Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
20 results
Oct 28, 2026Royal Addons for Elementor: Does not perform any authorization check before using the site owner's stored Mailchimp credential to add subscriber records to an audience chosen by the requestCVE-2026-107097 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Royal Addons for Elementor WordPress plugin before 1.7.1070 does not perform any authorization check before using the site owner's stored Mailchimp credential to add subscriber records to an audience chosen by the request, allowing unauthenticated attackers to inject arbitrary email addresses and contact details into the site owner's Mailchimp account as confirmed subscribers.
- Product
- Royal Addons for Elementor
- Fixed in
- 1.7.1070
- What to do
- Update Royal Addons for Elementor to 1.7.1070 or newer.
Oct 19, 2026BDM Digital Payment Gateway: Does not verify the credentials on its public payment-status update route and treats unset credentialsCVE-2026-106010 · WordPress plugins & themes · reported by WPScanMedium 5.3
The BDM Digital Payment Gateway WordPress plugin through 1.3.12 does not verify the credentials on its public payment-status update route and treats unset credentials as valid, allowing unauthenticated attackers to mark arbitrary WooCommerce orders as paid without payment in the default configuration.
- Product
- BDM Digital Payment Gateway
- Affected
- up to 1.3.12
- What to do
- Affects up to 1.3.12. Update BDM Digital Payment Gateway to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 30, 2026Newsletter – Send awesome emails from: Insufficiently Protected CredentialsCVE-2026-92537 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Newsletter – Send awesome emails from WordPress plugin for WordPress is vulnerable to Insufficiently Protected Credentials in all versions up to, and including, 9.3.9 The plugin's public click-tracking REST route `/tnp/l/` is registered with `permission_callback => '__return_true'` and, upon receiving a valid keyed-MD5 signature, calls `set_user_cookie()`, which emits a `Set-Cookie: newsletter=<id>-<raw_token>` response header to the requester because the subscriber object loaded via `get_user()` lacks the `_trusted` property, causing `get_user_key()` to return the raw token column value instead of its MD5-masked variant. This makes it possible for unauthenticated attackers who obtain any signed click-tracking URL for a target subscriber to receive that subscriber's permanent raw authentication cookie, which they can then use to export the subscriber's full PII record via the JSON profile-export endpoint (`?na=px`), rewrite the subscriber's stored profile (`?na=ps`), and silently unsubscribe the subscriber via the RFC-8058 one-click endpoint (`?na=ocu`), none of which require a nonce, password, or email challenge. Signed tracking URLs are embedded in every external link of ever
- Product
- Newsletter – Send awesome emails from
- Affected
- up to 9.3.9
- What to do
- Affects up to 9.3.9. Update Newsletter – Send awesome emails from to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 16, 2026All-in-One WP Migration and Backup: Insufficient Credential ProtectionCVE-2026-89064 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to Insufficient Credential Protection in versions up to, and including, 7.110. This is due to the `Ai1wm_Main_Controller::init()` method — registered on the `admin_init` hook, which fires unauthenticated on `admin-ajax.php` and `admin-post.php` requests — reading `$_SERVER['PHP_AUTH_USER']` and `$_SERVER['PHP_AUTH_PW']` from any incoming request and writing them to the `ai1wm_auth_header` option via `update_option()` as a reversible base64-encoded string, with no capability check, nonce verification, `is_user_logged_in()` check, or confirmation that Basic authentication actually succeeded. This makes it possible for unauthenticated attackers to capture into the database, in reversible base64 form, any WordPress Application Password or HTTP Basic credential presented to `/wp-admin/` by a legitimate integration, or to overwrite the stored credential with an attacker-chosen value by sending an anonymous request carrying a crafted `Authorization: Basic` header. This is particularly impactful in environments using WordPress Application Passwords for REST API or third-party integrations, as those credentials are tr
- Product
- All-in-One WP Migration and Backup
- Affected
- up to 7.110
- What to do
- Affects up to 7.110. Update All-in-One WP Migration and Backup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 5, 2026SEO Flow by LupsOnline: Does not correctly validate the credential supplied with its API requestsCVE-2026-78362 · WordPress plugins & themes · reported by WPScanCritical 9.8
The SEO Flow by LupsOnline WordPress plugin before 3.0.3 does not correctly validate the credential supplied with its API requests, allowing unauthenticated users to be served as the administrator who configured the SEO Flow by LupsOnline WordPress plugin before 3.0.3 and take over the site. Exploitation requires the SEO Flow by LupsOnline WordPress plugin before 3.0.3 to have been configured, which is its normal operating state.
- Product
- SEO Flow by LupsOnline
- Fixed in
- 3.0.3
- What to do
- Update SEO Flow by LupsOnline to 3.0.3 or newer.
