Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
129 results · page 1 of 3
Oct 22, 2026ShopMagic: Insertion of Sensitive Information into Externally-Accessible File or DirectoryCVE-2026-114195 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Insertion of Sensitive Information into Externally-Accessible File or Directory vulnerability in WP Desk ShopMagic shopmagic-for-woocommerce allows Retrieve Embedded Sensitive Data.This issue affects ShopMagic: from n/a through 4.9.1.
- Product
- ShopMagic
- Affected
- up to 4.9.1
- What to do
- Affects up to 4.9.1. Update ShopMagic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 14, 2026ShopMagic – email automation for: Local File InclusionCVE-2026-103367 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The ShopMagic – email automation for WordPress plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.9.0 via the 'billing_address.first_name' parameter parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. Exploitation requires a published recipe that processes the {{ customer.first_name }} placeholder — the plugin's built-in "New Order email with social media profile links" recipe satisfies this requirement out of the box, making the default configuration exploitable with no account, cookie, or nonce by simply submitting a guest checkout with the payload as the billing first name.
- Product
- ShopMagic – email automation for
- Affected
- up to 4.9.0
- What to do
- Affects up to 4.9.0. Update ShopMagic – email automation for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 4, 2026Mindio Magic MCP: Insertion of Sensitive Information Into Sent DataCVE-2026-104402 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Insertion of Sensitive Information Into Sent Data vulnerability in farvisun Mindio Magic MCP mindio-magic-mcp allows Retrieve Embedded Sensitive Data.This issue affects Mindio Magic MCP: from n/a through 0.5.6.
- Product
- Mindio Magic MCP
- Affected
- up to 0.5.6
- What to do
- Affects up to 0.5.6. Update Mindio Magic MCP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 3, 2026Magic Tooltips For Contact Form 7: Stored Cross-Site ScriptingCVE-2026-101928 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Magic Tooltips For Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'author' parameter in all versions up to, and including, 1.0.34 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is possible because the plugin's esc_html filter callback decodes HTML-entity-encoded payloads (e.g. those containing '<tip>') back into live HTML, meaning an entity-encoded script payload submitted as a comment author name — which bypasses sanitize_text_field — is rendered as executable markup when an administrator views wp-admin/edit-comments.php.
- Product
- Magic Tooltips For Contact Form 7
- Affected
- up to 1.0.34
- What to do
- Affects up to 1.0.34. Update Magic Tooltips For Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 5, 2026RegistrationMagic: Does not verifyCVE-2026-77826 · WordPress plugins & themes · reported by WPScanHigh 8.8
The RegistrationMagic WordPress plugin before 6.0.9.9 does not verify which application a Facebook access token was issued to before accepting it as proof of identity, allowing unauthenticated attackers to log in as an existing user whose token they can obtain, or to create and log into a new account even when user registration is disabled.
- Product
- RegistrationMagic
- Fixed in
- 6.0.9.9
- What to do
- Update RegistrationMagic to 6.0.9.9 or newer.
Sep 2, 2026RegistrationMagic: Does not validate a client-supplied quantity multiplierCVE-2026-77794 · WordPress plugins & themes · reported by WPScanMedium 5.3
The RegistrationMagic WordPress plugin before 6.0.9.9 does not validate a client-supplied quantity multiplier when calculating the total price of a paid registration, allowing unauthenticated users to register without paying and obtain an activated account holding the role the form grants.
- Product
- RegistrationMagic
- Fixed in
- 6.0.9.9
- What to do
- Update RegistrationMagic to 6.0.9.9 or newer.
Sep 2, 2026RegistrationMagic: Does not validate the total price of a paid registration server-sideCVE-2026-77793 · WordPress plugins & themes · reported by WPScanMedium 5.3
The RegistrationMagic WordPress plugin before 6.0.9.9 does not validate the total price of a paid registration server-side, allowing unauthenticated users to complete a paid registration without paying and obtain an activated account.
- Product
- RegistrationMagic
- Fixed in
- 6.0.9.9
- What to do
- Update RegistrationMagic to 6.0.9.9 or newer.
Sep 2, 2026RegistrationMagic: Does not escape a registration form field value before outputting it in an HTML attribute on an administrative pageCVE-2026-77792 · WordPress plugins & themes · reported by WPScanHigh 7.5
The RegistrationMagic WordPress plugin before 6.0.9.9 does not escape a registration form field value before outputting it in an HTML attribute on an administrative page, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks against high privilege users such as admin.
