Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
14,035 results · page 96 of 281
Aug 3, 2026Personal QR Message: Does not restrict the file types that can be uploaded through an unauthenticated handlerCVE-2026-16250 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Personal QR Message WordPress plugin through 1.0 does not restrict the file types that can be uploaded through an unauthenticated handler, allowing unauthenticated users to upload arbitrary executable PHP files that are directly reachable, leading to remote code execution.
- Product
- Personal QR Message
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Personal QR Message to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 3, 2026Insert or Embed Articulate Content into: Does not correctly validate the contents of an uploaded archiveCVE-2026-16060 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Insert or Embed Articulate Content into WordPress plugin through 4.3000000027 does not correctly validate the contents of an uploaded archive, relying on a bypassable check that lets an Editor-level user upload a server-executable file into a public directory, resulting in remote code execution on servers configured to execute it.
- Product
- Insert or Embed Articulate Content into
- Affected
- up to 4.3000000027
- What to do
- Affects up to 4.3000000027. Update Insert or Embed Articulate Content into to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 3, 2026Contest Gallery: Does not perform per-object capability or nonce checks in one of its post-deletion handlersCVE-2026-16057 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Contest Gallery WordPress plugin before 30.0.7 does not perform per-object capability or nonce checks in one of its post-deletion handlers, gating it only by a coarse role-membership test, which allows any Author-level or higher user to permanently delete arbitrary posts, pages, and other content they do not own.
- Product
- Contest Gallery
- Fixed in
- 30.0.7
- What to do
- Update Contest Gallery to 30.0.7 or newer.
Aug 3, 2026Simple Membership: Does not sanitise a subscriber name value received from an unauthenticated payment approval requestCVE-2026-15931 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Simple Membership WordPress plugin before 4.7.8 does not sanitise a subscriber name value received from an unauthenticated payment approval request, nor escape it when displaying it in the administration dashboard, allowing unauthenticated attackers to store arbitrary JavaScript that executes in an administrator's session.
- Product
- Simple Membership
- Fixed in
- 4.7.8
- What to do
- Update Simple Membership to 4.7.8 or newer.
Aug 3, 2026Simple Membership: Does not verify whether user creation failed during registration before using the returned valueCVE-2026-15930 · WordPress plugins & themes · reported by WPScanCritical 9.4
The Simple Membership WordPress plugin before 4.7.8 does not verify whether user creation failed during registration before using the returned value as a user ID to update an account, allowing unauthenticated attackers to overwrite the primary administrator's account data (including the email address) and take over that account through the password reset flow.
- Product
- Simple Membership
- Fixed in
- 4.7.8
- What to do
- Update Simple Membership to 4.7.8 or newer.
Aug 3, 2026Blog Floating Button: Does not sanitize or escape the visitor User-Agent headerCVE-2026-15383 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Blog Floating Button WordPress plugin through 1.4.20 does not sanitize or escape the visitor User-Agent header, which it stores through an unauthenticated tracking REST endpoint and later renders unescaped in an administrator report page. This allows an unauthenticated attacker to store a malicious script that executes in the session of any administrator who views the access report, leading to site takeover.
- Product
- Blog Floating Button
- Affected
- up to 1.4.20
- What to do
- Affects up to 1.4.20. Update Blog Floating Button to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 3, 2026GEO my WP: Does not perform any ownership or capability check on two of its logged-in AJAX actionsCVE-2026-15260 · WordPress plugins & themes · reported by WPScanMedium 4.3
The GEO my WP WordPress plugin before 4.5.5.3 does not perform any ownership or capability check on two of its logged-in AJAX actions, allowing users with subscriber-level access or above to modify or permanently delete other users' and posts' geolocation records by supplying arbitrary record IDs.
- Product
- GEO my WP
- Fixed in
- 4.5.5.3
- What to do
- Update GEO my WP to 4.5.5.3 or newer.
Aug 3, 2026Simply Schedule Appointments: Does not perform a capability check on an administrative appointment-listing shortcodeCVE-2026-15254 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Simply Schedule Appointments WordPress plugin before 1.6.12.11 does not perform a capability check on an administrative appointment-listing shortcode, and its per-user result scoping fails open for non-staff users, allowing users with the Contributor role and above to disclose all customers' appointment records, including names, email addresses, phone numbers and notes, across the whole site.
