Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
3,989 results · page 9 of 80
Aug 22, 2026The kk Star Ratings – Rate Post & Collect User Feedbacks: Arbitrary shortcode executionCVE-2026-3424 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The The kk Star Ratings – Rate Post & Collect User Feedbacks plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.4.10.3. This is due to the software allowing users to execute an action that does not properly validate the 'payload' value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
- Product
- The kk Star Ratings – Rate Post & Collect User Feedbacks
- Affected
- up to 5.4.10.3
- What to do
- Affects up to 5.4.10.3. Update The kk Star Ratings – Rate Post & Collect User Feedbacks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 21, 2026ProfilePress: Does not strip shortcodes from two of its profile fields before rendering them on public pagesCVE-2026-19848 · WordPress plugins & themes · reported by WPScanMedium 6.5
The ProfilePress WordPress plugin before 4.17.1 does not strip shortcodes from two of its profile fields before rendering them on public pages, allowing unauthenticated attackers to store shortcodes that are then executed when the page is viewed, disclosing a chosen user's email address, login and registration date.
- Product
- ProfilePress
- Fixed in
- 4.17.1
- What to do
- Update ProfilePress to 4.17.1 or newer.
Aug 21, 2026Welcart e-Commerce: Does not regenerate the session identifier on authentication and sets the session identifier from a user-supplied request parameterCVE-2025-15671 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Welcart e-Commerce WordPress plugin before 2.12.1 does not regenerate the session identifier on authentication and sets the session identifier from a user-supplied request parameter, allowing an unauthenticated attacker to fixate a shop member's session and take over their customer account after the victim logs in through an attacker-crafted request.
- Product
- Welcart e-Commerce
- Fixed in
- 2.12.1
- What to do
- Update Welcart e-Commerce to 2.12.1 or newer.
Aug 20, 2026Subscriber Arbitrary File Upload in Smart Cleaning <= 4.8.6 versions.CVE-2026-74016 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Subscriber Arbitrary File Upload in Smart Cleaning <= 4.8.6 versions.
- Affected
- up to 4.8.6
- What to do
- Affects up to 4.8.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 20, 2026Unauthenticated Privilege Escalation in Abandoned Cart Pro for WooCommerce <= 10.4.0 versions.CVE-2026-66682 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated Privilege Escalation in Abandoned Cart Pro for WooCommerce <= 10.4.0 versions.
- Affected
- up to 10.4.0
- What to do
- Affects up to 10.4.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 20, 2026Unauthenticated Cross Site Scripting (XSS) in SmartSMTP <= 1.2.0 versions.CVE-2026-66606 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in SmartSMTP <= 1.2.0 versions.
- Affected
- up to 1.2.0
- What to do
- Affects up to 1.2.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 20, 2026rtMedia for WordPress, BuddyPress and bbPress: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-66592 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in rtCamp Inc. rtMedia for WordPress, BuddyPress and bbPress buddypress-media allows Blind SQL Injection.This issue affects rtMedia for WordPress, BuddyPress and bbPress: from n/a through 4.7.11.
- Product
- rtMedia for WordPress, BuddyPress and bbPress
- Affected
- up to 4.7.11
- What to do
- Affects up to 4.7.11. Update rtMedia for WordPress, BuddyPress and bbPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 20, 2026Depicter — Popup & Slider Builder: Does not validate the type of a file uploaded through its import feature and does not remove a malformed uploadCVE-2026-15049 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Depicter — Popup & Slider Builder WordPress plugin before 4.8.0 does not validate the type of a file uploaded through its import feature and does not remove a malformed upload, allowing users with editor-level access to write an arbitrary file (including executable PHP) into a web-accessible directory, which can lead to remote code execution.
- Product
- Depicter — Popup & Slider Builder
- Fixed in
- 4.8.0
- What to do
- Update Depicter — Popup & Slider Builder to 4.8.0 or newer.
