Threat Log

Nothing in the entire threat log matches that search. Try a shorter term, for example just the product name or the CVE number.

1. For the record Wordfence

   Relevanssi

   CVE-2026-15941

   Affects you if you run Relevanssi or Relevanssi Premium and users with the Contributor role or higher have access to the WordPress dashboard.

   A SQL injection through the plugin's admin search. An attacker with a Contributor account can use it to blindly read data from the database. The attack takes time because the database response is not directly visible but must be inferred through time delays.

   The vulnerability is not on the KEV catalog of actively exploited flaws. A Contributor account is the prerequisite. That makes a mass attack unlikely, but it is suitable for a targeted attack on an installation where an attacker already has such an account.

   Update Relevanssi to 4.27.2 or Relevanssi Premium to 2.30.3.

   Affected

   Relevanssi Premium – A Better Search, Relevanssi – A Better Search

   Fixed in

   2.30.3, 4.27.2

   CVSS

   6.5
   source security@wordfence.com

   Login required

   yes, user account

   Likely to be exploited

   0.25 %
   percentile 16.3

   Type

   CWE-89

   Actively exploited

   not on the KEV list

   Published

   2026-08-04

   Sources: NVD · EPSS · Wordfence
   Includes data from the CVE Program, © MITRE Corporation.

2. For the record Wordfence

   Smash Balloon Social Photo Feed

   CVE-2026-15452

   Affects you if you run the Smash Balloon Social Photo Feed plugin in a version up to and including 6.11.3.

   A reflected cross-site scripting vulnerability. An attacker can place malicious code in the address bar. To do so, they need to trick someone with access to the site into clicking a crafted link. If that succeeds, the victim's browser executes the script as if it came from your site.

   The vulnerability is not listed in the CISA KEV catalog of actively exploited flaws. No active attack is currently known. That justifies the informational rating.

   Update to version 6.11.4.

   Affected

   Smash Balloon Social Photo Feed – Easy Social Feeds Plugin

   Fixed in

   6.11.4

   CVSS

   4.7
   source security@wordfence.com

   Login required

   no

   Likely to be exploited

   0.24 %
   percentile 15.1

   Type

   CWE-79

   Actively exploited

   not on the KEV list

   Published

   2026-08-04

   Sources: NVD · EPSS · Wordfence
   Includes data from the CVE Program, © MITRE Corporation.

3. For the record Wordfence

   VikRentItems Flexible Rental Management System

   CVE-2026-16143

   Affects you if you run the VikRentItems Flexible Rental Management System plugin in a version up to and including 1.2.1 and the guest booking form is enabled.

   An attacker can place a booking without an account and inject malicious code into the email field. The code is stored and later executed in the admin area as soon as someone views the booking. This is a classic stored XSS that enters through an insufficiently sanitized form field.

   The vulnerability is not critical because it requires interaction in the backend and the likelihood of exploitation is low. It is still listed here because it works without authentication and may appear on the managed systems.

   Update to version 1.2.2.

   Affected

   VikRentItems Flexible Rental Management System

   Fixed in

   1.2.2

   CVSS

   7.2
   source security@wordfence.com

   Login required

   no

   Likely to be exploited

   0.24 %
   percentile 14.7

   Type

   CWE-79

   Actively exploited

   not on the KEV list

   Published

   2026-08-04

   Sources: NVD · EPSS · Wordfence
   Includes data from the CVE Program, © MITRE Corporation.

4. For the record Wordfence

   Independent Analytics

   CVE-2026-17506

   Affects you if you run the Independent Analytics plugin in a version up to and including 2.15.0.

   An attacker can store malicious code in the analytics data without logging in. The code executes as soon as someone with the right permissions views the 404 statistics in the dashboard. The plugin sanitizes the submitted URLs in the wrong order, so a harmless-looking address turns into active HTML when displayed.

   Update to version 2.15.1.

   Affected

   Independent Analytics – WordPress Analytics Plugin

   Fixed in

   2.15.1

   CVSS

   7.2
   source security@wordfence.com

   Login required

   no

   Likely to be exploited

   0.23 %
   percentile 13.9

   Type

   CWE-79

   Actively exploited

   not on the KEV list

   Published

   2026-08-04

   Sources: NVD · EPSS · Wordfence
   Includes data from the CVE Program, © MITRE Corporation.

5. For the record Wordfence

   Football Pool

   CVE-2026-8790

   Affects you if you run the WordPress plugin Football Pool in a version up to and including 2.13.4 and use the Shoutbox widget.

   A reflected cross-site scripting in the Shoutbox widget. An attacker can craft a link or a page that sends a POST request to your site. If the security check fails, the injected code is echoed back into a logged-in visitor's browser without filtering. The attacker does not need an account for this, but they do need to trick someone who has one into submitting the manipulated request. That limits the immediate danger, which is why I am only noting this report.

   Update to version 2.13.5.

