Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
379 results · page 1 of 8
Oct 28, 2026Echo Knowledge Base – Documentation, FAQs, Chat & Smart Search: Reflected Cross-Site ScriptingCVE-2026-101935 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Echo Knowledge Base – Documentation, FAQs, Chat & Smart Search plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'new_kb_config' parameter (specifically the article-mobile-break-point-v2 key, among other config keys interpolated into the <style> element) in versions up to, and including, 17.214.0 This is due to insufficient input sanitization and output escaping in EPKB_Frontend_Editor::fe_preview_config() and EPKB_Articles_Setup: on every knowledge base article page view, when the request supplies epkb_fe_reload_mode=on, an attacker-controlled JSON blob is merged over the stored KB configuration and several values are concatenated directly into a stylesheet emitted inside a literal <style> element without escaping (minify_css() does not strip <, > or /). This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user (with Editor-level access or above, holding the manage_categories capability, or an Administrator) into performing an action such as clicking on a specially crafted link.
- Product
- Echo Knowledge Base – Documentation, FAQs, Chat & Smart Search
- Affected
- up to 17.214.0
- What to do
- Affects up to 17.214.0. Update Echo Knowledge Base – Documentation, FAQs, Chat & Smart Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 28, 2026Royal MCP: Does not perform object-level or post-type authorisation checks in one of its search toolsCVE-2026-111960 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Royal MCP WordPress plugin before 1.5.10 does not perform object-level or post-type authorisation checks in one of its search tools, allowing authenticated users such as a subscriber to disclose the title and content of non-public entries, including personal data stored by a companion Royal MCP WordPress plugin before 1.5.10.
- Product
- Royal MCP
- Fixed in
- 1.5.10
- What to do
- Update Royal MCP to 1.5.10 or newer.
Oct 21, 2026Ajax Search Lite: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-111852 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPdreams Ajax Search Lite ajax-search-lite allows Blind SQL Injection.This issue affects Ajax Search Lite: from n/a through 4.14.6.
- Product
- Ajax Search Lite
- Affected
- up to 4.14.6
- What to do
- Affects up to 4.14.6. Update Ajax Search Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 21, 2026Appointment Booking: Does not verify that an authenticated agent-level user is assigned to a customer before returning or searching that customer's recordCVE-2026-105257 · WordPress plugins & themes · reported by WPScanLow 2.7
The Appointment Booking Plugin WordPress plugin before 5.7.5 does not verify that an authenticated agent-level user is assigned to a customer before returning or searching that customer's record, allowing any agent to read and enumerate the personal information of every customer on the site, including those managed by other agents.
- Product
- Appointment Booking
- Fixed in
- 5.7.5
- What to do
- Update Appointment Booking to 5.7.5 or newer.
Oct 16, 2026FiboSearch – Ajax Search for WooCommerce: Stored Cross-Site ScriptingCVE-2026-100106 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The FiboSearch – Ajax Search for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'purchased_plan' parameter in all versions up to, and including, 1.34.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that the site owner has previously completed the standard Freemius opt-in flow; once that condition is met, any Subscriber can reach the vulnerable handler simply by loading /wp-admin/profile.php with the requisite query parameters.
- Product
- FiboSearch – Ajax Search for WooCommerce
- Affected
- up to 1.34.2
- What to do
- Affects up to 1.34.2. Update FiboSearch – Ajax Search for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 16, 2026Search Regex: PHP Object Injection in version 3CVE-2026-104932 · WordPress plugins & themes · reported by WordfenceHigh 8
The Search Regex plugin for WordPress is vulnerable to PHP Object Injection in version 3.5 via deserialization of untrusted input in the replace_all function. This allows authenticated attackers, with subscriber-level access and above, to inject a PHP Object. The additional presence of a POP chain allows attackers to execute code.
- Product
- Search Regex
- What to do
- Update Search Regex to the newest version.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Oct 15, 2026Ajax Search Lite: Missing AuthorizationCVE-2026-110360 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WPdreams Ajax Search Lite ajax-search-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ajax Search Lite: from n/a through 4.14.5.
