Updated 15 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

36added in the last 30 days

479new WordPress flaws this week

390,525entries in the database

175 results · page 1 of 4

Oct 29, 2026InstaWP Connect: Cross-Site Request Forgery (CSRF)CVE-2026-116399 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Cross-Site Request Forgery (CSRF) vulnerability in InstaWP InstaWP Connect instawp-connect allows Cross Site Request Forgery.This issue affects InstaWP Connect: from n/a through 0.1.4.2.
Product
InstaWP Connect
Affected
up to 0.1.4.2
What to do
Affects up to 0.1.4.2. Update InstaWP Connect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 25, 2026InstaWP Connect: Does not perform a capability check on its InstaWP Connect WordPress plugin before 0CVE-2026-114743 · WordPress plugins & themes · reported by WPScanLow 3.1
The InstaWP Connect WordPress plugin before 0.1.4.2 does not perform a capability check on its InstaWP Connect WordPress plugin before 0.1.4.2-settings update action, verifying only a nonce, allowing an authenticated user holding a low-privileged role that an administrator has granted access to the InstaWP Connect WordPress plugin before 0.1.4.2's sync feature to overwrite the InstaWP Connect WordPress plugin before 0.1.4.2's settings, including the setting controlling which roles may access that feature. The role grant is not enabled by default.
Product
InstaWP Connect
Fixed in
0.1.4.2
What to do
Update InstaWP Connect to 0.1.4.2 or newer.
Full record and what to do →NVD record wpscan.com
Oct 21, 2026WP User Manager: Does not keep its paid-registration capability restrictions in force once the payment gateway is disconnectedCVE-2026-110523 · WordPress plugins & themes · reported by WPScanHigh 8.1
The WP User Manager WordPress plugin before 2.9.26 does not keep its paid-registration capability restrictions in force once the payment gateway is disconnected, while a published paid registration form continues to assign its configured role, allowing unauthenticated users to register and immediately obtain a privileged administrator-equivalent role without completing the payment meant to gate it.
Product
WP User Manager
Fixed in
2.9.26
What to do
Update WP User Manager to 2.9.26 or newer.
Full record and what to do →NVD record wpscan.com
Oct 16, 2026WSP MCP AI Agents Connector: Sensitive Information DisclosureCVE-2026-109382 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The WSP MCP AI Agents Connector plugin for WordPress is vulnerable to Sensitive Information Disclosure in versions up to, and including, 2.9.5. This is due to the wsp_get_posts MCP tool being registered with an empty capability requirement while the MCP endpoint's authenticate() method accepts any logged-in user, and the wsp_execute_get_posts() callback honouring a caller-supplied status=all argument that expands into a WP_Query over 'publish', 'draft', 'pending' and 'future' posts with no author or ownership filter. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the titles, URLs, authors, categories, tags and 40-word excerpts of every unpublished (draft/pending/scheduled) post on the site.
Product
WSP MCP AI Agents Connector
Affected
up to 2.9.5
What to do
Affects up to 2.9.5. Update WSP MCP AI Agents Connector to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 16, 2026InstaWP Connect – 1-click WP Staging & Migration: Privilege EscalationCVE-2026-109400 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 0.1.4.1 This is due to the plugin registering its admin page via `add_management_page()` using a role name returned by `InstaWP_Setting::get_allowed_role()` as the required capability — which WordPress resolves as a real capability match for any user holding that role — combined with `generate_section_field()` rendering the master API key from the `instawp_api_options` option directly as the `value` attribute of a plain-text HTML input with no additional `manage_options` or equivalent capability check. This makes it possible for authenticated attackers with Subscriber-level access and above to read the plaintext master API key, use its SHA-256-derived secret as a bearer token accepted by the plugin's REST API `validate_api_request()`, and call `POST /wp-json/instawp-connect/v2/auto-login` to mint a 30-second single-use login URL that sets an administrator authentication cookie — fully escalating their privileges. Exploitation requires the site to be actively connected to InstaWP and an administrator to have added the attacker's role t
Product
InstaWP Connect – 1-click WP Staging & Migration
Affected
up to 0.1.4.1
What to do
Affects up to 0.1.4.1. Update InstaWP Connect – 1-click WP Staging & Migration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 14, 2026JTL-Connector for WooCommerce: Arbitrary File UploadCVE-2026-87855 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The JTL-Connector for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.4.3 via the saveImage() function. This is due to the startSession() function accepting an empty jtlauth parameter as a valid credential, combined with insufficient file type validation in handleImagePush(). This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible.
