Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
128 results · page 1 of 3
Oct 23, 2026The Profile Builder WordPress plugin from 4.0.0 to 4.0.4 does not enforce its reCAPTCHA verification on all comment submission paths, allowing authenticated useCVE-2026-111965 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Profile Builder WordPress plugin from 4.0.0 to 4.0.4 does not enforce its reCAPTCHA verification on all comment submission paths, allowing authenticated users to bypass the anti-spam protection an administrator configured for the WordPress comment form.
- What to do
- Update the plugin to the newest version.
Oct 23, 2026Otter Blocks: Does not enforce its block visibility conditionsCVE-2026-109935 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Otter Blocks WordPress plugin before 3.2.8 does not enforce its block visibility conditions when a published post is rendered through the WordPress REST API, allowing unauthenticated users to read block content that the site owner restricted to specific roles, logged-in users, the post author, categories or tags, or (on the Pro tier) Stripe purchasers.
- Product
- Otter Blocks
- Fixed in
- 3.2.8
- What to do
- Update Otter Blocks to 3.2.8 or newer.
Oct 21, 2026Contest Gallery: Does not reliably validate the visitor identity used to enforce its one-vote-per-entry restrictionCVE-2026-107447 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Contest Gallery WordPress plugin before 34.0.1 does not reliably validate the visitor identity used to enforce its one-vote-per-entry restriction, trusting a client-supplied request header and an unbound client-generated token, which allows unauthenticated users to bypass the restriction and cast multiple votes for the same contest entry, inflating its vote total.
- Product
- Contest Gallery
- Fixed in
- 34.0.1
- What to do
- Update Contest Gallery to 34.0.1 or newer.
Oct 21, 2026TI WooCommerce Wishlist: Does not enforce the same owner-only access control on its REST API that it applies on the front-endCVE-2026-15261 · WordPress plugins & themes · reported by WPScanMedium 5.3
The TI WooCommerce Wishlist WordPress plugin before 2.13.0 does not enforce the same owner-only access control on its REST API that it applies on the front-end, allowing unauthenticated users to read the metadata and item contents of private wishlists.
- Product
- TI WooCommerce Wishlist
- Fixed in
- 2.13.0
- What to do
- Update TI WooCommerce Wishlist to 2.13.0 or newer.
Oct 21, 2026WP User Manager: Does not keep its paid-registration capability restrictions in force once the payment gateway is disconnectedCVE-2026-110523 · WordPress plugins & themes · reported by WPScanHigh 8.1
The WP User Manager WordPress plugin before 2.9.26 does not keep its paid-registration capability restrictions in force once the payment gateway is disconnected, while a published paid registration form continues to assign its configured role, allowing unauthenticated users to register and immediately obtain a privileged administrator-equivalent role without completing the payment meant to gate it.
- Product
- WP User Manager
- Fixed in
- 2.9.26
- What to do
- Update WP User Manager to 2.9.26 or newer.
Oct 19, 2026Salon Booking System: Does not enforce a minimum of zeroCVE-2026-110034 · WordPress plugins & themes · reported by WPScanLow 3.7
The Salon Booking System WordPress plugin before 10.31.11 does not enforce a minimum of zero when subtracting a fixed-amount discount from a booking's total, allowing an unauthenticated visitor who knows a valid discount code to create a confirmed booking stored with a negative total.
- Product
- Salon Booking System
- Fixed in
- 10.31.11
- What to do
- Update Salon Booking System to 10.31.11 or newer.
Oct 14, 2026Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories: Does not enforce a safe HTML-element allowlist on a shortcode attribute and does not neutralise attacker-controlCVE-2026-105261 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories WordPress plugin before 4.10.6 does not enforce a safe HTML-element allowlist on a shortcode attribute and does not neutralise attacker-controlled text placed inside the resulting element, allowing users with the Contributor role and above to store JavaScript that executes in the session of any higher-privileged user who views the content.
- Product
- Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories
- Fixed in
- 4.10.6
- What to do
- Update Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories to 4.10.6 or newer.
Oct 11, 2026Disable Users: Does not enforce its account-disabling control on all authentication pathsCVE-2026-88827 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Disable Users WordPress plugin through 1.0.5 does not enforce its account-disabling control on all authentication paths, allowing the holder of an account an administrator has disabled to continue authenticating with the account's full privileges.
