Updated 10 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

512new WordPress flaws this week

391,181entries in the database

1,830 results · page 9 of 37

Apr 9, 2026Customer Reviews for WooCommerce: Authentication bypassCVE-2026-4664 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 5.103.0. This is due to the `create_review_permissions_check()` function comparing the user-supplied `key` parameter against the order's `ivole_secret_key` meta value using strict equality (`===`), without verifying that the stored key is non-empty. For orders where no review reminder email has been sent, the `ivole_secret_key` meta is not set, causing `get_meta()` to return an empty string. An attacker can supply `key: ""` to match this empty value and bypass the permission check. This makes it possible for unauthenticated attackers to submit, modify, and inject product reviews on any product — including products not associated with the referenced order — via the REST API endpoint `POST /ivole/v1/review`. Reviews are auto-approved by default since `ivole_enable_moderation` defaults to `"no"`.
Product
Customer Reviews for WooCommerce
Affected
up to 5.103.0
What to do
Affects up to 5.103.0. Update Customer Reviews for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 8, 2026The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin CVE-2026-1865 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin for WordPress is vulnerable to SQL Injection via the ‘membership_ids[]’ parameter in all versions up to, and including, 5.1.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Affected
up to 5.1.2
What to do
Affects up to 5.1.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 8, 2026FSM Custom Featured Image Caption: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-39693 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fesomia FSM Custom Featured Image Caption fsm-custom-featured-image-caption allows DOM-Based XSS.This issue affects FSM Custom Featured Image Caption: from n/a through <= 1.25.1.
Product
FSM Custom Featured Image Caption
Affected
up to 1.25.1
What to do
Affects up to 1.25.1. Update FSM Custom Featured Image Caption to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 8, 2026Super Custom Login: Missing AuthorizationCVE-2026-39605 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Obadiah Super Custom Login super-custom-login allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Super Custom Login: from n/a through <= 1.1.
Product
Super Custom Login
Affected
up to 1.1
What to do
Affects up to 1.1. Update Super Custom Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 8, 2026Custom Query Blocks: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-39575 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ronald Huereca Custom Query Blocks post-type-archive-mapping allows DOM-Based XSS.This issue affects Custom Query Blocks: from n/a through <= 5.5.0.
Product
Custom Query Blocks
Affected
up to 5.5.0
What to do
Affects up to 5.5.0. Update Custom Query Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 8, 2026Hide My WP Ghost: URL Redirection to Untrusted Site ('Open Redirect')CVE-2026-39484 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in John Darrel Hide My WP Ghost hide-my-wp allows Phishing.This issue affects Hide My WP Ghost: from n/a through < 7.0.00.
Product
Hide My WP Ghost
What to do
Update Hide My WP Ghost to the newest version.
Full record and what to do →NVD record patchstack.com
Apr 8, 2026Riaxe Product Customizer: Sensitive Information ExposureCVE-2026-3594 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Riaxe Product Customizer plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.4 via the '/wp-json/InkXEProductDesignerLite/orders' REST API endpoint. The endpoint is registered with 'permission_callback' set to '__return_true', meaning no authentication or authorization checks are performed. The endpoint queries WooCommerce order data from the database and returns it to the requester, including customer first and last names, customer IDs, order IDs, order totals, order dates, currencies, and order statuses. This makes it possible for unauthenticated attackers to extract sensitive customer and order information from the WooCommerce store.
Product
Riaxe Product Customizer
Affected
up to 2.4
What to do
Affects up to 2.4. Update Riaxe Product Customizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 7, 2026Elementor Website Builder – More Than Just a Page Builder: Stored Cross-Site ScriptingCVE-2025-14732 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Elementor Website Builder – More Than Just a Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several widget parameters in all versions up to, and including, 3.35.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Elementor Website Builder – More Than Just a Page Builder
Affected
up to 3.35.5
What to do
Affects up to 3.35.5. Update Elementor Website Builder – More Than Just a Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 7, 2026Hustle – Email Marketing, Lead Generation, Optins, Popups: Unauthorized modification of dataCVE-2026-2263 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'hustle_module_converted' AJAX action in all versions up to, and including, 7.8.10.2. This makes it possible for unauthenticated attackers to forge conversion tracking events for any Hustle module, including draft modules that are never displayed to users, thereby manipulating marketing analytics and conversion statistics.