Product
JTL-Connector for WooCommerce
Affected
up to 2.4.3
What to do
Affects up to 2.4.3. Update JTL-Connector for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 14, 2026JTL-Connector for WooCommerce: Time-based SQL InjectionCVE-2026-78193 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The JTL-Connector for WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via 'product.push' Identity Endpoint in all versions up to, and including, 2.4.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The injection fires during identity linking, before ProductController::push() executes, meaning exploitation succeeds even if downstream product handling would otherwise reject the request.
Product
JTL-Connector for WooCommerce
Affected
up to 2.4.3
What to do
Affects up to 2.4.3. Update JTL-Connector for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 10, 2026Advanced Form Integration — Connect Forms to 300+ Apps: Authentication BypassCVE-2026-104797 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Advanced Form Integration — Connect Forms to 300+ Apps plugin for WordPress is vulnerable to Authentication Bypass via Unverified Password Change in all versions up to, and including, 2.9.0 The `adfoin_ultimatememberac_send_data` function, which powers the Ultimate Member "Update Profile Field" action, resolves the target WordPress user from an attacker-supplied email address and passes an attacker-controlled field key and value directly to `UM()->user()->update_profile()` in the `account` context — which explicitly bypasses Ultimate Member's banned-key validation — without performing any submitter identity verification, ownership check, capability check, current-password reauthentication, or restriction on sensitive keys such as `user_pass`. This makes it possible for unauthenticated attackers to change the password of any WordPress user account, including Administrator accounts, by submitting a public Contact Form 7 form with a target email and `user_pass` as the field key, enabling full site takeover. Exploitation requires an administrator to have pre-configured a Contact Form 7 integration that maps the target email, field key, and value from public form inputs to the Ultim
Product
Advanced Form Integration — Connect Forms to 300+ Apps
Affected
up to 2.9.0
What to do
Affects up to 2.9.0. Update Advanced Form Integration — Connect Forms to 300+ Apps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 3, 2026WPZOOM Connect: AI Chat, Click to Chat, Social Icons & Share Buttons: Sensitive Information ExposureCVE-2026-100149 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WPZOOM Connect: AI Chat, Click to Chat, Social Icons & Share Buttons plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.7.3 via the 'x-yamidoo-signature (attacker-obtained via inline_js identify payload)' parameter. This makes it possible for unauthenticated attackers to extract the full customer card — including name, WordPress user ID, order history, order totals, purchased products, payment method labels, and EDD Software Licensing license keys with status and activation counts — for any arbitrary victim email address on the site. Exploitation requires the attacker to register a WooCommerce customer or subscriber-level account with a crafted email address whose local part encodes the target timestamp and victim email, allowing the signature printed into the page HTML by inline_js() to pass verify_request() for an arbitrary victim; both the share_customer_data and identify_logged_in settings are enabled by default, so no non-default configuration is required.
Product
WPZOOM Connect: AI Chat, Click to Chat, Social Icons & Share Buttons
Affected
up to 4.7.3
What to do
Affects up to 4.7.3. Update WPZOOM Connect: AI Chat, Click to Chat, Social Icons & Share Buttons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Oct 2, 2026Popup Maker: Does not perform a capability check on one of its account-connection actionsCVE-2026-85004 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Popup Maker WordPress plugin through 1.4.5 does not perform a capability check on one of its account-connection actions, only verifying a nonce, allowing authenticated users with minimal privileges such as Subscribers to overwrite a site-wide Popup Maker WordPress plugin through 1.4.5 option (the linked service account and API configuration) that should only be modifiable by administrators.