- Product
- Disable Users
- Affected
- up to 1.0.5
- What to do
- Affects up to 1.0.5. Update Disable Users to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 11, 2026AI Content Generator Marketing: Does not enforce a nonce or capability check on some of its AJAX actionsCVE-2026-85118 · WordPress plugins & themes · reported by WPScanCritical 9.8
The AI Content Generator Marketing WordPress plugin through 1.0.0 does not enforce a nonce or capability check on some of its AJAX actions, allowing unauthenticated users to update and delete arbitrary WordPress options, which can be used to gain administrator access to the site.
- Product
- AI Content Generator Marketing
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update AI Content Generator Marketing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 11, 2026Squadeno: Does not enforce its restrictions on every way a sport can be savedCVE-2026-107507 · WordPress plugins & themes · reported by WPScanLow 2.7
The Squadeno WordPress plugin before 1.12.0 does not enforce its restrictions on every way a sport can be saved, allowing users with the lowest-tier Trainer role to change the section, age group, author, password, comment settings and date of a sport they are assigned to.
- Product
- Squadeno
- Fixed in
- 1.12.0
- What to do
- Update Squadeno to 1.12.0 or newer.
Oct 9, 2026Restrict User Access – Membership Plugin with Force: Missing AuthorizationCVE-2026-62040 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in DEV Institute Restrict User Access – Membership Plugin with Force restrict-user-access allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Restrict User Access – Membership Plugin with Force: from n/a through 2.8.1.
- Product
- Restrict User Access – Membership Plugin with Force
- Affected
- up to 2.8.1
- What to do
- Affects up to 2.8.1. Update Restrict User Access – Membership Plugin with Force to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 8, 2026Appointment Booking: Does not enforce per-record authorization on several of its AI Abilities API actionsCVE-2026-105196 · WordPress plugins & themes · reported by WPScanLow 3.3
The Appointment Booking Plugin WordPress plugin before 5.6.9 does not enforce per-record authorization on several of its AI Abilities API actions, allowing an authenticated user holding the LatePoint Agent role, normally restricted to their own records, to read and modify other agents' profile data and read other agents' bookings and associated customer details when the Abilities API feature is enabled.
- Product
- Appointment Booking
- Fixed in
- 5.6.9
- What to do
- Update Appointment Booking to 5.6.9 or newer.
Oct 2, 2026WP Edit Password Protected: Does not enforce its site-wide access restriction on the WordPress REST APICVE-2026-90952 · WordPress plugins & themes · reported by WPScanMedium 5.3
The WP Edit Password Protected WordPress plugin before 2.0.7 does not enforce its site-wide access restriction on the WordPress REST API, allowing unauthenticated users to read the content of published posts and pages that the site's access mode was configured to hide.
- Product
- WP Edit Password Protected
- Fixed in
- 2.0.7
- What to do
- Update WP Edit Password Protected to 2.0.7 or newer.
Oct 2, 2026WP User Frontend: Does not enforce its subscription-purchase requirement in one of its post-creation handlersCVE-2026-79618 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WP User Frontend WordPress plugin before 4.3.12 does not enforce its subscription-purchase requirement in one of its post-creation handlers, allowing authenticated users with subscriber-level access and above to create and, depending on the form's configuration, immediately publish posts through forms restricted to paying subscribers.
- Product
- WP User Frontend
- Fixed in
- 4.3.12
- What to do
- Update WP User Frontend to 4.3.12 or newer.
Oct 1, 2026Featured Image from URL (FIFU) WordPress plugin before 6.0.8, Featured Image from URL (FIFU) Premium: Do not correctly enforce the REST API nonceCVE-2026-101147 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Featured Image from URL (FIFU) WordPress plugin before 6.0.8, Featured Image from URL (FIFU) Premium WordPress plugin before 8.2.8 do not correctly enforce the REST API nonce, disabling the check for the whole request when a crafted URL is used, which could allow attackers to make a logged-in administrator perform any REST API action, such as creating a new administrator account, via a CSRF attack.
- Product
- Featured Image from URL (FIFU) WordPress plugin before 6.0.8, Featured Image from URL (FIFU) Premium
- Fixed in
- 6.0.8
- What to do
- Update Featured Image from URL (FIFU) WordPress plugin before 6.0.8, Featured Image from URL (FIFU) Premium to 6.0.8 or newer.