- Product
- Ajax Search Lite
- Affected
- up to 4.14.5
- What to do
- Affects up to 4.14.5. Update Ajax Search Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 13, 2026BP Profile Search: Local File InclusionCVE-2026-104995 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The BP Profile Search plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 5.9 via the 'ajax_template' value parsed from the client-controlled 'bps_directory' cookie during BuddyPress AJAX directory requests. The bps_directory_ajax() filter (hooked onto bp_legacy_object_template_path and bp_nouveau_object_template_path) reads the cookie, applies only a referer-derived 'page' comparison in bps_get_directory_data() (where bps_current_page() uses HTTP_REFERER during AJAX and is therefore also attacker-controlled), and then suffixes the attacker-controlled template value with '.php' and passes it to bp_locate_template() with no basename restriction, no whitelist, and no path-traversal check. This makes it possible for unauthenticated attackers to include arbitrary PHP files on the server, which can lead to remote code execution when PHP files can be uploaded or when images such as the default wordpress:php8.
- Product
- BP Profile Search
- Affected
- up to 5.9
- What to do
- Affects up to 5.9. Update BP Profile Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 9, 2026FiboSearch: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-96553 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Damian Góra FiboSearch ajax-search-for-woocommerce allows Reflected XSS.This issue affects FiboSearch: from n/a through 1.34.1.
- Product
- FiboSearch
- Affected
- up to 1.34.1
- What to do
- Affects up to 1.34.1. Update FiboSearch to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 9, 2026Ajax Search Pro: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-96331 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in wpdreams Ajax Search Pro ajax-search-pro allows Blind SQL Injection.This issue affects Ajax Search Pro: from n/a through 4.29.1.
- Product
- Ajax Search Pro
- Affected
- up to 4.29.1
- What to do
- Affects up to 4.29.1. Update Ajax Search Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 9, 2026Search in Place: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-95598 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in codepeople Search in Place search-in-place allows Reflected XSS.This issue affects Search in Place: from n/a through 1.5.5.
- Product
- Search in Place
- Affected
- up to 1.5.5
- What to do
- Affects up to 1.5.5. Update Search in Place to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 3, 2026Unlimited Elements for Elementor: Does not correctly handle a search value before rewriting an already prepared SQL statementCVE-2026-85568 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not correctly handle a search value before rewriting an already prepared SQL statement, allowing unauthenticated users to perform SQL injection attacks and to retrieve non-public content, when a related widget option is set away from its default.
- Product
- Unlimited Elements for Elementor
- Fixed in
- 2.0.21
- What to do
- Update Unlimited Elements for Elementor to 2.0.21 or newer.
Oct 2, 2026Ivory Search – WordPress Search: Reflected Cross-Site ScriptingCVE-2026-92243 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Ivory Search – WordPress Search Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in all versions up to, and including, 5.5.18 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that the targeted search form has the 'Highlight Search Terms' option enabled by an administrator, and that the malicious search query returns at least one post result.
- Product
- Ivory Search – WordPress Search
- Affected
- up to 5.5.18
- What to do
- Affects up to 5.5.18. Update Ivory Search – WordPress Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 2, 2026Relevanssi – A Better Search: Stored Cross-Site ScriptingCVE-2026-97641 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Relevanssi – A Better Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to, and including, 4.28.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is only exploitable when the administrator has configured a non-empty value for the "Allowable tags in excerpts" setting, such as the default example value of <p><a><strong>, as the prefix-matching regex must have an allowable tag whose name is a prefix of the injected tag name.
- Product
- Relevanssi – A Better Search
- Affected
- up to 4.28.3
- What to do
- Affects up to 4.28.3. Update Relevanssi – A Better Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.complugins.trac.wordpress.org
Sep 30, 2026Unauthenticated Cross Site Scripting (XSS) in YITH WooCommerce Ajax Search <= 2.28.0 versions.CVE-2026-96352 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in YITH WooCommerce Ajax Search <= 2.28.0 versions.