- Product
- RegistrationMagic
- Fixed in
- 6.0.9.9
- What to do
- Update RegistrationMagic to 6.0.9.9 or newer.
Aug 31, 2026Unauthenticated Broken Authentication in RegistrationMagic <= 6.0.9.8 versions.CVE-2026-82225 · WordPress plugins & themes · reported by PatchstackHigh 7.4
Unauthenticated Broken Authentication in RegistrationMagic <= 6.0.9.8 versions.
- Affected
- up to 6.0.9.8
- What to do
- Affects up to 6.0.9.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 31, 2026Unauthenticated Cross Site Scripting (XSS) in RegistrationMagic <= 6.0.9.8 versions.CVE-2026-82221 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in RegistrationMagic <= 6.0.9.8 versions.
- Affected
- up to 6.0.9.8
- What to do
- Affects up to 6.0.9.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 26, 2026RegistrationMagic: Does not sanitise and escape a parameter before using it in a SQL statementCVE-2026-77790 · WordPress plugins & themes · reported by WPScanMedium 5.5
The RegistrationMagic WordPress plugin before 6.0.9.4 does not sanitise and escape a parameter before using it in a SQL statement, which could allow high privilege users such as admin to perform SQL injection attacks.
- Product
- RegistrationMagic
- Fixed in
- 6.0.9.4
- What to do
- Update RegistrationMagic to 6.0.9.4 or newer.
Aug 24, 2026Subscriber Local File Inclusion in MagicAI for WordPress - AI Text, Image, Chat, Code, and Voice Generator <= 1.4 versions.CVE-2026-32560 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Subscriber Local File Inclusion in MagicAI for WordPress - AI Text, Image, Chat, Code, and Voice Generator <= 1.4 versions.
- Affected
- up to 1.4
- What to do
- Affects up to 1.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 18, 2026Unauthenticated PHP Object Injection in RegistrationMagic <= 6.0.9.7 versions.CVE-2026-73341 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in RegistrationMagic <= 6.0.9.7 versions.
- Affected
- up to 6.0.9.7
- What to do
- Affects up to 6.0.9.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 11, 2026Social Login, Passkeys, Magic Link & Email OTP – Passwordless Login by VentraConnect: Authentication BypassCVE-2026-18961 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Social Login, Passkeys, Magic Link & Email OTP – Passwordless Login by VentraConnect plugin for WordPress is vulnerable to Authentication Bypass via Unverified Provider Email in all versions up to, and including, 1.4.3. This is due to the plugin trusting the unverified email field returned by Spotify's /v1/me endpoint as proof of mailbox ownership — Generic::normalize_common() copies this value into the normalized profile without requiring an email_verified assertion, and User_Links::link_or_login_user() subsequently passes it directly to get_user_by('email', $email) and issues a persistent authentication cookie via wp_set_auth_cookie() without a provider-specific verified-email gate, a local mailbox challenge, or a logged-in approval step. This makes it possible for unauthenticated attackers to log in as any existing WordPress user, including Administrators, by supplying a known target email address through a controlled Spotify OAuth flow, gaining full administrative access to the site.
- Product
- Social Login, Passkeys, Magic Link & Email OTP – Passwordless Login by VentraConnect
- Affected
- up to 1.4.3
- What to do
- Affects up to 1.4.3. Update Social Login, Passkeys, Magic Link & Email OTP – Passwordless Login by VentraConnect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recorddeveloper.spotify.complugins.svn.wordpress.org
Aug 6, 2026RegistrationMagic: Does not compare the verified PayPal capture's amountCVE-2026-15208 · WordPress plugins & themes · reported by WPScanMedium 5.3
The RegistrationMagic WordPress plugin before 6.0.9.5 does not compare the verified PayPal capture's amount, currency, payee, or prior use against the registration it is finalising: its server-side check only confirms the capture status is COMPLETED. An unauthenticated attacker can therefore finalise an expensive paid registration with any genuinely-completed low-value capture, and replay a single capture across unlimited registrations because captures are not de-duplicated.
- Product
- RegistrationMagic
- Fixed in
- 6.0.9.5
- What to do
- Update RegistrationMagic to 6.0.9.5 or newer.