Sep 30, 2026Image Optimizer: Does not enforce its intended capability check on several of its read REST routesCVE-2026-90953 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Image Optimizer WordPress plugin before 1.7.7 does not enforce its intended capability check on several of its read REST routes, allowing any authenticated user to read attachment metadata and site-wide statistics that should be restricted to administrators.
- Product
- Image Optimizer
- Fixed in
- 1.7.7
- What to do
- Update Image Optimizer to 1.7.7 or newer.
Sep 28, 2026The Blacklist Manager for WooCommerce WordPress plugin from 1.3.0 to 2.3.1 does not enforce its user blocking on every authentication path, allowing the holder CVE-2026-88828 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Blacklist Manager for WooCommerce WordPress plugin from 1.3.0 to 2.3.1 does not enforce its user blocking on every authentication path, allowing the holder of an account the site owner has blocked to keep authenticating with that account's privileges, without the block being enforced or recorded.
- What to do
- Update the plugin to the newest version.
Sep 24, 2026Events Manager: Does not force the scope of its logged-in event and location searchCVE-2026-93662 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Events Manager WordPress plugin before 7.4.5 does not force the scope of its logged-in event and location search when a caller supplies their own owner value, letting a low-privileged user read other accounts' unpublished, pending or trashed event and venue content, including full street addresses.
- Product
- Events Manager
- Fixed in
- 7.4.5
- What to do
- Update Events Manager to 7.4.5 or newer.
Sep 23, 2026Easy Hide Login: Does not fully enforce its hidden-login protectionCVE-2026-84168 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Easy Hide Login WordPress plugin before 1.7 does not fully enforce its hidden-login protection, allowing an unauthenticated attacker to reach the standard login page through certain password-reset request parameters and to recover the site's configured secret login slug from the returned page, defeating the Easy Hide Login WordPress plugin before 1.7's core protection.
- Product
- Easy Hide Login
- Fixed in
- 1.7
- What to do
- Update Easy Hide Login to 1.7 or newer.
Sep 20, 2026Import and export users and customers: Does not enforce the promote_users capability in its front-end import functionalityCVE-2026-92541 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Import and export users and customers WordPress plugin before 2.5.2 does not enforce the promote_users capability in its front-end import functionality, allowing users with only the create_users capability to change the role of existing users, including promoting them to administrator.
- Product
- Import and export users and customers
- Fixed in
- 2.5.2
- What to do
- Update Import and export users and customers to 2.5.2 or newer.
Sep 20, 2026Import and export users and customers: Does not correctly enforce the promote_users capabilityCVE-2026-92540 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Import and export users and customers WordPress plugin before 2.5.2 does not correctly enforce the promote_users capability when assigning roles during a CSV import, allowing users with only the create_users capability to create new administrator accounts or promote existing users to administrator.
- Product
- Import and export users and customers
- Fixed in
- 2.5.2
- What to do
- Update Import and export users and customers to 2.5.2 or newer.
Sep 20, 2026Forminator Forms: Does not apply the role validation it enforces elsewhereCVE-2026-87068 · WordPress plugins & themes · reported by WPScanMedium 6.6
The Forminator Forms WordPress plugin before 1.57.2.1 does not apply the role validation it enforces elsewhere when a registration form is nested inside an imported quiz, allowing a user who may import quizzes to publish a live, publicly reachable form that grants any role, including administrator, to anyone who submits it. The same user is refused an identical form through both the ordinary form editor and the ordinary form import.
- Product
- Forminator Forms
- Fixed in
- 1.57.2.1
- What to do
- Update Forminator Forms to 1.57.2.1 or newer.
Sep 17, 2026Autopay: Does not enforce the signature on one of its payment callbacksCVE-2026-90923 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Autopay WordPress plugin before 5.0.1 does not enforce the signature on one of its payment callbacks, allowing unauthenticated users to disclose and delete the stored payment parameters of other customers' orders.
- Product
- Autopay
- Fixed in
- 5.0.1
- What to do
- Update Autopay to 5.0.1 or newer.