- Affected
- up to 2.28.0
- What to do
- Affects up to 2.28.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 28, 2026SPS-Suite: Does not sanitise the search query before using it in a SQL queryCVE-2026-93000 · WordPress plugins & themes · reported by WPScanMedium 6.8
The SPS-Suite WordPress plugin through 1.4.0 does not sanitise the search query before using it in a SQL query when its static-page search feature is enabled, allowing unauthenticated attackers to perform SQL injection attacks.
- Product
- SPS-Suite
- Affected
- up to 1.4.0
- What to do
- Affects up to 1.4.0. Update SPS-Suite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 24, 2026Events Manager: Does not force the scope of its logged-in event and location searchCVE-2026-93662 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Events Manager WordPress plugin before 7.4.5 does not force the scope of its logged-in event and location search when a caller supplies their own owner value, letting a low-privileged user read other accounts' unpublished, pending or trashed event and venue content, including full street addresses.
- Product
- Events Manager
- Fixed in
- 7.4.5
- What to do
- Update Events Manager to 7.4.5 or newer.
Sep 19, 2026Search Atlas SEO – Premier SEO Plugin for One-Click WP Publishing & Integrated AI Optimization: Authorization bypassCVE-2026-15946 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Search Atlas SEO – Premier SEO Plugin for One-Click WP Publishing & Integrated AI Optimization plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6.23. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to overwrite the whitelabel settings password to an attacker-controlled value, enabling them to unlock whitelabel-protected admin settings tabs including whitelabel, general, and advanced configuration.
- Product
- Search Atlas SEO – Premier SEO Plugin for One-Click WP Publishing & Integrated AI Optimization
- Affected
- up to 2.6.23
- What to do
- Affects up to 2.6.23. Update Search Atlas SEO – Premier SEO Plugin for One-Click WP Publishing & Integrated AI Optimization to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 17, 2026Contributor Cross Site Scripting (XSS) in JetSearch <= 3.6.3 versions.CVE-2026-66577 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Cross Site Scripting (XSS) in JetSearch <= 3.6.3 versions.
- Affected
- up to 3.6.3
- What to do
- Affects up to 3.6.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 11, 2026Relevanssi – A Better Search: Reflected Cross-Site ScriptingCVE-2026-19985 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Relevanssi – A Better Search plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 4.28.1 via the 's', 'post_types', and 'orderby' request parameters. This is due to insufficient input sanitization and output escaping in the relevanssi_debug_array() function in lib/debug.php, which dumps user-supplied query variables through print_r() inside a <pre> block without HTML escaping. The debug path is enabled by supplying the relevanssi_debug=on request parameter when the administrator has previously enabled the 'Debugging mode' setting; the gate itself is a configuration check with no capability, nonce, or logged-in check (the vendor explicitly suppresses nonce verification on that line). This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a specially crafted link.
- Product
- Relevanssi – A Better Search
- Affected
- up to 4.28.1
- What to do
- Affects up to 4.28.1. Update Relevanssi – A Better Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 10, 2026Unauthenticated Broken Access Control in WP Fast Total Search <= 1.82.284 versions.CVE-2026-84821 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in WP Fast Total Search <= 1.82.284 versions.
- Affected
- up to 1.82.284
- What to do
- Affects up to 1.82.284. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 5, 2026Search Atlas SEO: Does not perform a nonce or capability check before processing a settings update in one of its early-priority handlersCVE-2026-15247 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Search Atlas SEO WordPress plugin before 2.6.24 does not perform a nonce or capability check before processing a settings update in one of its early-priority handlers, allowing any authenticated user such as a Subscriber to overwrite or delete the site's stored Google service-account credentials.
- Product
- Search Atlas SEO
- Fixed in
- 2.6.24
- What to do
- Update Search Atlas SEO to 2.6.24 or newer.
Sep 3, 2026Unauthenticated PHP Object Injection in JobSearch <= 3.2.0 versions.CVE-2026-84834 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in JobSearch <= 3.2.0 versions.
- Affected
- up to 3.2.0
- What to do
- Affects up to 3.2.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 28, 2026User Frontend: Does not restrict access to its user directory search endpointCVE-2026-14567 · WordPress plugins & themes · reported by WPScanMedium 5.3
The User Frontend WordPress plugin before 4.3.10 does not restrict access to its user directory search endpoint, allowing unauthenticated attackers to retrieve the email address and phone number of every registered user, including administrators.