Jul 30, 2026RegistrationMagic: Does not perform authorizationCVE-2026-15257 · WordPress plugins & themes · reported by WPScanMedium 5.3
The RegistrationMagic WordPress plugin before 6.0.9.4 does not perform authorization, ownership or nonce checks on a front-end submission-editing action, allowing unauthenticated attackers to overwrite other users' form submissions and the profile fields of the associated non-administrator WordPress accounts.
- Product
- RegistrationMagic
- Fixed in
- 6.0.9.4
- What to do
- Update RegistrationMagic to 6.0.9.4 or newer.
Jul 30, 2026RegistrationMagic: Does not properly validate that a one-time password presented in a cookie belongs to the identity being requested before returning front-end form submissionsCVE-2026-15255 · WordPress plugins & themes · reported by WPScanMedium 5.3
The RegistrationMagic WordPress plugin before 6.0.9.4 does not properly validate that a one-time password presented in a cookie belongs to the identity being requested before returning front-end form submissions, allowing unauthenticated attackers to read other users' form submission data, including personal information.
- Product
- RegistrationMagic
- Fixed in
- 6.0.9.4
- What to do
- Update RegistrationMagic to 6.0.9.4 or newer.
Jul 20, 2026Social Login, Passkeys, Magic Link & Email OTP: Does not enforce rate limiting or a working attempt lockout on its passwordless email one-time-password verificationCVE-2026-13142 · WordPress plugins & themes · reported by WPScanHigh 8.1
The Social Login, Passkeys, Magic Link & Email OTP WordPress plugin before 1.4.1 does not enforce rate limiting or a working attempt lockout on its passwordless email one-time-password verification, and stores the short numeric codes in plaintext, allowing an unauthenticated attacker who knows a registered email address to brute-force the code and log in as that user, including an administrator, leading to full site takeover.
- Product
- Social Login, Passkeys, Magic Link & Email OTP
- Fixed in
- 1.4.1
- What to do
- Update Social Login, Passkeys, Magic Link & Email OTP to 1.4.1 or newer.
Jul 1, 2026RegistrationMagic – User Registration Forms: Cross-Site Request ForgeryCVE-2026-12158 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The RegistrationMagic – User Registration Forms Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.0.9.1. This is due to missing or incorrect nonce validation on the process_request function. This makes it possible for unauthenticated attackers to escalate the privileges of an arbitrary form submitter to administrator by creating a malicious Chronos automation task that is executed via WordPress cron via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- RegistrationMagic – User Registration Forms
- Affected
- up to 6.0.9.1
- What to do
- Affects up to 6.0.9.1. Update RegistrationMagic – User Registration Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 27, 2026RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login: Authentication BypassCVE-2026-9242 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to Authentication Bypass via Insufficient Verification of Data Authenticity in all versions up to and including 6.0.8.6. This is due to the PayPal IPN `callback` handler being registered as a nopriv AJAX action with no authentication or nonce requirement, and critically because the handler updates the payment log database row with attacker-controlled POST data — including `payment_status` and the `custom` field encoding the target `user_id` — before PayPal IPN validation is performed, meaning the database remains poisoned even when validation subsequently fails. This makes it possible for unauthenticated attackers to authenticate as any WordPress user, including administrators, by submitting a forged IPN request that overwrites a payment log entry's `user_id` with that of a target account, then visiting the success return URL with a legitimately obtained security hash to cause the plugin to issue real WordPress authentication cookies for the targeted account.
- Product
- RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
- Affected
- up to 6.0.8.6
- What to do
- Affects up to 6.0.8.6. Update RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 18, 2026MagicForm: Does not properly validate the type of files uploaded through an unauthenticated AJAX actionCVE-2026-9815 · WordPress plugins & themes · reported by WPScanMedium 6.5
The MagicForm WordPress plugin through 0.1.3 does not properly validate the type of files uploaded through an unauthenticated AJAX action when a form's per-field extension allowlist is left empty, allowing unauthenticated attackers to upload PHP files and execute arbitrary code on the server.
- Product
- MagicForm
- Affected
- up to 0.1.3
- What to do
- Affects up to 0.1.3. Update MagicForm to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated Broken Authentication in RegistrationMagic <= 6.0.8.6 versions.CVE-2026-49764 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated Broken Authentication in RegistrationMagic <= 6.0.8.6 versions.
