Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
24,212 results · page 90 of 485
Jun 26, 2026Unauthenticated SQL Injection in JetBooking <= 4.0.4.1 versions.CVE-2026-54820 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in JetBooking <= 4.0.4.1 versions.
- What to do
- Update the plugin to the newest version.
Jun 26, 2026Unauthenticated Broken Access Control in User Registration <= 5.2.2 versions.CVE-2026-52701 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Broken Access Control in User Registration <= 5.2.2 versions.
- What to do
- Update the plugin to the newest version.
Jun 26, 2026Unauthenticated Broken Access Control in SiteGround Email Marketing <= 1.7.5 versions.CVE-2026-24547 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Broken Access Control in SiteGround Email Marketing <= 1.7.5 versions.
- What to do
- Update the plugin to the newest version.
Jun 26, 2026Contributor Cross Site Scripting (XSS) in BNE Testimonials <= 2.0.8 versions.CVE-2025-68075 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Cross Site Scripting (XSS) in BNE Testimonials <= 2.0.8 versions.
- Affected
- up to 2.0.8
- What to do
- Affects up to 2.0.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 26, 2026Contributor Cross Site Scripting (XSS) in Image Carousel <= 1.0.0.41 versions.CVE-2025-68074 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Cross Site Scripting (XSS) in Image Carousel <= 1.0.0.41 versions.
- Affected
- up to 1.0.0.41
- What to do
- Affects up to 1.0.0.41. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 26, 2026Contributor Local File Inclusion in Goya Core < 1.0.9.4 versions.CVE-2025-68064 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Contributor Local File Inclusion in Goya Core < 1.0.9.4 versions.
- What to do
- Update the plugin to the newest version.
Jun 26, 2026Contributor Local File Inclusion in Splash - Sport Club WordPress Theme for Basketball, Football, Hockey <= 4.4.3 versions.CVE-2025-68063 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Contributor Local File Inclusion in Splash - Sport Club WordPress Theme for Basketball, Football, Hockey <= 4.4.3 versions.
- Affected
- up to 4.4.3
- What to do
- Affects up to 4.4.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 26, 2026Unauthenticated Cross Site Request Forgery (CSRF) in Eagle Booking <= 1.3.4.3 versions.CVE-2025-68052 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Unauthenticated Cross Site Request Forgery (CSRF) in Eagle Booking <= 1.3.4.3 versions.
- Affected
- up to 1.3.4.3
- What to do
- Affects up to 1.3.4.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 26, 2026Unauthenticated Insecure Direct Object References (IDOR) in BookPro <= 1.1.0 versions.CVE-2025-66123 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Insecure Direct Object References (IDOR) in BookPro <= 1.1.0 versions.
- Affected
- up to 1.1.0
- What to do
- Affects up to 1.1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 26, 2026Unauthenticated Content Injection in Auros Core <= 5.3.1 versions.CVE-2025-64637 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Content Injection in Auros Core <= 5.3.1 versions.
- Affected
- up to 5.3.1
- What to do
- Affects up to 5.3.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 26, 2026Unauthenticated Broken Access Control in Donation Thermometer <= 2.2.7 versions.CVE-2025-64636 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Broken Access Control in Donation Thermometer <= 2.2.7 versions.
- Affected
- up to 2.2.7
- What to do
- Affects up to 2.2.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 26, 2026Contributor Broken Access Control in Live Copy Paste for Elementor <= 1.5.3 versions.CVE-2025-63079 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Contributor Broken Access Control in Live Copy Paste for Elementor <= 1.5.3 versions.
- Affected
- up to 1.5.3
- What to do
- Affects up to 1.5.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 26, 2026Subscriber Broken Access Control in Restaurant Menu by MotoPress <= 2.4.11 versions.CVE-2025-63078 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Subscriber Broken Access Control in Restaurant Menu by MotoPress <= 2.4.11 versions.
- Affected
- up to 2.4.11
- What to do
- Affects up to 2.4.11. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 26, 2026Contributor Broken Access Control in Forget About Shortcode Buttons <= 2.1.3 versions.CVE-2025-63041 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Contributor Broken Access Control in Forget About Shortcode Buttons <= 2.1.3 versions.
- Affected
- up to 2.1.3
- What to do
- Affects up to 2.1.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 26, 2026Exclusive Addons Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-57620 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tim Strifler Exclusive Addons Elementor allows Stored XSS. This issue affects Exclusive Addons Elementor: from n/a through 2.7.9.8.