Sep 2, 2026User Frontend: Does not enforce its subscription-purchase requirementCVE-2026-17563 · WordPress plugins & themes · reported by WPScanMedium 5.3
The User Frontend WordPress plugin before 4.3.11 does not enforce its subscription-purchase requirement when processing frontend post submissions, only when rendering the form, allowing unauthenticated users to create and, depending on the form's configuration, immediately publish posts through forms restricted to paying subscribers.
- Product
- User Frontend
- Fixed in
- 4.3.11
- What to do
- Update User Frontend to 4.3.11 or newer.
Sep 2, 2026Timetics: Does not enforce per-object ownershipCVE-2026-14326 · WordPress plugins & themes · reported by WPScanLow 3.8
The Timetics WordPress plugin through 1.0.61 does not enforce per-object ownership when updating appointments through its REST API, allowing users with its custom staff role to modify, disable, or take over appointments belonging to other staff members.
- Product
- Timetics
- Affected
- up to 1.0.61
- What to do
- Affects up to 1.0.61. Update Timetics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 2, 2026My Login: Does not enforce the network's registration settingCVE-2026-81583 · WordPress plugins & themes · reported by WPScanMedium 5.4
The My Login WordPress plugin before 7.2.0 does not enforce the network's registration setting when processing site signups on multisite installations, allowing users with a subscriber account, and unauthenticated users on some networks, to create new sites and be granted administrator over them.
- Product
- My Login
- Fixed in
- 7.2.0
- What to do
- Update My Login to 7.2.0 or newer.
Aug 29, 2026HEL Online Classroom: AI-powered Online Classrooms: Does not perform authorisation checks on its REST API routes and does not consistently enforce the per-class access codeCVE-2026-77010 · WordPress plugins & themes · reported by WPScanMedium 6.5
The HEL Online Classroom: AI-powered Online Classrooms WordPress plugin through 1.0.3 does not perform authorisation checks on its REST API routes and does not consistently enforce the per-class access code, allowing unauthenticated users to obtain a signed meeting join link for any classroom, including one protected by an access code, and to join it with moderator privileges.
- Product
- HEL Online Classroom: AI-powered Online Classrooms
- Affected
- up to 1.0.3
- What to do
- Affects up to 1.0.3. Update HEL Online Classroom: AI-powered Online Classrooms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 27, 2026CMP: Does not enforce an option-name allow-listCVE-2026-13415 · WordPress plugins & themes · reported by WPScanHigh 7.2
The CMP WordPress plugin before 4.1.18 does not enforce an option-name allow-list when importing settings via one of its AJAX actions, allowing users with the Editor role (when the administrator has granted the Editor role access to the CMP WordPress plugin before 4.1.18's admin-bar controls) to update arbitrary WordPress options, including options that lead to privilege escalation to Administrator.
- Product
- CMP
- Fixed in
- 4.1.18
- What to do
- Update CMP to 4.1.18 or newer.
Aug 22, 2026Forminator Forms: Does not consistently enforce the role restriction it applies to registration formsCVE-2026-19222 · WordPress plugins & themes · reported by WPScanMedium 6.6
The Forminator Forms WordPress plugin before 1.57.0.7 does not consistently enforce the role restriction it applies to registration forms, allowing users who are permitted to build forms to configure one that assigns the administrator role to any visitor who registers through it.
- Product
- Forminator Forms
- Fixed in
- 1.57.0.7
- What to do
- Update Forminator Forms to 1.57.0.7 or newer.
Aug 22, 2026Tutor LMS: Does not enforce per-object ownership checks on its course content typeCVE-2026-14187 · WordPress plugins & themes · reported by WPScanLow 2.7
The Tutor LMS WordPress plugin before 4.0.6 does not enforce per-object ownership checks on its course content type, allowing any user with the instructor role to read the content of private courses belonging to other instructors.
- Product
- Tutor LMS
- Fixed in
- 4.0.6
- What to do
- Update Tutor LMS to 4.0.6 or newer.
Aug 21, 2026NewPath WildApricotPress Add-on: Does not enforce its members-only field privacy on an unauthenticated REST routeCVE-2026-13736 · WordPress plugins & themes · reported by WPScanMedium 5.3
The NewPath WildApricotPress Add-on WordPress plugin through 1.0.0 does not enforce its members-only field privacy on an unauthenticated REST route, allowing anonymous visitors to read member email addresses and phone numbers that are configured to be visible to members only.