Aug 17, 2026WooMS: Does not validate a user-supplied URL before using it in a server-side request and attaches stored third-party integration credentials to every such requestCVE-2026-13700 · WordPress plugins & themes · reported by WPScanMedium 5.9
The WooMS WordPress plugin through 9.14 does not validate a user-supplied URL before using it in a server-side request and attaches stored third-party integration credentials to every such request, allowing unauthenticated attackers to perform Server-Side Request Forgery and to disclose the configured integration credentials when the relevant data-sync feature is enabled.
- Product
- WooMS
- Affected
- up to 9.14
- What to do
- Affects up to 9.14. Update WooMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 5, 2026WPFormify – Stripe Payments with Form and Checkout: Unauthorized modification and deletion of Stripe payment credentialsCVE-2026-6627 · WordPress plugins & themes · reported by WordfenceHigh 8.2
The WPFormify – Stripe Payments with Form and Checkout plugin for WordPress is vulnerable to unauthorized modification and deletion of Stripe payment credentials in all versions up to, and including, 1.1.1. This is due to missing capability checks and nonce verification on the `wpf_stripe_callback_success()` and `wpf_stripe_disconnect()` functions, both hooked to `admin_init`. The `admin_init` hook fires on `admin-post.php` which is accessible without authentication. This makes it possible for unauthenticated attackers to overwrite the site's Stripe API credentials with attacker-controlled values (redirecting payments to the attacker's Stripe account) or disconnect the Stripe integration entirely by deleting the stored credentials.
- Product
- WPFormify – Stripe Payments with Form and Checkout
- Affected
- up to 1.1.1
- What to do
- Affects up to 1.1.1. Update WPFormify – Stripe Payments with Form and Checkout to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 2, 2026Gallery for Google Photos: Does not properly restrict access to the stored third-party OAuth credentials of the connected accountCVE-2026-15236 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Gallery for Google Photos WordPress plugin before 1.2.1 does not properly restrict access to the stored third-party OAuth credentials of the connected account, exposing the persistent access and refresh tokens to unauthenticated users and allowing long-term compromise of the linked account.
- Product
- Gallery for Google Photos
- Fixed in
- 1.2.1
- What to do
- Update Gallery for Google Photos to 1.2.1 or newer.
Jul 27, 2026Quiz and Survey Master (QSM): Does not implement rate limiting or standard failed-login auditing on its front-end credential-check functionality and returns distinct responses for valid and invalid accountsCVE-2026-14820 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Quiz and Survey Master (QSM) WordPress plugin before 11.1.3 does not implement rate limiting or standard failed-login auditing on its front-end credential-check functionality and returns distinct responses for valid and invalid accounts, allowing unauthenticated attackers to enumerate valid usernames and to brute-force passwords while bypassing brute-force protection Quiz and Survey Master (QSM) WordPress plugin before 11.1.3.
- Product
- Quiz and Survey Master (QSM)
- Fixed in
- 11.1.3
- What to do
- Update Quiz and Survey Master (QSM) to 11.1.3 or newer.
Mar 25, 2026Addi – Cuotas que se adaptan a ti: Use of Hard-coded CredentialsCVE-2026-27073 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Use of Hard-coded Credentials vulnerability in Addi Addi – Cuotas que se adaptan a ti buy-now-pay-later-addi allows Password Recovery Exploitation.This issue affects Addi – Cuotas que se adaptan a ti: from n/a through <= 2.0.4.
- Product
- Addi – Cuotas que se adaptan a ti
- Affected
- up to 2.0.4
- What to do
- Affects up to 2.0.4. Update Addi – Cuotas que se adaptan a ti to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025Helpie FAQ: Use of Hard-coded CredentialsCVE-2025-58659 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Use of Hard-coded Credentials vulnerability in Essekia Helpie FAQ helpie-faq allows Retrieve Embedded Sensitive Data.This issue affects Helpie FAQ: from n/a through <= 1.45.
- Product
- Helpie FAQ
- Affected
- up to 1.45
- What to do
- Affects up to 1.45. Update Helpie FAQ to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025Estonian Shipping Methods for WooCommerce: Use of Hard-coded CredentialsCVE-2025-58656 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Use of Hard-coded Credentials vulnerability in Risto Niinemets Estonian Shipping Methods for WooCommerce estonian-shipping-methods-for-woocommerce allows Retrieve Embedded Sensitive Data.This issue affects Estonian Shipping Methods for WooCommerce: from n/a through <= 1.7.2.