Aug 19, 2026Grav Shortcode Core Plugin allows for the development shortcode plugins that utilize the common format utilized by WordPress and BBCode.CVE-2026-64851 · WordPress plugins & themes · reported by GitHubHigh 8.5
Grav Shortcode Core Plugin allows for the development shortcode plugins that utilize the common format utilized by WordPress and BBCode. Prior to 6.2.2, Grav Shortcode Core passes shortcode syntax through Security::detectXss() because it contains no literal less-than character, then ColorShortcode.php and related attribute handlers concatenate an attacker-controlled parameter into HTML without encoding. An account with admin.pages permission can close the generated attribute and add an event handler, creating stored cross-site scripting that executes for visitors or administrators who view the page. This issue is fixed in version 6.2.2.
- Fixed in
- 6.2.2
- What to do
- Update the plugin to 6.2.2 or newer.
Aug 19, 2026Unauthenticated SQL Injection in NGG Smart Image Search < 4.0.0 versions.CVE-2026-73185 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in NGG Smart Image Search < 4.0.0 versions.
- What to do
- Update the plugin to the newest version.
Aug 19, 2026SAML Single Sign On: Does not verify the signature of a SAML response before storing the certificate it carriesCVE-2026-19842 · WordPress plugins & themes · reported by WPScanHigh 8.8
The SAML Single Sign On WordPress plugin before 5.4.7 does not verify the signature of a SAML response before storing the certificate it carries, and offers an administrator a one-click control that promotes that stored certificate to the site's trusted signing certificate, allowing unauthenticated attackers to have a certificate of their own trusted and then authenticate as any user, including an administrator.
- Product
- SAML Single Sign On
- Fixed in
- 5.4.7
- What to do
- Update SAML Single Sign On to 5.4.7 or newer.
Aug 19, 2026SmartCrawl SEO checker, analyzer & optimizer: Does not perform capability checks on two of its AJAX actionsCVE-2026-16979 · WordPress plugins & themes · reported by WPScanMedium 4.3
The SmartCrawl SEO checker, analyzer & optimizer WordPress plugin before 3.16.3 does not perform capability checks on two of its AJAX actions, allowing users with at least the Subscriber role to read the titles of private and draft posts by ID and to enumerate stored post-meta key names.
- Product
- SmartCrawl SEO checker, analyzer & optimizer
- Fixed in
- 3.16.3
- What to do
- Update SmartCrawl SEO checker, analyzer & optimizer to 3.16.3 or newer.
Aug 19, 2026Product Shortlist: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2026-16950 · WordPress plugins & themes · reported by WPScanHigh 8.6
The Product Shortlist WordPress plugin through 1.0.4 does not properly sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated attackers to perform SQL injection attacks.
- Product
- Product Shortlist
- Affected
- up to 1.0.4
- What to do
- Affects up to 1.0.4. Update Product Shortlist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 18, 2026PPWP: Password Protect Pages, Posts & Full or Partial Content: Unauthorized access of dataCVE-2025-11729 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The PPWP: Password Protect Pages, Posts & Full or Partial Content plugin for WordPress is vulnerable to unauthorized access of data due to a improper capability check on the can_access function in all versions up to, and including, 1.9.15. This makes it possible for authenticated attackers, with Contributor-level access and above, to retrieve a master-password and access any password-protected content.
- Product
- PPWP: Password Protect Pages, Posts & Full or Partial Content
- Affected
- up to 1.9.15
- What to do
- Affects up to 1.9.15. Update PPWP: Password Protect Pages, Posts & Full or Partial Content to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Aug 18, 2026Shortcodes and extra features for Phlox: Insertion of Sensitive Information Into Sent DataCVE-2026-74008 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Insertion of Sensitive Information Into Sent Data vulnerability in Averta LTD Shortcodes and extra features for Phlox theme auxin-elements allows Retrieve Embedded Sensitive Data.This issue affects Shortcodes and extra features for Phlox theme: from n/a through 2.17.24.
- Product
- Shortcodes and extra features for Phlox
- Affected
- up to 2.17.24
- What to do
- Affects up to 2.17.24. Update Shortcodes and extra features for Phlox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 18, 2026Unauthenticated Denial of Service Attack in Starter Templates by Kadence WP <= 2.3.3 versions.CVE-2026-73997 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Denial of Service Attack in Starter Templates by Kadence WP <= 2.3.3 versions.