- Product
- Exclusive Addons Elementor
- Affected
- up to 2.7.9.8
- What to do
- Affects up to 2.7.9.8. Update Exclusive Addons Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 26, 2026The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin CVE-2026-1869 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin for WordPress is vulnerable to unauthorized modification of data due to missing validation checks in the confirm_payment() function in all versions up to, and including, 5.2.0. This makes it possible for unauthenticated attackers to bypass payment processing and activate paid memberships.
- Affected
- up to 5.2.0
- What to do
- Affects up to 5.2.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jun 26, 2026Frontend File Manager: Does not properly verify ownership of every targeted post before permanent deletionCVE-2026-8380 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Frontend File Manager Plugin WordPress plugin through 23.6 does not properly verify ownership of every targeted post before permanent deletion, allowing authenticated users with author-level access and above to permanently delete arbitrary posts and pages. When the Frontend File Manager Plugin WordPress plugin through 23.6's "Allow guest uploads" setting is enabled by an administrator, the same deletion primitive becomes reachable by unauthenticated users.
- Product
- Frontend File Manager
- Affected
- up to 23.6
- What to do
- Affects up to 23.6. Update Frontend File Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 26, 2026SALESmanago & Leadoo: Does not properly sanitise and escape a parameter passed to one of its AJAX actions before using it in a SQL statementCVE-2026-10835 · WordPress plugins & themes · reported by WPScanHigh 7.7
The SALESmanago & Leadoo WordPress plugin before 3.11.3 does not properly sanitise and escape a parameter passed to one of its AJAX actions before using it in a SQL statement, and fails to enforce authorisation on that action, allowing authenticated users with minimal permissions, such as subscribers, to perform SQL injection attacks.
- Product
- SALESmanago & Leadoo
- Fixed in
- 3.11.3
- What to do
- Update SALESmanago & Leadoo to 3.11.3 or newer.
Jun 25, 2026Groundhogg — CRM, Newsletters, and Marketing Automation: Generic SQL InjectionCVE-2026-13226 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to generic SQL Injection via the 'after' parameter in all versions up to, and including, 4.5.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Sales Manager-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The AJAX handler wp_ajax_groundhogg_get_contacts_table has its capability check commented out and performs no nonce verification, meaning any authenticated user regardless of role can reach the vulnerable code path.
- Product
- Groundhogg — CRM, Newsletters, and Marketing Automation
- Affected
- up to 4.5.4
- What to do
- Affects up to 4.5.4. Update Groundhogg — CRM, Newsletters, and Marketing Automation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 25, 2026Contributor Sensitive Data Exposure in Elementor Website Builder <= 4.1.3 versions.CVE-2026-57619 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Sensitive Data Exposure in Elementor Website Builder <= 4.1.3 versions.
- Affected
- up to 4.1.3
- What to do
- Affects up to 4.1.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 25, 2026Contributor Broken Access Control in Slim SEO <= 4.6.2 versions.CVE-2026-57429 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Broken Access Control in Slim SEO <= 4.6.2 versions.
- Affected
- up to 4.6.2
- What to do
- Affects up to 4.6.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 25, 2026Unauthenticated Cross Site Scripting (XSS) in Forminator <= 1.53.1 versions.CVE-2026-56071 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Forminator <= 1.53.1 versions.
- Affected
- up to 1.53.1
- What to do
- Affects up to 1.53.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 25, 2026Subscriber Arbitrary File Deletion in JS Help Desk <= 3.1.1 versions.CVE-2026-56054 · WordPress plugins & themes · reported by PatchstackHigh 7.7
Subscriber Arbitrary File Deletion in JS Help Desk <= 3.1.1 versions.
- Affected
- up to 3.1.1
- What to do
- Affects up to 3.1.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 25, 2026Subscriber PHP Object Injection in EventPrime <= 4.3.4.1 versions.CVE-2026-56053 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Subscriber PHP Object Injection in EventPrime <= 4.3.4.1 versions.
- Affected
- up to 4.3.4.1
- What to do
- Affects up to 4.3.4.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 25, 2026Unauthenticated Cross Site Scripting (XSS) in TablePress <= 3.3.1 versions.CVE-2026-56051 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in TablePress <= 3.3.1 versions.
