Vulnerability database

14,035 results · page 95 of 281

• Aug 5, 2026OTP Login With Phone Number, OTP Verification: Does not limit the number of OTP verification attempts or invalidate a one-time login code after a wrong guessCVE-2026-15210 · WordPress plugins & themes · reported by WPScanCritical 9.1

  The OTP Login With Phone Number, OTP Verification WordPress plugin before 1.8.71 does not limit the number of OTP verification attempts or invalidate a one-time login code after a wrong guess, and an unauthenticated user can request a login code for any account. Because the code is a short numeric OTP, an attacker can brute-force it and take over any account, including an administrator's.

  Product

  OTP Login With Phone Number, OTP Verification

  Fixed in

  1.8.71

  What to do

  Update OTP Login With Phone Number, OTP Verification to 1.8.71 or newer.

  NVD recordwpscan.com

• Aug 5, 2026zportals: Does not properly validate uploaded filesCVE-2026-14553 · WordPress plugins & themes · reported by WPScanHigh 8.1

  The zportals WordPress plugin before 6.3.4 does not properly validate uploaded files, trusting the client-supplied content type and preserving the original file extension, allowing any authenticated user (Subscriber or higher) to upload arbitrary PHP files and achieve remote code execution.

  Product

  zportals

  Fixed in

  6.3.4

  What to do

  Update zportals to 6.3.4 or newer.

  NVD recordwpscan.com

• Aug 5, 2026GeoDirectory: Does not sanitise and escape a place-category setting before outputting it back in an admin pageCVE-2025-15677 · WordPress plugins & themes · reported by WPScanLow 3.5

  The GeoDirectory WordPress plugin before 2.8.110 does not sanitise and escape a place-category setting before outputting it back in an admin page, allowing high-privilege users such as editors and above to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in a multisite setup).

  Product

  GeoDirectory

  Fixed in

  2.8.110

  What to do

  Update GeoDirectory to 2.8.110 or newer.

  NVD recordwpscan.com

• Aug 5, 2026The Membership Plugin – Kadence Memberships plugin for WordPress (formerly Restrict Content) is vulnerable to password reset link poisoning leading to account tCVE-2026-9273 · WordPress plugins & themes · reported by WordfenceCritical 9.3

  The Membership Plugin – Kadence Memberships plugin for WordPress (formerly Restrict Content) is vulnerable to password reset link poisoning leading to account takeover in all versions up to, and including, 4.0.0. This is due to the legacy lost-password handler rc_process_lost_password_form() consuming the attacker-controlled rc_redirect POST parameter into two unvalidated sinks in legacy/includes/forms.php: wp_redirect( esc_url( $_POST['rc_redirect'] ) . ... ) at line 243, and add_query_arg( array( 'key' => $key, 'login' => ... ), $_POST['rc_redirect'] ) inside rc_send_password_reset_email() at line 306. The nonce required to reach the handler is broadcast by the public [login_form] shortcode at line 207 to any anonymous visitor. This makes it possible for unauthenticated attackers to issue a password-reset request for any account (including administrators) whose reset email body points the victim at an attacker-controlled host carrying a valid reset key/login. When the victim clicks the link, the reset key leaks to the attacker, who can replay it against the legitimate site to complete account takeover.

  Affected

  up to 4.0.0

  What to do

  Affects up to 4.0.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Aug 5, 2026Football Pool: Reflected Cross-Site ScriptingCVE-2026-8790 · WordPress plugins & themes · reported by WordfenceMedium 6.1

  The Football Pool plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `shouttext` POST parameter of the Shoutbox widget in all versions up to, and including, 2.13.4 due to insufficient input sanitization and output escaping. When a shoutbox form submission fails the nonce check (or `shouttext` is empty, or the user is unable to save), the raw POST value is echoed back into a `<textarea>` element using `printf('%s', ...)` with no HTML escaping. This makes it possible for unauthenticated attackers to execute arbitrary web scripts in the browser of an authenticated victim (Subscriber-level or higher) who is tricked into submitting a crafted POST request to a page that contains the Shoutbox widget.

  Product

  Football Pool

  Affected

  up to 2.13.4

  What to do

  Affects up to 2.13.4. Update Football Pool to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Aug 5, 2026Dokan: Privilege EscalationCVE-2026-8761 · WordPress plugins & themes · reported by WordfenceHigh 8.8

  The Dokan plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 5.0.1. This is due to a missing authorization check in the `CustomersController` REST controller (`includes/REST/CustomersController.php`), which re-registers WooCommerce's customer CRUD routes under the `/dokan/v1/customers/` namespace and replaces WooCommerce's native `manage_woocommerce` capability check with a vendor-only check that inspects the **requesting** user's role and never validates the **target** user. This makes it possible for authenticated attackers with Vendor/Seller-level access and above to read, modify, or delete any WordPress user — including administrators — via `GET`/`PUT`/`DELETE` requests against `/wp-json/dokan/v1/customers/{id}`. Setting the `password` parameter on an administrator's record yields a full site takeover.