- Affected
- up to 6.0.8.6
- What to do
- Affects up to 6.0.8.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 27, 2026MetaMagic SEO: Cross-Site Request ForgeryCVE-2026-8942 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The MetaMagic SEO Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.6. This is due to missing or incorrect nonce validation on the metamagic_update_options function. This makes it possible for unauthenticated attackers to modify the plugin's SEO settings, including enabling or disabling the plugin and toggling description and keyword meta tag output via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- MetaMagic SEO
- Affected
- up to 1.6
- What to do
- Affects up to 1.6. Update MetaMagic SEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
May 25, 2026eMagicOne Store Manager: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-42773 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in eMagicOne eMagicOne Store Manager allows Blind SQL Injection. This issue affects eMagicOne Store Manager: from n/a through 1.3.2.
- Product
- eMagicOne Store Manager
- Affected
- up to 1.3.2
- What to do
- Affects up to 1.3.2. Update eMagicOne Store Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 4, 2026Magic Export & Import: Stores exported CSV files at a publicly accessible locationCVE-2026-5335 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Magic Export & Import WordPress plugin before 1.2.0 stores exported CSV files at a publicly accessible location, making it possible for any visitors to leak sensitive user information.
- Product
- Magic Export & Import
- Fixed in
- 1.2.0
- What to do
- Update Magic Export & Import to 1.2.0 or newer.
Apr 8, 2026Magic Conversation For Gravity Forms: Stored Cross-Site ScriptingCVE-2026-1396 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Magic Conversation For Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'magic-conversation' shortcode in all versions up to, and including, 3.0.97 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Magic Conversation For Gravity Forms
- Affected
- up to 3.0.97
- What to do
- Affects up to 3.0.97. Update Magic Conversation For Gravity Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 25, 2026RegistrationMagic: Missing AuthorizationCVE-2026-32498 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in Metagauss RegistrationMagic custom-registration-form-builder-with-submission-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects RegistrationMagic: from n/a through <= 6.0.7.6.
- Product
- RegistrationMagic
- Affected
- up to 6.0.7.6
- What to do
- Affects up to 6.0.7.6. Update RegistrationMagic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 25, 2026RegistrationMagic: Incorrect Privilege AssignmentCVE-2026-24373 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Incorrect Privilege Assignment vulnerability in Metagauss RegistrationMagic custom-registration-form-builder-with-submission-manager allows Privilege Escalation.This issue affects RegistrationMagic: from n/a through <= 6.0.7.1.
- Product
- RegistrationMagic
- Affected
- up to 6.0.7.1
- What to do
- Affects up to 6.0.7.1. Update RegistrationMagic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026Magical Addons For Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-32429 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Noor Alam Magical Addons For Elementor magical-addons-for-elementor allows Stored XSS.This issue affects Magical Addons For Elementor: from n/a through <= 1.4.1.
- Product
- Magical Addons For Elementor
- Affected
- up to 1.4.1
- What to do
- Affects up to 1.4.1. Update Magical Addons For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026RegistrationMagic: Missing AuthorizationCVE-2026-32385 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Metagauss RegistrationMagic custom-registration-form-builder-with-submission-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects RegistrationMagic: from n/a through <= 6.0.7.6.
- Product
- RegistrationMagic
- Affected
- up to 6.0.7.6
- What to do
- Affects up to 6.0.7.6. Update RegistrationMagic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 18, 2026RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login: Payment bypassCVE-2025-14444 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to payment bypass due to insufficient verification of data authenticity on the 'process_paypal_sdk_payment' function in all versions up to, and including, 6.0.6.9. This is due to the plugin trusting client-supplied values for payment verification without validating that the payment actually went through PayPal. This makes it possible for unauthenticated attackers to bypass paid registration by manipulating payment status and activating their account without completing a real PayPal payment.
- Product
- RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
- Affected
- up to 6.0.6.9
- What to do
- Affects up to 6.0.6.9. Update RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 16, 2026RegistrationMagic: Does not have proper capability checksCVE-2026-0929 · WordPress plugins & themes · reported by WPScanMedium 4.3
The RegistrationMagic WordPress plugin before 6.0.7.2 does not have proper capability checks, allowing subscribers and above to create forms on the site.
- Product
- RegistrationMagic
- Fixed in
- 6.0.7.2
- What to do
- Update RegistrationMagic to 6.0.7.2 or newer.