- Product
- NewPath WildApricotPress Add-on
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update NewPath WildApricotPress Add-on to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 14, 2026Object Sync for Salesforce: Unauthenticated SQL InjectionCVE-2026-15162 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Object Sync for Salesforce plugin is vulnerable to unauthenticated SQL Injection via the wordpress_object_type parameter of its /wp-json/object-sync-for-salesforce/push/ REST route. The route's permission callback (can_process()) checks only the HTTP method for the push class — no capability or nonce — so it is reachable by unauthenticated users. The wordpress_object_type value is concatenated directly into a SQL query (post_type = "$object_type", class-object-sync-sf-wordpress.php:328) and executed via $wpdb->get_results() with no $wpdb->prepare() (:578). Because REST body parameters are not magic-quoted, an attacker can break out of the quoted string and inject arbitrary SQL. This makes it possible for unauthenticated attackers to append additional SQL queries (time-based blind), enabling extraction of sensitive information such as password hashes from the database. Only a valid wordpress_id (e.g. 1) is required — no authentication or Salesforce connection.
- Product
- Object Sync for Salesforce
- What to do
- Update Object Sync for Salesforce to the newest version.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 12, 2026Payment Button for PayPal: Does not enforce the merchant-configured price server-side and trusts a client-supplied payment amountCVE-2026-16990 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Payment Button for PayPal WordPress plugin through 1.2.3.44 does not enforce the merchant-configured price server-side and trusts a client-supplied payment amount, allowing unauthenticated attackers to create a real PayPal order against the merchant for an arbitrary lower amount.
- Product
- Payment Button for PayPal
- Affected
- up to 1.2.3.44
- What to do
- Affects up to 1.2.3.44. Update Payment Button for PayPal to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 12, 2026Cookie Consent: Does not correctly enforce its intended administrator-only capability check on the REST route that stores its geolocation service license keyCVE-2026-18046 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Cookie Consent WordPress plugin before 0.0.10 does not correctly enforce its intended administrator-only capability check on the REST route that stores its geolocation service license key, so the route falls back to an authentication-only gate, allowing any authenticated user such as a subscriber to overwrite the stored key and disrupt the Cookie Consent WordPress plugin before 0.0.10's geolocation-based consent banner targeting.
- Product
- Cookie Consent
- Fixed in
- 0.0.10
- What to do
- Update Cookie Consent to 0.0.10 or newer.
Aug 12, 2026Cookie Consent: Does not correctly enforce its intended administrator-only capability check on its consent-settings REST routesCVE-2026-15388 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Cookie Consent WordPress plugin before 0.0.10 does not correctly enforce its intended administrator-only capability check on its consent-settings REST routes, so they fall back to an authentication-only gate, allowing any authenticated user such as a subscriber to update the Cookie Consent WordPress plugin before 0.0.10's consent settings and, on sites connected to the vendor's paid plan, read stored visitor consent logs.
- Product
- Cookie Consent
- Fixed in
- 0.0.10
- What to do
- Update Cookie Consent to 0.0.10 or newer.
Aug 10, 2026Block User Account: Does not enforce its account block on every authentication pathCVE-2026-18960 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Block User Account WordPress plugin before 2.0.1 does not enforce its account block on every authentication path, allowing a blocked user who holds an application password created before the block to retain their full role-level read and write access through the REST API.
- Product
- Block User Account
- Fixed in
- 2.0.1
- What to do
- Update Block User Account to 2.0.1 or newer.
Aug 10, 2026Login & Register Forms: Does not enforce its password reset attempt limit against a server-derived valueCVE-2026-18469 · WordPress plugins & themes · reported by WPScanHigh 8.1
The Login & Register Forms WordPress plugin before 4.0.2 does not enforce its password reset attempt limit against a server-derived value, keying both the verification code and the per-source attempt counter on client-controlled data, allowing unauthenticated attackers to reset the limit at will and brute-force the code to take over any account, including administrators, when the verification-code reset mode is enabled.
- Product
- Login & Register Forms
- Fixed in
- 4.0.2
- What to do
- Update Login & Register Forms to 4.0.2 or newer.