- Product
- User Frontend
- Fixed in
- 4.3.10
- What to do
- Update User Frontend to 4.3.10 or newer.
Aug 22, 2026FiboSearch: Does not consistently exclude password-protected products from its unauthenticated AJAX endpointsCVE-2026-16612 · WordPress plugins & themes · reported by WPScanMedium 5.3
The FiboSearch WordPress plugin before 1.34.1 does not consistently exclude password-protected products from its unauthenticated AJAX endpoints, allowing unauthenticated users to disclose and enumerate password-protected products and their metadata without entering the product password. Two endpoints are affected: the autocomplete search endpoint (dgwt_wcas_ajax_search) and the Details Panel endpoint (dgwt_wcas_result_details) when queried for taxonomy details.
- Product
- FiboSearch
- Fixed in
- 1.34.1
- What to do
- Update FiboSearch to 1.34.1 or newer.
Aug 21, 2026Media Library Assistant: Does not validate a search parameter before concatenating it into a SQL query in one of its media-library query handlersCVE-2026-16959 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Media Library Assistant WordPress plugin before 3.40 does not validate a search parameter before concatenating it into a SQL query in one of its media-library query handlers, allowing users with the Author role to perform SQL injection.
- Product
- Media Library Assistant
- Fixed in
- 3.40
- What to do
- Update Media Library Assistant to 3.40 or newer.
Aug 20, 2026Unauthenticated Cross Site Scripting (XSS) in Advance Product Search <= 1.4.8 versions.CVE-2026-66607 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Advance Product Search <= 1.4.8 versions.
- Affected
- up to 1.4.8
- What to do
- Affects up to 1.4.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 19, 2026Unauthenticated SQL Injection in NGG Smart Image Search < 4.0.0 versions.CVE-2026-73185 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in NGG Smart Image Search < 4.0.0 versions.
- What to do
- Update the plugin to the newest version.
Aug 7, 2026Ajax Search Lite: Does not prevent the deserialization of untrusted inputCVE-2026-16258 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Ajax Search Lite WordPress plugin before 4.14.5 does not prevent the deserialization of untrusted input, allowing unauthenticated attackers to perform PHP Object Injection. When a suitable POP chain is present via another installed Ajax Search Lite WordPress plugin before 4.14.5 or , this can be leveraged to achieve Remote Code Execution.
- Product
- Ajax Search Lite
- Fixed in
- 4.14.5
- What to do
- Update Ajax Search Lite to 4.14.5 or newer.
Aug 6, 2026Shop manager Cross Site Scripting (XSS) in FiboSearch <= 1.33.0 versions.CVE-2026-28179 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Shop manager Cross Site Scripting (XSS) in FiboSearch <= 1.33.0 versions.
- Affected
- up to 1.33.0
- What to do
- Affects up to 1.33.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 6, 2026Unauthenticated PHP Object Injection in Ajax Search Lite <= 4.14.4 versions.CVE-2026-28139 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in Ajax Search Lite <= 4.14.4 versions.
- Affected
- up to 4.14.4
- What to do
- Affects up to 4.14.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 5, 2026Search Analytics for WP: Cross-Site Request ForgeryCVE-2026-7444 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Search Analytics for WP plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.16. This is due to missing or incorrect nonce validation on the `process_bulk_action()` function of `MWTSA_Stats_Table`. This makes it possible for unauthenticated attackers to delete arbitrary search-term records, including all associated search-history rows, via a forged request granted they can trick a user with access to the plugin's "Search Analytics" dashboard page (Administrator by default) into performing an action such as clicking on a link.
- Product
- Search Analytics for WP
- Affected
- up to 1.4.16
- What to do
- Affects up to 1.4.16. Update Search Analytics for WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 5, 2026GeoDirectory: Does not restrict a user-search handler to users allowed to list usersCVE-2026-16968 · WordPress plugins & themes · reported by WPScanMedium 6.5
The GeoDirectory WordPress plugin before 2.8.168 does not restrict a user-search handler to users allowed to list users, allowing any authenticated user with Contributor-level access or higher to retrieve the email addresses of all registered users, including administrators.