Feb 14, 2026Magic Login Mail or QR Code: Privilege EscalationCVE-2026-2144 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Magic Login Mail or QR Code plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.05. This is due to the plugin storing the magic login QR code image with a predictable, static filename (QR_Code.png) in the publicly accessible WordPress uploads directory during the email sending process. The file is only deleted after wp_mail() completes, creating an exploitable race condition window. This makes it possible for unauthenticated attackers to trigger a login link request for any user, including administrators, and then exploit the race condition between QR code file creation and deletion to obtain the login URL encoded in the QR code, thereby gaining unauthorized access to the targeted user's account.
- Product
- Magic Login Mail or QR Code
- Affected
- up to 2.05
- What to do
- Affects up to 2.05. Update Magic Login Mail or QR Code to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 13, 2026RegistrationMagic: Checks nonces but not capabilitiesCVE-2025-15520 · WordPress plugins & themes · reported by WPScanMedium 4.3
The RegistrationMagic WordPress plugin before 6.0.7.2 checks nonces but not capabilities, allowing for the disclosure of some sensitive data to subscribers and above.
- Product
- RegistrationMagic
- Fixed in
- 6.0.7.2
- What to do
- Update RegistrationMagic to 6.0.7.2 or newer.
Feb 4, 2026Magic Import Document Extractor: Sensitive Information ExposureCVE-2025-15508 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Magic Import Document Extractor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.4 via the get_frontend_settings() function. This makes it possible for unauthenticated attackers to extract the site's magicimport.ai license key from the page source on any page containing the plugin's shortcode.
- Product
- Magic Import Document Extractor
- Affected
- up to 1.0.4
- What to do
- Affects up to 1.0.4. Update Magic Import Document Extractor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Feb 4, 2026Magic Import Document Extractor: Unauthorized modification of dataCVE-2025-15507 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Magic Import Document Extractor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax_sync_usage() function in all versions up to, and including, 1.0.5. This makes it possible for unauthenticated attackers to modify the plugin's license status and credit balance.
- Product
- Magic Import Document Extractor
- Affected
- up to 1.0.5
- What to do
- Affects up to 1.0.5. Update Magic Import Document Extractor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 28, 2026RegistrationMagic: Missing AuthorizationCVE-2026-1054 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The RegistrationMagic plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 6.0.7.4. This is due to missing nonce verification and capability checks on the rm_set_otp AJAX action handler. This makes it possible for unauthenticated attackers to modify arbitrary plugin settings, including reCAPTCHA keys, security settings, and frontend menu titles.
- Product
- RegistrationMagic
- Affected
- up to 6.0.7.4
- What to do
- Affects up to 6.0.7.4. Update RegistrationMagic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 22, 2026RegistrationMagic: Cross-Site Request Forgery (CSRF)CVE-2026-24374 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Metagauss RegistrationMagic custom-registration-form-builder-with-submission-manager allows Cross Site Request Forgery.This issue affects RegistrationMagic: from n/a through <= 6.0.6.9.
- Product
- RegistrationMagic
- Affected
- up to 6.0.6.9
- What to do
- Affects up to 6.0.6.9. Update RegistrationMagic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Magic Responsive Slider and Carousel: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49043 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup Magic Responsive Slider and Carousel WordPress magic_carousel allows Reflected XSS.This issue affects Magic Responsive Slider and Carousel WordPress: from n/a through <= 1.6.
- Product
- Magic Responsive Slider and Carousel
- Affected
- up to 1.6
- What to do
- Affects up to 1.6. Update Magic Responsive Slider and Carousel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Magic Slider: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-48094 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup Magic Slider magic_slider allows Reflected XSS.This issue affects Magic Slider: from n/a through <= 2.2.
- Product
- Magic Slider
- Affected
- up to 2.2
- What to do
- Affects up to 2.2. Update Magic Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 16, 2026RegistrationMagic: Privilege EscalationCVE-2025-15403 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The RegistrationMagic plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.0.7.1. This is due to the 'add_menu' function is accessible via the 'rm_user_exists' AJAX action and allows arbitrary updates to the 'admin_order' setting. This makes it possible for unauthenticated attackers to injecting an empty slug into the order parameter, and manipulate the plugin's menu generation logic, and when the admin menu is subsequently built, the plugin adds 'manage_options' capability for the target role. Note: The vulnerability can only be exploited unauthenticated, but further privilege escalation requires at least a subscriber user.
