New Plugin Vulnerabilities This Week (Ending June 3, 2026)

Newly disclosed vulnerabilities require prompt attention. Check whether a patched version is available and update affected plugins as quickly as possible. Where no fix exists yet, consider deactivating the plugin until the author releases a patch.

20 new vulnerabilities were disclosed in the 7 days ending June 3, 2026. Check whether a patched version is available for each affected plugin and update without delay.

• Zzypento-blocks: LOW | Zypento Blocks <= 1.0.6 – Authenticated (Author+) Stored Cross-Site Scripting via Table of Contents Block
• Zzynith-seo: LOW | Zynith SEO <= 7.4.9 – Missing Authorization to Unauthenticated Arbitrary Option Deletion
• Zzynith-seo: LOW | Zynith SEO <= 7.4.9 – Missing Authorization to Unauthenticated Settings Update
• Zzynith-seo: LOW | Zynith SEO <= 7.4.9 – Unauthenticated Stored Cross-Site Scripting
• Zzx-csv-upload: LOW | ZX_CSV Upload <= 1 – Authenticated (Admin+) SQL Injection
• Zzweb-social-mobile: LOW | ZWeb – Social Mobile <= 1.0.0 – Authenticated (Admin+) Stored Cross-Site Scripting
• Zzuppler-online-ordering: LOW | Zuppler Online Ordering <= 2.1.0 – Cross-Site Request Forgery to Stored Cross-Site Scripting
• Zzt-captcha: LOW | ZT Captcha <= 1.0.4 – Cross-Site Request Forgery to Settings Update
• Zzstore-manager-basic: LOW | zStore Manager Basic <= 3.311 – Missing Authorization to Authenticated (Subscriber+) Cache Clearing
• Zzotpress: LOW | ZotPress <= 7.3.15 – Authenticated (Author+) Stored Cross-Site Scripting via 'nickname'
• Zzotpress: LOW | Zotpress <= 7.3.4 – Reflected Cross-Site Scripting via 'PHP_SELF'
• Zzotpress: LOW | Zotpress <= 7.3.12 – Missing Authorization
• Zzotpress: LOW | Zotpress <= 7.3.7 – Authenticated (Contributor+) SQL Injection
• Zzotpress: LOW | Zotpress <= 7.3.3 – Reflected Cross-Site Scripting
• Zzotpress: LOW | Zotpress < 6.1.3 – SQL Injection
• Zzotpress: LOW | Zotpress <= 7.3.10 – Authenticated (Contributor+) Stored Cross-Site Scripting
• Zzotpress: LOW | Zotpress <= 7.3.9 – Authenticated (Contributor+) Cross-Site Scripting
• Zzopim-live-chat: LOW | Zendesk Chat < 1.2.6 – Cross-Site Scripting
• Zzoorum-comments: LOW | Zoorum Comments <= 0.9 – Cross-Site Request Forgery to Stored Cross-Site Scripting
• Zzooom: LOW | Zooom <= 1.1.0 – Authenticated (Contributor+) Stored Cross-Site Scripting

Report generated automatically on June 3, 2026 from live scan data and configured vulnerability feeds. Verify findings independently before making production decisions.