Threat Log

Nothing in the entire threat log matches that search. Try a shorter term, for example just the product name or the CVE number.

1. For the record Wordfence

   Cozy Blocks

   CVE-2026-15393

   Affects you if you run Cozy Blocks up to and including 2.2.11 and your installation has users with the Contributor role or higher.

   An insufficiently sanitized block attribute allows an authenticated user with Contributor rights to inject malicious scripts into pages. The scripts execute whenever someone accesses the affected page. This requires an account that can edit content but does not have full control over the installation.

   To my knowledge, this vulnerability is not actively exploited. The likelihood of exploitation is low. I still classify it as knowledge because a Contributor account is easy to obtain on many installations and the impact can be serious.

   Update Cozy Blocks to 2.2.12. The update closes the hole.

   Affected

   Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 700+ Patterns, 58 Blocks & Templates

   Fixed in

   2.2.12

   CVSS

   6.4
   source security@wordfence.com

   Login required

   yes, user account

   Likely to be exploited

   0.25 %
   percentile 16.5

   Type

   CWE-79

   Actively exploited

   not on the KEV list

   Published

   2026-07-28

   Sources: NVD · EPSS · Wordfence
   Includes data from the CVE Program, © MITRE Corporation.

2. For the record Wordfence

   Database for CF7

   CVE-2026-13425

   Affects you if you run Database for CF7 in version 1.2.6 or earlier and a contact form is reachable from the outside. With a contact form, that is the default.

   A stored cross-site scripting hole in the Database for CF7 plugin. An attacker can pass an array to an ordinary text field, such as your name, through the public REST API of Contact Form 7. The plugin stores the input unchecked, and the browser executes the injected script when the page is opened. No login is required, and the hole is reachable from the outside.

   The CVSS score of 7.2 and the low exploitation probability of 0.2 percent sound harmless. They are not. The hole requires no login, and a script running in the context of a WordPress page can take over sessions or create users. The low EPSS number only says that it is not yet exploited at scale, not that it is safe.

   Update the plugin to a version after 1.2.6 as soon as the vendor provides one. No interim fix is known for this hole, only the update helps.

   Affected

   Database for CF7

   CVSS

   7.2
   source security@wordfence.com

   Login required

   no

   Likely to be exploited

   0.25 %
   percentile 16.2

   Type

   CWE-79

   Actively exploited

   not on the KEV list

   Published

   2026-07-28

   Sources: NVD · EPSS · Wordfence
   Includes data from the CVE Program, © MITRE Corporation.

3. For the record Wordfence

   GTM4WP – A Google Tag Manager (GTM) plugin for WordPress

   CVE-2026-16597

   Affects you if you run GTM4WP version 1.22.3 or older with the WooCommerce order data integration enabled.

   An attacker can place a guest checkout order without an account and store a script in a billing field, such as the first name. That script later executes in the browser of another user when they access the affected page. The vulnerability exists because input from WooCommerce fields is not sufficiently sanitized before being output.

   Update GTM4WP to version 1.22.4.

   Affected

   GTM4WP – A Google Tag Manager (GTM) plugin for WordPress

   Fixed in

   1.22.4

   CVSS

   7.2
   source security@wordfence.com

   Login required

   no

   Likely to be exploited

   0.24 %
   percentile 15.3

   Type

   CWE-79

   Actively exploited

   not on the KEV list

   Published

   2026-07-28

   Sources: NVD · EPSS · Wordfence
   Includes data from the CVE Program, © MITRE Corporation.

4. For the record Wordfence

   Booking System Trafft

   CVE-2026-8791

   Affects you if you have the Booking System Trafft plugin up to version 1.0.17 on your WordPress installation and operate it in agency mode.

   An attacker with a subscriber-level account can exploit a stored cross-site scripting vulnerability to plant scripts on the website. This is done by abusing a missing capability check in the `set_options` AJAX action. The required nonce is visible to any authenticated user on every admin page. The stored script runs on all front-end pages that the plugin includes.

   Update the plugin to a version that closes the vulnerability. The source does not name the fixed release.

   Affected

   Booking System Trafft

   Fixed in

   1.0.18

   CVSS

   6.4
   source security@wordfence.com

   Login required

   yes, user account

   Likely to be exploited

   0.24 %
   percentile 15.3

   Type

   CWE-79

   Actively exploited

   not on the KEV list

   Published

   2026-07-28

   Sources: NVD · EPSS · Wordfence
   Includes data from the CVE Program, © MITRE Corporation.

5. For the record Wordfence

   Element Pack Addons for Elementor

   CVE-2026-65502

   Affects you if you run Element Pack Addons for Elementor up to and including version 8.7.13.

   A missing authorization check in the plugin. An attacker can access functions without logging in that are normally reserved for a user with higher privileges. What exactly they can do with it depends on which of the affected functions are active on your installation. The vulnerability is not on the KEV list and the likelihood of exploitation is near zero, which is why it is listed as informational.

   Update to the next version after 8.7.13. The source does not name the exact version with the fix.

   Affected

   Element Pack Addons for Elementor – Elementor Widgets, Elementor Templates, Elementor Addons

   Fixed in

   8.7.14

   CVSS

   5.3
   source audit@patchstack.com

   Login required

   no

   Likely to be exploited

   0.24 %
   percentile 15.1

   Type

   CWE-290

   Actively exploited

   not on the KEV list

   Published

   2026-07-28

   Sources: NVD · EPSS · Wordfence
   Includes data from the CVE Program, © MITRE Corporation.