- Product
- Simply Schedule Appointments
- Fixed in
- 1.6.12.11
- What to do
- Update Simply Schedule Appointments to 1.6.12.11 or newer.
Aug 3, 2026Tag, Category, and Taxonomy Manager: Does not verify that a user is authorized to access a referenced post before processing it and returning derived dataCVE-2026-15231 · WordPress plugins & themes · reported by WPScanLow 2.7
The Tag, Category, and Taxonomy Manager WordPress plugin before 3.51.0 does not verify that a user is authorized to access a referenced post before processing it and returning derived data, allowing users with contributor privileges to disclose data from private or draft posts they do not own.
- Product
- Tag, Category, and Taxonomy Manager
- Fixed in
- 3.51.0
- What to do
- Update Tag, Category, and Taxonomy Manager to 3.51.0 or newer.
Aug 3, 2026SoftMarket — Digital Marketplace: Does not properly validate an authentication token in one branch of its email-verification flowCVE-2026-14557 · WordPress plugins & themes · reported by WPScanCritical 9.1
The SoftMarket — Digital Marketplace WordPress plugin through 1.0.0 does not properly validate an authentication token in one branch of its email-verification flow, allowing unauthenticated attackers to obtain a valid session as any verified user by supplying only that user's ID.
- Product
- SoftMarket — Digital Marketplace
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update SoftMarket — Digital Marketplace to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 3, 2026SVG Support: Does not apply its SVG sanitisation to uploaded files using theCVE-2026-13340 · WordPress plugins & themes · reported by WPScanMedium 6.1
The SVG Support WordPress plugin before 2.5.17 does not apply its SVG sanitisation to uploaded files using the .svgz extension, even though it registers and serves them as SVG, allowing a user permitted to upload SVGs (such as an Author once granted upload access) to store a script-bearing file that executes in the browser of anyone who later views it, including an administrator.
- Product
- SVG Support
- Fixed in
- 2.5.17
- What to do
- Update SVG Support to 2.5.17 or newer.
Aug 3, 2026Super Store Finder: Does not sanitize a parameter of an unauthenticated AJAX action before using it in a SQL queryCVE-2026-12965 · WordPress plugins & themes · reported by WPScanCritical 9.1
The Super Store Finder WordPress plugin before 7.11 does not sanitize a parameter of an unauthenticated AJAX action before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection and extract data from the database.
- Product
- Super Store Finder
- Fixed in
- 7.11
- What to do
- Update Super Store Finder to 7.11 or newer.
Aug 3, 2026Webinfos: Does not validate the type or name of uploaded filesCVE-2026-12872 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Webinfos WordPress plugin through 1.2 does not validate the type or name of uploaded files, nor restrict the upload action with any authentication, capability, or nonce check, allowing unauthenticated attackers to upload arbitrary files (including PHP) to a web-accessible directory, leading to remote code execution on servers that execute PHP from the uploads path.
- Product
- Webinfos
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update Webinfos to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 3, 2026Import and export users and customers: Does not restrict the path of a file it reads and displays during a CSV importCVE-2025-15673 · WordPress plugins & themes · reported by WPScanMedium 4.9
The Import and export users and customers WordPress plugin before 2.4.3 does not restrict the path of a file it reads and displays during a CSV import, allowing high-privileged users to read arbitrary files on the server.
- Product
- Import and export users and customers
- Fixed in
- 2.4.3
- What to do
- Update Import and export users and customers to 2.4.3 or newer.
Aug 3, 2026ChamaWP: Does not properly validate user input before passing it to a PHP deserialization functionCVE-2025-15672 · WordPress plugins & themes · reported by WPScanHigh 8.1
The ChamaWP WordPress plugin before 1.0.13 does not properly validate user input before passing it to a PHP deserialization function, allowing unauthenticated attackers to inject arbitrary PHP objects, which could lead to remote code execution when a suitable gadget chain is present via other installed code.
- Product
- ChamaWP
- Fixed in
- 1.0.13
- What to do
- Update ChamaWP to 1.0.13 or newer.