Product
Popup Maker
Affected
up to 1.4.5
What to do
Affects up to 1.4.5. Update Popup Maker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Oct 1, 2026Subscriber Privilege Escalation in ByteCoreStack – MCP Connector for AI Tools <= 1.2.2 versions.CVE-2026-103068 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Subscriber Privilege Escalation in ByteCoreStack – MCP Connector for AI Tools <= 1.2.2 versions.
Affected
up to 1.2.2
What to do
Affects up to 1.2.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 1, 2026ByteCoreStack – MCP Connector for AI Tools: Privilege EscalationCVE-2026-19807 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The ByteCoreStack – MCP Connector for AI Tools plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.2.3 This is due to the `wp_update_user_meta` MCP tool in `execute_tool` gating writes solely with `current_user_can('edit_user', $uid)` — a check that WordPress core's `map_meta_cap` resolves to the `read` primitive when the target user ID matches the caller's own — while enforcing an incomplete meta key blocklist that covers only `user_pass`, `user_activation_key`, and `session_tokens`, leaving the `wp_capabilities` and `wp_user_level` meta keys entirely unprotected. This makes it possible for authenticated attackers with Subscriber-level access and above to elevate their privileges to Administrator by issuing a `wp_update_user_meta` call over the MCP JSON-RPC endpoint with `key=wp_capabilities` and an arbitrary role array such as `{'administrator': true}` targeting their own user ID, causing WordPress to load that account as an Administrator on the next request.
Product
ByteCoreStack – MCP Connector for AI Tools
Affected
up to 1.2.3
What to do
Affects up to 1.2.3. Update ByteCoreStack – MCP Connector for AI Tools to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 30, 2026Subscriber Broken Access Control in AllAble Connector <= 0.13.4 versions.CVE-2026-97243 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Subscriber Broken Access Control in AllAble Connector <= 0.13.4 versions.
Affected
up to 0.13.4
What to do
Affects up to 0.13.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 30, 2026Connections Business Directory: Does not apply its visibility and moderation-status restrictions on certain REST API read endpointsCVE-2026-86789 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Connections Business Directory WordPress plugin through 10.4.67 does not apply its visibility and moderation-status restrictions on certain REST API read endpoints, allowing unauthenticated attackers to retrieve directory entries that are marked private or unlisted, or that are still pending moderation, including entry names, organizations, biographies, internal notes and street addresses. The Connections Business Directory WordPress plugin through 10.4.67 has been closed on WordPress.org and no fixed version is available, so site owners should remove it or restrict unauthenticated access to its REST API routes.
Product
Connections Business Directory
Affected
up to 10.4.67
What to do
Affects up to 10.4.67. Update Connections Business Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Sep 23, 2026Unauthenticated Sensitive Data Exposure in TrustedLogin Connector <= 2.0.3 versions.CVE-2026-95600 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Sensitive Data Exposure in TrustedLogin Connector <= 2.0.3 versions.
Affected
up to 2.0.3
What to do
Affects up to 2.0.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 23, 2026Contributor Broken Access Control in WSP MCP – AI Agents Connector <= 2.7.0 versions.CVE-2026-93529 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Broken Access Control in WSP MCP – AI Agents Connector <= 2.7.0 versions.
Affected
up to 2.7.0
What to do
Affects up to 2.7.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 23, 2026Forminator Forms: Does not verify that a request came from a trusted proxy before preferring client-supplied forwarding headers over the connecting addressCVE-2026-87070 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Forminator Forms WordPress plugin before 1.57.2.1 does not verify that a request came from a trusted proxy before preferring client-supplied forwarding headers over the connecting address, and it uses that value both to enforce its per-visitor voting limit and to record who submitted an entry. Unauthenticated visitors can therefore vote without limit on any poll and can choose the address stored against every submission they make.
Product
Forminator Forms
Fixed in
1.57.2.1
What to do
Update Forminator Forms to 1.57.2.1 or newer.
