Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,158 results · page 8 of 24
Aug 20, 2026Unauthenticated Broken Authentication in User Registration & Membership Pro <= 5.4.5 versions.CVE-2026-74001 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated Broken Authentication in User Registration & Membership Pro <= 5.4.5 versions.
- What to do
- Update the plugin to the newest version.
Aug 20, 2026Unauthenticated PHP Object Injection in FundEngine <= 1.7.9 versions.CVE-2026-73993 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in FundEngine <= 1.7.9 versions.
- What to do
- Update the plugin to the newest version.
Aug 20, 2026Subscriber Remote Code Execution (RCE) in Query Wrangler <= 1.5.57 versions.CVE-2026-73992 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Subscriber Remote Code Execution (RCE) in Query Wrangler <= 1.5.57 versions.
- What to do
- Update the plugin to the newest version.
Aug 20, 2026Unauthenticated SQL Injection in BookingPress Appointment Booking Pro <= 6.0.2 versions.CVE-2026-68566 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in BookingPress Appointment Booking Pro <= 6.0.2 versions.
- What to do
- Update the plugin to the newest version.
Aug 20, 2026Unauthenticated Privilege Escalation in Abandoned Cart Pro for WooCommerce <= 10.4.0 versions.CVE-2026-66682 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated Privilege Escalation in Abandoned Cart Pro for WooCommerce <= 10.4.0 versions.
- What to do
- Update the plugin to the newest version.
Aug 20, 2026Unauthenticated SQL Injection in Locatoraid Store Locator <= 3.9.72 versions.CVE-2026-66680 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in Locatoraid Store Locator <= 3.9.72 versions.
- What to do
- Update the plugin to the newest version.
Aug 20, 2026Unauthenticated PHP Object Injection in Flatastic <= 2.0 versions.CVE-2026-66672 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in Flatastic <= 2.0 versions.
- What to do
- Update the plugin to the newest version.
Aug 20, 2026Unauthenticated SQL Injection in Directory Pro <= 2.5.8 versions.CVE-2026-66649 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in Directory Pro <= 2.5.8 versions.
- What to do
- Update the plugin to the newest version.
Aug 20, 2026Unauthenticated SQL Injection in TheGem (Elementor) <= 5.12.3 versions.CVE-2026-66609 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in TheGem (Elementor) <= 5.12.3 versions.
- What to do
- Update the plugin to the newest version.
Aug 20, 2026Author Arbitrary File Upload in Media LIbrary Assistant <= 3.39 versions.CVE-2026-66600 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Author Arbitrary File Upload in Media LIbrary Assistant <= 3.39 versions.
- What to do
- Update the plugin to the newest version.
Aug 20, 2026Unauthenticated SQL Injection in Security & Malware scan by CleanTalk <= 2.184 versions.CVE-2026-66593 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in Security & Malware scan by CleanTalk <= 2.184 versions.
- What to do
- Update the plugin to the newest version.
Aug 20, 2026Unauthenticated SQL Injection in rtMedia for WordPress, BuddyPress and bbPress <= 4.7.11 versions.CVE-2026-66592 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in rtMedia for WordPress, BuddyPress and bbPress <= 4.7.11 versions.
- What to do
- Update the plugin to the newest version.
Aug 20, 2026Unauthenticated PHP Object Injection in Forminator <= 1.57.0 versions.CVE-2026-66583 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in Forminator <= 1.57.0 versions.
- What to do
- Update the plugin to the newest version.
Aug 20, 2026Unauthenticated Privilege Escalation in Capella <= 2.5.5 versions.CVE-2025-15689 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated Privilege Escalation in Capella <= 2.5.5 versions.
- What to do
- Update the plugin to the newest version.
Aug 20, 2026Unauthenticated SQL Injection in Capella <= 2.5.5 versions.CVE-2025-15688 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in Capella <= 2.5.5 versions.
- What to do
- Update the plugin to the newest version.
Aug 20, 2026JSON Options: Does not have any capability check or nonce verification on one of its actionsCVE-2026-75860 · WordPress plugins & themes · reported by WPScanCritical 9.8
The JSON Options WordPress plugin through 0.0.4 does not have any capability check or nonce verification on one of its actions, which runs on every request and is available to unauthenticated users, allowing them to update arbitrary WordPress options. This can be leveraged to enable user registration and set the default role to administrator, leading to privilege escalation and full site takeover.
