shopping Cart & eCommerce Store
Affected
up to 5.9.2
What to do
Affects up to 5.9.2. Update Shopping Cart & eCommerce Store to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 31, 2026Unauthenticated Arbitrary File Upload in Hash Form <= 1.4.2 versions.CVE-2026-81780 · WordPress plugins & themes · reported by PatchstackCritical 10
Unauthenticated Arbitrary File Upload in Hash Form <= 1.4.2 versions.
Affected
up to 1.4.2
What to do
Affects up to 1.4.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 30, 2026MW WP Form: Does not sanitise and escape some of its form settings before outputting them back in an admin dashboard pageCVE-2026-78364 · WordPress plugins & themes · reported by WPScanLow 3.5
The MW WP Form WordPress plugin before 5.1.6 does not sanitise and escape some of its form settings before outputting them back in an admin dashboard page, which could allow users with a role as low as Editor to perform Stored Cross-Site Scripting attacks against high privilege users such as admin.
Product
MW WP Form
Fixed in
5.1.6
What to do
Update MW WP Form to 5.1.6 or newer.
Full record and what to do →NVD record wpscan.com
Aug 29, 2026User Profile Builder: Does not escape the output of one of its optional shortcodesCVE-2026-76546 · WordPress plugins & themes · reported by WPScanMedium 6.8
The User Profile Builder WordPress plugin before 4.0.1 does not escape the output of one of its optional shortcodes, allowing users with a role as low as contributor to perform Stored Cross-Site Scripting attacks against any user viewing the affected content, including administrators. The shortcode is not enabled by default.
Product
User Profile Builder
Fixed in
4.0.1
What to do
Update User Profile Builder to 4.0.1 or newer.
Full record and what to do →NVD record wpscan.com
Aug 28, 2026Unauthenticated Denial of Service Attack in Smush Image Compression and Optimization <= 4.2.0 versions.CVE-2026-81285 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Denial of Service Attack in Smush Image Compression and Optimization <= 4.2.0 versions.
Affected
up to 4.2.0
What to do
Affects up to 4.2.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 28, 2026User Registration & Membership: Does not perform a capability checkCVE-2026-79996 · WordPress plugins & themes · reported by WPScanHigh 7.2
The User Registration & Membership WordPress plugin before 5.2.6 does not perform a capability check when saving its login settings, allowing authenticated users who have been granted a User Registration & Membership WordPress plugin before 5.2.6 management capability but not full administrator access to change arbitrary site options and escalate their privileges to administrator.
Product
User Registration & Membership
Fixed in
5.2.6
What to do
Update User Registration & Membership to 5.2.6 or newer.
Full record and what to do →NVD record wpscan.com
Aug 28, 2026User Registration & Membership: Does not verify that the account whose pending email change is being cancelled belongs to the user making the requestCVE-2026-79995 · WordPress plugins & themes · reported by WPScanMedium 4.3
The User Registration & Membership WordPress plugin before 5.2.5 does not verify that the account whose pending email change is being cancelled belongs to the user making the request, allowing authenticated users with Subscriber-level access and above to cancel any other user's in-progress email change, including an administrator's.
Product
User Registration & Membership
Fixed in
5.2.5
What to do
Update User Registration & Membership to 5.2.5 or newer.
Full record and what to do →NVD record wpscan.com
Aug 28, 2026WPMU DEV Dashboard: Authentication BypassCVE-2026-76581 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The WPMU DEV Dashboard plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.0.1. This is due to inconsistent and ambiguous HMAC message construction between the unauthenticated `wdpsso_step1` and `wdpsso_step2` AJAX actions, where step 1 signs and discloses an unseparated concatenation of the token, state, redirect, and domain values, while step 2 verifies an unseparated concatenation that omits the domain field. This makes it possible for unauthenticated attackers, on sites connected to WPMU DEV with Hub SSO enabled and mapped to an administrator, to obtain a valid HMAC from step 1 and replay it to step 2 by moving the domain value into the redirect field, resulting in an authenticated administrator session.