- Product
- RegistrationMagic
- Affected
- up to 6.0.7.1
- What to do
- Affects up to 6.0.7.1. Update RegistrationMagic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 9, 2026WP Popup Magic: Stored Cross-Site ScriptingCVE-2025-13900 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP Popup Magic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name' parameter of the [wppum_end] shortcode in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- WP Popup Magic
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update WP Popup Magic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 30, 2025ShopMagic: Missing AuthorizationCVE-2025-69093 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in wpdesk ShopMagic shopmagic-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ShopMagic: from n/a through <= 4.7.2.
- Product
- ShopMagic
- Affected
- up to 4.7.2
- What to do
- Affects up to 4.7.2. Update ShopMagic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 15, 2025RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login: Stored Cross-Site ScriptingCVE-2025-13610 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'RM_Forms' shortcode in all versions up to, and including, 6.0.6.7 due to insufficient input sanitization and output escaping on the 'theme' attribute. This makes it possible for authenticated attackers, with contributor level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
- Affected
- up to 6.0.6.7
- What to do
- Affects up to 6.0.6.7. Update RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Dec 12, 2025Magical Posts Display: Stored Cross-Site ScriptingCVE-2025-12965 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Magical Posts Display plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mpac_title_tag' parameter in the Magical Posts Accordion widget in all versions up to, and including, 1.2.54 due to insufficient input sanitization and output escaping on user-supplied HTML tag names. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Magical Posts Display
- Affected
- up to 1.2.54
- What to do
- Affects up to 1.2.54. Update Magical Posts Display to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Dec 5, 2025Email Verification, Email OTP, Block Spam Email, Passwordless login, Hide Login, Magic Login – User Verification: Authentication bypassCVE-2025-12374 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Email Verification, Email OTP, Block Spam Email, Passwordless login, Hide Login, Magic Login – User Verification plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 2.0.44. This is due to the plugin not properly validating that an OTP was generated before comparing it to user input in the "user_verification_form_wrap_process_otpLogin" function. This makes it possible for unauthenticated attackers to log in as any user with a verified email address, such as an administrator, by submitting an empty OTP value.
- Product
- Email Verification, Email OTP, Block Spam Email, Passwordless login, Hide Login, Magic Login – User Verification
- Affected
- up to 2.0.44
- What to do
- Affects up to 2.0.44. Update Email Verification, Email OTP, Block Spam Email, Passwordless login, Hide Login, Magic Login – User Verification to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 21, 2025Magical Products Display: Stored Cross-Site ScriptingCVE-2025-12964 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Magical Products Display plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mpdpr_title_tag' and 'mpdpr_subtitle_tag' parameters in the MPD Pricing Table widget in all versions up to, and including, 1.1.29 due to insufficient input sanitization and output escaping on user-supplied HTML tag names. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Magical Products Display
- Affected
- up to 1.1.29
- What to do
- Affects up to 1.1.29. Update Magical Products Display to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 22, 2025ShopMagic: Insertion of Sensitive Information Into Sent DataCVE-2025-59578 · WordPress plugins & themes · reported by PatchstackMedium 5.8
Insertion of Sensitive Information Into Sent Data vulnerability in wpdesk ShopMagic shopmagic-for-woocommerce allows Retrieve Embedded Sensitive Data.This issue affects ShopMagic: from n/a through <= 4.5.6.
- Product
- ShopMagic
- Affected
- up to 4.5.6
- What to do
- Affects up to 4.5.6. Update ShopMagic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 18, 2025RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login: PHP Object InjectionCVE-2017-20208 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to PHP Object Injection in all versions up to 3.7.9.3 (exclusive) via deserialization of untrusted input from the is_expired_by_date() function. This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain allows attackers to fetch a remote file and install it on the site.
- Product
- RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
- Affected
- up to 3.7.9.3
- What to do
- Affects up to 3.7.9.3. Update RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Oct 8, 2025RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login: SQL InjectionCVE-2025-11204 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 6.0.6.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator access or higher, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. An unauthenticated attacker could utilize an injected Cross-Site Scripting via user-agent on form submission to leverage this to achieve Reflected Cross-Site Scripting.
- Product
- RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
- Affected
- up to 6.0.6.2
- What to do
- Affects up to 6.0.6.2. Update RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.