Vulnerability database

3,650 results · page 9 of 73

• Aug 19, 2026Subscriber SQL Injection in YITH WooCommerce Membership Premium <= 2.33.0 versions.CVE-2026-32552 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Subscriber SQL Injection in YITH WooCommerce Membership Premium <= 2.33.0 versions.

  Affected

  up to 2.33.0

  What to do

  Affects up to 2.33.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 19, 2026Membership For WooCommerce: Does not check that an API consumer secret has actually been generated before comparing it against the one supplied in a requestCVE-2026-19709 · WordPress plugins & themes · reported by WPScanMedium 5.3

  The Membership For WooCommerce WordPress plugin before 3.1.2 does not check that an API consumer secret has actually been generated before comparing it against the one supplied in a request, allowing unauthenticated attackers to reach its REST routes and disclose any user's membership plan details on sites where the API has been enabled but no keys were ever generated.

  Product

  Membership For WooCommerce

  Fixed in

  3.1.2

  What to do

  Update Membership For WooCommerce to 3.1.2 or newer.

  Full record and what to do →NVD recordwpscan.com

• Aug 19, 2026TabaPay Gateway: Does not validate the payment callback before establishing a session for the account associated with the referenced orderCVE-2026-18031 · WordPress plugins & themes · reported by WPScanCritical 9.8

  The TabaPay Gateway WordPress plugin through 1.4.0 does not validate the payment callback before establishing a session for the account associated with the referenced order, allowing unauthenticated attackers to log in as any registered user, including an administrator.

  Product

  TabaPay Gateway

  Affected

  up to 1.4.0

  What to do

  Affects up to 1.4.0. Update TabaPay Gateway to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordwpscan.com

• Aug 19, 2026Product Shortlist: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2026-16950 · WordPress plugins & themes · reported by WPScanHigh 8.6

  The Product Shortlist WordPress plugin through 1.0.4 does not properly sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated attackers to perform SQL injection attacks.

  Product

  Product Shortlist

  Affected

  up to 1.0.4

  What to do

  Affects up to 1.0.4. Update Product Shortlist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordwpscan.com

• Aug 19, 2026YayCurrency: Does not perform any capability or ownership check on several of its multi-vendor integration handlers that are reachable by unauthenticated usersCVE-2026-16058 · WordPress plugins & themes · reported by WPScanMedium 5.3

  The YayCurrency WordPress plugin before 3.3.5 does not perform any capability or ownership check on several of its multi-vendor integration handlers that are reachable by unauthenticated users, allowing anyone to read the store's order totals and its vendors' earnings, balance ledgers, and withdrawal histories by iterating identifiers.

  Product

  YayCurrency

  Fixed in

  3.3.5

  What to do

  Update YayCurrency to 3.3.5 or newer.

  Full record and what to do →NVD recordwpscan.com

• Aug 19, 2026Quiz and Survey Master (QSM): Does not perform a per-object ownership check on the REST routes that return a quiz's email-notification and results-page configurationCVE-2026-14826 · WordPress plugins & themes · reported by WPScanLow 2.7

  The Quiz and Survey Master (QSM) WordPress plugin before 11.2.4 does not perform a per-object ownership check on the REST routes that return a quiz's email-notification and results-page configuration, allowing users with contributor-level access and above to read the configuration, including notification recipient addresses, of quizzes created by other users.

  Product

  Quiz and Survey Master (QSM)

  Fixed in

  11.2.4

  What to do

  Update Quiz and Survey Master (QSM) to 11.2.4 or newer.

  Full record and what to do →NVD recordwpscan.com

• Aug 19, 2026Quiz and Survey Master (QSM): Does not perform a per-object ownership check before saving a quiz's front-end text settingsCVE-2026-14825 · WordPress plugins & themes · reported by WPScanLow 2.7

  The Quiz and Survey Master (QSM) WordPress plugin before 11.2.4 does not perform a per-object ownership check before saving a quiz's front-end text settings, allowing users with contributor-level access and above to modify the text settings of quizzes created by other users.

  Product

  Quiz and Survey Master (QSM)

  Fixed in

  11.2.4

  What to do

  Update Quiz and Survey Master (QSM) to 11.2.4 or newer.

