Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
11,525 results · page 84 of 231
Aug 6, 2026Contributor Cross Site Scripting (XSS) in Ultimate Addons for Elementor <= 1.45.2 versions.CVE-2026-66688 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Cross Site Scripting (XSS) in Ultimate Addons for Elementor <= 1.45.2 versions.
- What to do
- Update the plugin to the newest version.
Aug 6, 2026Unauthenticated Cross Site Request Forgery (CSRF) in Plugins Garbage Collector (Database Cleanup) <= 0.14 versions.CVE-2026-66686 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Cross Site Request Forgery (CSRF) in Plugins Garbage Collector (Database Cleanup) <= 0.14 versions.
- What to do
- Update the plugin to the newest version.
Aug 6, 2026Unauthenticated Sensitive Data Exposure in Featured Video Plus <= 2.3.3 versions.CVE-2026-66685 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Sensitive Data Exposure in Featured Video Plus <= 2.3.3 versions.
- What to do
- Update the plugin to the newest version.
Aug 6, 2026Unauthenticated Sensitive Data Exposure in Export Import Menus <= 1.9.2 versions.CVE-2026-66684 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Sensitive Data Exposure in Export Import Menus <= 1.9.2 versions.
- What to do
- Update the plugin to the newest version.
Aug 6, 2026Unauthenticated Sensitive Data Exposure in Custom CSS and JavaScript <= 2.0.16 versions.CVE-2026-66683 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Sensitive Data Exposure in Custom CSS and JavaScript <= 2.0.16 versions.
- What to do
- Update the plugin to the newest version.
Aug 6, 2026Unauthenticated Cross Site Request Forgery (CSRF) in Theme My Login <= 7.1.14 versions.CVE-2026-66681 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Unauthenticated Cross Site Request Forgery (CSRF) in Theme My Login <= 7.1.14 versions.
- What to do
- Update the plugin to the newest version.
Aug 6, 2026Contributor Broken Access Control in Advanced Custom Fields: Font Awesome Field <= 6.1.1 versions.CVE-2026-66678 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Contributor Broken Access Control in Advanced Custom Fields: Font Awesome Field <= 6.1.1 versions.
- What to do
- Update the plugin to the newest version.
Aug 6, 2026Unauthenticated Arbitrary File Upload in Type Hub <= 2.0.6 versions.CVE-2026-66665 · WordPress plugins & themes · reported by PatchstackCritical 10
Unauthenticated Arbitrary File Upload in Type Hub <= 2.0.6 versions.
- What to do
- Update the plugin to the newest version.
Aug 6, 2026Unauthenticated Cross Site Scripting (XSS) in SEO Plugin by Squirrly SEO <= 14.2.0 versions.CVE-2026-66664 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in SEO Plugin by Squirrly SEO <= 14.2.0 versions.
- What to do
- Update the plugin to the newest version.
Aug 6, 2026Unauthenticated Cross Site Scripting (XSS) in WP Data Access <= 5.5.79 versions.CVE-2026-66663 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in WP Data Access <= 5.5.79 versions.
- What to do
- Update the plugin to the newest version.
Aug 6, 2026Unauthenticated Privilege Escalation in Frontend Admin by DynamiApps <= 3.29.10 versions.CVE-2026-66662 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated Privilege Escalation in Frontend Admin by DynamiApps <= 3.29.10 versions.
- What to do
- Update the plugin to the newest version.
Aug 6, 2026Subscriber Broken Access Control in Frontend Admin by DynamiApps <= 3.29.10 versions.CVE-2026-66470 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Subscriber Broken Access Control in Frontend Admin by DynamiApps <= 3.29.10 versions.
- What to do
- Update the plugin to the newest version.
Aug 6, 2026Pixelite Events Manager events-manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-66457 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pixelite Events Manager events-manager allows Reflected XSS.This issue affects Events Manager: from n/a through 7.4.2.
- Product
- Pixelite Events Manager events-manager
- Affected
- up to 7.4.2
- What to do
- Affects up to 7.4.2. Update Pixelite Events Manager events-manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 6, 2026Unauthenticated Broken Access Control in Legal Text Connector of the IT-Recht Kanzlei <= 1.0.13 versions.CVE-2026-66452 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Broken Access Control in Legal Text Connector of the IT-Recht Kanzlei <= 1.0.13 versions.
- What to do
- Update the plugin to the newest version.
Aug 6, 2026Unauthenticated Broken Authentication in WP Event SOlution <= 4.1.9 versions.CVE-2026-66451 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Broken Authentication in WP Event SOlution <= 4.1.9 versions.
- What to do
- Update the plugin to the newest version.