Aug 8, 2026Admin Safety Guard — Login Security, Limit Logins, 2FA & Brute Force Protection: Does not perform any capability check on one of its REST API endpointsCVE-2026-16578 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Admin Safety Guard — Login Security, Limit Logins, 2FA & Brute Force Protection WordPress plugin before 1.4.0 does not perform any capability check on one of its REST API endpoints, allowing unauthenticated attackers to retrieve the full list of registered users including their usernames, email addresses, roles, and two-factor authentication enrollment status.
- Product
- Admin Safety Guard — Login Security, Limit Logins, 2FA & Brute Force Protection
- Fixed in
- 1.4.0
- What to do
- Update Admin Safety Guard — Login Security, Limit Logins, 2FA & Brute Force Protection to 1.4.0 or newer.
Aug 6, 2026WPC Name Your Price for WooCommerce: Does not enforce its server-side price allowlist for products configured in "Select" price modeCVE-2026-16620 · WordPress plugins & themes · reported by WPScanHigh 7.5
The WPC Name Your Price for WooCommerce WordPress plugin before 2.2.5 does not enforce its server-side price allowlist for products configured in "Select" price mode, allowing an unauthenticated visitor to add such a product to the cart at an arbitrary value below the merchant-defined allowed prices and commit a real order at that price (revenue loss / underpriced orders). This is a distinct, unfixed vector from CVE-2025-12115, whose 2.2.0 fix only addressed applying a custom price to products where Name Your Price is disabled and left the Select-mode allowlist unenforced through 2.2.4.
- Product
- WPC Name Your Price for WooCommerce
- Affected
- up to 2.2.4
- Fixed in
- 2.2.5
- What to do
- Update WPC Name Your Price for WooCommerce to 2.2.5 or newer.
Aug 6, 2026Easy Booking: Does not re-enforce a bookable product's configured minimum booking duration on the server sideCVE-2026-14831 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Easy Booking WordPress plugin before 3.5.0 does not re-enforce a bookable product's configured minimum booking duration on the server side when adding to cart and calculating the booking price, allowing unauthenticated users to place below-minimum bookings and complete underpriced orders.
- Product
- Easy Booking
- Fixed in
- 3.5.0
- What to do
- Update Easy Booking to 3.5.0 or newer.
Aug 6, 2026Estatik Real Estate: Does not properly enforce its anti-spam check or restrict the recipient routing of its property request formCVE-2026-14547 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Estatik Real Estate Plugin WordPress plugin before 4.3.3 does not properly enforce its anti-spam check or restrict the recipient routing of its property request form, allowing unauthenticated users to send emails to arbitrary recipients with arbitrary subject, body and Reply-To, effectively using the site as a mail relay for spam or phishing.
- Product
- Estatik Real Estate
- Fixed in
- 4.3.3
- What to do
- Update Estatik Real Estate to 4.3.3 or newer.
Aug 5, 2026User Registration & Membership: Does not enforce the site's registration-disabled settingCVE-2026-16736 · WordPress plugins & themes · reported by WPScanHigh 7.5
The User Registration & Membership WordPress plugin before 5.2.6 does not enforce the site's registration-disabled setting when processing registration-form submissions, allowing unauthenticated users to create new accounts even when the administrator has turned off open registration.
- Product
- User Registration & Membership
- Fixed in
- 5.2.6
- What to do
- Update User Registration & Membership to 5.2.6 or newer.
Aug 5, 2026Passster: Does not enforce its category-based content protection on the WordPress REST APICVE-2026-16603 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Passster WordPress plugin before 4.3.6 does not enforce its category-based content protection on the WordPress REST API, allowing unauthenticated users to read the full content, title, and excerpt of category-locked posts through the core REST API.
- Product
- Passster
- Fixed in
- 4.3.6
- What to do
- Update Passster to 4.3.6 or newer.
Aug 3, 2026Import and export users and customers: Does not enforce WordPress's role-assignment and per-user edit permissions during CSV importCVE-2026-16534 · WordPress plugins & themes · reported by WPScanCritical 9.1
The Import and export users and customers WordPress plugin before 2.4.2 does not enforce WordPress's role-assignment and per-user edit permissions during CSV import, allowing a user holding only the user-creation capability to create an administrator account and to overwrite an existing administrator's password or email.