Aug 2, 2026Exclusive Addons for Elementor: Stored Cross-Site ScriptingCVE-2026-12231 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘ exad_infobox_image’ parameter in all versions up to, and including, 2.7.9.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Exclusive Addons for Elementor
- Affected
- up to 2.7.9.8
- What to do
- Affects up to 2.7.9.8. Update Exclusive Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 2, 2026Simply Schedule Appointments: Does not correctly restrict a bulk appointment operation to the requester's own recordsCVE-2026-16540 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Simply Schedule Appointments WordPress plugin before 1.6.12.6 does not correctly restrict a bulk appointment operation to the requester's own records, allowing unauthenticated users to retrieve the personal data of all appointments across the site and, on premium editions, to permanently delete them.
- Product
- Simply Schedule Appointments
- Fixed in
- 1.6.12.6
- What to do
- Update Simply Schedule Appointments to 1.6.12.6 or newer.
Aug 2, 2026Frontend File Manager: Does not perform nonce validation on one of its file-metadata update actionsCVE-2026-16292 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Frontend File Manager Plugin WordPress plugin through 23.6 does not perform nonce validation on one of its file-metadata update actions, allowing an attacker to modify the metadata of a logged-in user's uploaded file via a CSRF attack, which can be leveraged to download that file. When guest uploads are enabled, the same action is reachable unauthenticated against any user's file.
- Product
- Frontend File Manager
- Affected
- up to 23.6
- What to do
- Affects up to 23.6. Update Frontend File Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 2, 2026ProfileGrid: Does not verify that a notification belongs to the requesting user before deleting itCVE-2026-16291 · WordPress plugins & themes · reported by WPScanMedium 4.3
The ProfileGrid WordPress plugin before 5.9.9.8 does not verify that a notification belongs to the requesting user before deleting it, allowing any authenticated user such as a Subscriber to delete other users' notifications by enumerating notification identifiers.
- Product
- ProfileGrid
- Fixed in
- 5.9.9.8
- What to do
- Update ProfileGrid to 5.9.9.8 or newer.
Aug 2, 2026Product Attachment for WooCommerce: Does not perform any authorization check before streaming media library filesCVE-2026-16285 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Product Attachment for WooCommerce WordPress plugin before 2.3.3 does not perform any authorization check before streaming media library files, allowing unauthenticated users to download any attachment — including private or unlinked uploads — by enumerating its numeric ID.
- Product
- Product Attachment for WooCommerce
- Fixed in
- 2.3.3
- What to do
- Update Product Attachment for WooCommerce to 2.3.3 or newer.
Aug 2, 2026Narrative Publisher: Does not restrict write access to a REST-exposed post meta field or escape itCVE-2026-16273 · WordPress plugins & themes · reported by WPScanMedium 4.6
The Narrative Publisher WordPress plugin through 1.0.7 does not restrict write access to a REST-exposed post meta field or escape it when rendering, allowing users with contributor-level access and above to store JavaScript that executes in the browser of any higher-privileged user who views the affected post.
- Product
- Narrative Publisher
- Affected
- up to 1.0.7
- What to do
- Affects up to 1.0.7. Update Narrative Publisher to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 2, 2026login-social: Does not validate password-reset requests against a reset key or the requester's identityCVE-2026-16261 · WordPress plugins & themes · reported by WPScanHigh 7.5
The login-social WordPress plugin through 1.0.4 does not validate password-reset requests against a reset key or the requester's identity, and it issues authentication sessions from unverified third-party sign-in data, allowing unauthenticated attackers to reset any user's password or log in as any existing account, including administrators, and take over the site.
- Product
- login-social
- Affected
- up to 1.0.4
- What to do
- Affects up to 1.0.4. Update login-social to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 2, 2026POUCO Import Users: Does not perform any capability or nonce checks on AJAX actions available to unauthenticated users that create and update WordPress accountsCVE-2026-16256 · WordPress plugins & themes · reported by WPScanCritical 9.8
The POUCO Import Users WordPress plugin through 1.0.0 does not perform any capability or nonce checks on AJAX actions available to unauthenticated users that create and update WordPress accounts, and it trusts an attacker-supplied role value, allowing unauthenticated attackers to create a new administrator account and take over the site.
- Product
- POUCO Import Users
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update POUCO Import Users to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 2, 2026Event Booking Manager for WooCommerce: Does not properly verify authorization on the object being modifiedCVE-2026-16064 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Event Booking Manager for WooCommerce WordPress plugin before 5.3.7 does not properly verify authorization on the object being modified when quick-editing events, only checking a global capability, allowing users with the Contributor role and above to modify the title and publication status of arbitrary posts and pages on the site, including content they do not own.
