Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
30 results
Oct 23, 2026The Profile Builder WordPress plugin from 4.0.0 to 4.0.4 does not enforce its reCAPTCHA verification on all comment submission paths, allowing authenticated useCVE-2026-111965 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Profile Builder WordPress plugin from 4.0.0 to 4.0.4 does not enforce its reCAPTCHA verification on all comment submission paths, allowing authenticated users to bypass the anti-spam protection an administrator configured for the WordPress comment form.
- What to do
- Update the plugin to the newest version.
Oct 11, 2026Disable Users: Does not enforce its account-disabling control on all authentication pathsCVE-2026-88827 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Disable Users WordPress plugin through 1.0.5 does not enforce its account-disabling control on all authentication paths, allowing the holder of an account an administrator has disabled to continue authenticating with the account's full privileges.
- Product
- Disable Users
- Affected
- up to 1.0.5
- What to do
- Affects up to 1.0.5. Update Disable Users to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 3, 2026Unlimited Elements for Elementor: Does not sanitise file paths inside uploaded archives before extracting themCVE-2026-85015 · WordPress plugins & themes · reported by WPScanMedium 6.6
The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not sanitise file paths inside uploaded archives before extracting them, allowing authenticated users with access to its asset-management feature (Administrators by default, or Editors when a non-default Unlimited Elements for Elementor WordPress plugin before 2.0.21 setting is enabled) to write arbitrary files, including executable PHP, outside the intended upload directory on servers where the PHP zip extension is unavailable, leading to Remote Code Execution.
- Product
- Unlimited Elements for Elementor
- Fixed in
- 2.0.21
- What to do
- Update Unlimited Elements for Elementor to 2.0.21 or newer.
Sep 9, 2026SupportCandy: Does not perform an authorization check on one of its support-ticket attachment download pathsCVE-2026-81021 · WordPress plugins & themes · reported by WPScanMedium 5.3
The SupportCandy WordPress plugin before 3.5.3 does not perform an authorization check on one of its support-ticket attachment download paths, allowing unauthenticated attackers to read protected customer-uploaded attachments by enumerating sequential attachment identifiers.
- Product
- SupportCandy
- Fixed in
- 3.5.3
- What to do
- Update SupportCandy to 3.5.3 or newer.
Aug 28, 2026Breeze Cache: Does not sanitise a value taken from the request before using it to build the paths of the files it cachesCVE-2026-79706 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Breeze Cache WordPress plugin before 2.5.13 does not sanitise a value taken from the request before using it to build the paths of the files it caches, allowing unauthenticated attackers to create files at arbitrary locations on the server, outside the intended cache directory.
- Product
- Breeze Cache
- Fixed in
- 2.5.13
- What to do
- Update Breeze Cache to 2.5.13 or newer.
Aug 21, 2026Passster: Does not correctly match its own public endpoint pathsCVE-2026-17559 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Passster WordPress plugin before 4.3.9 does not correctly match its own public endpoint paths when deciding which REST API requests may bypass global password protection, comparing them as an unanchored substring of the request URI rather than against the resolved route, allowing an unauthenticated attacker to read the content of globally password-protected posts and pages.
- Product
- Passster
- Fixed in
- 4.3.9
- What to do
- Update Passster to 4.3.9 or newer.
Aug 20, 2026GutenKit: Does not sanitise uploaded SVG files on all of the upload paths it enablesCVE-2026-19697 · WordPress plugins & themes · reported by WPScanMedium 6.8
The GutenKit WordPress plugin before 2.5.0 does not sanitise uploaded SVG files on all of the upload paths it enables, allowing users with the file upload capability, such as Author, to upload a malicious SVG and perform Stored Cross-Site Scripting attacks against any user opening it, including administrators.
- Product
- GutenKit
- Fixed in
- 2.5.0
- What to do
- Update GutenKit to 2.5.0 or newer.