  Full record and what to do →NVD recordwpscan.com

• Aug 19, 202610Web Booster: Does not correctly validate an access token on an unauthenticated request handler and does not escape attacker-supplied stylesheet content before rendering it into the page headCVE-2026-14287 · WordPress plugins & themes · reported by WPScanMedium 4.7

  The 10Web Booster WordPress plugin before 2.33.5 does not correctly validate an access token on an unauthenticated request handler and does not escape attacker-supplied stylesheet content before rendering it into the page head, allowing an unauthenticated attacker to store markup that executes as JavaScript in the browser of anonymous visitors to an affected page.

  Product

  10Web Booster

  Fixed in

  2.33.5

  What to do

  Update 10Web Booster to 2.33.5 or newer.

  Full record and what to do →NVD recordwpscan.com

• Aug 19, 2026Eventin: Does not verify ownership before allowing schedule records to be modified or deletedCVE-2026-13175 · WordPress plugins & themes · reported by WPScanMedium 6.5

  The Eventin WordPress plugin before 4.1.21 does not verify ownership before allowing schedule records to be modified or deleted, allowing users with contributor-level access and above to alter or delete schedule entries created by other users.

  Product

  Eventin

  Fixed in

  4.1.21

  What to do

  Update Eventin to 4.1.21 or newer.

  Full record and what to do →NVD recordwpscan.com

• Aug 19, 2026Eventin: Does not verify ownership or capability before deleting user accountsCVE-2026-13174 · WordPress plugins & themes · reported by WPScanHigh 7.2

  The Eventin WordPress plugin before 4.1.21 does not verify ownership or capability before deleting user accounts, allowing users with contributor-level access and above to permanently delete other users' accounts.

  Product

  Eventin

  Fixed in

  4.1.21

  What to do

  Update Eventin to 4.1.21 or newer.

  Full record and what to do →NVD recordwpscan.com

• Aug 19, 2026Eventin: Does not properly verify ownership of events before allowing them to be modifiedCVE-2026-13169 · WordPress plugins & themes · reported by WPScanHigh 8.1

  The Eventin WordPress plugin before 4.1.21 does not properly verify ownership of events before allowing them to be modified, deleted, or reassigned to a different author, allowing users with contributor-level access and above to alter, delete, or take over events created by other users including administrators.

  Product

  Eventin

  Fixed in

  4.1.21

  What to do

  Update Eventin to 4.1.21 or newer.

  Full record and what to do →NVD recordwpscan.com

• Aug 18, 2026PublishPress Series: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-27365 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PublishPress PublishPress Series allows Stored XSS. This issue affects PublishPress Series: from n/a through 2.17.0.

  Product

  PublishPress Series

  Affected

  up to 2.17.0

  What to do

  Affects up to 2.17.0. Update PublishPress Series to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 18, 2026HashBar – WordPress Notification Bar: Cross-Site Request Forgery (CSRF)CVE-2026-66602 · WordPress plugins & themes · reported by PatchstackHigh 8.8

  Cross-Site Request Forgery (CSRF) vulnerability in DevItems HashBar – WordPress Notification Bar allows Cross Site Request Forgery. This issue affects HashBar – WordPress Notification Bar: from n/a through 2.0.0.

  Product

  HashBar – WordPress Notification Bar

  Affected

  up to 2.0.0

  What to do

  Affects up to 2.0.0. Update HashBar – WordPress Notification Bar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 18, 2026Shortcodes and extra features for Phlox: Insertion of Sensitive Information Into Sent DataCVE-2026-74008 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Insertion of Sensitive Information Into Sent Data vulnerability in Averta LTD Shortcodes and extra features for Phlox theme auxin-elements allows Retrieve Embedded Sensitive Data.This issue affects Shortcodes and extra features for Phlox theme: from n/a through 2.17.24.

  Product

  Shortcodes and extra features for Phlox

  Affected

  up to 2.17.24

  What to do

  Affects up to 2.17.24. Update Shortcodes and extra features for Phlox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 18, 2026Shop manager Arbitrary File Download in CTX Feed <= 6.6.47 versions.CVE-2026-73383 · WordPress plugins & themes · reported by PatchstackMedium 4.9

  Shop manager Arbitrary File Download in CTX Feed <= 6.6.47 versions.

  Affected

  up to 6.6.47

  What to do

  Affects up to 6.6.47. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 18, 2026Unauthenticated Cross Site Scripting (XSS) in URL Shortify <= 2.5.0 versions.CVE-2026-73362 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in URL Shortify <= 2.5.0 versions.

