Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
276 results · page 1 of 6
Oct 29, 2026Contributor PHP Object Injection in WP Media folders <= 1.1.10 versions.CVE-2026-118075 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Contributor PHP Object Injection in WP Media folders <= 1.1.10 versions.
- Affected
- up to 1.1.10
- What to do
- Affects up to 1.1.10. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 24, 2026GeoDirectory: Does not properly escape administrator-defined text before writing it into a generated PHP file in its own folderCVE-2026-113673 · WordPress plugins & themes · reported by WPScanHigh 7.2
The GeoDirectory WordPress plugin before 2.8.194 does not properly escape administrator-defined text before writing it into a generated PHP file in its own folder, allowing high privilege users such as a subsite administrator on a multisite network, who cannot otherwise run code, to achieve Remote Code Execution that any unauthenticated visitor can trigger.
- Product
- GeoDirectory
- Fixed in
- 2.8.194
- What to do
- Update GeoDirectory to 2.8.194 or newer.
Oct 21, 2026WPZOOM Portfolio Lite: Does not check that a user is allowed to edit a post before changing its type and orderCVE-2026-110514 · WordPress plugins & themes · reported by WPScanMedium 4.9
The WPZOOM Portfolio Lite WordPress plugin before 1.4.34 does not check that a user is allowed to edit a post before changing its type and order, which could allow users with the contributor role and above to convert any other user's posts and pages into portfolio items, removing them from their original listings and URLs.
- Product
- WPZOOM Portfolio Lite
- Fixed in
- 1.4.34
- What to do
- Update WPZOOM Portfolio Lite to 1.4.34 or newer.
Oct 14, 2026Contact Form DB for Enfold: Stored Cross-Site ScriptingCVE-2026-83592 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Contact Form DB for Enfold plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Contact Form Field Values in all versions up to, and including, 2.0.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload is echoed unescaped both inside a title HTML attribute and in the table cell body in admin/ecf_index.php; base64 encoding and serialization of the stored values do not neutralize the malicious content.
- Product
- Contact Form DB for Enfold
- Affected
- up to 2.0.2
- What to do
- Affects up to 2.0.2. Update Contact Form DB for Enfold to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 10, 2026Portfolio Filter Gallery: Does not perform a per-object authorization check before deleting an attachmentCVE-2026-105977 · WordPress plugins & themes · reported by WPScanLow 2.2
The Portfolio Filter Gallery WordPress plugin before 2.2.1 does not perform a per-object authorization check before deleting an attachment, allowing users with the Contributor role and above to permanently delete certain media attachments belonging to other users, including administrators.
- Product
- Portfolio Filter Gallery
- Fixed in
- 2.2.1
- What to do
- Update Portfolio Filter Gallery to 2.2.1 or newer.
Oct 10, 2026Portfolio Filter Gallery: Does not perform proper authorization checks in a set of AJAX actionsCVE-2026-105976 · WordPress plugins & themes · reported by WPScanMedium 4.7
The Portfolio Filter Gallery WordPress plugin before 2.2.1 does not perform proper authorization checks in a set of AJAX actions, allowing users with at least the Contributor role to read, modify and delete other users' galleries as well as site-wide gallery filters.
- Product
- Portfolio Filter Gallery
- Fixed in
- 2.2.1
- What to do
- Update Portfolio Filter Gallery to 2.2.1 or newer.
Oct 9, 2026ColorFolio: Deserialization of Untrusted DataCVE-2026-94065 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in BuddhaThemes ColorFolio colorit allows Object Injection.This issue affects ColorFolio: from n/a through 1.3.
- Product
- ColorFolio
- Affected
- up to 1.3
- What to do
- Affects up to 1.3. Update ColorFolio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2026Unauthenticated Cross Site Scripting (XSS) in WP Media folder <= 6.2.2 versions.CVE-2026-32569 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in WP Media folder <= 6.2.2 versions.