- Product
- Event Booking Manager for WooCommerce
- Fixed in
- 5.3.7
- What to do
- Update Event Booking Manager for WooCommerce to 5.3.7 or newer.
Aug 2, 2026Event Booking Manager for WooCommerce: Does not sanitise or escape event timeline content submitted by users with post-editing access before storing it and rendering it on the public event pageCVE-2026-16063 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Event Booking Manager for WooCommerce WordPress plugin before 5.3.7 does not sanitise or escape event timeline content submitted by users with post-editing access before storing it and rendering it on the public event page, allowing users with the Author role and above to inject arbitrary JavaScript that executes in the browser of any visitor viewing the event, including administrators.
- Product
- Event Booking Manager for WooCommerce
- Fixed in
- 5.3.7
- What to do
- Update Event Booking Manager for WooCommerce to 5.3.7 or newer.
Aug 2, 2026Event Booking Manager for WooCommerce: Does not prevent the deserialization of user-controlled input in some of its event content fieldsCVE-2026-16062 · WordPress plugins & themes · reported by WPScanMedium 6.6
The Event Booking Manager for WooCommerce WordPress plugin before 5.3.7 does not prevent the deserialization of user-controlled input in some of its event content fields, allowing users with Contributor-level access and above to inject PHP objects. No POP chain is present in the Event Booking Manager for WooCommerce WordPress plugin before 5.3.7 itself, but if one is present via another installed Event Booking Manager for WooCommerce WordPress plugin before 5.3.7 or , this could lead to actions such as arbitrary file deletion, sensitive data retrieval, or remote code execution. This is an incomplete fix of the Event Booking Manager for WooCommerce WordPress plugin before 5.3.7's earlier object-injection advisories.
- Product
- Event Booking Manager for WooCommerce
- Fixed in
- 5.3.7
- What to do
- Update Event Booking Manager for WooCommerce to 5.3.7 or newer.
Aug 2, 2026LWS Optimize: Does not perform a capability check on its cache-clearing actionsCVE-2026-16042 · WordPress plugins & themes · reported by WPScanMedium 4.3
The LWS Optimize WordPress plugin before 3.4 does not perform a capability check on its cache-clearing actions, allowing any authenticated user, including Subscribers, to flush the site's caches and force repeated cache rebuilds.
- Product
- LWS Optimize
- Fixed in
- 3.4
- What to do
- Update LWS Optimize to 3.4 or newer.
Aug 2, 2026Simple Restrict: Does not enforce its content-restriction permission check on the REST API the way it does on the front endCVE-2026-15939 · WordPress plugins & themes · reported by WPScanLow 2.7
The Simple Restrict WordPress plugin before 1.2.9 does not enforce its content-restriction permission check on the REST API the way it does on the front end, relying there on a generic capability check instead of the Simple Restrict WordPress plugin before 1.2.9's own permission system, allowing users with contributor-level access or above to read the content of restricted posts and pages they were never granted access to.
- Product
- Simple Restrict
- Fixed in
- 1.2.9
- What to do
- Update Simple Restrict to 1.2.9 or newer.
Aug 2, 2026RT Mega Menu: Does not perform a capability check on the AJAX action that saves mega-menu configuration and per-menu-item settings; its only gate is a nonce that any logged-in user can read from a standard admin pageCVE-2026-15385 · WordPress plugins & themes · reported by WPScanMedium 5.4
The RT Mega Menu WordPress plugin before 1.5.2 does not perform a capability check on the AJAX action that saves mega-menu configuration and per-menu-item settings; its only gate is a nonce that any logged-in user can read from a standard admin page. A subscriber-level user can therefore enable the mega menu on a site menu and store a menu-item style value that is rendered, without output escaping, into a style attribute on the public navigation. By breaking out of that attribute the user persists a JavaScript event handler that executes for every visitor who hovers the navigation, including administrators, leading to session/site takeover.
- Product
- RT Mega Menu
- Fixed in
- 1.5.2
- What to do
- Update RT Mega Menu to 1.5.2 or newer.