- Affected
- up to 2.3.3
- What to do
- Affects up to 2.3.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 18, 2026Unauthenticated Cross Site Scripting (XSS) in URL Shortify <= 2.5.0 versions.CVE-2026-73362 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in URL Shortify <= 2.5.0 versions.
- Affected
- up to 2.5.0
- What to do
- Affects up to 2.5.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 18, 2026Unauthenticated Broken Authentication in SupportCandy <= 3.5.1 versions.CVE-2026-73350 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Unauthenticated Broken Authentication in SupportCandy <= 3.5.1 versions.
- Affected
- up to 3.5.1
- What to do
- Affects up to 3.5.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 18, 2026Contributor Cross Site Scripting (XSS) in Wufoo Shortcode <= 1.55 versions.CVE-2026-66643 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Cross Site Scripting (XSS) in Wufoo Shortcode <= 1.55 versions.
- Affected
- up to 1.55
- What to do
- Affects up to 1.55. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 18, 2026Unauthenticated Server Side Request Forgery (SSRF) in PDF Smart Viewer for Elementor <= 1.0.4 versions.CVE-2026-32473 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Unauthenticated Server Side Request Forgery (SSRF) in PDF Smart Viewer for Elementor <= 1.0.4 versions.
- Affected
- up to 1.0.4
- What to do
- Affects up to 1.0.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 18, 2026Subscriber Server Side Request Forgery (SSRF) in [Aotuman] Grab WeChat Articles <= 2.0.1 versions.CVE-2026-32467 · WordPress plugins & themes · reported by PatchstackMedium 6
Subscriber Server Side Request Forgery (SSRF) in [Aotuman] Grab WeChat Articles <= 2.0.1 versions.
- Affected
- up to 2.0.1
- What to do
- Affects up to 2.0.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 18, 2026Unauthenticated Broken Access Control in WP Sort Order <= 1.3.5 versions.CVE-2026-28567 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in WP Sort Order <= 1.3.5 versions.
- Affected
- up to 1.3.5
- What to do
- Affects up to 1.3.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 17, 2026WPAdverts – Classifieds: Authorization bypassCVE-2026-11801 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The WPAdverts – Classifieds Plugin plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.3.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to retrieve internal site configuration data exposed by the classifieds-types REST endpoint, including registered post types, labels, associated taxonomies, form scheme metadata, contact options, and custom field meta keys.
- Product
- WPAdverts – Classifieds
- Affected
- up to 2.3.2
- What to do
- Affects up to 2.3.2. Update WPAdverts – Classifieds to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 17, 2026ShopSmart Loyalty for WooCommerce: Does not perform any authorization or ownership check on a phone-number lookup exposed to unauthenticated usersCVE-2026-14832 · WordPress plugins & themes · reported by WPScanMedium 5.3
The ShopSmart Loyalty for WooCommerce WordPress plugin through 1.0.0 does not perform any authorization or ownership check on a phone-number lookup exposed to unauthenticated users, allowing anyone who knows a customer's phone number to retrieve that customer's loyalty profile, including name, email, and account balance.
- Product
- ShopSmart Loyalty for WooCommerce
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update ShopSmart Loyalty for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 17, 2026WooMS: Does not validate a user-supplied URL before using it in a server-side request and attaches stored third-party integration credentials to every such requestCVE-2026-13700 · WordPress plugins & themes · reported by WPScanMedium 5.9
The WooMS WordPress plugin through 9.14 does not validate a user-supplied URL before using it in a server-side request and attaches stored third-party integration credentials to every such request, allowing unauthenticated attackers to perform Server-Side Request Forgery and to disclose the configured integration credentials when the relevant data-sync feature is enabled.
- Product
- WooMS
- Affected
- up to 9.14
- What to do
- Affects up to 9.14. Update WooMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 16, 2026Visualizer: Does not properly authorise access to the configuration of its chartsCVE-2026-19726 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Visualizer WordPress plugin before 4.0.7 does not properly authorise access to the configuration of its charts, allowing users with the Contributor role and above to read the full configuration of any chart on the site, including charts the Visualizer WordPress plugin before 4.0.7's own interface denies them, and to retrieve every chart's configuration in a single request. The disclosed configuration can include the credentials of a remote data source a chart reads from.