- Affected
- up to 6.2.2
- What to do
- Affects up to 6.2.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 2, 2026DoFollow Case by Case: Stored Cross-Site ScriptingCVE-2026-95817 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The DoFollow Case by Case plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to, and including, 3.6.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Comment moderation delays but does not prevent exploitation — once an administrator approves the visually innocuous comment, the stored payload executes in the browser of every subsequent visitor to the affected post.
- Product
- DoFollow Case by Case
- Affected
- up to 3.6.0
- What to do
- Affects up to 3.6.0. Update DoFollow Case by Case to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 30, 2026Subscriber Broken Access Control in Prevent files / folders access <= 2.6.7 versions.CVE-2026-97267 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Subscriber Broken Access Control in Prevent files / folders access <= 2.6.7 versions.
- Affected
- up to 2.6.7
- What to do
- Affects up to 2.6.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 25, 2026Link Library: Does not sanitize a user-supplied destination folder before writing a generated image to diskCVE-2026-78394 · WordPress plugins & themes · reported by WPScanMedium 4.1
The Link Library WordPress plugin before 7.9.6 does not sanitize a user-supplied destination folder before writing a generated image to disk, allowing users with the Contributor role and above to create directories and write or overwrite image files anywhere the web server can write, including outside the site's document root. The written file name is always numeric with a fixed image extension, so executable code cannot be planted this way.
- Product
- Link Library
- Fixed in
- 7.9.6
- What to do
- Update Link Library to 7.9.6 or newer.
Sep 18, 2026FileBird – WordPress Media Library Folders & File Manager: Stored Cross-Site ScriptingCVE-2026-15004 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The FileBird – WordPress Media Library Folders & File Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via image alt text in all versions up to, and including, 6.5.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- FileBird – WordPress Media Library Folders & File Manager
- Affected
- up to 6.5.6
- What to do
- Affects up to 6.5.6. Update FileBird – WordPress Media Library Folders & File Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 9, 2026Several Newfold plugins are vulnerable to Authentication Bypass.CVE-2026-80099 · WordPress plugins & themes · reported by WordfenceHigh 8.8
Several Newfold plugins are vulnerable to Authentication Bypass. The vulnerability exists because the plugins bundle the wp-module-data module. In the module, the `authenticate()` method — registered on the `rest_authentication_errors` filter and therefore evaluated for every unauthenticated REST API request — performs an HMAC-style Bearer token comparison that degenerates when `HiiveConnection::get_auth_token()` returns `false`: PHP coerces `strrev(false)` to `strrev('')`, collapsing the secret salt to the publicly known constant `hash('sha256', '') = e3b0c44...`, while all remaining hash inputs (HTTP method, request URL, raw request body, and the `X-Timestamp` header) remain fully attacker-controlled. This makes it possible for unauthenticated attackers to compute a valid Bearer token entirely offline, pass the token equality check, and have `wp_set_current_user()` invoked against the first administrator returned by `get_users(['role' => 'administrator'])`, granting full administrator-level access and enabling arbitrary REST API operations such as creating new administrator accounts and achieving complete site takeover. Vulnerable versions are WP Plugin Crazy Domains (<= 2.5.2),
- Affected
- up to 2.9.4
- What to do
- Affects up to 2.9.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 5, 2026CatFolders Document Gallery & PDF Library: Does not properly validate a block attribute before using itCVE-2026-84930 · WordPress plugins & themes · reported by WPScanMedium 6.8
The CatFolders Document Gallery & PDF Library WordPress plugin before 2.0.7 does not properly validate a block attribute before using it as an HTML tag name in its gallery output, allowing users with the Author role and above to inject arbitrary web scripts that execute in the browser of anyone who views the affected post.
- Product
- CatFolders Document Gallery & PDF Library
- Fixed in
- 2.0.7
- What to do
- Update CatFolders Document Gallery & PDF Library to 2.0.7 or newer.
Sep 3, 2026Enfold: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-84815 · WordPress plugins & themes · reported by PatchstackMedium 5.8
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kriesi Enfold allows Reflected XSS. This issue affects Enfold: from n/a through 8.0.