Aug 2, 2026Meta Box: Does not verify that a user is authorized to delete the supplied attachment before deleting itCVE-2026-15248 · WordPress plugins & themes · reported by WPScanMedium 5.5
The Meta Box WordPress plugin before 5.13.1 does not verify that a user is authorized to delete the supplied attachment before deleting it, allowing users with a low-privilege role such as Contributor to permanently delete arbitrary media attachments belonging to other users.
- Product
- Meta Box
- Fixed in
- 5.13.1
- What to do
- Update Meta Box to 5.13.1 or newer.
Aug 2, 2026AI ChatBot for WooCommerce: Does not perform any authorization or nonce check on one of its AJAX actionsCVE-2026-15241 · WordPress plugins & themes · reported by WPScanHigh 7.5
The AI ChatBot for WooCommerce WordPress plugin before 4.8.4 does not perform any authorization or nonce check on one of its AJAX actions, allowing unauthenticated users to abuse the site owner's stored third-party API key to send requests billed to the owner's account and, when an optional feature is enabled, to retrieve indexed knowledge-base content.
- Product
- AI ChatBot for WooCommerce
- Fixed in
- 4.8.4
- What to do
- Update AI ChatBot for WooCommerce to 4.8.4 or newer.
Aug 2, 2026Gallery for Google Photos: Does not properly restrict access to the stored third-party OAuth credentials of the connected accountCVE-2026-15236 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Gallery for Google Photos WordPress plugin before 1.2.1 does not properly restrict access to the stored third-party OAuth credentials of the connected account, exposing the persistent access and refresh tokens to unauthenticated users and allowing long-term compromise of the linked account.
- Product
- Gallery for Google Photos
- Fixed in
- 1.2.1
- What to do
- Update Gallery for Google Photos to 1.2.1 or newer.
Aug 2, 2026SMS Alert: Does not bind its "mobile verified" session flag to the phone number that was actually verified: after an attacker verifies an OTP sent to their own phoneCVE-2026-15206 · WordPress plugins & themes · reported by WPScanHigh 7.5
The SMS Alert WordPress plugin before 3.9.8 does not bind its "mobile verified" session flag to the phone number that was actually verified: after an attacker verifies an OTP sent to their own phone, the signup/login handler reads a fresh, attacker-supplied phone number to select the account and logs them in. An unauthenticated attacker can therefore log in as any user, including an administrator, who has a billing phone on file.
- Product
- SMS Alert
- Fixed in
- 3.9.8
- What to do
- Update SMS Alert to 3.9.8 or newer.
Aug 2, 2026Five Star Restaurant Reservations: Does not perform a capability check on one of its AJAX actionsCVE-2026-15151 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Five Star Restaurant Reservations WordPress plugin before 2.7.23 does not perform a capability check on one of its AJAX actions, allowing users with the lowest booking-management role (which by default cannot access the Five Star Restaurant Reservations WordPress plugin before 2.7.23's settings) to reset the site's configured booking notification rules.
- Product
- Five Star Restaurant Reservations
- Fixed in
- 2.7.23
- What to do
- Update Five Star Restaurant Reservations to 2.7.23 or newer.
Aug 2, 2026FluentBoards: Does not verify that the items selected for a board import operation belong to a board the requesting user is authorized to accessCVE-2026-14938 · WordPress plugins & themes · reported by WPScanMedium 4.3
The FluentBoards WordPress plugin before 1.95.3 does not verify that the items selected for a board import operation belong to a board the requesting user is authorized to access, allowing any authenticated user with member access to a single board to copy and read the stages and tasks (including titles, descriptions and file attachments) of any other board on the site.
- Product
- FluentBoards
- Fixed in
- 1.95.3
- What to do
- Update FluentBoards to 1.95.3 or newer.
Aug 2, 2026## SummaryCVE-2026-14920 · WordPress plugins & themes · reported by WPScanHigh 8.2
Aug 2, 2026JetEngine: Does not escape a post meta value before outputting it through one of its shortcodesCVE-2026-14864 · WordPress plugins & themes · reported by WPScanMedium 5.4
The JetEngine WordPress plugin before 3.8.12 does not escape a post meta value before outputting it through one of its shortcodes, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks that execute in the context of higher-privileged users such as administrators.