  Product

  Dokan

  Affected

  up to 5.0.1

  What to do

  Affects up to 5.0.1. Update Dokan to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Aug 5, 2026Cost Calculator Builder: Unauthorized access of sensitive dataCVE-2026-7753 · WordPress plugins & themes · reported by WordfenceMedium 6.5

  The Cost Calculator Builder plugin for WordPress is vulnerable to unauthorized access of sensitive data due to a missing capability check on the `cost-calculator-custom-export-run` AJAX action (handler `CCBExportImport::export_calculators()`) in all versions up to, and including, 3.6.17. The handler only verifies a nonce, but the corresponding `ccb_export_nonce` is broadcast on every wp-admin page (including pages reachable to Subscribers, such as `/wp-admin/profile.php`) by the `ccb_add_admin_nonces` callback hooked to `admin_head`. This makes it possible for authenticated attackers, with Subscriber-level access and above, to export every calculator's full configuration — including stored Stripe secret keys, PayPal client secrets, Razorpay secret keys, webhook secret keys, and reCAPTCHA secret keys.

  Product

  Cost Calculator Builder

  Affected

  up to 3.6.17

  What to do

  Affects up to 3.6.17. Update Cost Calculator Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Aug 5, 2026PrettyLinks – Affiliate Links, Link Branding, Link Tracking, Marketing and Stripe Payments: SQL InjectionCVE-2026-5062 · WordPress plugins & themes · reported by WordfenceMedium 4.9

  The PrettyLinks – Affiliate Links, Link Branding, Link Tracking, Marketing and Stripe Payments Plugin plugin for WordPress is vulnerable to SQL Injection via the 's' (search) parameter on the Pretty Links listing page in all versions up to, and including, 3.6.20. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query in the `search_links_table()` function. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

  Product

  PrettyLinks – Affiliate Links, Link Branding, Link Tracking, Marketing and Stripe Payments

  Affected

  up to 3.6.20

  What to do

  Affects up to 3.6.20. Update PrettyLinks – Affiliate Links, Link Branding, Link Tracking, Marketing and Stripe Payments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Aug 5, 2026Smart Popup by Supsystic: Privilege EscalationCVE-2026-18322 · WordPress plugins & themes · reported by WordfenceHigh 8.8

  The Smart Popup by Supsystic plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.12.0. This is due to a permission map collision in the `havePermissions()` function in `classes/frame.php`, where `array_merge()` overwrites the popup module's administrator-restricted method list with the base controller's value, silently removing `save` from protected actions; this is compounded by the subscription confirmation email embedding the same generic `pps_nonce` that the unauthenticated `wp_ajax_nopriv_save` endpoint accepts, and by the complete absence of any server-side role allowlist in `createWpSubscriber()`. This makes it possible for unauthenticated attackers to submit a crafted POST request to `admin-ajax.php` using a nonce obtained from a public subscription confirmation email, setting `params[tpl][sub_wp_create_user_role]` to `administrator` via the exposed `popupControllerPps::save()` action, and then triggering the stored confirmation flow to create a persistent WordPress Administrator account with attacker-chosen credentials.

  Product

  Smart Popup by Supsystic

  Affected

  up to 1.12.0

  What to do

  Affects up to 1.12.0. Update Smart Popup by Supsystic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Aug 5, 2026VikRentItems – Flexible Rental Management System: Stored Cross-Site ScriptingCVE-2026-16143 · WordPress plugins & themes · reported by WordfenceHigh 7.2

  The VikRentItems – Flexible Rental Management System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the customer email field of the booking checkout form in versions up to, and including, 1.2.1. This is due to insufficient input sanitization and output escaping in the saveorder() function, which stores the raw email value via VikRequest::getString() (applying only sanitize_text_field(), which does not neutralize HTML attribute-breaking characters such as double quotes), and in the editorder template which echoes the stored custmail value into an HTML input element's value attribute without esc_attr(). This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