Product
WPMU DEV Dashboard
Affected
up to 5.0.1
What to do
Affects up to 5.0.1. Update WPMU DEV Dashboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpmudev.com wordfence.com
Aug 28, 2026shared-files-pro: Does not validate the file path suppliedCVE-2026-19084 · WordPress plugins & themes · reported by WPScanHigh 7.5
The shared-files-pro WordPress plugin before 1.7.70 does not validate the file path supplied when creating a featured image, allowing unauthenticated attackers to read arbitrary files from the server and republish their contents at a public URL.
Product
shared-files-pro
Fixed in
1.7.70
What to do
Update shared-files-pro to 1.7.70 or newer.
Full record and what to do →NVD record wpscan.com
Aug 28, 2026Shared Files WordPress plugin before 1.7.67, shared-files-pro: Do not perform a capability check in their file-upload handlerCVE-2026-12514 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Shared Files WordPress plugin before 1.7.67, shared-files-pro WordPress plugin before 1.7.70 do not perform a capability check in their file-upload handler, which is registered for unauthenticated users and protected only by a nonce that is output on public pages, so an unauthenticated visitor can upload files to a publicly accessible directory and read the server's absolute path from the response. Uploads are limited to WordPress's allowed MIME types, so executable PHP cannot be uploaded.
Product
Shared Files WordPress plugin before 1.7.67, shared-files-pro
Fixed in
1.7.67
What to do
Update Shared Files WordPress plugin before 1.7.67, shared-files-pro to 1.7.67 or newer.
Full record and what to do →NVD record wpscan.com
Aug 28, 2026Shared Files WordPress plugin before 1.7.67, shared-files-pro: Do not properly sanitize a file path taken from a frontend file submission and their single-pass traversal filter is bypassableCVE-2026-12513 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Shared Files WordPress plugin before 1.7.67, shared-files-pro WordPress plugin before 1.7.68 do not properly sanitize a file path taken from a frontend file submission and their single-pass traversal filter is bypassable, allowing unauthenticated users to store a path that points outside the uploads directory. When the corresponding file entry is later permanently deleted, an arbitrary file on the server (such as wp-config.php) is deleted, leading to denial of service and potential site takeover.
Product
Shared Files WordPress plugin before 1.7.67, shared-files-pro
Fixed in
1.7.67
What to do
Update Shared Files WordPress plugin before 1.7.67, shared-files-pro to 1.7.67 or newer.
Full record and what to do →NVD record wpscan.com
Aug 27, 2026Subscriber Broken Access Control in Push Notification for Post and BuddyPress <= 3.20 versions.CVE-2026-81279 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Subscriber Broken Access Control in Push Notification for Post and BuddyPress <= 3.20 versions.
Affected
up to 3.20
What to do
Affects up to 3.20. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 27, 2026Unauthenticated PHP Object Injection in Hash Form <= 1.4.1 versions.CVE-2026-78292 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in Hash Form <= 1.4.1 versions.
Affected
up to 1.4.1
What to do
Affects up to 1.4.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 27, 2026Subscriber SQL Injection in Kadence Shop Kit <= 3.0.6 versions.CVE-2026-32550 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Subscriber SQL Injection in Kadence Shop Kit <= 3.0.6 versions.
Affected
up to 3.0.6
What to do
Affects up to 3.0.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 27, 2026Smush: Does not restrict a network-wide setting to network administratorsCVE-2026-19223 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Smush WordPress plugin before 4.3.2 does not restrict a network-wide setting to network administrators, allowing an administrator of any single site on a multisite network to execute arbitrary code across the entire network.
Product
Smush
Fixed in
4.3.2
What to do
Update Smush to 4.3.2 or newer.