Aug 6, 2026Unauthenticated SQL Injection in WordPress File Upload <= 5.1.7 versions.CVE-2026-66447 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in WordPress File Upload <= 5.1.7 versions.
- What to do
- Update the plugin to the newest version.
Aug 6, 2026Unauthenticated Cross Site Scripting (XSS) in WPIDE – File Manager & Code Editor <= 3.5.7 versions.CVE-2026-66440 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in WPIDE – File Manager & Code Editor <= 3.5.7 versions.
- What to do
- Update the plugin to the newest version.
Aug 6, 2026Unauthenticated Cross Site Scripting (XSS) in Advanced AJAX Product Filters <= 3.2.0.3 versions.CVE-2026-66439 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Advanced AJAX Product Filters <= 3.2.0.3 versions.
- What to do
- Update the plugin to the newest version.
Aug 6, 2026Unauthenticated Broken Authentication in Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder <= 1.9.0 versions.CVE-2026-66425 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Broken Authentication in Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder <= 1.9.0 versions.
- What to do
- Update the plugin to the newest version.
Aug 6, 2026Unauthenticated PHP Object Injection in AI ANN <= 1.29.0 versions.CVE-2026-65581 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in AI ANN <= 1.29.0 versions.
- What to do
- Update the plugin to the newest version.
Aug 6, 2026Unauthenticated PHP Object Injection in Agricola <= 1.21.0 versions.CVE-2026-65579 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in Agricola <= 1.21.0 versions.
- What to do
- Update the plugin to the newest version.
Aug 6, 2026Unauthenticated PHP Object Injection in Agora <= 1.9 versions.CVE-2026-65578 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in Agora <= 1.9 versions.
- What to do
- Update the plugin to the newest version.
Aug 6, 2026Unauthenticated PHP Object Injection in Advice <= 1.18.0 versions.CVE-2026-65577 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in Advice <= 1.18.0 versions.
- What to do
- Update the plugin to the newest version.
Aug 6, 2026Unauthenticated PHP Object Injection in Adrena <= 1.2.14 versions.CVE-2026-65576 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in Adrena <= 1.2.14 versions.
- What to do
- Update the plugin to the newest version.
Aug 6, 2026Unauthenticated PHP Object Injection in Accalia <= 1.5.3 versions.CVE-2026-65575 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in Accalia <= 1.5.3 versions.
- What to do
- Update the plugin to the newest version.
Aug 6, 2026Unauthenticated PHP Object Injection in Abogado <= 1.18 versions.CVE-2026-65574 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in Abogado <= 1.18 versions.
- What to do
- Update the plugin to the newest version.
Aug 6, 2026Unauthenticated PHP Object Injection in Abelle <= 1.22 versions.CVE-2026-65573 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in Abelle <= 1.22 versions.
- What to do
- Update the plugin to the newest version.
Aug 6, 2026Unauthenticated PHP Object Injection in A.Williams <= 1.3.1 versions.CVE-2026-65572 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in A.Williams <= 1.3.1 versions.
- What to do
- Update the plugin to the newest version.
Aug 6, 2026Unauthenticated PHP Object Injection in 69 Clothing <= 1.2.11.1 versions.CVE-2026-65571 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in 69 Clothing <= 1.2.11.1 versions.
- What to do
- Update the plugin to the newest version.
Aug 6, 2026Login with phone number <= 1: Unauthenticated BypassCVE-2026-65570 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Bypass Vulnerability in Login with phone number <= 1.8.70 versions.
- Product
- Login with phone number <= 1
- What to do
- Update Login with phone number <= 1 to the newest version.
Aug 6, 2026Subscriber SQL Injection in WP Job Portal <= 2.5.6 versions.CVE-2026-65569 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Subscriber SQL Injection in WP Job Portal <= 2.5.6 versions.
- What to do
- Update the plugin to the newest version.
Aug 6, 2026Unauthenticated Cross Site Scripting (XSS) in Survey Maker <= 5.2.3.3 versions.CVE-2026-65565 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Survey Maker <= 5.2.3.3 versions.
- What to do
- Update the plugin to the newest version.
Aug 6, 2026Unauthenticated Cross Site Scripting (XSS) in Houzez Property Feed <= 2.5.48 versions.CVE-2026-65560 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Houzez Property Feed <= 2.5.48 versions.
- What to do
- Update the plugin to the newest version.
Aug 6, 2026Shop manager Privilege Escalation in Order Delivery Date for WooCommerce <= 4.6.0 versions.CVE-2026-65559 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Shop manager Privilege Escalation in Order Delivery Date for WooCommerce <= 4.6.0 versions.
- What to do
- Update the plugin to the newest version.