  Product

  VikRentItems – Flexible Rental Management System

  Affected

  up to 1.2.1

  What to do

  Affects up to 1.2.1. Update VikRentItems – Flexible Rental Management System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Aug 5, 2026The plugin provides an Admin Search page that allows users with the `edit_posts` capability to run Relevanssi searches from the WordPress dashboard.CVE-2026-15941 · WordPress plugins & themes · reported by WordfenceMedium 6.5

  The plugin provides an Admin Search page that allows users with the `edit_posts` capability to run Relevanssi searches from the WordPress dashboard. The AJAX handler accepts a URL-encoded `args` parameter, parses it into a `WP_Query`, and then passes user-controlled taxonomy query data into Relevanssi's taxonomy restriction builder. The taxonomy value is sanitized as text but is not parameterized for SQL before being interpolated into a term taxonomy lookup query. This allows an authenticated contributor-level attacker to inject SQL through the Admin Search AJAX request and execute time-based blind SQL injection against the WordPress database.

  What to do

  Update the plugin to the newest version.

  NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Aug 5, 2026VikAppointments Service Booking Calendar wordpress plugin is vulnerable to unauthenticated SQL injection due to one of the parameters that controls how the publCVE-2026-15918 · WordPress plugins & themes · reported by WordfenceHigh 7.5

  VikAppointments Service Booking Calendar wordpress plugin is vulnerable to unauthenticated SQL injection due to one of the parameters that controls how the public reviews list is sorted is taken from the incoming request and used to build a database query without proper validation or sanitization. Because this value is placed directly into the query, an attacker who is not logged in can inject arbitrary SQL through a normal booking page and read data from the site's database — including sensitive information such as WordPress user credentials. No authentication or special privileges are required

  What to do

  Update the plugin to the newest version.

  NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Aug 5, 2026ERP: Complete HR, Accounting & CRM Suite with WooCommerce CRM Support: SQL InjectionCVE-2026-11421 · WordPress plugins & themes · reported by WordfenceMedium 6.5

  The ERP: Complete HR, Accounting & CRM Suite with WooCommerce CRM Support plugin for WordPress is vulnerable to SQL Injection via the 'erpadvancefilter' parameter in all versions up to, and including, 1.17.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. The handler runs the value through sanitize_text_field, which preserves single quotes, and the downstream erp_crm_contact_advance_filter() function interpolates it directly into a single-quoted SQL WHERE clause before execution via $wpdb->get_results(). This makes it possible for authenticated attackers, with the plugin-supplied CRM Agent role (or higher CRM Manager / WordPress admin) and the erp_crm_list_contact capability, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

  Product

  ERP: Complete HR, Accounting & CRM Suite with WooCommerce CRM Support

  Affected

  up to 1.17.4

  What to do

  Affects up to 1.17.4. Update ERP: Complete HR, Accounting & CRM Suite with WooCommerce CRM Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Aug 4, 2026Create Block: Does not correctly escape user-supplied text before writing it into a generated PHP pattern fileCVE-2026-16623 · WordPress plugins & themes · reported by WPScanHigh 8

  The Create Block WordPress plugin before 2.10.0 does not correctly escape user-supplied text before writing it into a generated PHP pattern file, allowing a multisite subsite administrator (who holds the capability gating this action but is denied the capability that normally gates PHP file editing) to inject and execute arbitrary PHP code on the server.

  Product

  Create Block

  Fixed in

  2.10.0

  What to do

  Update Create Block to 2.10.0 or newer.

  NVD recordwpscan.com

• Aug 4, 2026Improve SEO: Does not properly validate uploaded filesCVE-2026-16618 · WordPress plugins & themes · reported by WPScanCritical 9.8

  The Improve SEO WordPress plugin through 2.0.11 does not properly validate uploaded files, checking only the file content type while writing the file with the attacker-supplied extension into a publicly accessible directory, allowing unauthenticated users to upload executable PHP files and achieve remote code execution.

  Product

  Improve SEO

  Affected

  up to 2.0.11

  What to do

  Affects up to 2.0.11. Update Improve SEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  NVD recordwpscan.com

• Aug 4, 2026Chat Widget: Floating Customer Support Button for 30+ Channels, Supporting SMS, Calls, and Chat: Does not validate the typeCVE-2026-16548 · WordPress plugins & themes · reported by WPScanMedium 6.5

  The Chat Widget: Floating Customer Support Button for 30+ Channels, Supporting SMS, Calls, and Chat WordPress plugin before 1.8.2 does not validate the type, extension, content, or size of files submitted to its public response endpoint and stores them under the uploads directory, so an unauthenticated user can upload arbitrary files. The original extension is discarded (files are stored under a bare UUID), so this does not yield code execution or stored XSS; impact is bounded to disk consumption and content hosting. The storing path requires the channel's response storage or mail-forwarding to be configured.