- Product
- Enfold
- Affected
- up to 8.0
- What to do
- Affects up to 8.0. Update Enfold to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 29, 2026Catfolders Document Gallery Pro: Does not authorise some of its REST API routesCVE-2026-19430 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Catfolders Document Gallery Pro WordPress plugin before 2.0.7 does not authorise some of its REST API routes, and the token identifying the requested content is forgeable client side, allowing unauthenticated users to list and download the contents of folders that were never published on the site.
- Product
- Catfolders Document Gallery Pro
- Fixed in
- 2.0.7
- What to do
- Update Catfolders Document Gallery Pro to 2.0.7 or newer.
Aug 16, 2026CatFolders Document Gallery & PDF Library: Does not have authorisation checks in some of its REST API endpointsCVE-2026-19717 · WordPress plugins & themes · reported by WPScanHigh 7.5
The CatFolders Document Gallery & PDF Library WordPress plugin before 2.0.7 does not have authorisation checks in some of its REST API endpoints, allowing unauthenticated users to retrieve the title, type, size and URL of the media attachments assigned to any of its folders, including folders which are not published in any gallery on the site.
- Product
- CatFolders Document Gallery & PDF Library
- Fixed in
- 2.0.7
- What to do
- Update CatFolders Document Gallery & PDF Library to 2.0.7 or newer.
Aug 16, 2026Divi: Does not properly escape some of its Social Media Follow module settings before outputting them in link attributesCVE-2026-13712 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Divi WordPress theme before 5.9.0 does not properly escape some of its Social Media Follow module settings before outputting them in link attributes, allowing users with a role as low as contributor to store JavaScript which will run when a higher privileged user, such as an administrator, views the post.
- Product
- Divi
- Fixed in
- 5.9.0
- What to do
- Update Divi to 5.9.0 or newer.
Jul 29, 2026wp-media-folder-addon: Does not validate a user-supplied parameter before using it in a file read operation in two AJAX actions available to unauthenticated usersCVE-2026-11974 · WordPress plugins & themes · reported by WPScanHigh 8.6
The wp-media-folder-addon WordPress plugin before 4.1.7 does not validate a user-supplied parameter before using it in a file read operation in two AJAX actions available to unauthenticated users, leading to Arbitrary File Disclosure and Server-Side Request Forgery on sites where a cloud storage connection has been configured. This is an incomplete fix of CVE-2026-9690, whose patch hardened only one of the affected cloud-storage handlers and left the others unpatched.
- Product
- wp-media-folder-addon
- Fixed in
- 4.1.7
- What to do
- Update wp-media-folder-addon to 4.1.7 or newer.
Jul 23, 2026GoDAM – Organize WordPress Media Library & File Manager with Unlimited Folders for Images, Videos & more: Arbitrary file uploadsCVE-2026-14282 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The GoDAM – Organize WordPress Media Library & File Manager with Unlimited Folders for Images, Videos & more plugin for WordPress is vulnerable to arbitrary file uploads in versions up to, and including, 1.12.2. This is due to insufficient file type validation in the save_video_file() function hooked into WPForms' public wpforms_process_before_filter, which trusts the attacker-supplied multipart Content-Type header, preserves the original filename via wp_unique_filename(), and moves the raw upload with $wp_filesystem->move() into a web-served directory — bypassing wp_handle_upload()'s MIME/extension allowlist. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
- Product
- GoDAM – Organize WordPress Media Library & File Manager with Unlimited Folders for Images, Videos & more
- Affected
- up to 1.12.2
- What to do
- Affects up to 1.12.2. Update GoDAM – Organize WordPress Media Library & File Manager with Unlimited Folders for Images, Videos & more to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 13, 2026WPZOOM Portfolio: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-57712 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPZOOM WPZOOM Portfolio wpzoom-portfolio allows Reflected XSS.This issue affects WPZOOM Portfolio: from n/a through <= 1.4.29.