Product
Hustle – Email Marketing, Lead Generation, Optins, Popups
Affected
up to 7.8.10.2
What to do
Affects up to 7.8.10.2. Update Hustle – Email Marketing, Lead Generation, Optins, Popups to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 27, 2026SureForms – Contact Form, Payment Form & Other Custom Form Builder: Payment Amount BypassCVE-2026-4987 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The SureForms – Contact Form, Payment Form & Other Custom Form Builder plugin for WordPress is vulnerable to Payment Amount Bypass in all versions up to, and including, 2.5.2. This is due to the create_payment_intent() function performing a payment validation solely based on the value of a user-controlled parameter. This makes it possible for unauthenticated attackers to bypass configured form payment-amount validation and create underpriced payment/subscription intents by setting form_id to 0.
Product
SureForms – Contact Form, Payment Form & Other Custom Form Builder
Affected
up to 2.5.2
What to do
Affects up to 2.5.2. Update SureForms – Contact Form, Payment Form & Other Custom Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 26, 2026FloristPress for Woo – Customize your eCommerce store for your Florist: Reflected Cross-Site ScriptingCVE-2026-1986 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The FloristPress for Woo – Customize your eCommerce store for your Florist plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'noresults' parameter in all versions up to, and including, 7.8.2 due to insufficient input sanitization and output escaping on the user supplied 'noresults' parameter. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
FloristPress for Woo – Customize your eCommerce store for your Florist
Affected
up to 7.8.2
What to do
Affects up to 7.8.2. Update FloristPress for Woo – Customize your eCommerce store for your Florist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 25, 2026WP Custom Admin Interface: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-32521 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Northern Beaches Websites WP Custom Admin Interface wp-custom-admin-interface allows DOM-Based XSS.This issue affects WP Custom Admin Interface: from n/a through <= 7.42.
Product
WP Custom Admin Interface
Affected
up to 7.42
What to do
Affects up to 7.42. Update WP Custom Admin Interface to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026JS Archive List: Deserialization of Untrusted DataCVE-2026-32513 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in Miguel Useche JS Archive List jquery-archive-list-widget allows Object Injection.This issue affects JS Archive List: from n/a through <= 6.1.7.
Product
JS Archive List
Affected
up to 6.1.7
What to do
Affects up to 6.1.7. Update JS Archive List to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026Pelicula: Deserialization of Untrusted DataCVE-2026-32512 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in Edge-Themes Pelicula pelicula-video-production-and-movie-theme allows Object Injection.This issue affects Pelicula: from n/a through < 1.10.
Product
Pelicula
What to do
Update Pelicula to the newest version.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026Stål: Deserialization of Untrusted DataCVE-2026-32511 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Deserialization of Untrusted Data vulnerability in Mikado-Themes Stål stal allows Object Injection.This issue affects Stål: from n/a through < 1.7.
Product
Stål
What to do
Update Stål to the newest version.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026Kamperen: Deserialization of Untrusted DataCVE-2026-32510 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Deserialization of Untrusted Data vulnerability in Edge-Themes Kamperen kamperen allows Object Injection.This issue affects Kamperen: from n/a through < 1.3.
Product
Kamperen
What to do
Update Kamperen to the newest version.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026Gracey: Deserialization of Untrusted DataCVE-2026-32509 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Deserialization of Untrusted Data vulnerability in Edge-Themes Gracey gracey allows Object Injection.This issue affects Gracey: from n/a through < 1.4.
Product
Gracey
What to do
Update Gracey to the newest version.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026Halstein: Deserialization of Untrusted DataCVE-2026-32508 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Deserialization of Untrusted Data vulnerability in Mikado-Themes Halstein halstein allows Object Injection.This issue affects Halstein: from n/a through < 1.8.
Product
Halstein
What to do
Update Halstein to the newest version.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026Leroux: Deserialization of Untrusted DataCVE-2026-32507 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Deserialization of Untrusted Data vulnerability in Elated-Themes Leroux leroux allows Object Injection.This issue affects Leroux: from n/a through < 1.4.
Product
Leroux
What to do
Update Leroux to the newest version.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026Archicon: Deserialization of Untrusted DataCVE-2026-32506 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Deserialization of Untrusted Data vulnerability in Edge-Themes Archicon archicon allows Object Injection.This issue affects Archicon: from n/a through < 1.7.
Product
Archicon
What to do
Update Archicon to the newest version.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026Trendustry: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-32503 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in CreativeWS Trendustry trendustry allows PHP Local File Inclusion.This issue affects Trendustry: from n/a through <= 1.1.4.
Product
Trendustry
Affected
up to 1.1.4
What to do
Affects up to 1.1.4. Update Trendustry to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026Borgholm: Deserialization of Untrusted DataCVE-2026-32502 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in Select-Themes Borgholm borgholm-marketing-agency-theme allows Object Injection.This issue affects Borgholm: from n/a through < 1.6.