- Product
- JetEngine
- Fixed in
- 3.8.12
- What to do
- Update JetEngine to 3.8.12 or newer.
Aug 2, 2026King Addons for Elementor: Does not escape a user-supplied grid setting before reflecting it into an HTML attribute in an unauthenticated AJAX responseCVE-2026-14841 · WordPress plugins & themes · reported by WPScanMedium 6.1
The King Addons for Elementor WordPress plugin before 51.1.76 does not escape a user-supplied grid setting before reflecting it into an HTML attribute in an unauthenticated AJAX response, allowing attackers to execute arbitrary JavaScript in the browser of a visitor who is tricked into loading a crafted page.
- Product
- King Addons for Elementor
- Fixed in
- 51.1.76
- What to do
- Update King Addons for Elementor to 51.1.76 or newer.
Aug 2, 2026Element Pack Addons for Elementor: Does not sanitize option values passed through certain data attributes before a bundled front-end library re-parses and renders them in the browserCVE-2026-14817 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Element Pack Addons for Elementor WordPress plugin before 8.7.13 does not sanitize option values passed through certain data attributes before a bundled front-end library re-parses and renders them in the browser, allowing users with contributor-level access or higher to inject arbitrary JavaScript that executes in the session of any visitor who views the affected content.
- Product
- Element Pack Addons for Elementor
- Fixed in
- 8.7.13
- What to do
- Update Element Pack Addons for Elementor to 8.7.13 or newer.
Aug 2, 2026webtoffee-cookie-consent: Does not perform authorization checks on several of its REST API routesCVE-2026-13389 · WordPress plugins & themes · reported by WPScanMedium 6.5
The webtoffee-cookie-consent WordPress plugin before 3.5.3 does not perform authorization checks on several of its REST API routes, allowing unauthenticated attackers to export and delete stored visitor consent records, create posts, and modify the webtoffee-cookie-consent WordPress plugin before 3.5.3's licensing state.
- Product
- webtoffee-cookie-consent
- Fixed in
- 3.5.3
- What to do
- Update webtoffee-cookie-consent to 3.5.3 or newer.
Aug 2, 2026Lenxel WP: Does not perform any authorization or ownership check on its password-reset actionCVE-2026-12586 · WordPress plugins & themes · reported by WPScanHigh 8.1
The Lenxel WP WordPress theme through 1.0.31 does not perform any authorization or ownership check on its password-reset action, validating only a CSRF nonce, allowing unauthenticated attackers to reset the password of any user (including an administrator) and take over the account.
- Product
- Lenxel WP
- Affected
- up to 1.0.31
- What to do
- Affects up to 1.0.31. Update Lenxel WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 2, 2026Clever Mega Menu for Visual Composer: Does not perform a nonce or capability check in an AJAX action that updates navigation menu item metadataCVE-2026-11872 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Clever Mega Menu for Visual Composer WordPress plugin through 1.0.1 does not perform a nonce or capability check in an AJAX action that updates navigation menu item metadata, allowing any authenticated user, including Subscribers, to overwrite menu item content and settings that are rendered in the site's public navigation.
- Product
- Clever Mega Menu for Visual Composer
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update Clever Mega Menu for Visual Composer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 2, 2026Charitable: Does not sanitise and escape one of its campaign image text fields before outputting it in an HTML attributeCVE-2025-15675 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Charitable WordPress plugin before 1.8.5.3 does not sanitise and escape one of its campaign image text fields before outputting it in an HTML attribute, allowing users with a high-privilege campaign-management role to perform Stored Cross-Site Scripting attacks that execute on the front-end campaign page.
- Product
- Charitable
- Fixed in
- 1.8.5.3
- What to do
- Update Charitable to 1.8.5.3 or newer.
Aug 1, 2026WooCommerce - Social Login: Authentication BypassCVE-2026-8457 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The WooCommerce - Social Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up to and including 2.8.7. This is due to the plugin's Apple login handler accepting the Apple id_token and decoding only its base64 payload without verifying the JWT signature against Apple's public keys or validating the issuer, audience, or expiry claims, combined with the security nonce required to invoke the login flow being publicly exposed to unauthenticated users via a localized JavaScript object on the login page. This makes it possible for unauthenticated attackers to log in as any existing WordPress user — including administrators — by supplying a forged id_token whose payload contains the target user's email address, as that email is used without any role exclusion to resolve a WordPress account and immediately issue an authenticated session for it.
