New Plugin Vulnerabilities This Week (Ending June 10, 2026)

Newly disclosed vulnerabilities require prompt attention. Check whether a patched version is available and update affected plugins as quickly as possible. Where no fix exists yet, consider deactivating the plugin until the author releases a patch.

20 new vulnerabilities were disclosed in the 7 days ending June 10, 2026. Check whether a patched version is available for each affected plugin and update without delay.

20 New Vulnerabilities

• Zzypento-blocksLow · Zypento Blocks <= 1.0.6 – Authenticated (Author+) Stored Cross-Site Scripting via Table of Contents Block
• Zzynith-seoLow · Zynith SEO <= 7.4.9 – Missing Authorization to Unauthenticated Arbitrary Option Deletion
• Zzynith-seoLow · Zynith SEO <= 7.4.9 – Missing Authorization to Unauthenticated Settings Update
• Zzynith-seoLow · Zynith SEO <= 7.4.9 – Unauthenticated Stored Cross-Site Scripting
• Zzx-csv-uploadLow · ZX_CSV Upload <= 1 – Authenticated (Admin+) SQL Injection
• Zzweb-social-mobileLow · ZWeb – Social Mobile <= 1.0.0 – Authenticated (Admin+) Stored Cross-Site Scripting
• Zzuppler-online-orderingLow · Zuppler Online Ordering <= 2.1.0 – Cross-Site Request Forgery to Stored Cross-Site Scripting
• Zzt-captchaLow · ZT Captcha <= 1.0.4 – Cross-Site Request Forgery to Settings Update
• Zzstore-manager-basicLow · zStore Manager Basic <= 3.311 – Missing Authorization to Authenticated (Subscriber+) Cache Clearing
• ZzotpressLow · ZotPress <= 7.3.15 – Authenticated (Author+) Stored Cross-Site Scripting via 'nickname'
• ZzotpressLow · Zotpress <= 7.3.4 – Reflected Cross-Site Scripting via 'PHP_SELF'
• ZzotpressLow · Zotpress <= 7.3.12 – Missing Authorization
• ZzotpressLow · Zotpress <= 7.3.7 – Authenticated (Contributor+) SQL Injection
• ZzotpressLow · Zotpress <= 7.3.3 – Reflected Cross-Site Scripting
• ZzotpressLow · Zotpress < 6.1.3 – SQL Injection
• ZzotpressLow · Zotpress <= 7.3.10 – Authenticated (Contributor+) Stored Cross-Site Scripting
• ZzotpressLow · Zotpress <= 7.3.9 – Authenticated (Contributor+) Cross-Site Scripting
• Zzopim-live-chatLow · Zendesk Chat < 1.2.6 – Cross-Site Scripting
• Zzoorum-commentsLow · Zoorum Comments <= 0.9 – Cross-Site Request Forgery to Stored Cross-Site Scripting
• ZzooomLow · Zooom <= 1.1.0 – Authenticated (Contributor+) Stored Cross-Site Scripting

Where no fix is available yet, consider temporarily deactivating the affected plugin and monitoring the plugin author's changelog for a security release.

Report generated automatically on June 12, 2026 from live scan data and configured vulnerability feeds. Verify findings independently before making production decisions.