Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
11,556 results · page 98 of 232
Jul 23, 2026TheGem: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-65480 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodexThemes TheGem allows DOM-Based XSS. This issue affects TheGem: from n/a before 5.12.1.1.
- Product
- TheGem
- Fixed in
- 5.12.1.1
- What to do
- Update TheGem to 5.12.1.1 or newer.
Jul 23, 2026Subscriber Broken Access Control in Reviewer <= 3.14.2 versions.CVE-2026-65479 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Subscriber Broken Access Control in Reviewer <= 3.14.2 versions.
- What to do
- Update the plugin to the newest version.
Jul 23, 2026Subscriber Broken Access Control in ListingPro <= 2.9.10 versions.CVE-2026-65478 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Subscriber Broken Access Control in ListingPro <= 2.9.10 versions.
- What to do
- Update the plugin to the newest version.
Jul 23, 2026Contributor Local File Inclusion in Tonda Core <= 2.1.2 versions.CVE-2026-65477 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Contributor Local File Inclusion in Tonda Core <= 2.1.2 versions.
- What to do
- Update the plugin to the newest version.
Jul 23, 2026Unauthenticated Broken Access Control in Civi <= 2.2.4 versions.CVE-2026-65476 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Broken Access Control in Civi <= 2.2.4 versions.
- What to do
- Update the plugin to the newest version.
Jul 23, 2026Modula Image Gallery: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-65475 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Modula Image Gallery allows Stored XSS. This issue affects Modula Image Gallery: from 2.14.25 through 2.14.30.
- Product
- Modula Image Gallery
- Affected
- up to 2.14.30
- What to do
- Affects up to 2.14.30. Update Modula Image Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026Unauthenticated Sensitive Data Exposure in Ninja Tables <= 5.2.10 versions.CVE-2026-65474 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Sensitive Data Exposure in Ninja Tables <= 5.2.10 versions.
- What to do
- Update the plugin to the newest version.
Jul 23, 2026Contributor Cross Site Scripting (XSS) in Virtue/Ascend/Pinnacle Toolkit <= 4.9.12 versions.CVE-2026-65473 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Cross Site Scripting (XSS) in Virtue/Ascend/Pinnacle Toolkit <= 4.9.12 versions.
- What to do
- Update the plugin to the newest version.
Jul 23, 2026Unauthenticated Broken Access Control in Kit (formerly ConvertKit) <= 3.3.5 versions.CVE-2026-65472 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Broken Access Control in Kit (formerly ConvertKit) <= 3.3.5 versions.
- What to do
- Update the plugin to the newest version.
Jul 23, 2026Unauthenticated Cross Site Request Forgery (CSRF) in Avada Core <= 5.15.6 versions.CVE-2026-65471 · WordPress plugins & themes · reported by PatchstackCritical 9.6
Unauthenticated Cross Site Request Forgery (CSRF) in Avada Core <= 5.15.6 versions.
- What to do
- Update the plugin to the newest version.
Jul 23, 2026Contributor Cross Site Scripting (XSS) in Fluent Support <= 2.3.0 versions.CVE-2026-65470 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Cross Site Scripting (XSS) in Fluent Support <= 2.3.0 versions.
- What to do
- Update the plugin to the newest version.
Jul 23, 2026Unauthenticated Broken Access Control in AWP Classifieds <= 4.4.7 versions.CVE-2026-65469 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Broken Access Control in AWP Classifieds <= 4.4.7 versions.
- What to do
- Update the plugin to the newest version.
Jul 23, 2026Unauthenticated Broken Access Control in JetBooking <= 4.1.2 versions.CVE-2026-65468 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Broken Access Control in JetBooking <= 4.1.2 versions.
- What to do
- Update the plugin to the newest version.
Jul 23, 2026Contributor Server Side Request Forgery (SSRF) in JetEngine <= 3.8.11 versions.CVE-2026-65467 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Contributor Server Side Request Forgery (SSRF) in JetEngine <= 3.8.11 versions.
- What to do
- Update the plugin to the newest version.
Jul 23, 2026Custom role Server Side Request Forgery (SSRF) in JetBooking <= 4.1.2 versions.CVE-2026-65466 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Custom role Server Side Request Forgery (SSRF) in JetBooking <= 4.1.2 versions.
- What to do
- Update the plugin to the newest version.
Jul 23, 2026Contributor Cross Site Scripting (XSS) in JetElements For Elementor <= 2.9.1.1 versions.CVE-2026-65465 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Cross Site Scripting (XSS) in JetElements For Elementor <= 2.9.1.1 versions.
- What to do
- Update the plugin to the newest version.
Jul 23, 2026Unauthenticated Cross Site Request Forgery (CSRF) in GiveWP <= 4.16.3 versions.CVE-2026-65464 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Unauthenticated Cross Site Request Forgery (CSRF) in GiveWP <= 4.16.3 versions.
