Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
10 results
Oct 7, 2026MetForm: Does not sanitize or escape submitted form-field values before inserting them into the HTML body of its email notificationsCVE-2026-86833 · WordPress plugins & themes · reported by WPScanMedium 5.4
The MetForm WordPress plugin before 4.3.1 does not sanitize or escape submitted form-field values before inserting them into the HTML body of its email notifications, allowing unauthenticated attackers to inject arbitrary markup into the administrator and submitter notification emails the site sends.
- Product
- MetForm
- Fixed in
- 4.3.1
- What to do
- Update MetForm to 4.3.1 or newer.
Mar 11, 2026LearnPress – WordPress LMS: Unauthorized email notification triggeringCVE-2026-3226 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to unauthorized email notification triggering due to missing capability checks on all 10 functions in the SendEmailAjax class in all versions up to, and including, 4.3.2.8. The AbstractAjax::catch_lp_ajax() dispatcher verifies a wp_rest nonce but performs no current_user_can() check before dispatching to handler functions. The wp_rest nonce is embedded in the frontend JavaScript for all authenticated users. This makes it possible for authenticated attackers, with Subscriber-level access and above, to trigger arbitrary email notifications to admins, instructors, and users, enabling email flooding, social engineering, and impersonation of admin decisions regarding instructor requests.
- Product
- LearnPress – WordPress LMS
- Affected
- up to 4.3.2.8
- What to do
- Affects up to 4.3.2.8. Update LearnPress – WordPress LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
May 7, 2025Email Notification on Login: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-47622 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in apasionados Email Notification on Login email-notification-on-login allows Stored XSS.This issue affects Email Notification on Login: from n/a through <= 1.7.0.
- Product
- Email Notification on Login
- Affected
- up to 1.7.0
- What to do
- Affects up to 1.7.0. Update Email Notification on Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 15, 2025Email Notifications for Updates: Missing AuthorizationCVE-2025-26741 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Missing Authorization vulnerability in AWEOS GmbH Email Notifications for Updates wp-update-mail-notification allows Privilege Escalation.This issue affects Email Notifications for Updates: from n/a through <= 1.1.6.
- Product
- Email Notifications for Updates
- Affected
- up to 1.1.6
- What to do
- Affects up to 1.1.6. Update Email Notifications for Updates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 4, 2025Email Notifications for Updates: Unauthorized modification of data that can lead to privilege escalationCVE-2025-2933 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Email Notifications for Updates plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the awun_import_settings() function in all versions up to, and including, 1.1.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site. CVE-2025-26741 is likely a duplicate of this issue.
- Product
- Email Notifications for Updates
- Affected
- up to 1.1.6
- What to do
- Affects up to 1.1.6. Update Email Notifications for Updates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Mar 27, 2025publish post email notification: Cross-Site Request Forgery (CSRF)CVE-2025-30816 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Nks publish post email notification publish-post-email-notification allows Cross Site Request Forgery.This issue affects publish post email notification: from n/a through <= 1.0.2.3.
- Product
- publish post email notification
- Affected
- up to 1.0.2.3
- What to do
- Affects up to 1.0.2.3. Update publish post email notification to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 6, 2024Drag & Drop Builder, Human Face Detector, Pre-built Templates, Spam Protection, User Email Notifications & more!: Reflected Cross-Site ScriptingCVE-2024-11436 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Drag & Drop Builder, Human Face Detector, Pre-built Templates, Spam Protection, User Email Notifications & more! plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and including, 1.4.19 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- Drag & Drop Builder, Human Face Detector, Pre-built Templates, Spam Protection, User Email Notifications & more!
- Affected
- up to 1.4.19
- What to do
- Affects up to 1.4.19. Update Drag & Drop Builder, Human Face Detector, Pre-built Templates, Spam Protection, User Email Notifications & more! to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Mar 31, 2024Ultimate Social Comments – Email Notification & Lazy Load: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-30555 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sayan Datta Ultimate Social Comments – Email Notification & Lazy Load allows Stored XSS.This issue affects Ultimate Social Comments – Email Notification & Lazy Load: from n/a through 1.4.8.
- Product
- Ultimate Social Comments – Email Notification & Lazy Load
- Affected
- up to 1.4.8
- What to do
- Affects up to 1.4.8. Update Ultimate Social Comments – Email Notification & Lazy Load to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jul 11, 2023Cross-Site Request Forgery (CSRF) vulnerability in Prem Tiwari Disable WordPress Update Notifications and auto-update Email Notifications plugin <= 2.3.3 versioCVE-2023-34029 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Prem Tiwari Disable WordPress Update Notifications and auto-update Email Notifications plugin <= 2.3.3 versions.
- Affected
- up to 2.3.3
- What to do
- Affects up to 2.3.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jun 8, 2022Drag & Drop Builder, Human Face Detector, Pre-built Templates, Spam Protection, User Email Notifications & more!: Does not sanitise and escape some of its form fieldsCVE-2022-1569 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Drag & Drop Builder, Human Face Detector, Pre-built Templates, Spam Protection, User Email Notifications & more! WordPress plugin before 1.4.9.4 does not sanitise and escape some of its form fields, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks when unfiltered_html is disallowed
- Product
- Drag & Drop Builder, Human Face Detector, Pre-built Templates, Spam Protection, User Email Notifications & more!
- Fixed in
- 1.4.9.4
- What to do
- Update Drag & Drop Builder, Human Face Detector, Pre-built Templates, Spam Protection, User Email Notifications & more! to 1.4.9.4 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.