  Product

  Chat Widget: Floating Customer Support Button for 30+ Channels, Supporting SMS, Calls, and Chat

  Fixed in

  1.8.2

  What to do

  Update Chat Widget: Floating Customer Support Button for 30+ Channels, Supporting SMS, Calls, and Chat to 1.8.2 or newer.

  NVD recordwpscan.com

• Aug 4, 2026REST API Log: Does not bind the token protecting its log download feature to the log entry being requestedCVE-2026-16547 · WordPress plugins & themes · reported by WPScanMedium 5.9

  The REST API Log WordPress plugin before 1.7.1 does not bind the token protecting its log download feature to the log entry being requested, nor does it check the capability of the requester, allowing unauthenticated users in possession of any such token to download the logged REST API requests and responses of any entry, which may contain sensitive data such as credentials, authentication tokens or private content.

  Product

  REST API Log

  Fixed in

  1.7.1

  What to do

  Update REST API Log to 1.7.1 or newer.

  NVD recordwpscan.com

• Aug 4, 2026Wired Impact Volunteer Management: Does not have authorisation checks in one of its AJAX actionsCVE-2026-16546 · WordPress plugins & themes · reported by WPScanMedium 4.3

  The Wired Impact Volunteer Management WordPress plugin before 2.8.2 does not have authorisation checks in one of its AJAX actions, and does not verify that the RSVP being removed belongs to the requesting user, allowing users with a role as low as Subscriber to remove arbitrary users' RSVPs from any volunteer opportunity.

  Product

  Wired Impact Volunteer Management

  Fixed in

  2.8.2

  What to do

  Update Wired Impact Volunteer Management to 2.8.2 or newer.

  NVD recordwpscan.com

• Aug 4, 2026Simple Google Calendar Outlook Events Widget: Does not validate a user-supplied URL before performing a server-side requestCVE-2026-16536 · WordPress plugins & themes · reported by WPScanMedium 5.3

  The Simple Google Calendar Outlook Events Widget WordPress plugin before 3.1.0 does not validate a user-supplied URL before performing a server-side request, allowing unauthenticated attackers to perform Server-Side Request Forgery attacks and, in some cases, read the response of the internal request.

  Product

  Simple Google Calendar Outlook Events Widget

  Fixed in

  3.1.0

  What to do

  Update Simple Google Calendar Outlook Events Widget to 3.1.0 or newer.

  NVD recordwpscan.com

• Aug 4, 2026Clearfy Cache: Does not validate the redirect target in its Cyrlitera old-URL redirect handlerCVE-2026-16296 · WordPress plugins & themes · reported by WPScanMedium 4.7

  The Clearfy Cache WordPress plugin before 2.4.3 does not validate the redirect target in its Cyrlitera old-URL redirect handler, passing a decoded request URI to an unsafe redirect function, which allows unauthenticated attackers to redirect visitors to an arbitrary external URL when a non-default option is enabled.

  Product

  Clearfy Cache

  Fixed in

  2.4.3

  What to do

  Update Clearfy Cache to 2.4.3 or newer.

  NVD recordwpscan.com

• Aug 4, 2026Clearfy Cache: Does not perform a capability check in one of its admin-page dispatch pathsCVE-2026-16295 · WordPress plugins & themes · reported by WPScanMedium 4.3

  The Clearfy Cache WordPress plugin before 2.4.3 does not perform a capability check in one of its admin-page dispatch paths, allowing any authenticated user such as a Subscriber to render admin-only settings pages and disclose their contents, including administrative nonces, while the canonical page URL correctly restricts access.

  Product

  Clearfy Cache

  Fixed in

  2.4.3

  What to do

  Update Clearfy Cache to 2.4.3 or newer.

  NVD recordwpscan.com

• Aug 4, 2026PowerPress Podcasting plugin by Blubrry: Does not sanitise and escape some of its Podcast Episode settingsCVE-2026-16293 · WordPress plugins & themes · reported by WPScanMedium 6.8

  The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.16.11 does not sanitise and escape some of its Podcast Episode settings, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.

  Product

  PowerPress Podcasting plugin by Blubrry

  Fixed in

  11.16.11

  What to do

  Update PowerPress Podcasting plugin by Blubrry to 11.16.11 or newer.