Full record and what to do →NVD record wpscan.com
Sep 23, 2026WP OAuth Server ( Login with WordPress ): Does not bind the OpenID Connect identity assertion it issues to the authorization grant being exchangedCVE-2026-82843 · WordPress plugins & themes · reported by WPScanCritical 9
The WP OAuth Server ( Login with WordPress ) WordPress plugin before 6.4.0 does not bind the OpenID Connect identity assertion it issues to the authorization grant being exchanged, returning instead the assertion belonging to whichever user authenticated most recently, which allows users with the Subscriber role and above to obtain a validly signed identity assertion for another user, including an administrator, and authenticate as them at any application that uses the site for single sign-on.
Product
WP OAuth Server ( Login with WordPress )
Fixed in
6.4.0
What to do
Update WP OAuth Server ( Login with WordPress ) to 6.4.0 or newer.
Full record and what to do →NVD record wpscan.com
Sep 3, 2026MountDev AI MCP Connector for: Missing AuthorizationCVE-2026-85306 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Cascadia Web Services MountDev AI MCP Connector for WordPress allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects MountDev AI MCP Connector for WordPress: from n/a through 1.6.5.
Product
MountDev AI MCP Connector for
Affected
up to 1.6.5
What to do
Affects up to 1.6.5. Update MountDev AI MCP Connector for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 31, 2026Unauthenticated Cross Site Scripting (XSS) in LeadConnector <= 4.0.5 versions.CVE-2026-81298 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in LeadConnector <= 4.0.5 versions.
Affected
up to 4.0.5
What to do
Affects up to 4.0.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 21, 2026LitExtension: Does not verify a nonce before an administrative action that overwrites the store-migration connector's authentication tokenCVE-2026-15046 · WordPress plugins & themes · reported by WPScanMedium 4.2
The LitExtension WordPress plugin through 1.2.5 does not verify a nonce before an administrative action that overwrites the store-migration connector's authentication token, allowing attackers to take over the connector token by tricking a logged-in administrator into clicking a crafted link (CSRF).
Product
LitExtension
Affected
up to 1.2.5
What to do
Affects up to 1.2.5. Update LitExtension to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Aug 13, 2026Unauthenticated Broken Access Control in InstaWP Connect <= 0.1.3.7 versions.CVE-2026-73401 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Broken Access Control in InstaWP Connect <= 0.1.3.7 versions.
Affected
up to 0.1.3.7
What to do
Affects up to 0.1.3.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 11, 2026Social Login, Passkeys, Magic Link & Email OTP – Passwordless Login by VentraConnect: Authentication BypassCVE-2026-18961 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Social Login, Passkeys, Magic Link & Email OTP – Passwordless Login by VentraConnect plugin for WordPress is vulnerable to Authentication Bypass via Unverified Provider Email in all versions up to, and including, 1.4.3. This is due to the plugin trusting the unverified email field returned by Spotify's /v1/me endpoint as proof of mailbox ownership — Generic::normalize_common() copies this value into the normalized profile without requiring an email_verified assertion, and User_Links::link_or_login_user() subsequently passes it directly to get_user_by('email', $email) and issues a persistent authentication cookie via wp_set_auth_cookie() without a provider-specific verified-email gate, a local mailbox challenge, or a logged-in approval step. This makes it possible for unauthenticated attackers to log in as any existing WordPress user, including Administrators, by supplying a known target email address through a controlled Spotify OAuth flow, gaining full administrative access to the site.