- What to do
- Update the plugin to the newest version.
Jul 23, 2026Subscriber Insecure Direct Object References (IDOR) in Masteriyo - LMS <= 2.3.1 versions.CVE-2026-65463 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Subscriber Insecure Direct Object References (IDOR) in Masteriyo - LMS <= 2.3.1 versions.
- What to do
- Update the plugin to the newest version.
Jul 23, 2026Administrator SQL Injection in Uncanny Automator <= 7.3.2 versions.CVE-2026-65462 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Administrator SQL Injection in Uncanny Automator <= 7.3.2 versions.
- What to do
- Update the plugin to the newest version.
Jul 23, 2026Administrator Arbitrary File Upload in Really Simple CSV Importer <= 1.3 versions.CVE-2026-65461 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Administrator Arbitrary File Upload in Really Simple CSV Importer <= 1.3 versions.
- What to do
- Update the plugin to the newest version.
Jul 23, 2026Unauthenticated Cross Site Request Forgery (CSRF) in Zarinpal Gateway <= 5.1.0 versions.CVE-2026-65460 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Unauthenticated Cross Site Request Forgery (CSRF) in Zarinpal Gateway <= 5.1.0 versions.
- What to do
- Update the plugin to the newest version.
Jul 23, 2026Chouby Polylang and Chouby Polylang Pro: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2026-65458 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Chouby Polylang and Chouby Polylang Pro allows Retrieve Embedded Sensitive Data. This issue affects Polylang: through 3.8.5; Polylang Pro: through 3.8.5.
- Product
- Chouby Polylang and Chouby Polylang Pro
- Affected
- up to 3.8.5
- What to do
- Affects up to 3.8.5. Update Chouby Polylang and Chouby Polylang Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026Subscriber Broken Access Control in ЮKassa для WooCommerce <= 2.16.1 versions.CVE-2026-65457 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Subscriber Broken Access Control in ЮKassa для WooCommerce <= 2.16.1 versions.
- What to do
- Update the plugin to the newest version.
Jul 23, 2026Contributor Insecure Direct Object References (IDOR) in Product Slider for WooCommerce <= 1.13.62 versions.CVE-2026-65456 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Contributor Insecure Direct Object References (IDOR) in Product Slider for WooCommerce <= 1.13.62 versions.
- What to do
- Update the plugin to the newest version.
Jul 23, 2026Administrator Arbitrary File Upload in MapSVG <= 8.14.0 versions.CVE-2026-65455 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Administrator Arbitrary File Upload in MapSVG <= 8.14.0 versions.
- What to do
- Update the plugin to the newest version.
Jul 23, 2026Contributor SQL Injection in Quiz And Survey Master <= 11.2.0 versions.CVE-2026-65454 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Contributor SQL Injection in Quiz And Survey Master <= 11.2.0 versions.
- What to do
- Update the plugin to the newest version.
Jul 23, 2026Unauthenticated Broken Access Control in Ebook Store <= 6.19 versions.CVE-2026-65453 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Broken Access Control in Ebook Store <= 6.19 versions.
- What to do
- Update the plugin to the newest version.
Jul 23, 2026Unauthenticated Broken Access Control in Ebook Store <= 6.19 versions.CVE-2026-65452 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Broken Access Control in Ebook Store <= 6.19 versions.
- What to do
- Update the plugin to the newest version.
Jul 23, 2026Contributor SQL Injection in MapSVG <= 8.14.0 versions.CVE-2026-65451 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Contributor SQL Injection in MapSVG <= 8.14.0 versions.
- What to do
- Update the plugin to the newest version.
Jul 23, 2026Contributor SQL Injection in MapSVG <= 8.14.0 versions.CVE-2026-65450 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Contributor SQL Injection in MapSVG <= 8.14.0 versions.
- What to do
- Update the plugin to the newest version.
Jul 23, 2026Contributor Cross Site Scripting (XSS) in MapSVG <= 8.14.0 versions.CVE-2026-65449 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Cross Site Scripting (XSS) in MapSVG <= 8.14.0 versions.
- What to do
- Update the plugin to the newest version.
Jul 23, 2026Unauthenticated Cross Site Request Forgery (CSRF) in Simple Link Directory Pro <= 15.0.8 versions.CVE-2026-61981 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Unauthenticated Cross Site Request Forgery (CSRF) in Simple Link Directory Pro <= 15.0.8 versions.
- What to do
- Update the plugin to the newest version.
Jul 23, 2026Subscriber Broken Access Control in ShopLentor Pro <= 2.8.5 versions.CVE-2026-61973 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Subscriber Broken Access Control in ShopLentor Pro <= 2.8.5 versions.