- Product
- Estonian Shipping Methods for WooCommerce
- Affected
- up to 1.7.2
- What to do
- Affects up to 1.7.2. Update Estonian Shipping Methods for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025WP Project Manager: Use of Hard-coded CredentialsCVE-2025-58269 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Use of Hard-coded Credentials vulnerability in weDevs WP Project Manager wedevs-project-manager allows Retrieve Embedded Sensitive Data.This issue affects WP Project Manager: from n/a through <= 2.6.25.
- Product
- WP Project Manager
- Affected
- up to 2.6.25
- What to do
- Affects up to 2.6.25. Update WP Project Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 20, 2024LiteSpeed Cache: Insufficiently Protected CredentialsCVE-2024-44000 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Insufficiently Protected Credentials vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache allows Authentication Bypass.This issue affects LiteSpeed Cache: from n/a through < 6.5.0.1.
- Product
- LiteSpeed Cache
- Fixed in
- 6.5.0.1
- What to do
- Update LiteSpeed Cache to 6.5.0.1 or newer.
Jun 6, 2023WPS Hide Login: Login page disclosure even when the settings of the plugin are set to hide the login page making it possible for unauthenticated attackers to brute force credentials on sitesCVE-2020-36710 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WPS Hide Login plugin for WordPress is vulnerable to login page disclosure even when the settings of the plugin are set to hide the login page making it possible for unauthenticated attackers to brute force credentials on sites in versions up to, and including, 1.5.4.2.
- Product
- WPS Hide Login
- Affected
- up to 1.5.4.2
- What to do
- Affects up to 1.5.4.2. Update WPS Hide Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordblog.nintechnet.comwordfence.com
Aug 1, 2022YaySMTP: Does not have capability check before displaying the Mailer Credentials in JS code for the settingsCVE-2022-2370 · WordPress plugins & themes · reported by WPScanMedium 6.5
The YaySMTP WordPress plugin before 2.2.1 does not have capability check before displaying the Mailer Credentials in JS code for the settings, allowing any authenticated users, such as subscriber to retrieve them
- Product
- YaySMTP
- Fixed in
- 2.2.1
- What to do
- Update YaySMTP to 2.2.1 or newer.
Jan 5, 2018(1) wp-dbmanager.php and (2) database-manage.php in the WP-DBManager (aka Database Manager) plugin before 2.7.2 for WordPress place credentials on the mysqldumpCVE-2014-8335 · WordPress plugins & themes · reported by MITREHigh 7.8
(1) wp-dbmanager.php and (2) database-manage.php in the WP-DBManager (aka Database Manager) plugin before 2.7.2 for WordPress place credentials on the mysqldump command line, which allows local users to obtain sensitive information by listing the process.
- Product
- (1) wp-dbmanager.php and (2) database-manage.php in the WP-DBManager (aka Database Manager)
- Fixed in
- 2.7.2
- What to do
- Update (1) wp-dbmanager.php and (2) database-manage.php in the WP-DBManager (aka Database Manager) to 2.7.2 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comopenwall.com
May 18, 2017In WordPress before 4.7.5, a Cross Site Request Forgery (CSRF) vulnerability exists in the filesystem credentials dialog because a nonce is not required for updCVE-2017-9064 · WordPress plugins & themes · reported by MITREHigh 8.8
In WordPress before 4.7.5, a Cross Site Request Forgery (CSRF) vulnerability exists in the filesystem credentials dialog because a nonce is not required for updating credentials.
- Fixed in
- 4.7.5
- What to do
- Update the plugin to 4.7.5 or newer.
Full record and what to do →NVD recorddebian.orgsecurityfocus.com
May 23, 2014The iMember360 plugin before 3.9.001 for WordPress does not properly restrict access, which allows remote attackers to obtain database credentials via the i4w_dCVE-2014-3848 · WordPress plugins & themes · reported by MITREMedium 5
The iMember360 plugin before 3.9.001 for WordPress does not properly restrict access, which allows remote attackers to obtain database credentials via the i4w_dbinfo parameter.
- Product
- iMember360
- Fixed in
- 3.9.001
- What to do
- Update iMember360 to 3.9.001 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comreleases.imember360.com
Jan 20, 2014Multiple cross-site scripting (XSS) vulnerabilities in the request_filesystem_credentials function in wp-admin/includes/file.php in WordPress before 3.0.2 allowCVE-2010-5294 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in the request_filesystem_credentials function in wp-admin/includes/file.php in WordPress before 3.0.2 allow remote servers to inject arbitrary web script or HTML by providing a crafted error message for a (1) FTP or (2) SSH connection attempt.
- Fixed in
- 3.0.2
- What to do
- Update the plugin to 3.0.2 or newer.
Full record and what to do →NVD recordcodex.wordpress.orgcore.trac.wordpress.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.