  Affected

  up to 2.5.0

  What to do

  Affects up to 2.5.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 18, 2026Contributor Cross Site Scripting (XSS) in Wufoo Shortcode <= 1.55 versions.CVE-2026-66643 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Contributor Cross Site Scripting (XSS) in Wufoo Shortcode <= 1.55 versions.

  Affected

  up to 1.55

  What to do

  Affects up to 1.55. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 18, 2026Ultimate Dashboard Pro: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-66621 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ultimate Dashboard Ultimate Dashboard Pro ultimate-dashboard-pro allows DOM-Based XSS.This issue affects Ultimate Dashboard Pro: from n/a through 3.11.2.

  Product

  Ultimate Dashboard Pro

  Affected

  up to 3.11.2

  What to do

  Affects up to 3.11.2. Update Ultimate Dashboard Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 17, 2026ShopSmart Loyalty for WooCommerce: Does not perform any authorization or ownership check on a phone-number lookup exposed to unauthenticated usersCVE-2026-14832 · WordPress plugins & themes · reported by WPScanMedium 5.3

  The ShopSmart Loyalty for WooCommerce WordPress plugin through 1.0.0 does not perform any authorization or ownership check on a phone-number lookup exposed to unauthenticated users, allowing anyone who knows a customer's phone number to retrieve that customer's loyalty profile, including name, email, and account balance.

  Product

  ShopSmart Loyalty for WooCommerce

  Affected

  up to 1.0.0

  What to do

  Affects up to 1.0.0. Update ShopSmart Loyalty for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordwpscan.com

• Aug 16, 2026ECS: Does not perform ownership or post-status checksCVE-2026-19613 · WordPress plugins & themes · reported by WPScanMedium 6.5

  The ECS WordPress plugin before 4.3.10 does not perform ownership or post-status checks when one of its dynamic repeater data sources reads custom field values from a user-supplied post identifier, allowing users with a contributor-level account or above to read custom field values and post metadata from posts they do not own, including private and draft ones.

  Product

  ECS

  Fixed in

  4.3.10

  What to do

  Update ECS to 4.3.10 or newer.

  Full record and what to do →NVD recordwpscan.com

• Aug 16, 2026SureDash – Community, Courses & Member Dashboard: Stored Cross-Site ScriptingCVE-2026-18402 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The SureDash – Community, Courses & Member Dashboard plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'draweropenverposition' Block/Shortcode Attribute in all versions up to, and including, 1.10.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload is stored inside the block-delimiter HTML comment's JSON, which wp_kses_post does not neutralize on save, and is only interpolated into the rendered style attribute at display time without esc_attr() escaping, allowing a double-quote to break out of the attribute and introduce arbitrary HTML event handlers.

  Product

  SureDash – Community, Courses & Member Dashboard

  Affected

  up to 1.10.3

  What to do

  Affects up to 1.10.3. Update SureDash – Community, Courses & Member Dashboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Aug 16, 2026Smash Balloon Social Post Feed – Simple Social Feeds for: Stored Cross-Site ScriptingCVE-2026-16775 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The Smash Balloon Social Post Feed – Simple Social Feeds for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'id' Shortcode Attribute in all versions up to, and including, 4.9.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

  Product

  Smash Balloon Social Post Feed – Simple Social Feeds for

  Affected

  up to 4.9.0

  What to do

  Affects up to 4.9.0. Update Smash Balloon Social Post Feed – Simple Social Feeds for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Aug 16, 2026Snippet Shortcodes: Stored Cross-Site ScriptingCVE-2026-16758 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The Snippet Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and including, 5.2.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

  Product

  Snippet Shortcodes

  Affected

  up to 5.2.0

  What to do

  Affects up to 5.2.0. Update Snippet Shortcodes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Aug 16, 2026Youtube Showcase: Stored Cross-Site ScriptingCVE-2026-15790 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The Youtube Showcase plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 4.0.4 via the 'emd_mb_meta' shortcode. This is due to insufficient input sanitization and output escaping on attachment titles referenced by the shortcode's image field: EMD_MB_Helper::image_info() returns the attachment's raw post_title, and EMD_MB_Helper::shortcode() interpolates it into title="%s" HTML attributes via sprintf() without esc_attr(). This makes it possible for authenticated attackers, with author-level access and above (upload_files capability required to create the attachment, edit_posts/publish_posts to embed the shortcode), to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