- Product
- GeoDirectory
- Fixed in
- 2.8.168
- What to do
- Update GeoDirectory to 2.8.168 or newer.
Aug 5, 2026The plugin provides an Admin Search page that allows users with the `edit_posts` capability to run Relevanssi searches from the WordPress dashboard.CVE-2026-15941 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The plugin provides an Admin Search page that allows users with the `edit_posts` capability to run Relevanssi searches from the WordPress dashboard. The AJAX handler accepts a URL-encoded `args` parameter, parses it into a `WP_Query`, and then passes user-controlled taxonomy query data into Relevanssi's taxonomy restriction builder. The taxonomy value is sanitized as text but is not parameterized for SQL before being interpolated into a term taxonomy lookup query. This allows an authenticated contributor-level attacker to inject SQL through the Admin Search AJAX request and execute time-based blind SQL injection against the WordPress database.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 31, 2026JS Help Desk: Does not perform authorization or ownership checks before returning support-ticket content in a nonce-gated search handlerCVE-2026-14928 · WordPress plugins & themes · reported by WPScanMedium 6.5
The JS Help Desk WordPress plugin before 3.1.4 does not perform authorization or ownership checks before returning support-ticket content in a nonce-gated search handler, allowing any authenticated user (Subscriber and above) to read the subject and full message body of every other user's support tickets.
- Product
- JS Help Desk
- Fixed in
- 3.1.4
- What to do
- Update JS Help Desk to 3.1.4 or newer.
Jul 30, 2026Search Atlas SEO: Does not perform a capability or nonce check in one of its AJAX handlersCVE-2026-15252 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Search Atlas SEO WordPress plugin before 2.6.12 does not perform a capability or nonce check in one of its AJAX handlers, allowing any authenticated user such as a Subscriber to invoke the site's Google Indexing API integration, submitting or removing the site's URLs from Google's index and consuming its indexing quota.
- Product
- Search Atlas SEO
- Fixed in
- 2.6.12
- What to do
- Update Search Atlas SEO to 2.6.12 or newer.
Jul 30, 2026WP Hotel Booking: Does not sanitise and escape a search parameter on an administrative listing before using it in a SQL queryCVE-2026-15153 · WordPress plugins & themes · reported by WPScanMedium 6.8
The WP Hotel Booking WordPress plugin before 2.3.2 does not sanitise and escape a search parameter on an administrative listing before using it in a SQL query, allowing users holding the WP Hotel Booking WordPress plugin before 2.3.2's booking-management roles to perform SQL injection attacks.
- Product
- WP Hotel Booking
- Fixed in
- 2.3.2
- What to do
- Update WP Hotel Booking to 2.3.2 or newer.
Jul 28, 2026WP Fast Total Search – The Power of Indexed Search: Generic SQL InjectionCVE-2026-12741 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The WP Fast Total Search – The Power of Indexed Search plugin for WordPress is vulnerable to generic SQL Injection via the 'form_data[s]' parameter in all versions up to, and including, 1.80.280 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- WP Fast Total Search – The Power of Indexed Search
- Affected
- up to 1.80.280
- What to do
- Affects up to 1.80.280. Update WP Fast Total Search – The Power of Indexed Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 23, 2026Unauthenticated Broken Access Control in WP Fast Total Search <= 1.81.282 versions.CVE-2026-27418 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Broken Access Control in WP Fast Total Search <= 1.81.282 versions.
- Affected
- up to 1.81.282
- What to do
- Affects up to 1.81.282. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 20, 2026LearnPress: Does not escape a search parameter before reflecting it into an HTML attributeCVE-2026-12970 · WordPress plugins & themes · reported by WPScanHigh 7.1
The LearnPress WordPress plugin before 4.4.1 does not escape a search parameter before reflecting it into an HTML attribute, leading to Reflected Cross-Site Scripting that executes in the browser of a logged-in instructor or administrator who is tricked into opening a crafted link.
