WordPress CVEs

CVE-2026-16253 August 12, 2026

The Total Upkeep WordPress plugin before 1.17.3 does not adequately protect the secret that authorizes its backup-restore functionality and exposes it to unauthenticated users, allowing them to disclose sensitive backup information and to force… Full details

HIGH 7.5

CVE-2026-16066 August 12, 2026

The Welcart e-Commerce WordPress plugin before 2.11.34 does not sanitise or escape a product field before outputting it on the product pages, allowing users with the Author role and above to inject arbitrary web… Full details

MEDIUM 5.4

CVE-2026-16051 August 12, 2026

The wpmudev-updates WordPress plugin before 5.0.1 does not verify the integrity of the packages installed through its remote management interface, nor protect those requests against replay, allowing an attacker able to obtain or replay… Full details

CRITICAL 9.8

CVE-2026-15388 August 12, 2026

The Cookie Consent WordPress plugin before 0.0.10 does not correctly enforce its intended administrator-only capability check on its consent-settings REST routes, so they fall back to an authentication-only gate, allowing any authenticated user such… Full details

MEDIUM 4.3

CVE-2026-15249 August 12, 2026

The Patterns Kit WordPress plugin through 1.0.3 does not escape a link attribute before its client-side script inserts it into the page, allowing users with a role as low as Contributor to store a… Full details

MEDIUM 5.4

CVE-2026-15039 August 12, 2026

The giftware WordPress plugin before 4.2.10 does not validate the type of uploaded files in one of its upload paths, allowing unauthenticated users to upload arbitrary files, including PHP code, which can lead to… Full details

CRITICAL 9.8

CVE-2026-14925 August 12, 2026

The Import WP WordPress plugin before 2.14.23 does not perform any authorization check on one of its export-file download handlers, allowing unauthenticated attackers to download export files generated by administrators, which may contain user… Full details

HIGH 7.5

CVE-2026-14859 August 12, 2026

The WP Crowdfunding WordPress plugin before 2.2.1 does not check the campaign-submission capability in one of its AJAX actions, allowing any authenticated users such as Subscribers to create crowdfunding campaign posts despite not being… Full details

MEDIUM 4.3

CVE-2026-14858 August 12, 2026

The WP Crowdfunding WordPress plugin before 2.2.1 does not verify order ownership before returning order details, allowing any authenticated users such as Subscribers to read the personal data of any WooCommerce order and enumerate… Full details

MEDIUM 4.3

CVE-2026-14857 August 12, 2026

The WP Crowdfunding WordPress plugin before 2.2.1 does not verify ownership of a campaign before allowing its update history to be modified and a notification email sent to its backers, allowing any authenticated users… Full details

MEDIUM 4.3

CVE-2026-13613 August 12, 2026

The KiviCare WordPress plugin before 4.5.2 does not properly sanitise and escape user-supplied parameters before using them in a SQL query, allowing authenticated users with a clinic staff-level role to perform SQL injection. Full details

HIGH 8.8

CVE-2026-13612 August 12, 2026

The KiviCare WordPress plugin before 4.5.2 does not verify that the requesting user owns the records being accessed, allowing authenticated patient-level users to read other patients' bills, invoices and appointment details. Full details

MEDIUM 4.3

CVE-2026-13177 August 12, 2026

The Eventin WordPress plugin before 4.1.20 does not properly restrict access to individual order records, allowing users with contributor-level access and above to read other customers' order data including personal information by iterating order… Full details

MEDIUM 4.3

CVE-2026-13171 August 12, 2026

The Eventin WordPress plugin before 4.1.20 does not perform an authorization check on its waiting-list registration handler, allowing unauthenticated users to create WordPress user accounts for arbitrary email addresses and inject order records. Full details

HIGH 8.2

CVE-2026-13168 August 12, 2026

The Eventin WordPress plugin before 4.1.20 does not properly restrict access to stored customer records, allowing users with contributor-level access and above to read other customers' personal data such as names and email addresses. Full details

MEDIUM 6.5

CVE-2026-12976 August 12, 2026

The LearnPress WordPress plugin before 4.4.4 does not verify that a user is enrolled in a course before processing AI-assistant requests against that course's lesson content, allowing any authenticated user such as a subscriber… Full details