Product
Social Login, Passkeys, Magic Link & Email OTP – Passwordless Login by VentraConnect
Affected
up to 1.4.3
What to do
Affects up to 1.4.3. Update Social Login, Passkeys, Magic Link & Email OTP – Passwordless Login by VentraConnect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record developer.spotify.com plugins.svn.wordpress.org
Aug 11, 2026InstaWP Connect – 1-click WP Staging & Migration: Remote Code ExecutionCVE-2026-13457 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 0.1.3.6 via the (top-level script) function. This is due to the plugin stores its encrypted options file as options-{migrate_key}.txt in wp-content/instawpbackups/ without deploying an index.php or .htaccess to prevent directory listing, exposing the 40-character migrate_key on Apache servers with directory indexing enabled, which allows an attacker to derive the AES-256-CBC passphrase via SHA256(migrate_key), decrypt the options file to recover the api_signature. This makes it possible for unauthenticated attackers to get the database access details and api_signature. Exploitation requires the target WordPress site to be hosted on Apache with directory listing enabled (Options +Indexes) for the wp-content/instawpbackups/ directory, and time limited because it can only be exploited during the migration period.
Product
InstaWP Connect – 1-click WP Staging & Migration
Affected
up to 0.1.3.6
What to do
Affects up to 0.1.3.6. Update InstaWP Connect – 1-click WP Staging & Migration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 10, 2026File Manager: Does not perform any capability check on one of its file manager connector endpointsCVE-2026-17542 · WordPress plugins & themes · reported by WPScanHigh 7.5
The File Manager WordPress plugin before 6.9.1 does not perform any capability check on one of its file manager connector endpoints, allowing any authenticated user, such as a subscriber, to browse the entire WordPress installation directory and download files of certain types from it, including archives and documents which may contain sensitive data.
Product
File Manager
Fixed in
6.9.1
What to do
Update File Manager to 6.9.1 or newer.
Full record and what to do →NVD record wpscan.com
Aug 9, 2026InfiniteWP Client: Does not properly verify the site-connection state and the authenticity of requests to its remote-management endpoint on WordPress Multisite installationsCVE-2026-15038 · WordPress plugins & themes · reported by WPScanCritical 9.8
The InfiniteWP Client WordPress plugin before 1.13.6 does not properly verify the site-connection state and the authenticity of requests to its remote-management endpoint on WordPress Multisite installations, allowing unauthenticated attackers to bind their own key, hijack an administrator session, and take over the entire network, leading to remote code execution.
Product
InfiniteWP Client
Fixed in
1.13.6
What to do
Update InfiniteWP Client to 1.13.6 or newer.
Full record and what to do →NVD record wpscan.com
Aug 6, 2026Unauthenticated Broken Access Control in Legal Text Connector of the IT-Recht Kanzlei <= 1.0.13 versions.CVE-2026-66452 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Broken Access Control in Legal Text Connector of the IT-Recht Kanzlei <= 1.0.13 versions.
Affected
up to 1.0.13
What to do
Affects up to 1.0.13. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 2, 2026Gallery for Google Photos: Does not properly restrict access to the stored third-party OAuth credentials of the connected accountCVE-2026-15236 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Gallery for Google Photos WordPress plugin before 1.2.1 does not properly restrict access to the stored third-party OAuth credentials of the connected account, exposing the persistent access and refresh tokens to unauthenticated users and allowing long-term compromise of the linked account.
Product
Gallery for Google Photos
Fixed in
1.2.1
What to do
Update Gallery for Google Photos to 1.2.1 or newer.
Full record and what to do →NVD record wpscan.com
Aug 1, 2026GSheetConnector – CF7 Google Sheets Connector with Real-Time Sync: Generic SQL InjectionCVE-2026-16614 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The GSheetConnector – CF7 Google Sheets Connector with Real-Time Sync plugin for WordPress is vulnerable to generic SQL Injection via the 's' parameter in all versions up to, and including, 5.2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. wp_unslash() strips magic-quote protection and sanitize_text_field() does not escape SQL metacharacters, leaving single quotes and other SQL metacharacters intact before the value is interpolated into the query.
Product
GSheetConnector – CF7 Google Sheets Connector with Real-Time Sync
Affected
up to 5.2.1
What to do
Affects up to 5.2.1. Update GSheetConnector – CF7 Google Sheets Connector with Real-Time Sync to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 1, 2026YOP Poll: Does not validate the connection's origin IP address and instead trusts client-controlled forwarding headersCVE-2026-14840 · WordPress plugins & themes · reported by WPScanMedium 5.3
The YOP Poll WordPress plugin before 7.0.6 does not validate the connection's origin IP address and instead trusts client-controlled forwarding headers when enforcing its per-IP vote restriction, allowing unauthenticated attackers to bypass the vote limit and cast unlimited votes on a public poll.