- Product
- JSON Options
- Affected
- up to 0.0.4
- What to do
- Affects up to 0.0.4. Update JSON Options to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 19, 2026TrueBooker – Appointment Booking and Scheduler System: Authorization Bypass Through User-Controlled Key leading to Account TakeoverCVE-2026-18315 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key leading to Account Takeover in all versions up to, and including, 1.2.6. This is due to the admin_user_create_cus AJAX handler lacking any authentication or capability check before passing the attacker-supplied truebooker_wp_user_id parameter directly to wp_update_user. This makes it possible for unauthenticated attackers to overwrite the email address of any WordPress user — including an administrator — and then complete the standard WordPress lost-password flow to fully take over the targeted account.
- Product
- TrueBooker – Appointment Booking and Scheduler System
- Affected
- up to 1.2.6
- What to do
- Affects up to 1.2.6. Update TrueBooker – Appointment Booking and Scheduler System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.svn.wordpress.orgplugins.svn.wordpress.org
Aug 19, 2026Elementor Pro: Unrestricted Upload of File with Dangerous TypeCVE-2026-32475 · WordPress plugins & themes · reported by PatchstackCritical 9
Unrestricted Upload of File with Dangerous Type vulnerability in Elementor Elementor Pro allows Using Malicious Files. This issue affects Elementor Pro: from n/a through 4.2.1.
- Product
- Elementor Pro
- Affected
- up to 4.2.1
- What to do
- Affects up to 4.2.1. Update Elementor Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 19, 2026Joomla Extension - cmsjunkie.com - SQL injection in trips search in J-BusinessDirectory < 6.2.3 - Search keywords and ORDER BY were concatenated into SQL.CVE-2026-75954 · Websites & servers · reported by security@joomla.orgCritical 9.3
Joomla Extension - cmsjunkie.com - SQL injection in trips search in J-BusinessDirectory < 6.2.3 - Search keywords and ORDER BY were concatenated into SQL. 6.2.3 quotes keywords and allow-lists the sort clause.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2026Joomla Extension - cmsjunkie.com - Arbitrary file upload / deletion (path traversal) in J-BusinessDirectory < 6.2.3 - Upload/remove accepted a client-controlleCVE-2026-75949 · Websites & servers · reported by security@joomla.orgCritical 10
Joomla Extension - cmsjunkie.com - Arbitrary file upload / deletion (path traversal) in J-BusinessDirectory < 6.2.3 - Upload/remove accepted a client-controlled root (_path_type could point at the component site/admin trees), did not enforce path containment, and used a weak extension check. CSRF token was also missing on upload/remove.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2026Joomla Extension - yootheme.com - Unauthenticated SQL injection in ItemController::element() in Zoo < 4.1.64 - The filter_type request value is interpolated intCVE-2026-74804 · Websites & servers · reported by security@joomla.orgCritical 9.3
Joomla Extension - yootheme.com - Unauthenticated SQL injection in ItemController::element() in Zoo < 4.1.64 - The filter_type request value is interpolated into the query as a.type = "..." and the type_filter array as a.type IN ("..."), with no quoting or escaping.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2026Joomla Extension - yootheme.com - Unauthenticated arbitrary file upload in Zoo < 4.1.64 - The image element accepts arbitrary files when the client-supplied ConCVE-2026-74803 · Websites & servers · reported by security@joomla.orgCritical 10
Joomla Extension - yootheme.com - Unauthenticated arbitrary file upload in Zoo < 4.1.64 - The image element accepts arbitrary files when the client-supplied Content-Type falls within the image MIME group.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2026Unauthenticated SQL Injection in Total Donations <= 2.0.5 versions.CVE-2026-73391 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in Total Donations <= 2.0.5 versions.
- What to do
- Update the plugin to the newest version.
Aug 19, 2026Unauthenticated Privilege Escalation in Total Donations <= 2.0.5 versions.CVE-2026-73390 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated Privilege Escalation in Total Donations <= 2.0.5 versions.
- What to do
- Update the plugin to the newest version.
Aug 19, 2026Unauthenticated PHP Object Injection in Kalles Addons <= 1.0.6 versions.CVE-2026-73389 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in Kalles Addons <= 1.0.6 versions.
- What to do
- Update the plugin to the newest version.