Full record and what to do →NVD record wpscan.com
Aug 27, 2026Mobile App for WooCommerce: ShopApper Mobile App Builder Service for WooCommerce: Does not check the user's capabilities before allowing a stock-update operation through one of its REST endpointsCVE-2026-16569 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Mobile App for WooCommerce: ShopApper Mobile App Builder Service for WooCommerce WordPress plugin through 0.4.62 does not check the user's capabilities before allowing a stock-update operation through one of its REST endpoints, allowing any authenticated user, such as a customer or subscriber, to change the stock quantity of arbitrary products.
Product
Mobile App for WooCommerce: ShopApper Mobile App Builder Service for WooCommerce
Affected
up to 0.4.62
What to do
Affects up to 0.4.62. Update Mobile App for WooCommerce: ShopApper Mobile App Builder Service for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Aug 27, 2026Mobile App for WooCommerce: ShopApper Mobile App Builder Service for WooCommerce: Does not verify that the requesting user owns the customer profile being queried through one of its REST endpointsCVE-2026-16568 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Mobile App for WooCommerce: ShopApper Mobile App Builder Service for WooCommerce WordPress plugin through 0.4.62 does not verify that the requesting user owns the customer profile being queried through one of its REST endpoints, allowing any authenticated user (e.g. a customer/subscriber) to retrieve other users' personal data, including their email address, name, and roles.
Product
Mobile App for WooCommerce: ShopApper Mobile App Builder Service for WooCommerce
Affected
up to 0.4.62
What to do
Affects up to 0.4.62. Update Mobile App for WooCommerce: ShopApper Mobile App Builder Service for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Aug 26, 2026Greenshift – animation and page builder blocks: Stored Cross-Site ScriptingCVE-2026-5092 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the customapi action handler in versions up to, and including, 12.8.9. This is due to insufficient sanitization of API responses before output via innerHTML. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the injected page.
Product
Greenshift – animation and page builder blocks
Affected
up to 12.8.9
What to do
Affects up to 12.8.9. Update Greenshift – animation and page builder blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 26, 2026Return Refund and Exchange For WooCommerce: Does not correctly verify the ownership of guest orders in some of the AJAX actions it exposes to unauthenticated usersCVE-2026-77695 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Return Refund and Exchange For WooCommerce WordPress plugin before 4.6.4 does not correctly verify the ownership of guest orders in some of the AJAX actions it exposes to unauthenticated users, allowing them to read private order messages, post messages and attachments in the customer's name, and cancel return requests on any guest order.
Product
Return Refund and Exchange For WooCommerce
Fixed in
4.6.4
What to do
Update Return Refund and Exchange For WooCommerce to 4.6.4 or newer.
Full record and what to do →NVD record wpscan.com
Aug 26, 2026Royal Addons for Elementor: Does not perform any capability or ownership check (relying only on a publicly-scrapeable nonce) before writing like-count and visitor-tracking post meta keyed on an arbitrary post IDCVE-2026-13404 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not perform any capability or ownership check (relying only on a publicly-scrapeable nonce) before writing like-count and visitor-tracking post meta keyed on an arbitrary post ID, allowing unauthenticated users to modify that metadata on any post, including private and draft posts.
Product
Royal Addons for Elementor
Fixed in
1.7.1066
What to do
Update Royal Addons for Elementor to 1.7.1066 or newer.
Full record and what to do →NVD record wpscan.com
Aug 26, 2026Eventin: Does not restrict access to non-published content by status or ownership in one of its REST API namespacesCVE-2026-13172 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Eventin WordPress plugin before 4.1.22 does not restrict access to non-published content by status or ownership in one of its REST API namespaces, allowing unauthenticated users to retrieve draft, pending and private posts belonging to other users, along with the passwords and contents of password-protected ones.
Product
Eventin
Fixed in
4.1.22
What to do
Update Eventin to 4.1.22 or newer.