- Affected
- up to 3.3.1
- What to do
- Affects up to 3.3.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 25, 2026Contributor Remote Code Execution (RCE) in Post Snippets <= 4.0.19 versions.CVE-2026-56049 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Contributor Remote Code Execution (RCE) in Post Snippets <= 4.0.19 versions.
- Affected
- up to 4.0.19
- What to do
- Affects up to 4.0.19. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 25, 2026Customer Cross Site Scripting (XSS) in Advanced Order Export For WooCommerce <= 4.0.9 versions.CVE-2026-56042 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Customer Cross Site Scripting (XSS) in Advanced Order Export For WooCommerce <= 4.0.9 versions.
- Affected
- up to 4.0.9
- What to do
- Affects up to 4.0.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 25, 2026Customer Broken Access Control in UPI QR Code Payment Gateway for WooCommerce <= 1.6.2 versions.CVE-2026-56023 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Customer Broken Access Control in UPI QR Code Payment Gateway for WooCommerce <= 1.6.2 versions.
- Affected
- up to 1.6.2
- What to do
- Affects up to 1.6.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 25, 2026Master Slider: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-56014 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Averta Master Slider master-slider allows Reflected XSS.This issue affects Master Slider: from n/a through 3.11.5.
- Product
- Master Slider
- Affected
- up to 3.11.5
- What to do
- Affects up to 3.11.5. Update Master Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 25, 2026Unauthenticated Insecure Direct Object References (IDOR) in License Manager for WooCommerce <= 3.0.15 versions.CVE-2026-56013 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Insecure Direct Object References (IDOR) in License Manager for WooCommerce <= 3.0.15 versions.
- Affected
- up to 3.0.15
- What to do
- Affects up to 3.0.15. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 25, 2026Unauthenticated Cross Site Scripting (XSS) in H5P <= 1.17.6 versions.CVE-2026-56006 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in H5P <= 1.17.6 versions.
- Affected
- up to 1.17.6
- What to do
- Affects up to 1.17.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 25, 2026WP Activity Log: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-56005 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Melapress WP Activity Log wp-security-audit-log allows Stored XSS.This issue affects WP Activity Log: from n/a through 5.6.3.1.
- Product
- WP Activity Log
- Affected
- up to 5.6.3.1
- What to do
- Affects up to 5.6.3.1. Update WP Activity Log to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 25, 2026Unauthenticated SQL Injection in Premmerce Wishlist for WooCommerce <= 1.1.11 versions.CVE-2026-54849 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in Premmerce Wishlist for WooCommerce <= 1.1.11 versions.
- Affected
- up to 1.1.11
- What to do
- Affects up to 1.1.11. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 25, 2026APIExperts Square for WooCommerce: Insertion of Sensitive Information Into Sent DataCVE-2026-54848 · WordPress plugins & themes · reported by PatchstackHigh 8.3
Insertion of Sensitive Information Into Sent Data vulnerability in Saad Iqbal APIExperts Square for WooCommerce allows Retrieve Embedded Sensitive Data. This issue affects APIExperts Square for WooCommerce: from n/a through 4.7.3.
- Product
- APIExperts Square for WooCommerce
- Affected
- up to 4.7.3
- What to do
- Affects up to 4.7.3. Update APIExperts Square for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 25, 2026Unauthenticated Local File Inclusion in MDTF <= 1.3.8 versions.CVE-2026-54845 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Local File Inclusion in MDTF <= 1.3.8 versions.
- Affected
- up to 1.3.8
- What to do
- Affects up to 1.3.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 25, 2026Unauthenticated Broken Access Control in CheckView Automated Testing <= 2.1.0 versions.CVE-2026-54844 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in CheckView Automated Testing <= 2.1.0 versions.
- Affected
- up to 2.1.0
- What to do
- Affects up to 2.1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 25, 2026Unauthenticated SQL Injection in MDTF <= 1.3.7 versions.CVE-2026-54843 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in MDTF <= 1.3.7 versions.
- Affected
- up to 1.3.7
- What to do
- Affects up to 1.3.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 25, 2026Royal MCP: Missing AuthorizationCVE-2026-54842 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Missing Authorization vulnerability in Royal Plugins Royal MCP allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Royal MCP: from n/a through 1.4.25.