Product
YOP Poll
Fixed in
7.0.6
What to do
Update YOP Poll to 7.0.6 or newer.
Full record and what to do →NVD record wpscan.com
Jul 30, 2026Easy Appointments: Does not perform any capability or nonce check in one of its connection-deletion actionsCVE-2026-14222 · WordPress plugins & themes · reported by WPScanLow 3.8
The Easy Appointments WordPress plugin before 3.12.28 does not perform any capability or nonce check in one of its connection-deletion actions, allowing users with contributor-level access to delete the booking configuration and disable the booking system.
Product
Easy Appointments
Fixed in
3.12.28
What to do
Update Easy Appointments to 3.12.28 or newer.
Full record and what to do →NVD record wpscan.com
Jul 28, 2026Advanced Form Integration — Connect Forms to 200+ Apps: Authorization bypassCVE-2026-16587 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Advanced Form Integration — Connect Forms to 200+ Apps plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to overwrite the site's stored MailUp OAuth tokens in the adfoin_mailup_keys option with attacker-controlled tokens, hijacking future form-submission data to a MailUp account they control or nulling the tokens to break the integration entirely. This is exploitable by any authenticated user who can reach /wp-admin/profile.php, as admin_init fires for all logged-in users visiting any wp-admin page.
Product
Advanced Form Integration — Connect Forms to 200+ Apps
Affected
up to 2.6.0
What to do
Affects up to 2.6.0. Update Advanced Form Integration — Connect Forms to 200+ Apps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 23, 2026MountDev AI MCP Connector for: Authorization bypassCVE-2026-15015 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The MountDev AI MCP Connector for WordPress plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.6.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to obtain an administrator-bound OAuth Bearer token via a self-registered client, granting full administrator-equivalent access to the plugin's MCP tool surface and all exposed WordPress content, users, and options. This is exploitable by combining the publicly accessible Dynamic Client Registration endpoint, which allows unauthenticated callers to register arbitrary OAuth clients with an attacker-controlled redirect_uri, with the unprotected authorization endpoint to complete the full OAuth flow without any administrator interaction.
Product
MountDev AI MCP Connector for
Affected
up to 1.6.1
What to do
Affects up to 1.6.1. Update MountDev AI MCP Connector for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 11, 2026Catalyst Connect Zoho CRM Client Portal: Time-based SQL InjectionCVE-2025-5017 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The Catalyst Connect Zoho CRM Client Portal plugin for WordPress is vulnerable to time-based SQL Injection via the ‘uid’ parameter in all versions up to, and including, 2.2.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Catalyst Connect Zoho CRM Client Portal
Affected
up to 2.2.0
What to do
Affects up to 2.2.0. Update Catalyst Connect Zoho CRM Client Portal to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wordpress.org
Jul 9, 2026Connect Contact Form 7 and Mailchimp: Stored Cross-Site ScriptingCVE-2026-15000 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Connect Contact Form 7 and Mailchimp plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Mailchimp Merge Field Values in all versions up to, and including, 0.9.78.06 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload is only triggered when a privileged user (Administrator) performs a Contact Lookup for the email address submitted via the CF7 form, meaning execution is deferred until an administrator interacts with the affected entry.
Product
Connect Contact Form 7 and Mailchimp
Affected
up to 0.9.78.06
What to do
Affects up to 0.9.78.06. Update Connect Contact Form 7 and Mailchimp to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 1, 2026Advanced Form Integration — Connect Forms to 200+ Apps: Does not restrict the WordPress role assignedCVE-2026-11794 · WordPress plugins & themes · reported by WPScanHigh 8.1
The Advanced Form Integration — Connect Forms to 200+ Apps WordPress plugin before 2.1.1 does not restrict the WordPress role assigned when it creates a user from a public form submission, allowing unauthenticated visitors to create an administrator account when an active integration maps the user role to a public form field. This requires a specific, non-default multi-Advanced Form Integration — Connect Forms to 200+ Apps WordPress plugin before 2.1.1 configuration.