  Product

  Youtube Showcase

  Affected

  up to 4.0.4

  What to do

  Affects up to 4.0.4. Update Youtube Showcase to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Aug 16, 2026ShortPixel Adaptive Images – WebP, AVIF, CDN, Image Optimization: Authorization bypassCVE-2026-15345 · WordPress plugins & themes · reported by WordfenceMedium 4.3

  The ShortPixel Adaptive Images – WebP, AVIF, CDN, Image Optimization plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.11.5. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to modify configuration options of third-party plugins including ShortPixel Image Optimizer, Autoptimize, WP Rocket, Imagify, and LiteSpeed Cache, as well as the plugin's own API key and account binding. Exploitation requires the respective third-party plugins to be installed, as the impact against those plugins' settings is only reachable when those plugins are present.

  Product

  ShortPixel Adaptive Images – WebP, AVIF, CDN, Image Optimization

  Affected

  up to 3.11.5

  What to do

  Affects up to 3.11.5. Update ShortPixel Adaptive Images – WebP, AVIF, CDN, Image Optimization to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Aug 16, 2026StoreEngine — Complete eCommerce Solution with Memberships, Licensing, Affiliates & More: Directory TraversalCVE-2026-15056 · WordPress plugins & themes · reported by WordfenceMedium 6.5

  The StoreEngine — Complete eCommerce Solution with Memberships, Licensing, Affiliates & More plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.1.1 via the parse_file_path function. This makes it possible for authenticated attackers, with vendor-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.

  Product

  StoreEngine — Complete eCommerce Solution with Memberships, Licensing, Affiliates & More

  Affected

  up to 2.1.1

  What to do

  Affects up to 2.1.1. Update StoreEngine — Complete eCommerce Solution with Memberships, Licensing, Affiliates & More to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Aug 16, 2026The The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerableCVE-2026-18385 · WordPress plugins & themes · reported by WordfenceMedium 5.4

  The The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 4.16.19. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for authenticated attackers, with subscriber-level access and above, to execute arbitrary shortcodes. The partial mitigation introduced via strip_shortcodes() on [profile-first-name] and [profile-last-name] can be bypassed through the [profile-display-name format="first_last_names"] render path, the [profile-bio] render path (which re-fetches the raw description meta), and the double-bracket escape sequence [[tag]], all of which allow attacker-controlled shortcode text to reach the outer do_shortcode() call.

  Affected

  up to 4.16.19

  What to do

  Affects up to 4.16.19. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Aug 16, 2026Podlove Podcast Publisher: Arbitrary file deletionCVE-2026-16099 · WordPress plugins & themes · reported by WordfenceHigh 8.8

  The Podlove Podcast Publisher plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the create_link_item function in all versions up to, and including, 4.5.3. This makes it possible for authenticated attackers, with contributor-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). A viable POP chain exists within the plugin itself via Podlove\ImageCache\GenerationGuard, whose __destruct() method invokes wp_delete_file() with an attacker-controlled file path populated through unserialization.

  Product

  Podlove Podcast Publisher

  Affected

  up to 4.5.3

  What to do

  Affects up to 4.5.3. Update Podlove Podcast Publisher to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Aug 15, 2026ECS: Does not have capability or ownership checks on its dynamic repeater actionsCVE-2026-18807 · WordPress plugins & themes · reported by WPScanMedium 4.3

  The ECS WordPress plugin before 4.3.13 does not have capability or ownership checks on its dynamic repeater actions, relying only on a nonce available to any user who can open the page builder, allowing users with a contributor-level account or above to read, alter and delete the binding configuration of posts they do not own and to change the ECS WordPress plugin before 4.3.13's site-wide presets.

  Product

  ECS

  Fixed in

  4.3.13

  What to do

  Update ECS to 4.3.13 or newer.

  Full record and what to do →NVD recordwpscan.com

• Aug 15, 2026ECS: Does not perform capability or object-ownership checks on its Dynamic Repeater AJAX handlers (gated only by a capability-agnostic nonce that any edit_posts user obtains from the Elementor editor)CVE-2026-14230 · WordPress plugins & themes · reported by WPScanMedium 5.4

  The ECS WordPress plugin before 4.3.8 does not perform capability or object-ownership checks on its Dynamic Repeater AJAX handlers (gated only by a capability-agnostic nonce that any edit_posts user obtains from the Elementor editor), so a Contributor can write a data-source binding into any post — including admin-authored pages — whose attacker-controlled values are rendered into a widget's repeater output without sanitization, executing JavaScript in the session of any visitor or administrator who views the page.