  NVD recordwpscan.com

• Aug 4, 2026Brizy: Does not properly verify authorization on the object being modified before updating a template's type metaCVE-2026-16070 · WordPress plugins & themes · reported by WPScanLow 2.7

  The Brizy WordPress plugin before 2.8.19 does not properly verify authorization on the object being modified before updating a template's type meta, validating a request parameter that is different from the one used in the write operation, allowing users with Contributor-level access and above to change the template-type assignment of templates owned by other users.

  Product

  Brizy

  Fixed in

  2.8.19

  What to do

  Update Brizy to 2.8.19 or newer.

  NVD recordwpscan.com

• Aug 4, 2026Brizy: Does not sanitize or escape featured-image focal-point coordinates submitted through one of its AJAX actions before storing them and later echoing them into HTML attributes in the post editor's Featured Image metaCVE-2026-16069 · WordPress plugins & themes · reported by WPScanMedium 6.8

  The Brizy WordPress plugin before 2.8.19 does not sanitize or escape featured-image focal-point coordinates submitted through one of its AJAX actions before storing them and later echoing them into HTML attributes in the post editor's Featured Image meta box, allowing users with the Contributor role or above to inject arbitrary web scripts that execute in the session of a higher-privileged user who opens the post for review.

  Product

  Brizy

  Fixed in

  2.8.19

  What to do

  Update Brizy to 2.8.19 or newer.

  NVD recordwpscan.com

• Aug 4, 2026Brizy: Does not properly restrict who can modify its site-global design data and does not sanitise part of that data before outputting itCVE-2026-16068 · WordPress plugins & themes · reported by WPScanLow 3.5

  The Brizy WordPress plugin before 2.8.19 does not properly restrict who can modify its site-global design data and does not sanitise part of that data before outputting it, allowing authenticated users with Author-level access and above to store arbitrary JavaScript that is then served unsanitised on the site's front-end pages and executes in the browser of every visitor, including administrators.

  Product

  Brizy

  Fixed in

  2.8.19

  What to do

  Update Brizy to 2.8.19 or newer.

  NVD recordwpscan.com

• Aug 4, 2026Contest Gallery: Does not perform any capability or nonce check in one of its handlersCVE-2026-16056 · WordPress plugins & themes · reported by WPScanMedium 4.3

  The Contest Gallery WordPress plugin before 30.0.7 does not perform any capability or nonce check in one of its handlers, allowing any authenticated user down to Subscriber to read the site's entire stored OpenAI prompt history.

  Product

  Contest Gallery

  Fixed in

  30.0.7

  What to do

  Update Contest Gallery to 30.0.7 or newer.

  NVD recordwpscan.com

• Aug 4, 2026miniOrange 2FA: Does not restrict who can trigger its second-factor configuration OTP sendCVE-2026-16035 · WordPress plugins & themes · reported by WPScanMedium 4.3

  The miniOrange 2FA WordPress plugin before 6.2.7 does not restrict who can trigger its second-factor configuration OTP send, nor bind the OTP recipient to the enrolling user's own address, allowing a low-privileged user to send one-time-passcode emails to arbitrary recipients and to exhaust the site's metered OTP allowance, preventing legitimate users from receiving their second-factor codes.

  Product

  miniOrange 2FA

  Fixed in

  6.2.7

  What to do

  Update miniOrange 2FA to 6.2.7 or newer.

  NVD recordwpscan.com

• Aug 4, 2026Easy Integration for Dropbox: Does not perform authorization checks on several of its file-management AJAX actions that it also registers for unauthenticated usersCVE-2026-15958 · WordPress plugins & themes · reported by WPScanCritical 9.3

  The Easy Integration for Dropbox WordPress plugin before 2.2.0 does not perform authorization checks on several of its file-management AJAX actions that it also registers for unauthenticated users, allowing an unauthenticated attacker to list, download and upload arbitrary files across the connected Dropbox account and to read the connected account and administrator email addresses.

  Product

  Easy Integration for Dropbox

  Fixed in

  2.2.0

  What to do

  Update Easy Integration for Dropbox to 2.2.0 or newer.

  NVD recordwpscan.com

• Aug 4, 2026Nested Pages: Does not properly escape post titles before outputting them into HTML attributes on an administrative listing screenCVE-2026-15233 · WordPress plugins & themes · reported by WPScanMedium 4.8

  The Nested Pages WordPress plugin before 3.2.15 does not properly escape post titles before outputting them into HTML attributes on an administrative listing screen, allowing users with the Editor role (or Contributor/Author when the Nested Pages WordPress plugin before 3.2.15 is enabled for the post type) to inject arbitrary JavaScript that executes in the session of any higher-privileged user who views that screen.