Product
Advanced Form Integration — Connect Forms to 200+ Apps
Fixed in
2.1.1
What to do
Update Advanced Form Integration — Connect Forms to 200+ Apps to 2.1.1 or newer.
Full record and what to do →NVD record wpscan.com
Jun 24, 2026WP Forms Connector: SQL InjectionCVE-2026-9179 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The WP Forms Connector plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter of the /wp-json/wp/v3/post/list REST endpoint in versions up to and including 1.8. This is due to insufficient escaping on the user-supplied 'order' parameter (read directly from $_GET['order'] into $shorting) and the lack of sufficient preparation on the existing SQL query in the listPost() function, where the value is concatenated unquoted into the ORDER BY clause and executed via $wpdb->get_results() without $wpdb->prepare(). The endpoint is registered with permission_callback '__return_true' and performs only a broken header-based check that validates the supplied 'Username' corresponds to an administrator account while never verifying the 'Password'. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
WP Forms Connector
Affected
up to 1.8
What to do
Affects up to 1.8. Update WP Forms Connector to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 24, 2026WP Forms Connector: Information ExposureCVE-2026-9178 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The WP Forms Connector plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.8. The plugin registers the REST route wp/v3/user/list/<id> (callback userDetail()) with permission_callback set to '__return_true', and the function's home-grown authentication only verifies that the supplied 'Username' HTTP header maps to an administrator account and that a 'Password' HTTP header is non-empty. It never validates the password with wp_check_password() (unlike the sibling delete_wc_user() function which does). This makes it possible for unauthenticated attackers to retrieve sensitive information for any registered user ID — including the WordPress password hash (user_pass) and email address — by sending a request with a valid administrator login name (commonly the default 'admin') and any arbitrary password value.
Product
WP Forms Connector
Affected
up to 1.8
What to do
Affects up to 1.8. Update WP Forms Connector to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 19, 20262Download Connector for 2DL Hosted Checkout: Unauthorized accessCVE-2026-6798 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The 2Download Connector for 2DL Hosted Checkout plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 0.1.5. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to view arbitrary customers' subscription data including subscription status, product names, order IDs, purchase dates, and expiry dates.
Product
2Download Connector for 2DL Hosted Checkout
Affected
up to 0.1.5
What to do
Affects up to 0.1.5. Update 2Download Connector for 2DL Hosted Checkout to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 7, 2026the elFinder connector that: WordPress Augmented-Reality plugin contains a remote code executionCVE-2023-54350 · WordPress plugins & themes · reported by VulnCheckHigh 8.7
WordPress Augmented-Reality plugin contains a remote code execution vulnerability in the elFinder connector that allows unauthenticated attackers to upload and execute arbitrary PHP files. Attackers can send POST requests to the connector.minimal.php endpoint with mkfile and put commands to create malicious PHP files in the file_manager directory and execute them on the server.
Product
the elFinder connector that
What to do
Update the elFinder connector that to the newest version.
Full record and what to do →NVD record exploit-db.com vulncheck.com
Jun 2, 2026JTL-Connector for WooCommerce: Missing AuthorizationCVE-2026-9234 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The JTL-Connector for WooCommerce plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 2.4.1. This is due to missing capability checks and nonce verification on the admin_post_settings_save_woo-jtl-connector action (handled by JtlConnectorAdmin::save()) and on the wp_ajax_downloadJTLLogs and wp_ajax_clearJTLLogs AJAX actions (handled by the global downloadJTLLogs() and clearJTLLogs() functions). This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify arbitrary plugin settings, download a ZIP archive of the connector's developer log files, and delete those log files.