Aug 19, 2026Unauthenticated SQL Injection in Nikstore Core <= 1.5 versions.CVE-2026-73388 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in Nikstore Core <= 1.5 versions.
- What to do
- Update the plugin to the newest version.
Aug 19, 2026Customer PHP Object Injection in Flexible Subscriptions <= 1.8.1 versions.CVE-2026-73364 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Customer PHP Object Injection in Flexible Subscriptions <= 1.8.1 versions.
- What to do
- Update the plugin to the newest version.
Aug 19, 2026Unauthenticated Privilege Escalation in TrueBooker <= 1.2.6 versions.CVE-2026-73347 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated Privilege Escalation in TrueBooker <= 1.2.6 versions.
- What to do
- Update the plugin to the newest version.
Aug 19, 2026Unauthenticated SQL Injection in NGG Smart Image Search < 4.0.0 versions.CVE-2026-73185 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in NGG Smart Image Search < 4.0.0 versions.
- What to do
- Update the plugin to the newest version.
Aug 19, 2026Unauthenticated SQL Injection in Maps Marker Pro <= 4.32 versions.CVE-2026-73183 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in Maps Marker Pro <= 4.32 versions.
- What to do
- Update the plugin to the newest version.
Aug 19, 2026Joomla Extension - balbooa.com - Pre-auth PHP Code Injection in Balbooa Forms < 2.4.3.2 - The form's optional custom-PHP post-submission handler is executed viaCVE-2026-67364 · Websites & servers · reported by security@joomla.orgCritical 10
Joomla Extension - balbooa.com - Pre-auth PHP Code Injection in Balbooa Forms < 2.4.3.2 - The form's optional custom-PHP post-submission handler is executed via eval(). The [URL parameter = X] shortcode is substituted with the raw, unescaped value of a query parameter, letting an unauthenticated attacker inject arbitrary PHP that executes server-side. The CSRF token needed to reach the endpoint is itself disclosed anonymously via a separate task, so it provides no real protection. Exploitability requires the form to have a custom-PHP handler configured (a documented builder feature) referencing that shortcode, and no reCAPTCHA on the submit button.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2026Unauthenticated Remote Code Execution (RCE) in JetEngine <= 3.8.14 versions.CVE-2026-66613 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated Remote Code Execution (RCE) in JetEngine <= 3.8.14 versions.
- What to do
- Update the plugin to the newest version.
Aug 19, 2026Broken Link Checker: Does not limitCVE-2026-18937 · WordPress plugins & themes · reported by WPScanCritical 9
The Broken Link Checker WordPress plugin before 2.4.12 does not limit which query variables it accepts from user input on sites using plain permalinks, allowing unauthenticated users to overwrite arbitrary PHP global variables, and to execute arbitrary code on the server when a classic (non-block) is active.
- Product
- Broken Link Checker
- Fixed in
- 2.4.12
- What to do
- Update Broken Link Checker to 2.4.12 or newer.
Aug 19, 2026TrueBooker: Does not have proper authorisation checks in some of its AJAX actionsCVE-2026-18776 · WordPress plugins & themes · reported by WPScanCritical 9.8
The TrueBooker WordPress plugin before 1.2.7 does not have proper authorisation checks in some of its AJAX actions, allowing unauthenticated users to change the email address of arbitrary users, including administrators, and subsequently take over their account via the password reset flow.
- Product
- TrueBooker
- Fixed in
- 1.2.7
- What to do
- Update TrueBooker to 1.2.7 or newer.
Aug 19, 2026W3 Total Cache: Does not properly validate the request path it uses to build cache file namesCVE-2026-18051 · WordPress plugins & themes · reported by WPScanCritical 10
The W3 Total Cache WordPress plugin before 2.10.5 does not properly validate the request path it uses to build cache file names, allowing unauthenticated attackers to write a file into any existing directory on the server, inside or outside the web root, overwriting whatever occupies the target name. On Apache, the same flaw overwrites the site's .htaccess files, which breaks the site and can strip hardening rules that other security measures rely on.
- Product
- W3 Total Cache
- Fixed in
- 2.10.5
- What to do
- Update W3 Total Cache to 2.10.5 or newer.