- Product
- WPZOOM Portfolio
- Affected
- up to 1.4.29
- What to do
- Affects up to 1.4.29. Update WPZOOM Portfolio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated Arbitrary File Download in WP Media folder Addon <= 4.0.1 versions.CVE-2026-9690 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Arbitrary File Download in WP Media folder Addon <= 4.0.1 versions.
- Affected
- up to 4.0.1
- What to do
- Affects up to 4.0.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated Cross Site Scripting (XSS) in Enfold <= 7.1.4 versions.CVE-2026-48869 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Enfold <= 7.1.4 versions.
- Affected
- up to 7.1.4
- What to do
- Affects up to 7.1.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Themify Folo: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31013 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themify Folo allows Reflected XSS. This issue affects Themify Folo: from n/a through 1.9.6.
- Product
- Themify Folo
- Affected
- up to 1.9.6
- What to do
- Affects up to 1.9.6. Update Themify Folo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026callback.php that: WordPress Brandfolder plugin version 3.0 and earlier contains a local file inclusionCVE-2016-20080 · WordPress plugins & themes · reported by VulnCheckMedium 6.9
WordPress Brandfolder plugin version 3.0 and earlier contains a local file inclusion vulnerability in callback.php that allows unauthenticated attackers to include arbitrary files by manipulating the wp_abspath parameter. Attackers can supply path traversal sequences or remote URLs through the wp_abspath parameter to read sensitive files like wp-config.php or execute remote code.
- Product
- callback.php that
- Affected
- up to 3.0
- What to do
- Affects up to 3.0. Update callback.php that to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordbrandfolder.comwordpress.org
Jun 10, 2026WPZOOM Portfolio: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-49069 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPZOOM Portfolio allows Reflected XSS. This issue affects WPZOOM Portfolio: from n/a through 1.4.21.
- Product
- WPZOOM Portfolio
- Affected
- up to 1.4.21
- What to do
- Affects up to 1.4.21. Update WPZOOM Portfolio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 2, 2026Remove NoFollow Commenter URL: Cross-Site Request ForgeryCVE-2026-9730 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Remove NoFollow Commenter URL plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing or incorrect nonce validation on the gmz_comment_settings_save function. This makes it possible for unauthenticated attackers to modify the plugin's comment-display setting via a forged request via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Remove NoFollow Commenter URL
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Remove NoFollow Commenter URL to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
May 10, 2026Filterable Portfolio Gallery 1.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious JavaScript by enteCVE-2021-47929 · WordPress plugins & themes · reported by VulnCheckMedium 5.1
Filterable Portfolio Gallery 1.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious JavaScript by entering payloads in the title field. Attackers can store JavaScript code like image tags with onerror handlers that execute when the gallery is previewed, affecting all users viewing the page.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordfilterable-portfolio.comwordpress.org
Apr 8, 2026Grand Portfolio: Cross-Site Request Forgery (CSRF)CVE-2026-39634 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in ThemeGoods Grand Portfolio grandportfolio allows Cross Site Request Forgery.This issue affects Grand Portfolio: from n/a through <= 3.3.
- Product
- Grand Portfolio
- Affected
- up to 3.3
- What to do
- Affects up to 3.3. Update Grand Portfolio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 25, 2026Visual Portfolio, Photo Gallery & Post Grid: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-32537 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in nK Visual Portfolio, Photo Gallery & Post Grid visual-portfolio allows PHP Local File Inclusion.This issue affects Visual Portfolio, Photo Gallery & Post Grid: from n/a through <= 3.5.1.
- Product
- Visual Portfolio, Photo Gallery & Post Grid
- Affected
- up to 3.5.1
- What to do
- Affects up to 3.5.1. Update Visual Portfolio, Photo Gallery & Post Grid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 19, 2026ColorFolio - Freelance Designer: Deserialization of Untrusted DataCVE-2026-27096 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Deserialization of Untrusted Data vulnerability in BuddhaThemes ColorFolio - Freelance Designer WordPress Theme allows Object Injection.This issue affects ColorFolio - Freelance Designer WordPress Theme: from n/a through 1.3.