Product
JTL-Connector for WooCommerce
Affected
up to 2.4.1
What to do
Affects up to 2.4.1. Update JTL-Connector for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 12, 2026GWD Connect: Missing authorization to limited code executionCVE-2026-6663 · WordPress plugins & themes · reported by WordfenceMedium 4.8
The GWD Connect plugin for WordPress is vulnerable to missing authorization to limited code execution in all versions up to, and including, 2.9. This is due to the plugin's standalone agent endpoints (gwd-backup.php and gwd-logs.php) not verifying authentication when the API key has not been configured, which is the default state. This makes it possible for unauthenticated attackers - on unregistered installations only, in certain environments - to execute arbitrary code on the server via the update_agent action, which writes attacker-supplied PHP code to the agent file.
Product
GWD Connect
Affected
up to 2.9
What to do
Affects up to 2.9. Update GWD Connect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 22, 2026CI HUB Connector: Stored Cross-Site ScriptingCVE-2026-4353 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The CI HUB Connector plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' attribute of the `cihub_metadata` shortcode in all versions up to, and including, 1.2.106 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
CI HUB Connector
Affected
up to 1.2.106
What to do
Affects up to 1.2.106. Update CI HUB Connector to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 8, 2026InstaWP Connect: Missing AuthorizationCVE-2026-39504 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in InstaWP InstaWP Connect instawp-connect allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects InstaWP Connect: from n/a through <= 0.1.2.5.
Product
InstaWP Connect
Affected
up to 0.1.2.5
What to do
Affects up to 0.1.2.5. Update InstaWP Connect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 26, 2026LeadConnector: Does not have authorization in a REST routeCVE-2026-1890 · WordPress plugins & themes · reported by WPScanMedium 5.3
The LeadConnector WordPress plugin before 3.0.22 does not have authorization in a REST route, allowing unauthenticated users to call it and overwrite existing data
Product
LeadConnector
Fixed in
3.0.22
What to do
Update LeadConnector to 3.0.22 or newer.
Full record and what to do →NVD record wpscan.com
Mar 21, 2026Neos Connector for Fakturama: Cross-Site Request ForgeryCVE-2026-4143 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Neos Connector for Fakturama plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 0.0.14. This is due to missing nonce validation in the ncff_add_plugin_page() function which handles settings updates. This makes it possible for unauthenticated attackers to modify plugin settings via a forged request, granted they can trick a site administrator into performing an action such as clicking a link.
Product
Neos Connector for Fakturama
Affected
up to 0.0.14
What to do
Affects up to 0.0.14. Update Neos Connector for Fakturama to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 7, 2026Infomaniak Connect for OpenID: Stored Cross-Site ScriptingCVE-2026-1824 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Infomaniak Connect for OpenID plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'endpoint_login' parameter of the infomaniak_connect_generic_auth_url shortcode in all versions up to, and including, 1.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Infomaniak Connect for OpenID
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update Infomaniak Connect for OpenID to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 20, 2026WPForms Google Sheet Connector: Improper Control of Generation of Code ('Code Injection')CVE-2025-67979 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Improper Control of Generation of Code ('Code Injection') vulnerability in WesternDeal WPForms Google Sheet Connector gsheetconnector-wpforms allows Code Injection.This issue affects WPForms Google Sheet Connector: from n/a through <= 4.0.1.
Product
WPForms Google Sheet Connector
Affected
up to 4.0.1
What to do
Affects up to 4.0.1. Update WPForms Google Sheet Connector to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 19, 2026LeadConnector: Missing AuthorizationCVE-2026-25441 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in varunvairavanlc LeadConnector leadconnector allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LeadConnector: from n/a through <= 3.0.21.
Product
LeadConnector
Affected
up to 3.0.21
What to do
Affects up to 3.0.21. Update LeadConnector to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2026Apimo Connector: Missing AuthorizationCVE-2026-22445 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Proptech Plugin Apimo Connector apimo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Apimo Connector: from n/a through <= 2.6.5.2.
Product
Apimo Connector
Affected
up to 2.6.5.2
What to do
Affects up to 2.6.5.2. Update Apimo Connector to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.