  Product

  Nested Pages

  Fixed in

  3.2.15

  What to do

  Update Nested Pages to 3.2.15 or newer.

  NVD recordwpscan.com

• Aug 4, 2026Visualizer: Does not restrict a user-supplied URL to safe address ranges before fetching it server-sideCVE-2026-14939 · WordPress plugins & themes · reported by WPScanMedium 6.8

  The Visualizer WordPress plugin before 4.0.6 does not restrict a user-supplied URL to safe address ranges before fetching it server-side, allowing users with Contributor-level access and above to perform Server-Side Request Forgery against link-local instance-metadata endpoints. As the fetched response is returned in the reply, the attack is non-blind, enabling retrieval of cloud instance metadata (including IAM credentials) on cloud-hosted sites.

  Product

  Visualizer

  Fixed in

  4.0.6

  What to do

  Update Visualizer to 4.0.6 or newer.

  NVD recordwpscan.com

• Aug 4, 2026Database for Contact Form 7, WPforms, Elementor forms: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2026-14872 · WordPress plugins & themes · reported by WPScanMedium 6.8

  The Database for Contact Form 7, WPforms, Elementor forms WordPress plugin before 1.5.5 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL Injection exploitable by users granted a specific capability which is limited to administrators by default but can be delegated to lower privileged roles.

  Product

  Database for Contact Form 7, WPforms, Elementor forms

  Fixed in

  1.5.5

  What to do

  Update Database for Contact Form 7, WPforms, Elementor forms to 1.5.5 or newer.

  NVD recordwpscan.com

• Aug 4, 2026Paid Membership Subscriptions: Does not verify that the subscription being modified through its change-subscription checkout belongs to the current userCVE-2026-14848 · WordPress plugins & themes · reported by WPScanMedium 5.4

  The Paid Membership Subscriptions WordPress plugin before 3.0.8 does not verify that the subscription being modified through its change-subscription checkout belongs to the current user, allowing any authenticated user with Subscriber-level access and above to take over another member's subscription and overwrite its plan, status and expiration.

  Product

  Paid Membership Subscriptions

  Fixed in

  3.0.8

  What to do

  Update Paid Membership Subscriptions to 3.0.8 or newer.

  NVD recordwpscan.com

• Aug 4, 2026Quiz and Survey Master (QSM): Does not properly escape a question setting before outputting it into an unquoted HTML attributeCVE-2026-14824 · WordPress plugins & themes · reported by WPScanMedium 4.8

  The Quiz and Survey Master (QSM) WordPress plugin before 11.2.2 does not properly escape a question setting before outputting it into an unquoted HTML attribute, allowing users with contributor-level access and above to inject arbitrary JavaScript that executes in the browser of any user viewing the affected quiz.

  Product

  Quiz and Survey Master (QSM)

  Fixed in

  11.2.2

  What to do

  Update Quiz and Survey Master (QSM) to 11.2.2 or newer.

  NVD recordwpscan.com

• Aug 4, 2026GDPR Framework By Data443: Does not properly verify authorization or the identity of the data subjectCVE-2026-14816 · WordPress plugins & themes · reported by WPScanMedium 6.5

  The GDPR Framework By Data443 WordPress plugin before 2.4.0 does not properly verify authorization or the identity of the data subject when recording cookie-consent choices and privacy requests, allowing unauthenticated attackers to forge consent records for arbitrary email addresses and to flood the site's privacy-request queue with arbitrary entries.

  Product

  GDPR Framework By Data443

  Fixed in

  2.4.0

  What to do

  Update GDPR Framework By Data443 to 2.4.0 or newer.

  NVD recordwpscan.com

• Aug 4, 2026wpForo Forum: Does not restrictCVE-2026-12698 · WordPress plugins & themes · reported by WPScanMedium 4.3

  The wpForo Forum WordPress plugin before 3.1.3 does not restrict which profile fields a member may set when editing their own account, allowing users with a subscriber-level account to write administrator-controlled account-state and reputation fields on their own profile, including self-activating a pending or banned account and forging their forum reputation score.

  Product

  wpForo Forum

  Fixed in

  3.1.3

  What to do

  Update wpForo Forum to 3.1.3 or newer.

  NVD recordwpscan.com

• Aug 4, 2026MonsterInsights: Does not correctly validate the signature on one of its unauthenticated AJAX actions:CVE-2026-11366 · WordPress plugins & themes · reported by WPScanLow 3.7

  The MonsterInsights WordPress plugin before 11.1.0 does not correctly validate the signature on one of its unauthenticated AJAX actions: when the MonsterInsights WordPress plugin before 11.1.0 is not connected to Google Analytics the HMAC signing key is empty, which lets unauthenticated attackers forge a valid signature and overwrite a MonsterInsights WordPress plugin before 11.1.0 configuration value, disrupting the MonsterInsights WordPress plugin before 11.1.0's server-side analytics in Manual GA4 mode.