Full record and what to do →NVD record wpscan.com
Aug 25, 2026ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution: Privilege EscalationCVE-2026-75971 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.9.4. This is due to the `rum_importer()` function being registered on the WordPress core `import_start` action hook with no plugin-owned capability check and no allowlist filtering, causing arbitrary `<wp_option>` name/value pairs parsed from an attacker-supplied WXR import file to be passed directly to `update_option()`. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to write arbitrary WordPress options — most critically setting `users_can_register` to `1` and `default_role` to `administrator` — enabling open self-registration of Administrator accounts and full site takeover. This is exploitable by Shop Manager-level users because WooCommerce grants that role the `import` capability, allowing it to reach the WordPress Importer flow that fires the `import_start` hook on which `rum_importer()` is registered, contrary to the assumption that the hook is restricted to Administrators.
Product
ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution
Affected
up to 4.9.4
What to do
Affects up to 4.9.4. Update ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 25, 2026Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership: Stored Cross-Site ScriptingCVE-2026-18547 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Textarea Profile Field with HTML Support (DOM Gadget via id Attribute) in all versions up to, and including, 2.12.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is possible because the wp_kses 'templates' allowlist permits the id attribute on div elements but does not neutralize unescaped quotes within its value; when pickadate.js concatenates the stored id value into an HTML string via jQuery .html() on profile page load, the smuggled onfocus and autofocus attribute syntax breaks out of attribute context and executes as JavaScript.
Product
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership
Affected
up to 2.12.1
What to do
Affects up to 2.12.1. Update Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 25, 2026CM Map Locations – Visualize and share your locations in a few clicks: Limited Arbitrary File UploadCVE-2026-16601 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The CM Map Locations – Visualize and share your locations in a few clicks plugin for WordPress is vulnerable to Limited Arbitrary File Upload in all versions up to, and including, 2.1.8 via the uploadMedia function. This is due to insufficient file type validation in the upload handler, which performs incomplete extension filtering without MIME-type checks or upload capability verification before passing attacker-supplied files to move_uploaded_file(). This makes it possible for authenticated attackers, with subscriber-level access and above, to upload files that may be executable, which makes remote code execution possible. The required nonce is exposed to any logged-in Subscriber via the CMLOC_Editor_Images JavaScript object on the front-end location editor page.
Product
CM Map Locations – Visualize and share your locations in a few clicks
Affected
up to 2.1.8
What to do
Affects up to 2.1.8. Update CM Map Locations – Visualize and share your locations in a few clicks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 24, 2026BetterLinks – Link Shortener, Link Cloaking, Redirects, Affiliate Link Manager & MCP: Authorization bypassCVE-2026-19801 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The BetterLinks – Link Shortener, Link Cloaking, Redirects, Affiliate Link Manager & MCP plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.1.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to create arbitrary BetterLinks short URLs with attacker-controlled slugs and redirect destinations, enabling phishing and SEO abuse. Exploitation requires the Fluent Boards companion plugin to be installed and active (so that the FLUENT_BOARDS constant is defined), and is further facilitated by the betterlinks_admin_nonce nonce being emitted on every frontend page via wp_localize_script, making it accessible to any authenticated user.
Product
BetterLinks – Link Shortener, Link Cloaking, Redirects, Affiliate Link Manager & MCP
Affected
up to 3.1.0
What to do
Affects up to 3.1.0. Update BetterLinks – Link Shortener, Link Cloaking, Redirects, Affiliate Link Manager & MCP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 24, 2026Unauthenticated Cross Site Request Forgery (CSRF) in Hash Form <= 1.4.0 versions.CVE-2026-78280 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Unauthenticated Cross Site Request Forgery (CSRF) in Hash Form <= 1.4.0 versions.
Affected
up to 1.4.0
What to do
Affects up to 1.4.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 24, 2026Contributor Server Side Request Forgery (SSRF) in Shared Files <= 1.7.69 versions.CVE-2026-78269 · WordPress plugins & themes · reported by PatchstackMedium 6.4
Contributor Server Side Request Forgery (SSRF) in Shared Files <= 1.7.69 versions.