- Product
- ColorFolio - Freelance Designer
- Affected
- up to 1.3
- What to do
- Affects up to 1.3. Update ColorFolio - Freelance Designer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 16, 2026Wicked Folders – Folder Organizer for Pages, Posts, and Custom Post Types: Insecure Direct Object ReferenceCVE-2026-1883 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Wicked Folders – Folder Organizer for Pages, Posts, and Custom Post Types plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.1.0 via the delete_folders() function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Contributor-level access and above, to delete arbitrary folders created by other users.
- Product
- Wicked Folders – Folder Organizer for Pages, Posts, and Custom Post Types
- Affected
- up to 4.1.0
- What to do
- Affects up to 4.1.0. Update Wicked Folders – Folder Organizer for Pages, Posts, and Custom Post Types to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Mar 13, 2026VW Portfolio: Missing AuthorizationCVE-2026-32437 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in vowelweb VW Portfolio vw-portfolio allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VW Portfolio: from n/a through <= 1.3.3.
- Product
- VW Portfolio
- Affected
- up to 1.3.3
- What to do
- Affects up to 1.3.3. Update VW Portfolio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026Perfect Portfolio: Missing AuthorizationCVE-2026-32345 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in raratheme Perfect Portfolio perfect-portfolio allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Perfect Portfolio: from n/a through <= 1.2.4.
- Product
- Perfect Portfolio
- Affected
- up to 1.2.4
- What to do
- Affects up to 1.2.4. Update Perfect Portfolio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026the getFollowsPage() function that: WpDiscuz before 7.6.47 contains a cross-site request forgeryCVE-2026-22215 · WordPress plugins & themes · reported by VulnCheckMedium 5.3
wpDiscuz before 7.6.47 contains a cross-site request forgery vulnerability in the getFollowsPage() function that allows attackers to trigger unauthorized actions without nonce validation. Attackers can craft malicious requests to enumerate follow relationships and manipulate user follow data by exploiting the missing CSRF protection in the follows page handler.
- Product
- the getFollowsPage() function that
- Fixed in
- 7.6.47
- What to do
- Update the getFollowsPage() function that to 7.6.47 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Mar 5, 2026DesignThemes Portfolio: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-27385 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in designthemes DesignThemes Portfolio designthemes-portfolio allows Reflected XSS.This issue affects DesignThemes Portfolio: from n/a through <= 1.3.
- Product
- DesignThemes Portfolio
- Affected
- up to 1.3
- What to do
- Affects up to 1.3. Update DesignThemes Portfolio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026Portfolio Builder: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-69375 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in SolverWp Portfolio Builder swp-portfolio allows PHP Local File Inclusion.This issue affects Portfolio Builder: from n/a through <= 1.2.5.
- Product
- Portfolio Builder
- Affected
- up to 1.2.5
- What to do
- Affects up to 1.2.5. Update Portfolio Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 14, 2026Media Library Folders: Insecure Direct Object ReferenceCVE-2026-2312 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Media Library Folders plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 8.3.6 via the delete_maxgalleria_media() and maxgalleria_rename_image() functions due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Author-level access and above, to delete or rename attachments owned by other users (including administrators). The rename flow also deletes all postmeta for the target attachment, causing data loss.
- Product
- Media Library Folders
- Affected
- up to 8.3.6
- What to do
- Affects up to 8.3.6. Update Media Library Folders to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jan 28, 2026Simple Folio: Stored Cross-Site ScriptingCVE-2025-14039 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Simple Folio plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '_simple_folio_item_client_name' and '_simple_folio_item_link' meta fields in all versions up to, and including, 1.1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Simple Folio
- Affected
- up to 1.1.1
- What to do
- Affects up to 1.1.1. Update Simple Folio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 22, 2026Ultra Portfolio: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-69180 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in themepassion Ultra Portfolio ultra-portfolio allows Blind SQL Injection.This issue affects Ultra Portfolio: from n/a through <= 6.7.