Aug 12, 2026giftware: Does not validate the type of uploaded files in one of its upload pathsCVE-2026-15039 · WordPress plugins & themes · reported by WPScanCritical 9.8
The giftware WordPress plugin before 4.2.10 does not validate the type of uploaded files in one of its upload paths, allowing unauthenticated users to upload arbitrary files, including PHP code, which can lead to remote code execution.
- Product
- giftware
- Fixed in
- 4.2.10
- What to do
- Update giftware to 4.2.10 or newer.
Aug 4, 2026Clearfy Cache: Does not perform a capability check in one of its admin-page dispatch pathsCVE-2026-16295 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Clearfy Cache WordPress plugin before 2.4.3 does not perform a capability check in one of its admin-page dispatch paths, allowing any authenticated user such as a Subscriber to render admin-only settings pages and disclose their contents, including administrative nonces, while the canonical page URL correctly restricts access.
- Product
- Clearfy Cache
- Fixed in
- 2.4.3
- What to do
- Update Clearfy Cache to 2.4.3 or newer.
Jul 23, 2026security-ninja-premium: Does not verify the second authentication factor in one of its two-factor authentication code pathsCVE-2026-14291 · WordPress plugins & themes · reported by WPScanHigh 7.5
The security-ninja-premium WordPress plugin before 5.290 does not verify the second authentication factor in one of its two-factor authentication code paths, allowing an unauthenticated attacker who knows a user's password to complete authentication without the one-time code and bypass enforced two-factor authentication for any account, including administrators. The affected two-factor module ships only in the premium build.
- Product
- security-ninja-premium
- Fixed in
- 5.290
- What to do
- Update security-ninja-premium to 5.290 or newer.
Jun 9, 2026Custom Block Builder: Does not consistently check the unfiltered_html capability across all paths that write to its block template code fieldsCVE-2026-8981 · WordPress plugins & themes · reported by WPScanLow 3.5
The Custom Block Builder WordPress plugin before 4.3.0 does not consistently check the unfiltered_html capability across all paths that write to its block template code fields, allowing administrators on multisite installations (or single-site installs with DISALLOW_UNFILTERED_HTML defined) to inject arbitrary JavaScript that executes for any visitor of pages embedding the affected block.
- Product
- Custom Block Builder
- Fixed in
- 4.3.0
- What to do
- Update Custom Block Builder to 4.3.0 or newer.
Feb 7, 2026Post Slides: Does not validate some shortcode attributes before using them to generate paths passed to include function/sCVE-2025-15491 · WordPress plugins & themes · reported by WPScanMedium 5.5
The Post Slides WordPress plugin through 1.0.1 does not validate some shortcode attributes before using them to generate paths passed to include function/s, allowing any authenticated users such as with contributor or higher roles to perform LFI attacks
- Product
- Post Slides
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update Post Slides to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2025CSV to SortTable: Does not validate some shortcode attributes before using them to generate paths passed to include function/sCVE-2025-13070 · WordPress plugins & themes · reported by WPScanMedium 6.6
The CSV to SortTable WordPress plugin through 4.2 does not validate some shortcode attributes before using them to generate paths passed to include function/s, allowing any authenticated users such as contributor to perform LFI attacks.
- Product
- CSV to SortTable
- Affected
- up to 4.2
- What to do
- Affects up to 4.2. Update CSV to SortTable to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 24, 2025PixelYourSite: Does not validate some URL parameters before using them to generate paths passed to function/sCVE-2025-10723 · WordPress plugins & themes · reported by WPScanLow 2.7
The PixelYourSite WordPress plugin before 11.1.2 does not validate some URL parameters before using them to generate paths passed to function/s, allowing any admins to perform LFI attacks
- Product
- PixelYourSite
- Fixed in
- 11.1.2
- What to do
- Update PixelYourSite to 11.1.2 or newer.
Oct 15, 2025BlindMatrix e-Commerce: Does not validate some shortcode attributes before using them to generate paths passed to include function/sCVE-2025-10406 · WordPress plugins & themes · reported by WPScanMedium 5.5
The BlindMatrix e-Commerce WordPress plugin before 3.1 does not validate some shortcode attributes before using them to generate paths passed to include function/s, allowing any authenticated users, such as contributors, to perform LFI attacks.