Affected
up to 1.7.69
What to do
Affects up to 1.7.69. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 24, 2026Unauthenticated Cross Site Scripting (XSS) in Social Media & Share Icons <= 2.9.9 versions.CVE-2026-66623 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Social Media & Share Icons <= 2.9.9 versions.
Affected
up to 2.9.9
What to do
Affects up to 2.9.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 24, 2026Unauthenticated Arbitrary File Deletion in ShopBuilder Pro – Elementor WooCommerce Builder Addons <= 2.2.0 versions.CVE-2026-32477 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Unauthenticated Arbitrary File Deletion in ShopBuilder Pro – Elementor WooCommerce Builder Addons <= 2.2.0 versions.
Affected
up to 2.2.0
What to do
Affects up to 2.2.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 23, 2026Content Mask: Does not check the capability required to publish the post type being createdCVE-2026-77003 · WordPress plugins & themes · reported by WPScanLow 2.7
The Content Mask WordPress plugin before 1.8.5.5 does not check the capability required to publish the post type being created, allowing users with a role as low as Contributor to publish posts and pages on the site without holding the publish capability.
Product
Content Mask
Fixed in
1.8.5.5
What to do
Update Content Mask to 1.8.5.5 or newer.
Full record and what to do →NVD record wpscan.com
Aug 22, 2026WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels: Directory TraversalCVE-2026-18027 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.9.8 via the get_image_src_in_base64 function. This makes it possible for authenticated attackers, with subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. The base64-encoded file contents are embedded into the cached invoice HTML and served directly to the attacker via the plugin's own Print/Download invoice endpoints, which require only a valid nonce and access key.
Product
WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels
Affected
up to 4.9.8
What to do
Affects up to 4.9.8. Update WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 22, 2026GreenShift – Animation and Page Builder Blocks: Unauthorized modification of dataCVE-2026-5093 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The GreenShift – Animation and Page Builder Blocks plugin for WordPress is vulnerable to unauthorized modification of data in versions up to, and including, 12.8.9. This is due to a missing capability check on the 'gspb_update_global_wp_settings' function that only verifies the 'edit_posts' capability instead of requiring administrative privileges. This makes it possible for authenticated attackers, with contributor-level access and above, to modify global WordPress theme color settings site-wide, leading to site defacement.
Product
GreenShift – Animation and Page Builder Blocks
Affected
up to 12.8.9
What to do
Affects up to 12.8.9. Update GreenShift – Animation and Page Builder Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 22, 2026The kk Star Ratings – Rate Post & Collect User Feedbacks: Arbitrary shortcode executionCVE-2026-3424 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The The kk Star Ratings – Rate Post & Collect User Feedbacks plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.4.10.3. This is due to the software allowing users to execute an action that does not properly validate the 'payload' value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
Product
The kk Star Ratings – Rate Post & Collect User Feedbacks
Affected
up to 5.4.10.3
What to do
Affects up to 5.4.10.3. Update The kk Star Ratings – Rate Post & Collect User Feedbacks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 22, 2026Social Login & Sharing buttons with Analytics By SoClever: Does not perform any authenticationCVE-2026-77001 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Social Login & Sharing buttons with Analytics By SoClever WordPress plugin through 1.2.0 does not perform any authentication, authorisation or nonce checks in one of its publicly accessible login handlers, allowing unauthenticated attackers to obtain a valid session as any existing user, including administrators. In the default case a session as the site's original administrator account is obtained without needing to know any account details at all.
Product
Social Login & Sharing buttons with Analytics By SoClever
Affected
up to 1.2.0
What to do
Affects up to 1.2.0. Update Social Login & Sharing buttons with Analytics By SoClever to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Aug 22, 2026Tutor LMS: Does not enforce per-object ownership checks on its course content typeCVE-2026-14187 · WordPress plugins & themes · reported by WPScanLow 2.7
The Tutor LMS WordPress plugin before 4.0.6 does not enforce per-object ownership checks on its course content type, allowing any user with the instructor role to read the content of private courses belonging to other instructors.