- Product
- Visualizer
- Fixed in
- 4.0.7
- What to do
- Update Visualizer to 4.0.7 or newer.
Aug 16, 2026All-in-One WP Migration and Backup: Does not restrict its migration import functionality to network administrators on multisite installationsCVE-2026-17533 · WordPress plugins & themes · reported by WPScanHigh 7.2
The All-in-One WP Migration and Backup WordPress plugin before 7.108 does not restrict its migration import functionality to network administrators on multisite installations, allowing an administrator of a single subsite to execute arbitrary PHP code across the entire network.
- Product
- All-in-One WP Migration and Backup
- Fixed in
- 7.108
- What to do
- Update All-in-One WP Migration and Backup to 7.108 or newer.
Aug 16, 2026Snippet Shortcodes: Stored Cross-Site ScriptingCVE-2026-16758 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Snippet Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and including, 5.2.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Snippet Shortcodes
- Affected
- up to 5.2.0
- What to do
- Affects up to 5.2.0. Update Snippet Shortcodes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 16, 2026ShortPixel Adaptive Images – WebP, AVIF, CDN, Image Optimization: Authorization bypassCVE-2026-15345 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The ShortPixel Adaptive Images – WebP, AVIF, CDN, Image Optimization plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.11.5. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to modify configuration options of third-party plugins including ShortPixel Image Optimizer, Autoptimize, WP Rocket, Imagify, and LiteSpeed Cache, as well as the plugin's own API key and account binding. Exploitation requires the respective third-party plugins to be installed, as the impact against those plugins' settings is only reachable when those plugins are present.
- Product
- ShortPixel Adaptive Images – WebP, AVIF, CDN, Image Optimization
- Affected
- up to 3.11.5
- What to do
- Affects up to 3.11.5. Update ShortPixel Adaptive Images – WebP, AVIF, CDN, Image Optimization to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 16, 2026Turnkey bbPress by WeaverTheme: PHP Object InjectionCVE-2026-10035 · WordPress plugins & themes · reported by WordfenceMedium 6.6
The Turnkey bbPress by WeaverTheme plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.7.1 via deserialization of untrusted input in the wvrbbp_set_to_serialized_values() function (reached through the wvrbbp_save_restore() settings-restore handler). The function reads the raw contents of an administrator-uploaded file and passes them directly to unserialize() without any validation. This makes it possible for authenticated attackers, with administrator-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable plugin itself; however, if a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
- Product
- Turnkey bbPress by WeaverTheme
- Affected
- up to 1.7.1
- What to do
- Affects up to 1.7.1. Update Turnkey bbPress by WeaverTheme to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 14, 2026Image Uploader for Welcart: Generic SQL InjectionCVE-2026-16080 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Image Uploader for Welcart plugin for WordPress is vulnerable to generic SQL Injection via the 'post_title' parameter in all versions up to, and including, 1.4.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with author-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- Image Uploader for Welcart
- Affected
- up to 1.4.6
- What to do
- Affects up to 1.4.6. Update Image Uploader for Welcart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 14, 2026Embed Google Photos album: Does not escape a shortcode attribute value before outputting it inside an HTML attributeCVE-2026-14290 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Embed Google Photos album WordPress plugin through 2.2.1 does not escape a shortcode attribute value before outputting it inside an HTML attribute, allowing users with the Contributor role or above to inject arbitrary JavaScript that executes in the browser of any user, including administrators, who views the affected post.
- Product
- Embed Google Photos album
- Affected
- up to 2.2.1
- What to do
- Affects up to 2.2.1. Update Embed Google Photos album to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 13, 2026Unauthenticated Cross Site Scripting (XSS) in Smart Online Order for Clover <= 1.6.1 versions.CVE-2026-66700 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Smart Online Order for Clover <= 1.6.1 versions.
- Affected
- up to 1.6.1
- What to do
- Affects up to 1.6.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 13, 2026Unauthenticated Broken Access Control in StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart <= 2.1.1 versiCVE-2026-66466 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart <= 2.1.1 versions.
- Affected
- up to 2.1.1
- What to do
- Affects up to 2.1.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 13, 2026Unauthenticated Broken Authentication in Cartify <= 1.3.0.1 versions.CVE-2026-66465 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated Broken Authentication in Cartify <= 1.3.0.1 versions.