- Product
- BlindMatrix e-Commerce
- Fixed in
- 3.1
- What to do
- Update BlindMatrix e-Commerce to 3.1 or newer.
Apr 24, 2025The-wound WordPress theme through 0.0.1 does not validate some parameters before using them to generate paths passed to include function/s, allowing unauthenticCVE-2025-2558 · WordPress plugins & themes · reported by WPScanHigh 8.6
The-wound WordPress theme through 0.0.1 does not validate some parameters before using them to generate paths passed to include function/s, allowing unauthenticated users to perform LFI attacks and download arbitrary file from the server
- Affected
- up to 0.0.1
- What to do
- Affects up to 0.0.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 7, 2024Safe SVG: Has its sanitisation code is only running for paths that call wp_handle_uploadCVE-2024-8378 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Safe SVG WordPress plugin before 2.2.6 has its sanitisation code is only running for paths that call wp_handle_upload, but not for example for code that uses wp_handle_sideload which is often used to upload attachments via raw POST data.
- Product
- Safe SVG
- Fixed in
- 2.2.6
- What to do
- Update Safe SVG to 2.2.6 or newer.
Dec 26, 2023Hotel Booking Lite: Does not validate file paths provided via user inputCVE-2023-5991 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Hotel Booking Lite WordPress plugin before 4.8.5 does not validate file paths provided via user input, as well as does not have proper CSRF and authorisation checks, allowing unauthenticated users to download and delete arbitrary files on the server
- Product
- Hotel Booking Lite
- Fixed in
- 4.8.5
- What to do
- Update Hotel Booking Lite to 4.8.5 or newer.
Dec 18, 2023SiteOrigin Widgets Bundle: Does not validate user input before using it to generate paths passed to include function/sCVE-2023-6295 · WordPress plugins & themes · reported by WPScanHigh 7.2
The SiteOrigin Widgets Bundle WordPress plugin before 1.51.0 does not validate user input before using it to generate paths passed to include function/s, allowing users with the administrator role to perform LFI attacks in the context of Multisite WordPress sites.
- Product
- SiteOrigin Widgets Bundle
- Fixed in
- 1.51.0
- What to do
- Update SiteOrigin Widgets Bundle to 1.51.0 or newer.
Nov 6, 2023Awesome Support: Does not sanitize file pathsCVE-2023-5355 · WordPress plugins & themes · reported by WPScanHigh 8.1
The Awesome Support WordPress plugin before 6.1.5 does not sanitize file paths when deleting temporary attachment files, allowing a ticket submitter to delete arbitrary files on the server.
- Product
- Awesome Support
- Fixed in
- 6.1.5
- What to do
- Update Awesome Support to 6.1.5 or newer.
Oct 16, 2023WordPress Gallery: Does not validate some block attributes before using them to generate paths passed to include function/sCVE-2023-3279 · WordPress plugins & themes · reported by WPScanMedium 4.9
The WordPress Gallery Plugin WordPress plugin before 3.39 does not validate some block attributes before using them to generate paths passed to include function/s, allowing Admin users to perform LFI attacks
- Product
- WordPress Gallery
- Fixed in
- 3.39
- What to do
- Update WordPress Gallery to 3.39 or newer.
Oct 4, 2023Make Paths Relative: Cross-Site Request Forgery (CSRF)CVE-2023-27433 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in YAS Global Team Make Paths Relative allows Cross Site Request Forgery.This issue affects Make Paths Relative: from n/a through 1.3.0.
- Product
- Make Paths Relative
- Affected
- up to 1.3.0
- What to do
- Affects up to 1.3.0. Update Make Paths Relative to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jul 4, 2023ND Shortcodes: Does not validate some shortcode attributes before using them to generate paths passed to include function/sCVE-2023-1273 · WordPress plugins & themes · reported by WPScanHigh 8.8
The ND Shortcodes WordPress plugin before 7.0 does not validate some shortcode attributes before using them to generate paths passed to include function/s, allowing any authenticated users such as subscriber to perform LFI attacks
- Product
- ND Shortcodes
- Fixed in
- 7.0
- What to do
- Update ND Shortcodes to 7.0 or newer.