- Product
- WooCommerce - Social Login
- Affected
- up to 2.8.7
- What to do
- Affects up to 2.8.7. Update WooCommerce - Social Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 1, 2026User Access Manager: Directory TraversalCVE-2026-18352 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The User Access Manager plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.3.15 via the 'uamgetfile' parameter parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. This is possible because when attachment_url_to_postid() returns 0 for a traversal path, the plugin falls back to the global post set by a valid ?attachment_id parameter supplied by the attacker, causing the access check to pass against a legitimate public attachment while the file streamed is the attacker-chosen path.
- Product
- User Access Manager
- Affected
- up to 2.3.15
- What to do
- Affects up to 2.3.15. Update User Access Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 1, 2026CubeWP Framework: Directory TraversalCVE-2026-13339 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The CubeWP Framework plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.1.30 via the 'cubewp_get_svg_content' function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. This is exploitable by unauthenticated attackers because the required nonce is publicly emitted into the markup of any page rendering the CubeWP posts shortcode or widget with AJAX loading enabled, making it harvestable by any guest visitor before submitting the AJAX request.
- Product
- CubeWP Framework
- Affected
- up to 1.1.30
- What to do
- Affects up to 1.1.30. Update CubeWP Framework to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 1, 2026CubeWP Framework: SQL InjectionCVE-2026-6453 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The CubeWP Framework plugin for WordPress is vulnerable to SQL Injection in all versions up to and including 1.1.30. This is due to insufficient input sanitization in the cubewp_remove_relation() AJAX function, specifically the use of wp_unslash() on the relation_id parameter before interpolating it directly into a raw SQL query without using $wpdb->prepare(). The wp_unslash() call explicitly removes the backslash escaping that WordPress's wp_magic_quotes() adds to all $_POST data, neutralizing the only layer of SQL injection protection. The sanitize_text_field() function applied afterward offers no SQL protection. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries to the existing query.
- Product
- CubeWP Framework
- Affected
- up to 1.1.30
- What to do
- Affects up to 1.1.30. Update CubeWP Framework to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 1, 2026Kadence Blocks — Page Builder Toolkit for Gutenberg Editor: Stored Cross-Site ScriptingCVE-2026-18435 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Kadence Blocks — Page Builder Toolkit for Gutenberg Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'toggleIcon' Block Attribute in all versions up to, and including, 3.7.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Kadence Blocks — Page Builder Toolkit for Gutenberg Editor
- Affected
- up to 3.7.8
- What to do
- Affects up to 3.7.8. Update Kadence Blocks — Page Builder Toolkit for Gutenberg Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 1, 2026Wp Responsive Thumbnail Slider: Reflected Cross-Site ScriptingCVE-2026-18344 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Wp Responsive Thumbnail Slider plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'id' parameter in versions up to, and excluding, 1.1.53. This is due to insufficient input sanitization and output escaping in the responsive_thumbnail_image_management() function, which echoes $_GET['id'] directly into a double-quoted HTML attribute with no esc_attr() call. The only guard is a loose PHP numeric comparison ($_GET['id']>0) that a string beginning with a numeric prefix trivially satisfies, and the addslashes() applied by wp_magic_quotes() is inert in HTML-attribute context because backslash is not an HTML escape character. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a specially crafted link.
- Product
- Wp Responsive Thumbnail Slider
- What to do
- Update Wp Responsive Thumbnail Slider to the newest version.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 1, 2026Kadence Blocks — Page Builder Toolkit for Gutenberg Editor: Stored Cross-Site ScriptingCVE-2026-18062 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Kadence Blocks — Page Builder Toolkit for Gutenberg Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Identity Block Inner Image Content in all versions up to, and including, 3.7.8.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability is only triggerable when the block's urlTransparent attribute is set to a non-empty value, as this is a required precondition for the vulnerable code path in build_html() to be reached.
- Product
- Kadence Blocks — Page Builder Toolkit for Gutenberg Editor
- Affected
- up to 3.7.8.1
- What to do
- Affects up to 3.7.8.1. Update Kadence Blocks — Page Builder Toolkit for Gutenberg Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. The WordPress, CMS and hosting-panel entries come from the National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan and others); we show who. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.