- Affected
- up to 1.3.0.1
- What to do
- Affects up to 1.3.0.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 13, 2026Unauthenticated Privilege Escalation in SMS Alert Order Notifications <= 3.9.7 versions.CVE-2026-66424 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated Privilege Escalation in SMS Alert Order Notifications <= 3.9.7 versions.
- Affected
- up to 3.9.7
- What to do
- Affects up to 3.9.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 13, 2026Unauthenticated Arbitrary File Deletion in Participants Database <= 2.7.8.4 versions.CVE-2026-28189 · WordPress plugins & themes · reported by PatchstackHigh 7.4
Unauthenticated Arbitrary File Deletion in Participants Database <= 2.7.8.4 versions.
- Affected
- up to 2.7.8.4
- What to do
- Affects up to 2.7.8.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 13, 2026Unauthenticated Cross Site Scripting (XSS) in Welcart e-Commerce <= 2.11.31 versions.CVE-2026-27539 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Welcart e-Commerce <= 2.11.31 versions.
- Affected
- up to 2.11.31
- What to do
- Affects up to 2.11.31. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 13, 2026Ecwid by Lightspeed Ecommerce Shopping Cart: Does not perform a capability check or nonce verification on one of its store-management actionsCVE-2026-14332 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Ecwid by Lightspeed Ecommerce Shopping Cart WordPress plugin before 7.0.9 does not perform a capability check or nonce verification on one of its store-management actions, allowing any authenticated user, such as a subscriber, to disconnect the store and take the storefront offline until an administrator reconnects it.
- Product
- Ecwid by Lightspeed Ecommerce Shopping Cart
- Fixed in
- 7.0.9
- What to do
- Update Ecwid by Lightspeed Ecommerce Shopping Cart to 7.0.9 or newer.
Aug 12, 2026Estatik Real Estate: Does not validate the same recipient list that it later uses to address the message sent by its property request formCVE-2026-18044 · WordPress plugins & themes · reported by WPScanLow 3.7
The Estatik Real Estate Plugin WordPress plugin before 4.3.4 does not validate the same recipient list that it later uses to address the message sent by its property request form, allowing unauthenticated users to send emails to arbitrary recipients with arbitrary subject, body and Reply-To on sites where the form is configured to route to a custom address.
- Product
- Estatik Real Estate
- Fixed in
- 4.3.4
- What to do
- Update Estatik Real Estate to 4.3.4 or newer.
Aug 12, 2026Kirki: Does not properly authorise its front-end form submission REST routes and passes attacker-controlled input through shortcode executionCVE-2026-16747 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Kirki WordPress plugin before 6.2.1 does not properly authorise its front-end form submission REST routes and passes attacker-controlled input through shortcode execution, allowing unauthenticated users to run any shortcode registered on the site, which on a default install leads to disclosure of the site administrator's email address and an arbitrary-recipient mail relay from the victim's domain.
- Product
- Kirki
- Fixed in
- 6.2.1
- What to do
- Update Kirki to 6.2.1 or newer.
Aug 12, 2026Welcart e-Commerce: Does not verify the authenticity of its convenience-store / bank-transfer settlement callback: an unauthenticated request can flip an order from unpaid to settled purely from an order number and a staCVE-2026-15213 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Welcart e-Commerce WordPress plugin before 2.11.33 does not verify the authenticity of its convenience-store / bank-transfer settlement callback: an unauthenticated request can flip an order from unpaid to settled purely from an order number and a status flag, with no signature, amount, or origin check. Because these are pay-later methods, an attacker can mark their own unpaid order as settled and obtain fulfilment without paying.
- Product
- Welcart e-Commerce
- Fixed in
- 2.11.33
- What to do
- Update Welcart e-Commerce to 2.11.33 or newer.
Aug 12, 2026Ezoic: Does not properly restrict access to some of its content export functionalityCVE-2026-18789 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Ezoic WordPress plugin before 2.23.1 does not properly restrict access to some of its content export functionality, allowing unauthenticated attackers to trigger a server-side export of the site's database, including user password hashes and password reset tokens, as well as to persistently change some of its settings.