  Product

  MonsterInsights

  Fixed in

  11.1.0

  What to do

  Update MonsterInsights to 11.1.0 or newer.

  NVD recordwpscan.com

• Aug 4, 2026EmbedPress: Does not validate user-supplied URLs before making server-side requests through unauthenticated endpointsCVE-2026-10526 · WordPress plugins & themes · reported by WPScanMedium 5.8

  The EmbedPress WordPress plugin before 4.6.1 does not validate user-supplied URLs before making server-side requests through unauthenticated endpoints, allowing unauthenticated attackers to induce the site to send HTTP requests to internal hosts and services that WordPress core URL validation does not cover (a blind Server-Side Request Forgery).

  Product

  EmbedPress

  Fixed in

  4.6.1

  What to do

  Update EmbedPress to 4.6.1 or newer.

  NVD recordwpscan.com

• Aug 3, 2026Unlimited Elements For Elementor (Free Widgets, Addons, Templates): Missing AuthorizationCVE-2026-28147 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Missing Authorization vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 2.0.15.

  Product

  Unlimited Elements For Elementor (Free Widgets, Addons, Templates)

  Affected

  up to 2.0.15

  What to do

  Affects up to 2.0.15. Update Unlimited Elements For Elementor (Free Widgets, Addons, Templates) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  NVD recordpatchstack.com

• Aug 3, 2026LogMyTrip: Does not sanitize and escape a value taken from a cookie before using it in a SQL queryCVE-2026-16572 · WordPress plugins & themes · reported by WPScanHigh 8.6

  The LogMyTrip WordPress plugin through 1.9 does not sanitize and escape a value taken from a cookie before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks on any page that renders one of the LogMyTrip WordPress plugin through 1.9's shortcodes.

  Product

  LogMyTrip

  Affected

  up to 1.9

  What to do

  Affects up to 1.9. Update LogMyTrip to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  NVD recordwpscan.com

• Aug 3, 2026Dokan: AI Powered WooCommerce Multivendor Marketplace Solution: Does not verify product ownership on its product-attribute REST write endpointsCVE-2026-16565 · WordPress plugins & themes · reported by WPScanMedium 4.3

  The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.9 does not verify product ownership on its product-attribute REST write endpoints, allowing users with a Dokan vendor account to modify the product attributes and default attributes of any other vendor's products on the marketplace.

  Product

  Dokan: AI Powered WooCommerce Multivendor Marketplace Solution

  Fixed in

  5.0.9

  What to do

  Update Dokan: AI Powered WooCommerce Multivendor Marketplace Solution to 5.0.9 or newer.

  NVD recordwpscan.com

• Aug 3, 2026Dokan: AI Powered WooCommerce Multivendor Marketplace Solution: Does not verify order ownership on a REST endpoint that performs bulk order-status changesCVE-2026-16564 · WordPress plugins & themes · reported by WPScanMedium 4.3

  The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.9 does not verify order ownership on a REST endpoint that performs bulk order-status changes, allowing users with a Dokan vendor account to modify the status of any WooCommerce order on the marketplace, including orders belonging to other vendors and the store's own customers.

  Product

  Dokan: AI Powered WooCommerce Multivendor Marketplace Solution

  Fixed in

  5.0.9

  What to do

  Update Dokan: AI Powered WooCommerce Multivendor Marketplace Solution to 5.0.9 or newer.

  NVD recordwpscan.com

• Aug 3, 2026Academy LMS: Does not verify course enrollment or lesson publication statusCVE-2026-16563 · WordPress plugins & themes · reported by WPScanMedium 6.5

  The Academy LMS WordPress plugin before 3.8.3 does not verify course enrollment or lesson publication status when returning a single lesson through its REST API, allowing users with a self-service student (Subscriber-level) account to disclose the content of arbitrary lessons, including lessons of paid courses they are not enrolled in and unpublished (draft, pending, private) lessons.

  Product

  Academy LMS

  Fixed in

  3.8.3

  What to do

  Update Academy LMS to 3.8.3 or newer.