- Product
- LearnPress
- Fixed in
- 4.4.1
- What to do
- Update LearnPress to 4.4.1 or newer.
Jul 16, 2026Advance Product Search- Voice & Ajax Search for WooCommerce: Generic SQL InjectionCVE-2026-12753 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Advance Product Search- Voice & Ajax Search for WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 's' and 'match' parameter in all versions up to, and including, 1.4.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- Advance Product Search- Voice & Ajax Search for WooCommerce
- Affected
- up to 1.4.4
- What to do
- Affects up to 1.4.4. Update Advance Product Search- Voice & Ajax Search for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 13, 2026JetSearch: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2026-61977 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Crocoblock JetSearch jet-search allows Retrieve Embedded Sensitive Data.This issue affects JetSearch: from n/a through <= 3.6.1.2.
- Product
- JetSearch
- Affected
- up to 3.6.1.2
- What to do
- Affects up to 3.6.1.2. Update JetSearch to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 13, 2026JobSearch: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-57383 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in eyecix JobSearch wp-jobsearch allows Stored XSS.This issue affects JobSearch: from n/a through <= 3.2.9.
- Product
- JobSearch
- Affected
- up to 3.2.9
- What to do
- Affects up to 3.2.9. Update JobSearch to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 10, 2026BuddyHolis TableSearch: Stored Cross-Site ScriptingCVE-2026-15301 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The BuddyHolis TableSearch plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘placeholder’ parameter in all versions up to, and including, 1.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- BuddyHolis TableSearch
- Affected
- up to 1.1.0
- What to do
- Affects up to 1.1.0. Update BuddyHolis TableSearch to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jul 2, 2026Unauthenticated SQL Injection in WP Fast Total Search <= 1.80.280 versions.CVE-2026-57683 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in WP Fast Total Search <= 1.80.280 versions.
- What to do
- Update the plugin to the newest version.
Jul 2, 2026Unauthenticated Cross Site Scripting (XSS) in Search Atlas SEO <= 2.6.6 versions.CVE-2026-57357 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Search Atlas SEO <= 2.6.6 versions.
- What to do
- Update the plugin to the newest version.
Jul 2, 2026Adminify: Does not perform per-user read-capability checks on the results returned by one of its administration search featuresCVE-2026-11781 · WordPress plugins & themes · reported by WPScanLow 2.7
The Adminify WordPress plugin before 4.2.10 does not perform per-user read-capability checks on the results returned by one of its administration search features, allowing users with a low-privilege role (Contributor) to disclose non-public content that WordPress would not otherwise expose to them, such as other authors' unpublished post titles, pending comment content, the site's Adminify WordPress plugin before 4.2.10 inventory, and user account names.
- Product
- Adminify
- Fixed in
- 4.2.10
- What to do
- Update Adminify to 4.2.10 or newer.
Jun 30, 2026The EventON - WordPress Virtual Event Calendar Plugin plugin for WordPress (full) is vulnerable to SQL Injection via the WordPress 'search' parameter in versionCVE-2026-9711 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The EventON - WordPress Virtual Event Calendar Plugin plugin for WordPress (full) is vulnerable to SQL Injection via the WordPress 'search' parameter in versions up to, and including, 5.0.11 due to insufficient escaping on the user supplied parameter and lack of preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database, granted the "Enable additional search queries" setting is enabled and at least one published event exists.
- Affected
- up to 5.0.11
- What to do
- Affects up to 5.0.11. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordmyeventon.comwordfence.com
Jun 26, 2026Ivory Search – WordPress Search: Stored Cross-Site ScriptingCVE-2026-11356 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Ivory Search – WordPress Search Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'menu_title' and 'menu_magnifier_color' Settings in all versions up to, and including, 5.5.15 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Ivory Search – WordPress Search
- Affected
- up to 5.5.15
- What to do
- Affects up to 5.5.15. Update Ivory Search – WordPress Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 26, 2026Unauthenticated SQL Injection in Advance Product Search <= 1.4.4 versions.CVE-2026-56070 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in Advance Product Search <= 1.4.4 versions.
- What to do
- Update the plugin to the newest version.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.