- Product
- Ezoic
- Fixed in
- 2.23.1
- What to do
- Update Ezoic to 2.23.1 or newer.
Aug 12, 2026Welcart e-Commerce: Does not sanitise or escape a product field before outputting it on the product pagesCVE-2026-16066 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Welcart e-Commerce WordPress plugin before 2.11.34 does not sanitise or escape a product field before outputting it on the product pages, allowing users with the Author role and above to inject arbitrary web scripts that execute in the browser of any visitor viewing the product page.
- Product
- Welcart e-Commerce
- Fixed in
- 2.11.34
- What to do
- Update Welcart e-Commerce to 2.11.34 or newer.
Aug 12, 2026Patterns Kit: Does not escape a link attribute before its client-side script inserts it into the pageCVE-2026-15249 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Patterns Kit WordPress plugin through 1.0.3 does not escape a link attribute before its client-side script inserts it into the page, allowing users with a role as low as Contributor to store a payload that executes in the browser of a user who views the content and clicks the affected element.
- Product
- Patterns Kit
- Affected
- up to 1.0.3
- What to do
- Affects up to 1.0.3. Update Patterns Kit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 12, 2026Import WP: Does not perform any authorization check on one of its export-file download handlersCVE-2026-14925 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Import WP WordPress plugin before 2.14.23 does not perform any authorization check on one of its export-file download handlers, allowing unauthenticated attackers to download export files generated by administrators, which may contain user personal data such as email addresses, login names and roles. Exploitation requires an unconsumed export to already exist and a low-entropy, time-based download key to be obtained.
- Product
- Import WP
- Fixed in
- 2.14.23
- What to do
- Update Import WP to 2.14.23 or newer.
Aug 10, 2026RSS Aggregator by Feedzy: Does not verify that the requesting user owns or is allowed to edit the import job named in the requestCVE-2026-18934 · WordPress plugins & themes · reported by WPScanMedium 5.5
The RSS Aggregator by Feedzy WordPress plugin before 5.2.6 does not verify that the requesting user owns or is allowed to edit the import job named in the request, allowing users with author-level access and above to permanently delete the posts created by another user's import job, reset its deduplication and scheduling state, disable it, or clear its error log. One of the affected actions performs no object-type check either, so arbitrary posts and pages can also be unpublished regardless of who owns them.
- Product
- RSS Aggregator by Feedzy
- Fixed in
- 5.2.6
- What to do
- Update RSS Aggregator by Feedzy to 5.2.6 or newer.
Aug 10, 2026Login & Register Forms: Does not bind the password reset verification state to the account being reset or to the party that completed the verificationCVE-2026-18468 · WordPress plugins & themes · reported by WPScanHigh 8.1
The Login & Register Forms WordPress plugin before 4.0.2 does not bind the password reset verification state to the account being reset or to the party that completed the verification, keying it instead on a value the client controls, allowing unauthenticated attackers to take over the account of any user who recently completed a reset verification, including an administrator.
- Product
- Login & Register Forms
- Fixed in
- 4.0.2
- What to do
- Update Login & Register Forms to 4.0.2 or newer.
Aug 10, 2026Saitama Addon Pack: Does not sanitise and escape certain post metadata values before outputting themCVE-2026-17010 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Saitama Addon Pack WordPress plugin through 1.0.8 does not sanitise and escape certain post metadata values before outputting them, allowing users with contributor-level access and above to inject stored Cross-Site Scripting payloads that execute in the browser of a higher-privileged user who reviews the content.
- Product
- Saitama Addon Pack
- Affected
- up to 1.0.8
- What to do
- Affects up to 1.0.8. Update Saitama Addon Pack to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 10, 2026s2Member: Does not escape several shortcode attributes before outputting them inside an inline script contextCVE-2026-15047 · WordPress plugins & themes · reported by WPScanMedium 6.8
The s2Member WordPress plugin before 260805 does not escape several shortcode attributes before outputting them inside an inline script context, allowing users with contributor-level access to inject arbitrary JavaScript that executes when a viewer opens the post (stored XSS).
- Product
- s2Member
- Fixed in
- 260805
- What to do
- Update s2Member to 260805 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.