Product
Borgholm
What to do
Update Borgholm to the newest version.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026weForms: Deserialization of Untrusted DataCVE-2026-32484 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in BoldGrid weForms weforms allows Object Injection.This issue affects weForms: from n/a through <= 1.6.26.
Product
weForms
Affected
up to 1.6.26
What to do
Affects up to 1.6.26. Update weForms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026Bus Ticket Booking with Seat Reservation: Deserialization of Untrusted DataCVE-2026-27095 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in magepeopleteam Bus Ticket Booking with Seat Reservation bus-ticket-booking-with-seat-reservation allows Object Injection.This issue affects Bus Ticket Booking with Seat Reservation: from n/a through <= 5.6.0.
Product
Bus Ticket Booking with Seat Reservation
Affected
up to 5.6.0
What to do
Affects up to 5.6.0. Update Bus Ticket Booking with Seat Reservation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026Buisson: Deserialization of Untrusted DataCVE-2026-27084 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeREX Buisson buisson allows Object Injection.This issue affects Buisson: from n/a through <= 1.1.11.
Product
Buisson
Affected
up to 1.1.11
What to do
Affects up to 1.1.11. Update Buisson to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026Work & Travel Company: Deserialization of Untrusted DataCVE-2026-27083 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeREX Work & Travel Company work-travel-company allows Object Injection.This issue affects Work & Travel Company: from n/a through <= 1.2.
Product
Work & Travel Company
Affected
up to 1.2
What to do
Affects up to 1.2. Update Work & Travel Company to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026Love Story: Deserialization of Untrusted DataCVE-2026-27082 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeREX Love Story lovestory allows Object Injection.This issue affects Love Story: from n/a through <= 1.3.12.
Product
Love Story
Affected
up to 1.3.12
What to do
Affects up to 1.3.12. Update Love Story to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026StoreCustomizer: Missing AuthorizationCVE-2026-27046 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Kaira StoreCustomizer woocustomizer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects StoreCustomizer: from n/a through <= 2.6.3.
Product
StoreCustomizer
Affected
up to 2.6.3
What to do
Affects up to 2.6.3. Update StoreCustomizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026WooCommerce Infinite Scroll: Deserialization of Untrusted DataCVE-2026-27045 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in sbthemes WooCommerce Infinite Scroll sb-woocommerce-infinite-scroll allows Object Injection.This issue affects WooCommerce Infinite Scroll: from n/a through <= 1.6.2.
Product
WooCommerce Infinite Scroll
Affected
up to 1.6.2
What to do
Affects up to 1.6.2. Update WooCommerce Infinite Scroll to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026Nexa Blocks: Deserialization of Untrusted DataCVE-2026-25429 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in wpdive Nexa Blocks nexa-blocks allows Object Injection.This issue affects Nexa Blocks: from n/a through <= 1.1.1.
Product
Nexa Blocks
Affected
up to 1.1.1
What to do
Affects up to 1.1.1. Update Nexa Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026Apicona: Deserialization of Untrusted DataCVE-2026-25400 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in thememount Apicona apicona allows Object Injection.This issue affects Apicona: from n/a through <= 24.1.0.
Product
Apicona
Affected
up to 24.1.0
What to do
Affects up to 24.1.0. Update Apicona to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026Vex: Deserialization of Untrusted DataCVE-2026-25360 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in rascals Vex vex allows Object Injection.This issue affects Vex: from n/a through < 1.2.9.
Product
Vex
What to do
Update Vex to the newest version.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026Pendulum: Deserialization of Untrusted DataCVE-2026-25359 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in rascals Pendulum pendulum allows Object Injection.This issue affects Pendulum: from n/a through < 3.1.5.
Product
Pendulum
What to do
Update Pendulum to the newest version.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026Meloo: Deserialization of Untrusted DataCVE-2026-25358 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in rascals Meloo meloo allows Object Injection.This issue affects Meloo: from n/a through < 2.8.2.
Product
Meloo
What to do
Update Meloo to the newest version.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026Ricky: Deserialization of Untrusted DataCVE-2026-25032 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in park_of_ideas Ricky ricky allows Object Injection.This issue affects Ricky: from n/a through < 2.31.
Product
Ricky
What to do
Update Ricky to the newest version.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026Tasty Daily: Deserialization of Untrusted DataCVE-2026-25031 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in park_of_ideas Tasty Daily tastydaily allows Object Injection.This issue affects Tasty Daily: from n/a through < 1.27.
Product
Tasty Daily
What to do
Update Tasty Daily to the newest version.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026Goldish: Deserialization of Untrusted DataCVE-2026-25030 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in park_of_ideas Goldish goldish allows Object Injection.This issue affects Goldish: from n/a through < 3.47.