  Product

  ECS

  Fixed in

  4.3.8

  What to do

  Update ECS to 4.3.8 or newer.

  Full record and what to do →NVD recordwpscan.com

• Aug 14, 2026Embed Google Photos album: Does not escape a shortcode attribute value before outputting it inside an HTML attributeCVE-2026-14290 · WordPress plugins & themes · reported by WPScanMedium 6.8

  The Embed Google Photos album WordPress plugin through 2.2.1 does not escape a shortcode attribute value before outputting it inside an HTML attribute, allowing users with the Contributor role or above to inject arbitrary JavaScript that executes in the browser of any user, including administrators, who views the affected post.

  Product

  Embed Google Photos album

  Affected

  up to 2.2.1

  What to do

  Affects up to 2.2.1. Update Embed Google Photos album to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordwpscan.com

• Aug 14, 2026Wishlist Member: Account TakeoverCVE-2026-12949 · WordPress plugins & themes · reported by WordfenceCritical 9.8

  The Wishlist Member plugin for WordPress is vulnerable to Account Takeover via Insufficient Verification of Data Authenticity in versions up to and including 3.34.1. This is due to the wpm_register() function validating the registration cookie only against the GET reg parameter while accepting the POST mergewith and POST wpm_id parameters without verifying that the mergewith user ID references a temporary or incomplete registrant that is bound to the current registration transaction. This makes it possible for unauthenticated attackers to take over any existing WordPress account — including administrator accounts — by supplying an arbitrary user's numeric ID as the mergewith value, which causes wp_update_user() to overwrite the target account's username (additionally written via a direct $wpdb UPDATE), password, email address, first name, and last name with attacker-controlled values, while WordPress password and email change notification emails are explicitly suppressed. When wpm_id references a non-existent membership level, no role key is added to the update payload, causing wp_update_user() to preserve the target user's existing role — including administrator — making full priv

  Product

  Wishlist Member

  Affected

  up to 3.34.1

  What to do

  Affects up to 3.34.1. Update Wishlist Member to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordwishlistmember.comwordfence.com

• Aug 13, 2026Samex - Clean, Minimal Shop WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-28154 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in snstheme Samex - Clean, Minimal Shop WooCommerce WordPress Theme and snstheme M.Anh - Fashion WooCoommerce WordPress Theme allows Reflected XSS. This issue affects Samex - Clean, Minimal Shop WooCommerce WordPress Theme: from n/a through 2.5; M.Anh - Fashion WooCoommerce WordPress Theme: from n/a through 1.7.

  Product

  Samex - Clean, Minimal Shop WooCommerce

  Affected

  up to 2.5

  What to do

  Affects up to 2.5. Update Samex - Clean, Minimal Shop WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.compatchstack.com

• Aug 13, 2026Unauthenticated Cross Site Scripting (XSS) in SureDash <= 1.10.1 versions.CVE-2026-66698 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in SureDash <= 1.10.1 versions.

  Affected

  up to 1.10.1

  What to do

  Affects up to 1.10.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 13, 2026Unauthenticated Cross Site Scripting (XSS) in MultiParcels Shipping For WooCommerce <= 1.30.36 versions.CVE-2026-66655 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in MultiParcels Shipping For WooCommerce <= 1.30.36 versions.

  Affected

  up to 1.30.36

  What to do

  Affects up to 1.30.36. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 13, 2026Subscriber Cross Site Scripting (XSS) in AfterShip Tracking <= 1.18.1 versions.CVE-2026-66460 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Subscriber Cross Site Scripting (XSS) in AfterShip Tracking <= 1.18.1 versions.

  Affected

  up to 1.18.1

  What to do

  Affects up to 1.18.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 13, 2026Unauthenticated Local File Inclusion in Geo Mashup <= 1.13.18 versions.CVE-2026-66450 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Unauthenticated Local File Inclusion in Geo Mashup <= 1.13.18 versions.

  Affected

  up to 1.13.18

  What to do

  Affects up to 1.13.18. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 13, 2026Unauthenticated Cross Site Scripting (XSS) in Geo Mashup <= 1.13.18 versions.CVE-2026-66449 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in Geo Mashup <= 1.13.18 versions.