May 30, 2023Otter: Does not sanitize some user-controlled file paths before performing file operations on themCVE-2023-2288 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Otter WordPress plugin before 2.2.6 does not sanitize some user-controlled file paths before performing file operations on them. This leads to a PHAR deserialization vulnerability on PHP < 8.0 using the phar:// stream wrapper.
- Product
- Otter
- Fixed in
- 2.2.6
- What to do
- Update Otter to 2.2.6 or newer.
Apr 17, 2023Pricing Tables For WPBakery Page Builder (formerly Visual Composer): Does not validate some shortcode attributes before using them to generate paths passed to include function/sCVE-2023-1274 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Pricing Tables For WPBakery Page Builder (formerly Visual Composer) WordPress plugin before 3.0 does not validate some shortcode attributes before using them to generate paths passed to include function/s, allowing any authenticated users such as subscriber to perform LFI attacks
- Product
- Pricing Tables For WPBakery Page Builder (formerly Visual Composer)
- Fixed in
- 3.0
- What to do
- Update Pricing Tables For WPBakery Page Builder (formerly Visual Composer) to 3.0 or newer.
Apr 10, 2023WP Meta SEO: Does not validate image file paths before attempting to manipulate the image filesCVE-2023-1381 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WP Meta SEO WordPress plugin before 4.5.5 does not validate image file paths before attempting to manipulate the image files, leading to a PHAR deserialization vulnerability. Furthermore, the plugin contains a gadget chain which may be used in certain configurations to achieve remote code execution.
- Product
- WP Meta SEO
- Fixed in
- 4.5.5
- What to do
- Update WP Meta SEO to 4.5.5 or newer.
Full record and what to do →NVD recordblog.wpscan.comwpscan.com
Nov 7, 2022Import any XML or CSV File to: Is not validating the paths of files contained in uploaded zip archivesCVE-2022-2711 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Import any XML or CSV File to WordPress plugin before 3.6.9 is not validating the paths of files contained in uploaded zip archives, allowing highly privileged users, such as admins, to write arbitrary files to any part of the file system accessible by the web server via a path traversal vector.
- Product
- Import any XML or CSV File to
- Fixed in
- 3.6.9
- What to do
- Update Import any XML or CSV File to to 3.6.9 or newer.
Oct 17, 2019WordPress before 5.2.4 has a Server Side Request Forgery (SSRF) vulnerability because Windows paths are mishandled during certain validation of relative URLs.CVE-2019-17670 · WordPress plugins & themes · reported by MITRECritical 9.8
WordPress before 5.2.4 has a Server Side Request Forgery (SSRF) vulnerability because Windows paths are mishandled during certain validation of relative URLs.
- Fixed in
- 5.2.4
- What to do
- Update the plugin to 5.2.4 or newer.
Full record and what to do →NVD recordblog.wpscan.orgcore.trac.wordpress.org
Aug 22, 2019The insert-pages plugin before 3.2.4 for WordPress has directory traversal via custom template paths.CVE-2017-18586 · WordPress plugins & themes · reported by MITRECritical 9.1
The insert-pages plugin before 3.2.4 for WordPress has directory traversal via custom template paths.
- Product
- insert-pages
- Fixed in
- 3.2.4
- What to do
- Update insert-pages to 3.2.4 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Mar 1, 2018In the nextgen-gallery plugin before 2.2.50 for WordPress, gallery paths are not secured.CVE-2018-7586 · WordPress plugins & themes · reported by MITREHigh 7.5
In the nextgen-gallery plugin before 2.2.50 for WordPress, gallery paths are not secured.
- Product
- In the nextgen-gallery
- Fixed in
- 2.2.50
- What to do
- Update In the nextgen-gallery to 2.2.50 or newer.
Full record and what to do →NVD recordwordpress.orgwpvulndb.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.