MEDIUM 6.5

CVE-2026-18961 August 12, 2026

The Social Login, Passkeys, Magic Link & Email OTP – Passwordless Login by VentraConnect plugin for WordPress is vulnerable to Authentication Bypass via Unverified Provider Email in all versions up to, and including, 1.4.3.… Full details

HIGH 8.1

CVE-2026-15606 August 11, 2026

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.29.9. This is due to the plugin not properly verifying that a user is… Full details

HIGH 8.8

CVE-2026-19091 August 11, 2026

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_revision function in all versions up… Full details

HIGH 8.1

CVE-2026-16230 August 11, 2026

The Formidable Digital Signatures plugin for WordPress is vulnerable to file deletion due to insufficient file path validation in the delete_file function in all versions up to, and including, 3.0.6. This makes it possible… Full details

CRITICAL 9.8

CVE-2026-13457 August 11, 2026

The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 0.1.3.6 via the (top-level script) function. This is due… Full details

HIGH 7.5

CVE-2026-15426 August 11, 2026

The AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 10.11.1. This is due to the… Full details

HIGH 8.8

CVE-2026-14549 August 11, 2026

The Ray Enterprise Translation WordPress plugin through 1.7.3 does not perform any capability or nonce checks on one of its AJAX actions, allowing any authenticated user, including Subscribers, to add or delete the site's… Full details

MEDIUM 4.3

CVE-2026-14548 August 11, 2026

The Ray Enterprise Translation WordPress plugin through 1.7.3 does not perform any capability or nonce checks on one of its AJAX actions, allowing any authenticated user, including Subscribers, to overwrite the administrator-configured translation API… Full details

MEDIUM 6.5

CVE-2026-16974 August 11, 2026

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the post_meta Shortcode in all versions up to, and including, 6.2.0 due to insufficient… Full details

MEDIUM 6.4

CVE-2026-73033 August 10, 2026

Sucuri Security WordPress plugin through version 2.7.3 contains a path traversal vulnerability in the pageIntegritySubmission() method in src/integrity.lib.php that allows authenticated administrators to delete arbitrary files by supplying directory traversal sequences in the sucuriscan_integrity… Full details

HIGH 7

CVE-2026-19089 August 10, 2026

The Product Input Fields for WooCommerce WordPress plugin before 2.0.2 does not validate uploaded file types when its accepted-types setting is left empty, which its own documentation advertises as accepting all files, allowing unauthenticated… Full details

CRITICAL 9.8

CVE-2026-19077 August 10, 2026

The Duplicate Post WordPress plugin before 1.5.5 does not perform per-object authorisation checks in its bulk copy and delete operations, allowing any user whose role an administrator has granted Duplicate Post WordPress plugin before… Full details

MEDIUM 6.5

CVE-2026-19074 August 10, 2026

The Advanced Classifieds & Directory Pro Advanced Classifieds & Directory Pro WordPress plugin before 3.4.3 ( Full details

MEDIUM 5.3

CVE-2026-19053 August 10, 2026

The ProSolution WP Client WordPress plugin before 2.0.6 does not sanitise and escape a parameter before using it in a SQL statement reachable by unauthenticated visitors, leading to a blind SQL injection. Full details

CRITICAL 9.1

CVE-2026-19049 August 10, 2026

The ProSolution WP Client WordPress plugin before 2.0.9 does not sanitise a cookie value before using it in SQL queries, and processes that cookie on every request without any authentication or capability check, allowing… Full details

HIGH 8.6

CVE-2026-18960 August 10, 2026

The Block User Account WordPress plugin before 2.0.1 does not enforce its account block on every authentication path, allowing a blocked user who holds an application password created before the block to retain their… Full details

MEDIUM 5.4

CVE-2026-18946 August 10, 2026

The Contact Form to Any API WordPress plugin before 3.0.7 does not use a random filename when copying files uploaded through contact forms into a publicly accessible directory, allowing unauthenticated attackers to enumerate and… Full details

HIGH 7.5

CVE-2026-18934 August 10, 2026

The RSS Aggregator by Feedzy WordPress plugin before 5.2.6 does not verify that the requesting user owns or is allowed to edit the import job named in the request, allowing users with author-level access… Full details