  Affected

  up to 1.13.18

  What to do

  Affects up to 1.13.18. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 13, 2026Ecwid by Lightspeed Ecommerce Shopping Cart: Does not perform a capability check or nonce verification on one of its store-management actionsCVE-2026-14332 · WordPress plugins & themes · reported by WPScanMedium 5.4

  The Ecwid by Lightspeed Ecommerce Shopping Cart WordPress plugin before 7.0.9 does not perform a capability check or nonce verification on one of its store-management actions, allowing any authenticated user, such as a subscriber, to disconnect the store and take the storefront offline until an administrator reconnects it.

  Product

  Ecwid by Lightspeed Ecommerce Shopping Cart

  Fixed in

  7.0.9

  What to do

  Update Ecwid by Lightspeed Ecommerce Shopping Cart to 7.0.9 or newer.

  Full record and what to do →NVD recordwpscan.com

• Aug 13, 2026ShopEngine Elementor WooCommerce Builder Addon: Does not protect one of its authentication endpoints against CSRFCVE-2026-19088 · WordPress plugins & themes · reported by WPScanMedium 5.4

  The ShopEngine Elementor WooCommerce Builder Addon WordPress plugin before 4.9.3 does not protect one of its authentication endpoints against CSRF, allowing an attacker to log a victim into an attacker-controlled account, so that the billing and shipping details the victim then enters at checkout are stored under and readable by the attacker.

  Product

  ShopEngine Elementor WooCommerce Builder Addon

  Fixed in

  4.9.3

  What to do

  Update ShopEngine Elementor WooCommerce Builder Addon to 4.9.3 or newer.

  Full record and what to do →NVD recordwpscan.com

• Aug 13, 2026Food Menu: Does not perform any capability or ownership check on its reservation-status update actionCVE-2026-13328 · WordPress plugins & themes · reported by WPScanMedium 5.3

  The Food Menu WordPress plugin before 6.0.2 does not perform any capability or ownership check on its reservation-status update action, which is also exposed to unauthenticated users and gated only by a nonce that is publicly available to visitors, allowing unauthenticated attackers to change the status of arbitrary reservations.

  Product

  Food Menu

  Fixed in

  6.0.2

  What to do

  Update Food Menu to 6.0.2 or newer.

  Full record and what to do →NVD recordwpscan.com

• Aug 12, 2026Draft List is a WordPress plugin to manage and promote unpublished content.CVE-2026-49466 · WordPress plugins & themes · reported by GitHubMedium 6.5

  Draft List is a WordPress plugin to manage and promote unpublished content. Versions 2.6.3 and below are vulnerable to stored Cross-Site Scripting (XSS) in the `[drafts]` shortcode and Draft List widget when the documented custom `template` option places the `{{draft}}` placeholder inside an HTML attribute. The vulnerable code inserts the raw draft `post_title` into `{{draft}}` when the current viewer cannot edit posts. Because the template is sanitized before `{{draft}}` replacement, a Contributor can store a quote-only title payload that breaks out of an attribute in a site-configured Draft List template and executes JavaScript for visitors who load the public page. Version 2.6.4 fixes the issue.

  What to do

  Update the plugin to the newest version.

  Full record and what to do →NVD recordgithub.comgithub.com

• Aug 12, 2026Kirki: Does not properly authorise its front-end form submission REST routes and passes attacker-controlled input through shortcode executionCVE-2026-16747 · WordPress plugins & themes · reported by WPScanMedium 6.5

  The Kirki WordPress plugin before 6.2.1 does not properly authorise its front-end form submission REST routes and passes attacker-controlled input through shortcode execution, allowing unauthenticated users to run any shortcode registered on the site, which on a default install leads to disclosure of the site administrator's email address and an arbitrary-recipient mail relay from the victim's domain.

  Product

  Kirki

  Fixed in

  6.2.1

  What to do

  Update Kirki to 6.2.1 or newer.

  Full record and what to do →NVD recordwpscan.com

• Aug 12, 2026WP Travel Engine: Does not perform authorization or ownership checksCVE-2026-16737 · WordPress plugins & themes · reported by WPScanMedium 5.3

  The WP Travel Engine WordPress plugin before 6.8.5 does not perform authorization or ownership checks when loading a caller-supplied booking identifier in one of its unauthenticated cart actions, allowing unauthenticated attackers to disclose any customer's booking order details and their stored billing information, and to overwrite that customer's booking record with their own data.