Product
Goldish
What to do
Update Goldish to the newest version.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026KIDZ: Deserialization of Untrusted DataCVE-2026-25029 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in park_of_ideas KIDZ kidz allows Object Injection.This issue affects KIDZ: from n/a through <= 5.24.
Product
KIDZ
Affected
up to 5.24
What to do
Affects up to 5.24. Update KIDZ to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026SUMO Affiliates Pro: Deserialization of Untrusted DataCVE-2026-24989 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in FantasticPlugins SUMO Affiliates Pro affs allows Object Injection.This issue affects SUMO Affiliates Pro: from n/a through < 11.4.0.
Product
SUMO Affiliates Pro
What to do
Update SUMO Affiliates Pro to the newest version.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026Visionary Core: Deserialization of Untrusted DataCVE-2026-24981 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in NooTheme Visionary Core noo-visionary-core allows Object Injection.This issue affects Visionary Core: from n/a through <= 1.4.9.
Product
Visionary Core
Affected
up to 1.4.9
What to do
Affects up to 1.4.9. Update Visionary Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026Jobica Core: Deserialization of Untrusted DataCVE-2026-24978 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in NooTheme Jobica Core jobica-core allows Object Injection.This issue affects Jobica Core: from n/a through <= 1.4.1.
Product
Jobica Core
Affected
up to 1.4.1
What to do
Affects up to 1.4.1. Update Jobica Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026Organici Library: Deserialization of Untrusted DataCVE-2026-24976 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in NooTheme Organici Library noo-organici-library allows Object Injection.This issue affects Organici Library: from n/a through <= 2.1.2.
Product
Organici Library
Affected
up to 2.1.2
What to do
Affects up to 2.1.2. Update Organici Library to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026CitiLights: Deserialization of Untrusted DataCVE-2026-24974 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in NooTheme CitiLights noo-citilights allows Object Injection.This issue affects CitiLights: from n/a through <= 3.7.1.
Product
CitiLights
Affected
up to 3.7.1
What to do
Affects up to 3.7.1. Update CitiLights to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026EventPrime: Deserialization of Untrusted DataCVE-2026-24378 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in Metagauss EventPrime eventprime-event-calendar-management allows Object Injection.This issue affects EventPrime: from n/a through <= 4.2.8.0.
Product
EventPrime
Affected
up to 4.2.8.0
What to do
Affects up to 4.2.8.0. Update EventPrime to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026WoodMart: Deserialization of Untrusted DataCVE-2026-23971 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Deserialization of Untrusted Data vulnerability in xtemos WoodMart woodmart allows Object Injection.This issue affects WoodMart: from n/a through <= 8.3.8.
Product
WoodMart
Affected
up to 8.3.8
What to do
Affects up to 8.3.8. Update WoodMart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026Melody: Deserialization of Untrusted DataCVE-2026-22510 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Deserialization of Untrusted Data vulnerability in AncoraThemes Melody melodyschool allows Object Injection.This issue affects Melody: from n/a through <= 1.6.3.
Product
Melody
Affected
up to 1.6.3
What to do
Affects up to 1.6.3. Update Melody to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026Beelove: Deserialization of Untrusted DataCVE-2026-22507 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in AncoraThemes Beelove beelove allows Object Injection.This issue affects Beelove: from n/a through <= 1.2.6.
Product
Beelove
Affected
up to 1.2.6
What to do
Affects up to 1.2.6. Update Beelove to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026Morning Records: Deserialization of Untrusted DataCVE-2026-22505 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Deserialization of Untrusted Data vulnerability in AncoraThemes Morning Records morning-records allows Object Injection.This issue affects Morning Records: from n/a through <= 1.2.
Product
Morning Records
Affected
up to 1.2
What to do
Affects up to 1.2. Update Morning Records to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026m2 | Construction and Tools Store: Deserialization of Untrusted DataCVE-2026-22500 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in axiomthemes m2 | Construction and Tools Store m2-ce allows Object Injection.This issue affects m2 | Construction and Tools Store: from n/a through <= 1.1.2.
Product
m2 | Construction and Tools Store
Affected
up to 1.1.2
What to do
Affects up to 1.1.2. Update m2 | Construction and Tools Store to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026Product Feed for WooCommerce: Deserialization of Untrusted DataCVE-2026-22480 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Deserialization of Untrusted Data vulnerability in WebToffee Product Feed for WooCommerce webtoffee-product-feed allows Object Injection.This issue affects Product Feed for WooCommerce: from n/a through <= 2.3.3.
Product
Product Feed for WooCommerce
Affected
up to 2.3.3
What to do
Affects up to 2.3.3. Update Product Feed for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.