- Product
- Import and export users and customers
- Fixed in
- 2.4.2
- What to do
- Update Import and export users and customers to 2.4.2 or newer.
Aug 2, 2026Simple Restrict: Does not enforce its content-restriction permission check on the REST API the way it does on the front endCVE-2026-15939 · WordPress plugins & themes · reported by WPScanLow 2.7
The Simple Restrict WordPress plugin before 1.2.9 does not enforce its content-restriction permission check on the REST API the way it does on the front end, relying there on a generic capability check instead of the Simple Restrict WordPress plugin before 1.2.9's own permission system, allowing users with contributor-level access or above to read the content of restricted posts and pages they were never granted access to.
- Product
- Simple Restrict
- Fixed in
- 1.2.9
- What to do
- Update Simple Restrict to 1.2.9 or newer.
Aug 1, 2026Login & Register Forms: Does not properly enforce the rate limit on its password-reset verification-code flowCVE-2026-14836 · WordPress plugins & themes · reported by WPScanHigh 8.1
The Login & Register Forms WordPress plugin before 3.2.5 does not properly enforce the rate limit on its password-reset verification-code flow, keying both the verification code and the per-source attempt counter on an unauthenticated, client-controlled value, allowing unauthenticated attackers to reset the limit at will and brute-force the code to take over any account, including administrators, when the verification-code reset mode is enabled.
- Product
- Login & Register Forms
- Fixed in
- 3.2.5
- What to do
- Update Login & Register Forms to 3.2.5 or newer.
Jul 31, 2026BuddyPress: Does not properly enforce authorization on its private messaging endpointsCVE-2026-8155 · WordPress plugins & themes · reported by WPScanMedium 5.4
The BuddyPress WordPress plugin before 14.5.0 does not properly enforce authorization on its private messaging endpoints, allowing any authenticated user (Subscriber+) to read, modify, or delete other users' private messages.
- Product
- BuddyPress
- Fixed in
- 14.5.0
- What to do
- Update BuddyPress to 14.5.0 or newer.
Jul 30, 2026Bit Form: Does not enforce a form's active/published status on its public form-submission handlersCVE-2026-15054 · WordPress plugins & themes · reported by WPScanLow 3.7
The Bit Form WordPress plugin before 3.1.2 does not enforce a form's active/published status on its public form-submission handlers, allowing unauthenticated users to submit entries to, and fire the configured workflows (such as email notifications) of forms the site owner has deactivated or unpublished.
- Product
- Bit Form
- Fixed in
- 3.1.2
- What to do
- Update Bit Form to 3.1.2 or newer.
Jul 30, 2026Sync Post With Other Site: Does not correctly enforce the page-editing capability on a REST route that creates and updates postsCVE-2026-14923 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Sync Post With Other Site WordPress plugin before 1.9.3 does not correctly enforce the page-editing capability on a REST route that creates and updates posts, because of an operator-precedence flaw in its authorization check. An authenticated user holding only the post-editing capability (such as a Contributor) can create, publish, and overwrite arbitrary Pages, including modifying content authored by higher-privileged users.
- Product
- Sync Post With Other Site
- Fixed in
- 1.9.3
- What to do
- Update Sync Post With Other Site to 1.9.3 or newer.
Jul 28, 2026WordPress Coding Standards is a set of PHP_CodeSniffer rules (sniffs) that enforce WordPress coding conventions.CVE-2026-45293 · WordPress plugins & themes · reported by GitHubHigh 8.6
WordPress Coding Standards is a set of PHP_CodeSniffer rules (sniffs) that enforce WordPress coding conventions. From 0.14.1 until 3.4.1, the WordPress.WP.EnqueuedResourceParameters sniff (active in the WordPress and WordPress-Extra rulesets) reconstructed the $ver argument passed to functions such as wp_enqueue_script() and ran it through eval() inside its is_falsy() method, so a maliciously crafted argument such as 'system'('id') would execute during a scan; as a result, running PHPCS with WordPressCS over untrusted PHP (for example a CI pipeline that lints pull requests, or a developer reviewing third-party code) could lead to arbitrary command execution on the scanning host. The WordPress-Core and WordPress-Docs rulesets are not affected. This issue is fixed in version 3.4.1.
- Fixed in
- 3.4.1
- What to do
- Update the plugin to 3.4.1 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.