- What to do
- Update the plugin to the newest version.
Jul 23, 2026Unauthenticated Broken Access Control in ShopLentor Pro <= 2.8.5 versions.CVE-2026-61972 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Broken Access Control in ShopLentor Pro <= 2.8.5 versions.
- What to do
- Update the plugin to the newest version.
Jul 23, 2026Unauthenticated Broken Access Control in PayU India <= 3.8.9 versions.CVE-2026-61954 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in PayU India <= 3.8.9 versions.
- What to do
- Update the plugin to the newest version.
Jul 23, 2026Unauthenticated Privilege Escalation in TrueBooker <= 1.2.3 versions.CVE-2026-61951 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated Privilege Escalation in TrueBooker <= 1.2.3 versions.
- What to do
- Update the plugin to the newest version.
Jul 23, 2026Unauthenticated SQL Injection in TrueBooker <= 1.2.3 versions.CVE-2026-61950 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in TrueBooker <= 1.2.3 versions.
- What to do
- Update the plugin to the newest version.
Jul 23, 2026Unauthenticated SQL Injection in Bookly <= 27.7 versions.CVE-2026-61949 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in Bookly <= 27.7 versions.
- What to do
- Update the plugin to the newest version.
Jul 23, 2026Unauthenticated SQL Injection in WPDM – Premium Packages <= 6.2.0 versions.CVE-2026-61948 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in WPDM – Premium Packages <= 6.2.0 versions.
- What to do
- Update the plugin to the newest version.
Jul 23, 2026Unauthenticated Cross Site Scripting (XSS) in Form Vibes – Database Manager for Forms <= 1.5.2 versions.CVE-2026-61947 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Form Vibes – Database Manager for Forms <= 1.5.2 versions.
- What to do
- Update the plugin to the newest version.
Jul 23, 2026Unauthenticated Insecure Direct Object References (IDOR) in Easy Appointments <= 3.12.27 versions.CVE-2026-61946 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Insecure Direct Object References (IDOR) in Easy Appointments <= 3.12.27 versions.
- What to do
- Update the plugin to the newest version.
Jul 23, 2026WooCommerce Product Stock Alert: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2026-61945 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in MultiVendorX WooCommerce Product Stock Alert allows Retrieve Embedded Sensitive Data. This issue affects WooCommerce Product Stock Alert: from n/a through 3.0.6.
- Product
- WooCommerce Product Stock Alert
- Affected
- up to 3.0.6
- What to do
- Affects up to 3.0.6. Update WooCommerce Product Stock Alert to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026Unauthenticated Cross Site Scripting (XSS) in Bookly <= 27.7 versions.CVE-2026-61944 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Bookly <= 27.7 versions.
- What to do
- Update the plugin to the newest version.
Jul 23, 2026Unauthenticated Broken Access Control in WPDM – Premium Packages <= 6.2.0 versions.CVE-2026-61943 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in WPDM – Premium Packages <= 6.2.0 versions.
- What to do
- Update the plugin to the newest version.
Jul 23, 2026Unauthenticated Arbitrary File Deletion in Participants Database <= 2.7.8.3 versions.CVE-2026-59555 · WordPress plugins & themes · reported by PatchstackCritical 10
Unauthenticated Arbitrary File Deletion in Participants Database <= 2.7.8.3 versions.
- What to do
- Update the plugin to the newest version.
Jul 23, 2026Unauthenticated Broken Authentication in Ziina <= 1.2.21 versions.CVE-2026-59554 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Authentication in Ziina <= 1.2.21 versions.
- What to do
- Update the plugin to the newest version.
Jul 23, 2026Unauthenticated Broken Access Control in Payment Gateway for PayPal on WooCommerce <= 9.1.4 versions.CVE-2026-59547 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in Payment Gateway for PayPal on WooCommerce <= 9.1.4 versions.
- What to do
- Update the plugin to the newest version.
Jul 23, 2026Unauthenticated Broken Authentication in miniOrange Discord Integration <= 2.2.4 versions.CVE-2026-59545 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Broken Authentication in miniOrange Discord Integration <= 2.2.4 versions.
- What to do
- Update the plugin to the newest version.
Jul 23, 2026Unauthenticated PHP Object Injection in Thrive Quiz Builder <= 10.9.3.0 versions.CVE-2026-59544 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in Thrive Quiz Builder <= 10.9.3.0 versions.
- What to do
- Update the plugin to the newest version.
Jul 23, 2026Subscriber Remote Code Execution (RCE) in Advanced Views <= 3.8.11 versions.CVE-2026-59543 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Subscriber Remote Code Execution (RCE) in Advanced Views <= 3.8.11 versions.
- What to do
- Update the plugin to the newest version.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. The WordPress, CMS and hosting-panel entries come from the National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan and others); we show who. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.