MEDIUM 5.5

CVE-2026-18786 August 10, 2026

The CheckView WordPress plugin before 2.3.2 does not restrict its REST API authentication filter to its own routes and unconditionally discards the authentication error raised for any request whose URI merely contains a CheckView… Full details

HIGH 8.8

CVE-2026-18666 August 10, 2026

The Library Management System WordPress plugin before 3.6.7 does not sanitize and escape a user-supplied parameter before using it in a SQL statement, allowing users with a role as low as Subscriber to perform… Full details

MEDIUM 4.3

CVE-2026-18470 August 10, 2026

The Login & Register Forms WordPress plugin before 4.0.2 does not verify that a password reset request comes from the account's owner, and does not adequately redact the address returned in its response, allowing… Full details

HIGH 7.5

CVE-2026-18469 August 10, 2026

The Login & Register Forms WordPress plugin before 4.0.2 does not enforce its password reset attempt limit against a server-derived value, keying both the verification code and the per-source attempt counter on client-controlled data,… Full details

HIGH 8.1

CVE-2026-18468 August 10, 2026

The Login & Register Forms WordPress plugin before 4.0.2 does not bind the password reset verification state to the account being reset or to the party that completed the verification, keying it instead on… Full details

HIGH 8.1

CVE-2026-18200 August 10, 2026

The FoodBoxBooker WordPress plugin before 1.0.8 does not verify that the user account being updated belongs to the user making the request, allowing authenticated users, with Subscriber-level access and above, to modify the profile… Full details

MEDIUM 4.3

CVE-2026-18030 August 10, 2026

The BricksForge WordPress plugin before 3.1.8.8 does not verify the identity of the requester when processing a password change submitted through one of its form actions, allowing unauthenticated attackers to set an arbitrary password… Full details

HIGH 8.1

CVE-2026-17542 August 10, 2026

The File Manager WordPress plugin before 6.9.1 does not perform any capability check on one of its file manager connector endpoints, allowing any authenticated user, such as a subscriber, to browse the entire WordPress… Full details

HIGH 7.5

CVE-2026-17541 August 10, 2026

The File Manager WordPress plugin before 6.9.1 does not have authorisation checks on one of its REST API routes, allowing unauthenticated users to read its file activity log, disclosing the file operations performed on… Full details

HIGH 7.5

CVE-2026-17540 August 10, 2026

The File Manager WordPress plugin before 6.9.1 does not properly authorise its file management commands, allowing any authenticated user, such as a subscriber, to read and delete arbitrary files under the WordPress installation directory,… Full details

HIGH 8.8

CVE-2026-17023 August 10, 2026

The Salon Booking System WordPress plugin through 10.30.33 does not perform any capability check or validate an OAuth state value on its Google Calendar authorization callback, which is also hooked for unauthenticated users, allowing… Full details

MEDIUM 4.8

CVE-2026-17022 August 10, 2026

The Salon Booking System WordPress plugin before 10.30.34 does not properly validate a booking's ownership token before loading it in its booking-wizard confirmation steps, allowing unauthenticated attackers to disclose other customers' booking records, including… Full details

HIGH 7.5

CVE-2026-17021 August 10, 2026

The Salon Booking System WordPress plugin before 10.30.34 does not properly restrict access to some of its booking-modification AJAX actions and does not verify ownership of the targeted booking, allowing unauthenticated users to tamper… Full details

MEDIUM 5.3

CVE-2026-17020 August 10, 2026

The Salon Booking System WordPress plugin through 10.31.0 does not verify that a requested booking belongs to the caller on one of its REST API endpoints, requiring only a basic read capability, allowing any… Full details

MEDIUM 4.3

CVE-2026-17019 August 10, 2026

The JetEngine WordPress plugin before 3.8.13.1 does not sanitise uploaded SVG files before storing and serving them, and does not adequately restrict who can upload them, allowing unauthenticated attackers to upload a file containing… Full details

MEDIUM 6.1

CVE-2026-17018 August 10, 2026

The CubeWP Framework WordPress plugin through 1.1.30 does not perform a per-object read authorization check, nor restrict which metadata keys may be requested, on one of its REST API endpoints, allowing users with the… Full details

MEDIUM 4.9