- Product
- Ultra Portfolio
- Affected
- up to 6.7
- What to do
- Affects up to 6.7. Update Ultra Portfolio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Enfold: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68900 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kriesi Enfold allows DOM-Based XSS. This issue affects Enfold: from n/a through 7.1.3.
- Product
- Enfold
- Affected
- up to 7.1.3
- What to do
- Affects up to 7.1.3. Update Enfold to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2026Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager: Unauthorized Arbitrary Media ReplacementCVE-2025-12640 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager plugin for WordPress is vulnerable to Unauthorized Arbitrary Media Replacement in all versions up to, and including, 3.1.5. This is due to missing object-level authorization checks in the handle_folders_file_upload() function. This makes it possible for authenticated attackers, with Author-level access and above, to replace arbitrary media files from the WordPress Media Library.
- Product
- Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager
- Affected
- up to 3.1.5
- What to do
- Affects up to 3.1.5. Update Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jan 5, 2026Follow My Blog Post: Missing AuthorizationCVE-2025-68547 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in wpweb Follow My Blog Post follow-my-blog-post allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Follow My Blog Post: from n/a through <= 2.4.0.
- Product
- Follow My Blog Post
- Affected
- up to 2.4.0
- What to do
- Affects up to 2.4.0. Update Follow My Blog Post to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2025Mediabay - WordPress Media Library Folders: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-28949 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Codedraft Mediabay - WordPress Media Library Folders allows Blind SQL Injection.This issue affects Mediabay - WordPress Media Library Folders: from n/a through 1.4.
- Product
- Mediabay - WordPress Media Library Folders
- Affected
- up to 1.4
- What to do
- Affects up to 1.4. Update Mediabay - WordPress Media Library Folders to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2025Behance Portfolio Manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-59135 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in eleopard Behance Portfolio Manager portfolio-manager-powered-by-behance allows Stored XSS.This issue affects Behance Portfolio Manager: from n/a through <= 1.7.5.
- Product
- Behance Portfolio Manager
- Affected
- up to 1.7.5
- What to do
- Affects up to 1.7.5. Update Behance Portfolio Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2025GS Portfolio for Envato: Missing AuthorizationCVE-2025-62755 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in GS Plugins GS Portfolio for Envato gs-envato-portfolio allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GS Portfolio for Envato: from n/a through <= 1.4.2.
- Product
- GS Portfolio for Envato
- Affected
- up to 1.4.2
- What to do
- Affects up to 1.4.2. Update GS Portfolio for Envato to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2025Portfolio Gallery: Missing AuthorizationCVE-2025-62098 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in totalsoft Portfolio Gallery gallery-portfolio allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Portfolio Gallery: from n/a through <= 1.4.8.
- Product
- Portfolio Gallery
- Affected
- up to 1.4.8
- What to do
- Affects up to 1.4.8. Update Portfolio Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2025Behance Portfolio Manager: Cross-Site Request Forgery (CSRF)CVE-2025-59137 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in eleopard Behance Portfolio Manager portfolio-manager-powered-by-behance allows Stored XSS.This issue affects Behance Portfolio Manager: from n/a through <= 1.7.5.
- Product
- Behance Portfolio Manager
- Affected
- up to 1.7.5
- What to do
- Affects up to 1.7.5. Update Behance Portfolio Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 30, 2025HomeFix Elementor Portfolio: Missing AuthorizationCVE-2025-68981 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in designthemes HomeFix Elementor Portfolio homefix-ele-portfolio allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HomeFix Elementor Portfolio: from n/a through <= 1.0.1.
- Product
- HomeFix Elementor Portfolio
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update HomeFix Elementor Portfolio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 30, 2025WeDesignTech Portfolio: Missing AuthorizationCVE-2025-68980 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in designthemes WeDesignTech Portfolio wedesigntech-portfolio allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WeDesignTech Portfolio: from n/a through <= 1.0.2.
- Product
- WeDesignTech Portfolio
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update WeDesignTech Portfolio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.