Product
Tutor LMS
Fixed in
4.0.6
What to do
Update Tutor LMS to 4.0.6 or newer.
Full record and what to do →NVD record wpscan.com
Aug 21, 2026ProfilePress: Does not strip shortcodes from two of its profile fields before rendering them on public pagesCVE-2026-19848 · WordPress plugins & themes · reported by WPScanMedium 6.5
The ProfilePress WordPress plugin before 4.17.1 does not strip shortcodes from two of its profile fields before rendering them on public pages, allowing unauthenticated attackers to store shortcodes that are then executed when the page is viewed, disclosing a chosen user's email address, login and registration date.
Product
ProfilePress
Fixed in
4.17.1
What to do
Update ProfilePress to 4.17.1 or newer.
Full record and what to do →NVD record wpscan.com
Aug 21, 2026Eventin: Does not validate a user-supplied webhook URL stored on events nor verify event ownershipCVE-2026-13176 · WordPress plugins & themes · reported by WPScanLow 2.7
The Eventin WordPress plugin before 4.1.21 does not validate a user-supplied webhook URL stored on events nor verify event ownership, allowing users with contributor-level access and above to trigger blind server-side requests to arbitrary hosts.
Product
Eventin
Fixed in
4.1.21
What to do
Update Eventin to 4.1.21 or newer.
Full record and what to do →NVD record wpscan.com
Aug 20, 2026Unauthenticated Broken Access Control in EPROLO Dropshipping <= 2.4.2 versions.CVE-2026-74019 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Broken Access Control in EPROLO Dropshipping <= 2.4.2 versions.
Affected
up to 2.4.2
What to do
Affects up to 2.4.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 20, 2026Subscriber SQL Injection in eShipper Commerce <= 2.16.13 versions.CVE-2026-74013 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Subscriber SQL Injection in eShipper Commerce <= 2.16.13 versions.
Affected
up to 2.16.13
What to do
Affects up to 2.16.13. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 20, 2026Unauthenticated Broken Authentication in User Registration & Membership Pro <= 5.4.5 versions.CVE-2026-74001 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated Broken Authentication in User Registration & Membership Pro <= 5.4.5 versions.
Affected
up to 5.4.5
What to do
Affects up to 5.4.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 20, 2026Unauthenticated Cross Site Scripting (XSS) in Podlove Podcast Publisher <= 4.5.4 versions.CVE-2026-66615 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Podlove Podcast Publisher <= 4.5.4 versions.
Affected
up to 4.5.4
What to do
Affects up to 4.5.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 20, 2026Unauthenticated Local File Inclusion in Shuffle <= 1.8 versions.CVE-2025-15637 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Local File Inclusion in Shuffle <= 1.8 versions.
Affected
up to 1.8
What to do
Affects up to 1.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 19, 2026Grav Shortcode Core Plugin allows for the development shortcode plugins that utilize the common format utilized by WordPress and BBCode.CVE-2026-64851 · WordPress plugins & themes · reported by GitHubHigh 8.5
Grav Shortcode Core Plugin allows for the development shortcode plugins that utilize the common format utilized by WordPress and BBCode. Prior to 6.2.2, Grav Shortcode Core passes shortcode syntax through Security::detectXss() because it contains no literal less-than character, then ColorShortcode.php and related attribute handlers concatenate an attacker-controlled parameter into HTML without encoding. An account with admin.pages permission can close the generated attribute and add an event handler, creating stored cross-site scripting that executes for visitors or administrators who view the page. This issue is fixed in version 6.2.2.
Fixed in
6.2.2
What to do
Update the plugin to 6.2.2 or newer.
Full record and what to do →NVD record github.com github.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.