   Affected

   Football Pool

   Fixed in

   2.13.5

   CVSS

   6.1
   source security@wordfence.com

   Login required

   no

   Likely to be exploited

   0.22 %
   percentile 12.6

   Type

   CWE-79

   Actively exploited

   not on the KEV list

   Published

   2026-08-04

   Sources: NVD · EPSS · Wordfence
   Includes data from the CVE Program, © MITRE Corporation.

6. For the record Wordfence

   Contact Form Extender for Divi

   Wordfence advisory

   Affects you if you run the Contact Form Extender for Divi plugin in a version up to and including 1.0.6 on your WordPress site.

   A plugin for the Divi theme that can delete files on the server without the attacker being logged in. The file path validation is insufficient. An attacker can use this to delete arbitrary files, such as wp-config.php. That opens the door to a full site takeover.

   Update to version 1.0.7.

   Affected

   Contact Form Extender for Divi – Submissions DB & Extra Fields

   Fixed in

   1.0.7

   CVSS

   7.5
   source Wordfence

   Actively exploited

   not on the KEV list

   Published

   2026-08-04

   Sources: Wordfence
   Includes data from the CVE Program, © MITRE Corporation.

7. For the record Wordfence

   Online Scheduling and Appointment Booking System – Bookly

   CVE-2026-13395

   Affects you if you run Bookly in a version before 27.8 and the booking page is reachable from outside. It is, if you take appointments online.

   A SQL injection in the booking flow. A stranger can append parameters to the query without logging in and read the database. Password hashes are the least of what comes out. The flaw is not on the KEV list, but exploitation is simple and the plugin is widely deployed.

   Update to version 27.8 or newer. No workaround is known, only the update helps.

   Affected

   Online Scheduling and Appointment Booking System – Bookly

   Fixed in

   27.8

   CVSS

   8.6
   source 134c704f-9b21-4f2e-91b3-4a467353bcc0

   Login required

   no

   Likely to be exploited

   0.34 %
   percentile 26.5

   Type

   CWE-89

   Actively exploited

   not on the KEV list

   Published

   2026-08-03

   Sources: NVD · EPSS · Wordfence
   Includes data from the CVE Program, © MITRE Corporation.

8. For the record Wordfence

   MotoPress Hotel Booking

   CVE-2026-15235

   Affects you if you run MotoPress Hotel Booking in a version below 6.0.4 and allow users with low privileges, such as subscribers, to be created on your installation.

   An AJAX endpoint in the plugin returns a booking's full customer details without first checking whether the requester is authorized to see them. Any authenticated user, even a subscriber, can retrieve your customers' names, email addresses, phone numbers, and physical addresses. A data leak through the back door that requires no active exploitation, just an account.

   The vulnerability is not listed in the CISA KEV catalog of actively exploited vulnerabilities. That does not make it harmless, but there is currently no indication of ongoing attacks.

   Update to version 6.0.4.

   Affected

   MotoPress Hotel Booking

   Fixed in

   6.0.4

   CVSS

   4.3
   source 134c704f-9b21-4f2e-91b3-4a467353bcc0

   Login required

   yes, user account

   Likely to be exploited

   0.22 %
   percentile 13.1

   Type

   CWE-200

   Actively exploited

   not on the KEV list

   Published

   2026-08-03

   Sources: NVD · EPSS · Wordfence
   Includes data from the CVE Program, © MITRE Corporation.

9. Act now Wordfence

   ShopLentor Pro

   CVE-2026-61972

   Affects you if you run ShopLentor Pro up to and including version 2.8.5.

   A broken access control that can be exploited without logging in. An attacker can reach functions that should require an account. What exactly they do with that depends on which functions the plugin exposes in the vulnerable area. The source does not give a definitive list, but the hole opens the door to settings and data not meant for strangers.

   Update to version 2.8.6.

   Affected

   ShopLentor Pro

   Fixed in

   2.8.6

   CVSS

   5.3
   source audit@patchstack.com

   Login required

   no

   Likely to be exploited

   0.21 %
   percentile 11.9

   Type

   CWE-862

   Actively exploited

   not on the KEV list

   Published

   2026-08-01

   Sources: NVD · EPSS · Wordfence
   Includes data from the CVE Program, © MITRE Corporation.

10. This week Wordfence

    CubeWP Framework

    CVE-2026-13339

    Affects you if you use the CubeWP Framework plugin and its posts shortcode or widget is rendered on a page with AJAX loading enabled.

    A directory traversal flaw that lets anyone read arbitrary files without logging in. The plugin emits a security token into the page markup, so any visitor can read it. That defeats the protection meant to keep people from opening files outside the intended directory. The result is read access to configuration files and other sensitive data on the server.

    Update the plugin to the latest version and check whether AJAX loading for the widget or shortcode is still necessary.

    Affected

    CubeWP Framework

    Fixed in

    1.1.31

    CVSS

    7.5
    source security@wordfence.com

    Login required

    no

    Likely to be exploited

    0.64 %
    percentile 47.4

    Type

    CWE-22

    Actively exploited

    not on the KEV list

    Published

    2026-08-01

    Sources: NVD · EPSS · Wordfence
    Includes data from the CVE Program, © MITRE Corporation.