6. For the record Wordfence

   Event Booking Manager for WooCommerce

   CVE-2026-17166

   Affects you if you run Event Booking Manager for WooCommerce up to and including version 5.3.7 and users with the role Contributor or higher have access to the WordPress backend.

   The plugin does not check whether a user has the necessary permissions during an Ajax call. An authenticated user with the role Contributor or higher can modify the site-wide payment settings. This includes enabling WooCommerce payments, cart redirect behavior, login requirements for checkout, and the status of processed bookings. An attacker could redirect the booking flow or disable payments.

   The vulnerability requires an account. That makes it less urgent than one exploitable from the outside without authentication. It should still be closed before an attacker combines it with another vulnerability that gives them an account.

   Update to version 5.3.8.

   Affected

   Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar

   Fixed in

   5.3.8

   CVSS

   4.3
   source security@wordfence.com

   Login required

   yes, user account

   Likely to be exploited

   0.23 %
   percentile 14.2

   Type

   CWE-862

   Actively exploited

   not on the KEV list

   Published

   2026-07-28

   Sources: NVD · EPSS · Wordfence
   Includes data from the CVE Program, © MITRE Corporation.

7. For the record Wordfence

   WowStore

   CVE-2026-17162

   Affects you if you run the WowStore plugin in version 4.4.24 or earlier and have registered users with at least a Contributor role.

   An attacker with a Contributor account can store malicious script in a block attribute. The script runs whenever someone visits the affected page. On its own this is annoying but not earth-shattering, because the attacker needs an account. Combined with another vulnerability that provides one, it becomes an effective attack on every visitor to the site.

   Update to version 4.5.0. The source does not name a workaround.

   Affected

   WowStore – Store Builder & Product Blocks for WooCommerce

   Fixed in

   4.5.0

   CVSS

   6.4
   source security@wordfence.com

   Login required

   yes, user account

   Likely to be exploited

   0.19 %
   percentile 9.2

   Type

   CWE-79

   Actively exploited

   not on the KEV list

   Published

   2026-07-28

   Sources: NVD · EPSS · Wordfence
   Includes data from the CVE Program, © MITRE Corporation.

8. For the record Wordfence

   WowStore – Store Builder & Product Blocks for WooCommerce

   CVE-2026-17161

   Affects you if you run the WowStore plugin in a version up to 4.4.24 and users with the Contributor role or higher have access to the editor.

   Stored XSS via a block attribute. An authenticated user with at least Contributor privileges can place scripts in the editor that execute in the browser of other visitors when the page is loaded. The save-time sanitization fails because the payload sits inside a JSON comment within a Gutenberg delimiter block and survives that way.

   The attacker needs an account but does not need to be an administrator. That makes the vulnerability relevant in multi-user environments, such as shops with external product maintainers.

   Update to version 4.5.0. The source does not name a workaround.

   Affected

   WowStore – Store Builder & Product Blocks for WooCommerce

   Fixed in

   4.5.0

   CVSS

   6.4
   source security@wordfence.com

   Login required

   yes, user account

   Likely to be exploited

   0.19 %
   percentile 9.2

   Type

   CWE-79

   Actively exploited

   not on the KEV list

   Published

   2026-07-28

   Sources: NVD · EPSS · Wordfence
   Includes data from the CVE Program, © MITRE Corporation.

9. For the record Wordfence

   Contact Form to Any API

   CVE-2026-15735

   Affects you if you run the Contact Form to Any API plugin in versions up to and including 3.0.6 and your installation has users with the Contributor role or higher that you do not fully control.

   An attacker with a Contributor account can store malicious scripts in the plugin's post meta data. These scripts execute whenever someone accesses the affected page. The attacker needs an account for this, but no administrator privileges. The vulnerability is not listed in the KEV catalog of actively exploited flaws, and the likelihood of widespread exploitation is low at an EPSS of 0.2 %.

   On its own, this is a finding that requires an existing account. In an environment where you do not give the Contributor role to strangers, the risk is manageable. If you do, you should act.

   Update to version 3.0.7.

   Affected

   Contact Form to Any API

   Fixed in

   3.0.7

   CVSS

   6.4
   source security@wordfence.com

   Login required

   yes, user account

   Likely to be exploited

   0.19 %
   percentile 9.2

   Type

   CWE-79

   Actively exploited

   not on the KEV list

   Published

   2026-07-28

   Sources: NVD · EPSS · Wordfence
   Includes data from the CVE Program, © MITRE Corporation.

10. For the record Wordfence

    AffiliateWP

    CVE-2026-65515

    Affects you if you run AffiliateWP up to and including version 2.35.0.

    Stored cross-site scripting exploitable without authentication. An attacker can place malicious code in your installation that executes in your visitors' browsers. The plugin is widely deployed and the vulnerability reachable from the outside.

    Update to version 2.35.1.

    Affected

    AffiliateWP

    Fixed in

    2.35.1

    CVSS

    7.1
    source audit@patchstack.com

    Login required

    no

    Likely to be exploited

    0.18 %
    percentile 7.8

    Type

    CWE-79

    Actively exploited

    not on the KEV list

    Published

    2026-07-28

    Sources: NVD · EPSS · Wordfence
    Includes data from the CVE Program, © MITRE Corporation.