Aug 19, 2026TabaPay Gateway: Does not validate the payment callback before establishing a session for the account associated with the referenced orderCVE-2026-18031 · WordPress plugins & themes · reported by WPScanCritical 9.8
The TabaPay Gateway WordPress plugin through 1.4.0 does not validate the payment callback before establishing a session for the account associated with the referenced order, allowing unauthenticated attackers to log in as any registered user, including an administrator.
- Product
- TabaPay Gateway
- Affected
- up to 1.4.0
- What to do
- Affects up to 1.4.0. Update TabaPay Gateway to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 18, 2026Unauthenticated SQL Injection in Readabler < 2.0.18 versions.CVE-2026-74015 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in Readabler < 2.0.18 versions.
- What to do
- Update the plugin to the newest version.
Aug 18, 2026Unauthenticated Arbitrary File Upload in Masteriyo - LMS <= 2.3.2 versions.CVE-2026-73996 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated Arbitrary File Upload in Masteriyo - LMS <= 2.3.2 versions.
- What to do
- Update the plugin to the newest version.
Aug 18, 2026Unauthenticated Deserialization of untrusted data in Youzify <= 1.3.7 versions.CVE-2026-73397 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated Deserialization of untrusted data in Youzify <= 1.3.7 versions.
- What to do
- Update the plugin to the newest version.
Aug 18, 2026Unauthenticated Broken Authentication in Popup by Supsystic <= 1.13.0 versions.CVE-2026-73381 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Unauthenticated Broken Authentication in Popup by Supsystic <= 1.13.0 versions.
- What to do
- Update the plugin to the newest version.
Aug 18, 2026Unauthenticated PHP Object Injection in Popup by Supsystic <= 1.13.0 versions.CVE-2026-73380 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in Popup by Supsystic <= 1.13.0 versions.
- What to do
- Update the plugin to the newest version.
Aug 18, 2026Unauthenticated PHP Object Injection in Ultimate Maps by Supsystic < 1.5.0 versions.CVE-2026-73376 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in Ultimate Maps by Supsystic < 1.5.0 versions.
- What to do
- Update the plugin to the newest version.
Aug 18, 2026Unauthenticated PHP Object Injection in Easy Google Maps <= 1.13.0 versions.CVE-2026-73366 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in Easy Google Maps <= 1.13.0 versions.
- What to do
- Update the plugin to the newest version.
Aug 18, 2026Unauthenticated SQL Injection in JetAppointment <= 2.5.2 versions.CVE-2026-73365 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in JetAppointment <= 2.5.2 versions.
- What to do
- Update the plugin to the newest version.
Aug 18, 2026Unauthenticated SQL Injection in Affiliates Manager <= 2.9.53 versions.CVE-2026-73355 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in Affiliates Manager <= 2.9.53 versions.
- What to do
- Update the plugin to the newest version.
Aug 18, 2026Unauthenticated Remote Code Execution (RCE) in WP Compress < 7.20.01 versions.CVE-2026-73343 · WordPress plugins & themes · reported by PatchstackCritical 10
Unauthenticated Remote Code Execution (RCE) in WP Compress < 7.20.01 versions.
- What to do
- Update the plugin to the newest version.
Aug 18, 2026Unauthenticated PHP Object Injection in RegistrationMagic <= 6.0.9.7 versions.CVE-2026-73341 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in RegistrationMagic <= 6.0.9.7 versions.
- What to do
- Update the plugin to the newest version.
Aug 18, 2026Unauthenticated SQL Injection in Modern Events Calendar < 7.35.0 versions.CVE-2026-73339 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in Modern Events Calendar < 7.35.0 versions.
- What to do
- Update the plugin to the newest version.
Aug 18, 2026Unauthenticated SQL Injection in Sticky Chat Widget <= 1.4.2 versions.CVE-2026-73187 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in Sticky Chat Widget <= 1.4.2 versions.
- What to do
- Update the plugin to the newest version.
Aug 18, 2026GP Premium: Unrestricted Upload of File with Dangerous TypeCVE-2026-66627 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in EDGE22 Studios Ltd. GP Premium allows Remote Code Inclusion. This issue affects GP Premium: from n/a through 2.5.5.
- Product
- GP Premium
- Affected
- up to 2.5.5
- What to do
- Affects up to 2.5.5. Update GP Premium to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. The WordPress, CMS and hosting-panel entries come from the National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan and others); we show who. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, a booking system, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.