- Product
- Royal MCP
- Affected
- up to 1.4.25
- What to do
- Affects up to 1.4.25. Update Royal MCP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 25, 2026Unauthenticated Sensitive Data Exposure in Vitepos <= 3.4.2 versions.CVE-2026-54841 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Sensitive Data Exposure in Vitepos <= 3.4.2 versions.
- Affected
- up to 3.4.2
- What to do
- Affects up to 3.4.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 25, 2026Subscriber SQL Injection in WC Vendors Marketplace <= 2.6.8 versions.CVE-2026-54838 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Subscriber SQL Injection in WC Vendors Marketplace <= 2.6.8 versions.
- Affected
- up to 2.6.8
- What to do
- Affects up to 2.6.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 25, 2026YMC Filter: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-54836 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in YMC Filter allows SQL Injection. This issue affects YMC Filter: from n/a through 3.11.5.
- Product
- YMC Filter
- Affected
- up to 3.11.5
- What to do
- Affects up to 3.11.5. Update YMC Filter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 25, 2026Unauthenticated Broken Access Control in Five Star Restaurant Reservations <= 2.7.19 versions.CVE-2026-54830 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in Five Star Restaurant Reservations <= 2.7.19 versions.
- Affected
- up to 2.7.19
- What to do
- Affects up to 2.7.19. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 25, 2026WP Photo Album Plus: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-54829 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Jacob N. Breetvelt WP Photo Album Plus allows Blind SQL Injection. This issue affects WP Photo Album Plus: from n/a through 9.1.13.005.
- Product
- WP Photo Album Plus
- Affected
- up to 9.1.13.005
- What to do
- Affects up to 9.1.13.005. Update WP Photo Album Plus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 25, 2026Unauthenticated Broken Access Control in Motors <= 1.4.109 versions.CVE-2026-54828 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in Motors <= 1.4.109 versions.
- Affected
- up to 1.4.109
- What to do
- Affects up to 1.4.109. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 25, 2026Contributor Remote Code Execution (RCE) in Widget Options <= 4.2.3 versions.CVE-2026-54823 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Contributor Remote Code Execution (RCE) in Widget Options <= 4.2.3 versions.
- Affected
- up to 4.2.3
- What to do
- Affects up to 4.2.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 25, 2026Subscriber SQL Injection in SALESmanago & Leadoo <= 3.11.2 versions.CVE-2026-54822 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Subscriber SQL Injection in SALESmanago & Leadoo <= 3.11.2 versions.
- Affected
- up to 3.11.2
- What to do
- Affects up to 3.11.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 25, 2026Subscriber Sensitive Data Exposure in Visual Link Preview <= 2.3.1 versions.CVE-2026-54821 · WordPress plugins & themes · reported by PatchstackHigh 7.4
Subscriber Sensitive Data Exposure in Visual Link Preview <= 2.3.1 versions.
- Affected
- up to 2.3.1
- What to do
- Affects up to 2.3.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 25, 2026Unauthenticated Broken Access Control in MainWP Child <= 6.1.1 versions.CVE-2026-27366 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in MainWP Child <= 6.1.1 versions.
- Affected
- up to 6.1.1
- What to do
- Affects up to 6.1.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 25, 2026Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental: Generic SQL InjectionCVE-2026-12937 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental WordPress Plugin plugin for WordPress is vulnerable to generic SQL Injection via the 'post_id' parameter in all versions up to, and including, 2.22.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The AJAX handler is registered for unauthenticated users via wp_ajax_nopriv_tf_room_availability, and the required nonce is emitted on the public single-hotel page template, allowing unauthenticated attackers to freely obtain a valid nonce and reach the vulnerable code path.
- Product
- Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental
- Affected
- up to 2.22.7
- What to do
- Affects up to 2.22.7. Update Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 25, 2026InPost PL: Does not verify that the request originates from the legitimate buyer before allowing the WooCommerce order parcel-locker destination to be updatedCVE-2026-9702 · WordPress plugins & themes · reported by WPScanHigh 7.5
The InPost PL WordPress plugin before 1.9.1 does not verify that the request originates from the legitimate buyer before allowing the WooCommerce order parcel-locker destination to be updated, allowing unauthenticated attackers to silently redirect the shipping destination of any pending or processing order on the site.
- Product
- InPost PL
- Fixed in
- 1.9.1
- What to do
- Update InPost PL to 1.9.1 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.