Aug 6, 2026Unauthenticated PHP Object Injection in WPBruiser {no- Captcha anti-Spam} <= 3.1.43 versions.CVE-2026-65556 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in WPBruiser {no- Captcha anti-Spam} <= 3.1.43 versions.
- What to do
- Update the plugin to the newest version.
Aug 6, 2026Subscriber Broken Access Control in AnsPress – Question and answer 4.4.4 versions.CVE-2026-65554 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Subscriber Broken Access Control in AnsPress – Question and answer 4.4.4 versions.
- What to do
- Update the plugin to the newest version.
Aug 6, 2026Unauthenticated Remote Code Execution (RCE) in Spider Analyser – WordPress搜索引擎蜘蛛分析插件 <= 2.1.3 versions.CVE-2026-65553 · WordPress plugins & themes · reported by PatchstackCritical 10
Unauthenticated Remote Code Execution (RCE) in Spider Analyser – WordPress搜索引擎蜘蛛分析插件 <= 2.1.3 versions.
- What to do
- Update the plugin to the newest version.
Aug 6, 2026Subscriber PHP Object Injection in Export User Data <= 2.2.6 versions.CVE-2026-65552 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Subscriber PHP Object Injection in Export User Data <= 2.2.6 versions.
- What to do
- Update the plugin to the newest version.
Aug 6, 2026Author PHP Object Injection in Jeg Kit for Elementor <= 3.2.10 versions.CVE-2026-65549 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Author PHP Object Injection in Jeg Kit for Elementor <= 3.2.10 versions.
- What to do
- Update the plugin to the newest version.
Aug 6, 2026Contributor Remote Code Execution (RCE) in Betheme <= 28.4.2 versions.CVE-2026-65548 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Contributor Remote Code Execution (RCE) in Betheme <= 28.4.2 versions.
- What to do
- Update the plugin to the newest version.
Aug 6, 2026Subscriber SQL Injection in Creative Mail <= 1.6.9 versions.CVE-2026-65547 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Subscriber SQL Injection in Creative Mail <= 1.6.9 versions.
- What to do
- Update the plugin to the newest version.
Aug 6, 2026Unauthenticated SQL Injection in Qode Tours <= 3.1.3.1 versions.CVE-2026-65546 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in Qode Tours <= 3.1.3.1 versions.
- What to do
- Update the plugin to the newest version.
Aug 6, 2026Unauthenticated Cross Site Scripting (XSS) in AI Engine <= 3.6.8 versions.CVE-2026-65545 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in AI Engine <= 3.6.8 versions.
- What to do
- Update the plugin to the newest version.
Aug 6, 2026Unauthenticated Cross Site Scripting (XSS) in Super Socializer <= 7.14.5 versions.CVE-2026-65544 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Super Socializer <= 7.14.5 versions.
- What to do
- Update the plugin to the newest version.
Aug 6, 2026Subscriber Sensitive Data Exposure in Vimeo <= 1.2.2 versions.CVE-2026-65543 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Subscriber Sensitive Data Exposure in Vimeo <= 1.2.2 versions.
- What to do
- Update the plugin to the newest version.
Aug 6, 2026Unauthenticated Broken Authentication in Super Socializer <= 7.14.5 versions.CVE-2026-65542 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Unauthenticated Broken Authentication in Super Socializer <= 7.14.5 versions.
- What to do
- Update the plugin to the newest version.
Aug 6, 2026Unauthenticated Broken Access Control in Staff Training <= 1.0.7 versions.CVE-2026-65541 · WordPress plugins & themes · reported by PatchstackHigh 7.3
Unauthenticated Broken Access Control in Staff Training <= 1.0.7 versions.
- What to do
- Update the plugin to the newest version.
Aug 6, 2026Unauthenticated Insecure Direct Object References (IDOR) in Formidable Forms Signature Online Contract Automation <= 2.0.1 versions.CVE-2026-65523 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Insecure Direct Object References (IDOR) in Formidable Forms Signature Online Contract Automation <= 2.0.1 versions.
- What to do
- Update the plugin to the newest version.
Aug 6, 2026Unauthenticated SQL Injection in WP OAuth Server <= 6.2.0 versions.CVE-2026-65520 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in WP OAuth Server <= 6.2.0 versions.
- What to do
- Update the plugin to the newest version.
Aug 6, 2026Unauthenticated Cross Site Scripting (XSS) in Easy PayPal Buy Now Button <= 2.0.4 versions.CVE-2026-65517 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Easy PayPal Buy Now Button <= 2.0.4 versions.
- What to do
- Update the plugin to the newest version.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. The WordPress, CMS and hosting-panel entries come from the National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan and others); we show who. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.