  Product

  WP Travel Engine

  Fixed in

  6.8.5

  What to do

  Update WP Travel Engine to 6.8.5 or newer.

  Full record and what to do →NVD recordwpscan.com

• Aug 12, 2026WP Crowdfunding: Does not verify order ownership before returning order detailsCVE-2026-14858 · WordPress plugins & themes · reported by WPScanMedium 4.3

  The WP Crowdfunding WordPress plugin before 2.2.1 does not verify order ownership before returning order details, allowing any authenticated users such as Subscribers to read the personal data of any WooCommerce order and enumerate every order in the store.

  Product

  WP Crowdfunding

  Fixed in

  2.2.1

  What to do

  Update WP Crowdfunding to 2.2.1 or newer.

  Full record and what to do →NVD recordwpscan.com

• Aug 12, 2026WP Crowdfunding: Does not verify ownership of a campaign before allowing its update history to be modified and a notification email sent to its backersCVE-2026-14857 · WordPress plugins & themes · reported by WPScanMedium 4.3

  The WP Crowdfunding WordPress plugin before 2.2.1 does not verify ownership of a campaign before allowing its update history to be modified and a notification email sent to its backers, allowing any authenticated users such as Subscribers to alter other users' campaigns.

  Product

  WP Crowdfunding

  Fixed in

  2.2.1

  What to do

  Update WP Crowdfunding to 2.2.1 or newer.

  Full record and what to do →NVD recordwpscan.com

• Aug 10, 2026Salon Booking System: Does not properly validate a booking's ownership token before loading it in its booking-wizard confirmation stepsCVE-2026-17022 · WordPress plugins & themes · reported by WPScanHigh 7.5

  The Salon Booking System WordPress plugin before 10.30.34 does not properly validate a booking's ownership token before loading it in its booking-wizard confirmation steps, allowing unauthenticated attackers to disclose other customers' booking records, including personal information, by supplying a sequential booking identifier.

  Product

  Salon Booking System

  Fixed in

  10.30.34

  What to do

  Update Salon Booking System to 10.30.34 or newer.

  Full record and what to do →NVD recordwpscan.com

• Aug 10, 2026Salon Booking System: Does not properly restrict access to some of its booking-modification AJAX actions and does not verify ownership of the targeted bookingCVE-2026-17021 · WordPress plugins & themes · reported by WPScanMedium 5.3

  The Salon Booking System WordPress plugin before 10.30.34 does not properly restrict access to some of its booking-modification AJAX actions and does not verify ownership of the targeted booking, allowing unauthenticated users to tamper with the stored total of arbitrary bookings.

  Product

  Salon Booking System

  Fixed in

  10.30.34

  What to do

  Update Salon Booking System to 10.30.34 or newer.

  Full record and what to do →NVD recordwpscan.com

• Aug 10, 2026MotoPress Hotel Booking: Does not verify record ownership before updating customer recordsCVE-2026-15238 · WordPress plugins & themes · reported by WPScanMedium 5.4

  The MotoPress Hotel Booking WordPress plugin before 6.2.3 does not verify record ownership before updating customer records, allowing any authenticated user with a low-privileged account (Subscriber and above) to modify or overwrite the personal data of any customer by supplying an arbitrary identifier.

  Product

  MotoPress Hotel Booking

  Fixed in

  6.2.3

  What to do

  Update MotoPress Hotel Booking to 6.2.3 or newer.

  Full record and what to do →NVD recordwpscan.com

• Aug 10, 2026MotoPress Hotel Booking: Does not perform any authorization or ownership check on a REST endpoint that creates payment recordsCVE-2026-15237 · WordPress plugins & themes · reported by WPScanMedium 5.3

  The MotoPress Hotel Booking WordPress plugin before 6.2.3 does not perform any authorization or ownership check on a REST endpoint that creates payment records, allowing unauthenticated users to create completed payment records against arbitrary bookings and falsely mark them as paid.

  Product

  MotoPress Hotel Booking

  Fixed in

  6.2.3

  What to do

  Update MotoPress Hotel Booking to 6.2.3 or newer.

  Full record and what to do →NVD recordwpscan.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.