  NVD recordwpscan.com

• Aug 3, 2026sm page duplicator: Does not sanitise and escape a stored value before using it in a SQL statementCVE-2026-16539 · WordPress plugins & themes · reported by WPScanHigh 8.1

  The sm page duplicator WordPress plugin through 1.0.0 does not sanitise and escape a stored value before using it in a SQL statement when duplicating a page, allowing users with the Editor role and above to perform SQL Injection attacks.

  Product

  sm page duplicator

  Affected

  up to 1.0.0

  What to do

  Affects up to 1.0.0. Update sm page duplicator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  NVD recordwpscan.com

• Aug 3, 2026Import and export users and customers: Does not enforce WordPress's role-assignment and per-user edit permissions during CSV importCVE-2026-16534 · WordPress plugins & themes · reported by WPScanCritical 9.1

  The Import and export users and customers WordPress plugin before 2.4.2 does not enforce WordPress's role-assignment and per-user edit permissions during CSV import, allowing a user holding only the user-creation capability to create an administrator account and to overwrite an existing administrator's password or email.

  Product

  Import and export users and customers

  Fixed in

  2.4.2

  What to do

  Update Import and export users and customers to 2.4.2 or newer.

  NVD recordwpscan.com

• Aug 3, 2026Link Library: Does not properly sanitise and escape a user-supplied value before using it in a SQL queryCVE-2026-16532 · WordPress plugins & themes · reported by WPScanCritical 9.1

  The Link Library WordPress plugin before 7.9.3 does not properly sanitise and escape a user-supplied value before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks.

  Product

  Link Library

  Fixed in

  7.9.3

  What to do

  Update Link Library to 7.9.3 or newer.

  NVD recordwpscan.com

• Aug 3, 2026ChamaWP: Does not properly validate a password reset requestCVE-2026-16300 · WordPress plugins & themes · reported by WPScanCritical 9.8

  The ChamaWP WordPress plugin before 1.0.13 does not properly validate a password reset request, allowing unauthenticated attackers to reset the password of arbitrary users, including administrators, which could lead to a full site takeover.

  Product

  ChamaWP

  Fixed in

  1.0.13

  What to do

  Update ChamaWP to 1.0.13 or newer.

  NVD recordwpscan.com

• Aug 3, 2026Clearfy Cache: Does not restrict the classes allowedCVE-2026-16297 · WordPress plugins & themes · reported by WPScanMedium 4.1

  The Clearfy Cache WordPress plugin before 2.4.3 does not restrict the classes allowed when unserializing settings-import data, allowing users with administrator access to perform PHP Object Injection attacks, which may lead to remote code execution when a suitable gadget chain is present in the environment.

  Product

  Clearfy Cache

  Fixed in

  2.4.3

  What to do

  Update Clearfy Cache to 2.4.3 or newer.

  NVD recordwpscan.com

• Aug 3, 2026ProfileGrid: Does not perform authorization checksCVE-2026-16289 · WordPress plugins & themes · reported by WPScanMedium 4.3

  The ProfileGrid WordPress plugin before 6.0.0.0 does not perform authorization checks when listing a group's pending membership requests, allowing any authenticated user such as a Subscriber to disclose the names and request dates of the users awaiting approval to join any group, including private ones.

  Product

  ProfileGrid

  Fixed in

  6.0.0.0

  What to do

  Update ProfileGrid to 6.0.0.0 or newer.

  NVD recordwpscan.com

• Aug 3, 2026Classified Listing: Does not perform a capability check on an AJAX action that returns aggregated store revenue totalsCVE-2026-16276 · WordPress plugins & themes · reported by WPScanLow 2.7

  The Classified Listing WordPress plugin before 5.4.4 does not perform a capability check on an AJAX action that returns aggregated store revenue totals, allowing users with contributor-level access and above to read daily revenue figures normally restricted to administrators and report managers.

  Product

  Classified Listing

  Fixed in

  5.4.4

  What to do

  Update Classified Listing to 5.4.4 or newer.

  NVD recordwpscan.com

• Aug 3, 2026Classified Listing: Does not perform a capability or ownership check on an AJAX action that returns a post's contentCVE-2026-16274 · WordPress plugins & themes · reported by WPScanLow 2.7

  The Classified Listing WordPress plugin before 5.4.4 does not perform a capability or ownership check on an AJAX action that returns a post's content, allowing users with contributor-level access and above to read the content of any post, page, or custom post type on the site — including drafts, pending, and private posts owned by other users — regardless of ownership.

  Product

  Classified Listing

  Fixed in

  5.4.4

  What to do

  Update Classified Listing to 5.4.4 or newer.

  NVD recordwpscan.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. The WordPress, CMS and hosting-panel entries come from the National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan and others); we show who. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories.