Updated 12 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

456new WordPress flaws this week

390,714entries in the database

5,893 results · page 10 of 118

Sep 18, 2026Filter Gallery: Authorization bypassCVE-2026-89138 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Filter Gallery plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.1.4. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to overwrite the title and content of arbitrary WordPress posts, write the _wp_attachment_image_alt meta key on arbitrary posts, and create or overwrite arbitrary ufg_gallery_* options.
Product
Filter Gallery
Affected
up to 1.1.4
What to do
Affects up to 1.1.4. Update Filter Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 18, 2026Magazine Blocks – Blog Designer, Magazine & Newspaper Website Builder, Page Builder with Posts Blocks, Post Grid: Authorization bypassCVE-2026-75017 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Magazine Blocks – Blog Designer, Magazine & Newspaper Website Builder, Page Builder with Posts Blocks, Post Grid plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.8.6. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to demote administrator-owned published builder templates (header, footer, front page, single, archive, 404, and search) to draft status and replace them with attacker-authored block content rendered site-wide, enabling defacement, phishing, and SEO spam. This is possible because the mzb-builder-template post type is registered with capability_type='post' and exposed via the REST API, and the _mzb_template meta key is accessible to any user with edit_posts capability, meaning Contributor-level users and above can trigger the vulnerable save_post() hook.
Product
Magazine Blocks – Blog Designer, Magazine & Newspaper Website Builder, Page Builder with Posts Blocks, Post Grid
Affected
up to 1.8.6
What to do
Affects up to 1.8.6. Update Magazine Blocks – Blog Designer, Magazine & Newspaper Website Builder, Page Builder with Posts Blocks, Post Grid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 18, 2026Foxtool All-in-One: Contact chat button, Custom login, Media optimize images: Authorization bypassCVE-2026-18317 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Foxtool All-in-One: Contact chat button, Custom login, Media optimize images plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.5.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to modify arbitrary subkeys of the foxtool_settings option, including enabling site-wide SVG uploads by toggling the media-up3 key, which can facilitate stored cross-site scripting via malicious SVG files.
Product
Foxtool All-in-One: Contact chat button, Custom login, Media optimize images
Affected
up to 2.5.3
What to do
Affects up to 2.5.3. Update Foxtool All-in-One: Contact chat button, Custom login, Media optimize images to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 18, 2026MasterStudy LMS: Does not verify that the requesting user owns the course before returning its enrolled-student dataCVE-2026-88844 · WordPress plugins & themes · reported by WPScanLow 2.7
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not verify that the requesting user owns the course before returning its enrolled-student data, allowing users with the MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50's Instructor role to disclose the names and email addresses of students enrolled in other instructors' courses.
Product
MasterStudy LMS
Fixed in
3.7.50
What to do
Update MasterStudy LMS to 3.7.50 or newer.
Full record and what to do →NVD record wpscan.com
Sep 18, 2026Easy Appointments: Does not perform an ownership or authorization check on its unauthenticated appointment-reservation endpoint before updating an existing appointment identified by a request-supplied idCVE-2026-87966 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Easy Appointments WordPress plugin before 4.0.2.2 does not perform an ownership or authorization check on its unauthenticated appointment-reservation endpoint before updating an existing appointment identified by a request-supplied id, allowing unauthenticated attackers to overwrite, and through a follow-on cleanup delete, arbitrary appointments.
Product
Easy Appointments
Fixed in
4.0.2.2
What to do
Update Easy Appointments to 4.0.2.2 or newer.
Full record and what to do →NVD record wpscan.com
Sep 18, 2026Easy Appointments: Does not use an unguessable token to authorize its mail-link appointment cancellation and confirmation actionCVE-2026-87965 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Easy Appointments WordPress plugin before 4.0.2.2 does not use an unguessable token to authorize its mail-link appointment cancellation and confirmation action, deriving the token from a hardcoded source-embedded salt and the appointment's creation timestamp, so unauthenticated attackers who know or guess that timestamp can cancel or confirm arbitrary appointments.
Product
Easy Appointments
Fixed in
4.0.2.2
What to do
Update Easy Appointments to 4.0.2.2 or newer.
Full record and what to do →NVD record wpscan.com
Sep 18, 2026Easy Form Builder by WhiteStudio: Does not validate a submitted value against the stored configuration for some of its form typesCVE-2026-85123 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Easy Form Builder by WhiteStudio WordPress plugin before 4.2.0 does not validate a submitted value against the stored configuration for some of its form types, allowing unauthenticated users to create WordPress accounts on a site whose owner has disabled registration.
Product
Easy Form Builder by WhiteStudio
Fixed in
4.2.0
What to do
Update Easy Form Builder by WhiteStudio to 4.2.0 or newer.
Full record and what to do →NVD record wpscan.com
Sep 18, 2026Easy Form Builder by WhiteStudio: Does not validate a submitted value against the stored configuration for some of its form typesCVE-2026-85122 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Easy Form Builder by WhiteStudio WordPress plugin before 4.2.0 does not validate a submitted value against the stored configuration for some of its form types, allowing unauthenticated users to store arbitrary content which is then rendered unescaped in an admin page, leading to Stored XSS.
Product
Easy Form Builder by WhiteStudio
Fixed in
4.2.0
What to do
Update Easy Form Builder by WhiteStudio to 4.2.0 or newer.
Full record and what to do →NVD record wpscan.com
Sep 18, 2026MasterStudy LMS: Does not perform per-object ownership or capability checksCVE-2026-81340 · WordPress plugins & themes · reported by WPScanLow 3.8
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not perform per-object ownership or capability checks when updating orders through its REST API, allowing users with the Instructor role to modify any order on the site, granting free course enrolment, revoking other users' paid enrolments, and tampering with order notes.
Product
MasterStudy LMS
Fixed in
3.7.50
What to do
Update MasterStudy LMS to 3.7.50 or newer.
Full record and what to do →NVD record wpscan.com
Sep 17, 2026Motors – Car Dealership & Classified Listings: Unauthorized access of dataCVE-2026-16750 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to unauthorized access of data due to missing authorization checks in mvl_ajax_dealer_load_cars() function in all versions up to, and including, 1.4.120. This makes it possible for unauthenticated attackers to retrieve draft, pending, private, and future car listings belonging to arbitrary users.
Product
Motors – Car Dealership & Classified Listings
Affected
up to 1.4.120
What to do
Affects up to 1.4.120. Update Motors – Car Dealership & Classified Listings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 17, 2026Contributor Cross Site Scripting (XSS) in Geo Mashup <= 1.13.21 versions.CVE-2026-78294 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Cross Site Scripting (XSS) in Geo Mashup <= 1.13.21 versions.
Affected
up to 1.13.21
What to do
Affects up to 1.13.21. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 17, 2026Unauthenticated Broken Access Control in Easy Invoice <= 2.3.8 versions.CVE-2026-66676 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Broken Access Control in Easy Invoice <= 2.3.8 versions.
Affected
up to 2.3.8
What to do
Affects up to 2.3.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 17, 2026Administrator SQL Injection in WPMasterToolKit <= 2.22.0 versions.CVE-2026-66624 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Administrator SQL Injection in WPMasterToolKit <= 2.22.0 versions.
Affected
up to 2.22.0
What to do
Affects up to 2.22.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 17, 2026Unauthenticated Cross Site Request Forgery (CSRF) in Asset CleanUp: Page Speed Booster <= 1.4.0.5 versions.CVE-2026-66571 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Request Forgery (CSRF) in Asset CleanUp: Page Speed Booster <= 1.4.0.5 versions.
Affected
up to 1.4.0.5
What to do
Affects up to 1.4.0.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 17, 2026Robokassa payment gateway for Woocommerce: Does not verify the authenticity of incoming payment notificationsCVE-2026-91017 · WordPress plugins & themes · reported by WPScanLow 3.7
The Robokassa payment gateway for Woocommerce WordPress plugin before 1.8.9 does not verify the authenticity of incoming payment notifications when its non-default deferred-payment feature is enabled, allowing unauthenticated attackers to forge a notification and mark arbitrary WooCommerce orders as paid or on-hold without payment or a valid signature.
Product
Robokassa payment gateway for Woocommerce
Fixed in
1.8.9
What to do
Update Robokassa payment gateway for Woocommerce to 1.8.9 or newer.
Full record and what to do →NVD record wpscan.com
Sep 17, 2026Master Addons for Elementor: Does not perform an authorization check on the AJAX action that deactivates its Popup Builder popupsCVE-2026-91015 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Master Addons for Elementor WordPress plugin before 3.1.9 does not perform an authorization check on the AJAX action that deactivates its Popup Builder popups, relying only on a nonce that is publicly output to every visitor, allowing unauthenticated attackers to permanently disable any popup on the site.
Product
Master Addons for Elementor
Fixed in
3.1.9
What to do
Update Master Addons for Elementor to 3.1.9 or newer.
Full record and what to do →NVD record wpscan.com
Sep 17, 2026Newsletter: Does not generate its email tracking signing key with sufficient entropy and signs its tracking links with an unkeyed hashCVE-2026-86824 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Newsletter WordPress plugin before 9.3.8 does not generate its email tracking signing key with sufficient entropy and signs its tracking links with an unkeyed hash, allowing an unauthenticated attacker who recovers that key offline to forge tracking links, obtain any subscriber's session token, and read and modify that subscriber's stored personal data.
Product
Newsletter
Fixed in
9.3.8
What to do
Update Newsletter to 9.3.8 or newer.
Full record and what to do →NVD record wpscan.com
Sep 17, 2026WPLP Cookie Consent: Does not escape a value submitted through a public endpoint for the JavaScript context it is later output in on an administrative screenCVE-2026-85130 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WPLP Cookie Consent WordPress plugin before 4.4.4 does not escape a value submitted through a public endpoint for the JavaScript context it is later output in on an administrative screen, allowing unauthenticated users to run arbitrary JavaScript in the session of an administrator who interacts with the logged entry. Only multisite installations are affected.
Product
WPLP Cookie Consent
Fixed in
4.4.4
What to do
Update WPLP Cookie Consent to 4.4.4 or newer.
Full record and what to do →NVD record wpscan.com
Sep 16, 2026In AVideo through 29.0, the autoCSRFGuard() function maintains a hardcoded allowlist of exempt basenames tested without directory context, allowing plugin filesCVE-2026-92579 · WordPress plugins & themes · reported by VulnCheckMedium 5.3
In AVideo through 29.0, the autoCSRFGuard() function maintains a hardcoded allowlist of exempt basenames tested without directory context, allowing plugin files matching core filenames to inherit CSRF exemptions. The LoginWordPress plugin file login.json.php inherits an exemption and unconditionally logs out authenticated users on cross-site POST requests before validating credentials.
Affected
up to 29.0
What to do
Affects up to 29.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com vulncheck.com
Sep 16, 2026Tutor LMS: Does not check that a user has access to a course before returning its lesson discussion contentCVE-2026-85572 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Tutor LMS WordPress plugin before 4.0.8 does not check that a user has access to a course before returning its lesson discussion content, allowing any authenticated user, such as a subscriber, to read comments from courses they are not enrolled in, including comments awaiting moderation.
Product
Tutor LMS
Fixed in
4.0.8
What to do
Update Tutor LMS to 4.0.8 or newer.
Full record and what to do →NVD record wpscan.com
Sep 16, 2026Xpro Addons — 140+ Widgets for Elementor: Does not validate or sanitize a widget link setting before storing and using it in a JavaScript navigation callCVE-2026-84088 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Xpro Addons — 140+ Widgets for Elementor WordPress plugin before 1.7.9 does not validate or sanitize a widget link setting before storing and using it in a JavaScript navigation call, allowing users with the contributor role and above to inject and store JavaScript that executes in the browser of anyone who interacts with the affected widget.
Product
Xpro Addons — 140+ Widgets for Elementor
Fixed in
1.7.9
What to do
Update Xpro Addons — 140+ Widgets for Elementor to 1.7.9 or newer.
Full record and what to do →NVD record wpscan.com
Sep 16, 2026Schema & Structured Data for WP & AMP: Does not check whether a post is password protected before including its content in the structured data it generatesCVE-2026-82124 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Schema & Structured Data for WP & AMP WordPress plugin before 1.66 does not check whether a post is password protected before including its content in the structured data it generates, allowing unauthenticated users to obtain the content of password protected posts via more than one public output route.
Product
Schema & Structured Data for WP & AMP
Fixed in
1.66
What to do
Update Schema & Structured Data for WP & AMP to 1.66 or newer.
Full record and what to do →NVD record wpscan.com
Sep 16, 2026WP Import Export Lite: Does not escape custom field names retrieved from the database before inserting them into the DOM of one of its administration screensCVE-2026-76558 · WordPress plugins & themes · reported by WPScanMedium 6.8
The WP Import Export Lite WordPress plugin before 3.9.33 does not escape custom field names retrieved from the database before inserting them into the DOM of one of its administration screens, allowing users with a role as low as contributor to perform Stored XSS attacks which will trigger in the browser of a high privileged user, such as an administrator, viewing that screen.
Product
WP Import Export Lite
Fixed in
3.9.33
What to do
Update WP Import Export Lite to 3.9.33 or newer.
Full record and what to do →NVD record wpscan.com
Sep 16, 2026TrueBooker – Appointment Booking and Scheduler System: Authorization bypassCVE-2026-14349 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.2.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to modify the email address of arbitrary user accounts, including administrators, which can be leveraged to reset the account's password and gain access to it.
Product
TrueBooker – Appointment Booking and Scheduler System
Affected
up to 1.2.3
What to do
Affects up to 1.2.3. Update TrueBooker – Appointment Booking and Scheduler System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 16, 2026Ad Inserter – Ad Manager & AdSense Ads: Authorization bypassCVE-2026-11984 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.8.16 due to a missing capability check on the `ai-debug-code` URL-parameter. This makes it possible for unauthenticated attackers to view administrator-configured header and footer code blocks that have been disabled from public display.
Product
Ad Inserter – Ad Manager & AdSense Ads
Affected
up to 2.8.16
What to do
Affects up to 2.8.16. Update Ad Inserter – Ad Manager & AdSense Ads to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 15, 2026The "Design Scuole Italia" WordPress theme is affected by multiple Authorization Bypass vulnerabilities in the dsi_pdf_generator and dsi_csv_generator functionsCVE-2026-87792 · WordPress plugins & themes · reported by a6d3dc9e-0591-4a13-bce7-0f5b31ff6158High 8.7
The "Design Scuole Italia" WordPress theme is affected by multiple Authorization Bypass vulnerabilities in the dsi_pdf_generator and dsi_csv_generator functions, allowing an unauthenticated attacker to access restricted "Circolare" content and registered users' data. An unauthenticated RSS feed at /circolare/feed/ further facilitates exploitation.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record github.com acn.gov.it
Sep 13, 2026User Registration & Membership: Does not check the capability of the user making a membership purchaseCVE-2026-86406 · WordPress plugins & themes · reported by WPScanHigh 7.5
The User Registration & Membership WordPress plugin before 5.2.8 does not check the capability of the user making a membership purchase, and does not validate the payment method or the plan submitted with it, allowing any authenticated user such as a subscriber to be granted the WordPress role attached to a paid plan without paying for it. Where the site owner has mapped a plan to a privileged role, this leads to privilege escalation up to administrator.
Product
User Registration & Membership
Fixed in
5.2.8
What to do
Update User Registration & Membership to 5.2.8 or newer.
Full record and what to do →NVD record wpscan.com
Sep 12, 2026rtMedia for WordPress, BuddyPress and bbPress: Time-based blind SQL InjectionCVE-2026-16482 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The rtMedia for WordPress, BuddyPress and bbPress plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'compare' parameter in all versions up to, and including, 4.7.11 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This is exploitable on any public page containing an rtMedia shortcode (e.g., [rtmedia_gallery]) when the rtmedia_shortcode GET parameter is set, because RTMediaQuery::query() merges $_REQUEST into the internal query while only validating top-level array keys, allowing the nested 'compare' subvalue to reach the vulnerable sink without authentication.
Product
rtMedia for WordPress, BuddyPress and bbPress
Affected
up to 4.7.11
What to do
Affects up to 4.7.11. Update rtMedia for WordPress, BuddyPress and bbPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 12, 2026Masteriyo LMS: Does not verify ownership ofCVE-2026-82851 · WordPress plugins & themes · reported by WPScanLow 2.7
The Masteriyo LMS WordPress plugin before 3.4.1 does not verify ownership of, or restrict the type of, the records a user requests for download, allowing users with the instructor role to retrieve the full content and metadata of arbitrary posts, including other instructors' private and draft courses.
Product
Masteriyo LMS
Fixed in
3.4.1
What to do
Update Masteriyo LMS to 3.4.1 or newer.
Full record and what to do →NVD record wpscan.com
Sep 12, 2026Masteriyo LMS: Does not sanitise and escape one of its course fields before outputting it back in the course editorCVE-2026-82847 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Masteriyo LMS WordPress plugin before 3.4.1 does not sanitise and escape one of its course fields before outputting it back in the course editor, allowing users with the instructor role to perform Stored Cross-Site Scripting attacks against higher privileged users such as administrators.
Product
Masteriyo LMS
Fixed in
3.4.1
What to do
Update Masteriyo LMS to 3.4.1 or newer.
Full record and what to do →NVD record wpscan.com
Sep 12, 2026Masteriyo LMS: Does not prevent user-supplied values heldCVE-2026-82845 · WordPress plugins & themes · reported by WPScanCritical 9.9
The Masteriyo LMS WordPress plugin before 3.4.1 does not prevent user-supplied values held as metadata from being deserialized when they are read back, allowing users with a minimal account to inject arbitrary PHP objects and, by way of a class shipped in a library bundled with the Masteriyo LMS WordPress plugin before 3.4.1, write and execute arbitrary code on the server. A weaker form of the same issue is reachable without an account and yields an arbitrary file write rather than code execution.
Product
Masteriyo LMS
Fixed in
3.4.1
What to do
Update Masteriyo LMS to 3.4.1 or newer.
Full record and what to do →NVD record wpscan.com
Sep 12, 2026Yogeta WP Cloud: Does not validate a user-supplied file path before passing it to a file-read function on a public endpoint that lacks any authorization checkCVE-2026-80494 · WordPress plugins & themes · reported by WPScanHigh 8.6
The Yogeta WP Cloud WordPress plugin through 1.0 does not validate a user-supplied file path before passing it to a file-read function on a public endpoint that lacks any authorization check, allowing unauthenticated attackers to download arbitrary files from the server, including files containing sensitive credentials.
Product
Yogeta WP Cloud
Affected
up to 1.0
What to do
Affects up to 1.0. Update Yogeta WP Cloud to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Sep 12, 2026Temporary Login Without Password: Does not prevent a temporary user from creating an Application PasswordCVE-2026-77753 · WordPress plugins & themes · reported by WPScanMedium 5.5
The Temporary Login Without Password WordPress plugin before 1.9.9 does not prevent a temporary user from creating an Application Password, and does not revoke one when the temporary access expires or is disabled, allowing the recipient of a temporary login to retain working access to the site over REST and XML-RPC after the administrator believes it has been withdrawn. The retained access carries whatever role was granted, which for the Temporary Login Without Password WordPress plugin before 1.9.9's main use case is Administrator.
Product
Temporary Login Without Password
Fixed in
1.9.9
What to do
Update Temporary Login Without Password to 1.9.9 or newer.
Full record and what to do →NVD record wpscan.com
Sep 12, 2026Temporary Login Without Password: Does not verify that the user requesting a temporary login holds network super admin rights before granting the new account those rightsCVE-2026-77752 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Temporary Login Without Password WordPress plugin before 1.9.9 does not verify that the user requesting a temporary login holds network super admin rights before granting the new account those rights, allowing an administrator of a single site on a multisite network to take over the whole network. The same missing check also allows an existing account, including the attacker's own, to be promoted.
Product
Temporary Login Without Password
Fixed in
1.9.9
What to do
Update Temporary Login Without Password to 1.9.9 or newer.
Full record and what to do →NVD record wpscan.com
Sep 12, 2026Booking for Appointments and Events Calendar: Does not verify that a payment was actually taken before recording a bookingCVE-2026-77689 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Booking for Appointments and Events Calendar WordPress plugin before 9.8.1 does not verify that a payment was actually taken before recording a booking as paid, trusting the payment gateway named in a public, unauthenticated booking request even when the site has never configured that gateway. This lets an unauthenticated attacker obtain confirmed, fully paid appointments and events without any payment being collected.
Product
Booking for Appointments and Events Calendar
Fixed in
9.8.1
What to do
Update Booking for Appointments and Events Calendar to 9.8.1 or newer.
Full record and what to do →NVD record wpscan.com
Sep 11, 2026Unauthenticated Insecure Direct Object References (IDOR) in Quiz And Survey Master <= 11.2.5 versions.CVE-2026-62140 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Insecure Direct Object References (IDOR) in Quiz And Survey Master <= 11.2.5 versions.
Affected
up to 11.2.5
What to do
Affects up to 11.2.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 11, 2026Unauthenticated Broken Access Control in Flexible Quantity – Measurement Price Calculator for WooCommerce <= 2.3.21 versions.CVE-2026-62136 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Broken Access Control in Flexible Quantity – Measurement Price Calculator for WooCommerce <= 2.3.21 versions.
Affected
up to 2.3.21
What to do
Affects up to 2.3.21. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 11, 2026Subscriber Broken Access Control in Masteriyo - LMS <= 3.4.0 versions.CVE-2026-62132 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Subscriber Broken Access Control in Masteriyo - LMS <= 3.4.0 versions.
Affected
up to 3.4.0
What to do
Affects up to 3.4.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 11, 2026Unauthenticated Broken Access Control in Passster <= 4.3.13 versions.CVE-2026-62114 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Broken Access Control in Passster <= 4.3.13 versions.
Affected
up to 4.3.13
What to do
Affects up to 4.3.13. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 11, 2026Unauthenticated PHP Object Injection in Masteriyo - LMS <= 3.4.0 versions.CVE-2026-62107 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Unauthenticated PHP Object Injection in Masteriyo - LMS <= 3.4.0 versions.
Affected
up to 3.4.0
What to do
Affects up to 3.4.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 11, 2026Master Addons for Elementor: Missing AuthorizationCVE-2026-62089 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Missing Authorization vulnerability in Pixar Labs Master Addons for Elementor allows Privilege Abuse. This issue affects Master Addons for Elementor: from n/a through 3.2.2.
Product
Master Addons for Elementor
Affected
up to 3.2.2
What to do
Affects up to 3.2.2. Update Master Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 11, 2026ElasticPress: Insertion of Sensitive Information Into Sent DataCVE-2026-62088 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Insertion of Sensitive Information Into Sent Data vulnerability in 10up ElasticPress allows Retrieve Embedded Sensitive Data. This issue affects ElasticPress: from n/a through 5.3.4.
Product
ElasticPress
Affected
up to 5.3.4
What to do
Affects up to 5.3.4. Update ElasticPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 11, 2026Media Library Assistant: Stored Cross-Site ScriptingCVE-2026-6642 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Media Library Assistant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the bulk edit preset export/import mechanism in versions up to and including 3.35. This is due to insufficient output escaping on preset field values when they are rendered in HTML attribute contexts in the mla_generate_bulk_edit_form_fieldsets() function and mla-bulk-edit-fieldsets.tpl template. While wp_kses() filtering is applied during preset export for users without unfiltered_html capability, this does not prevent attribute injection attacks since the malicious payload consists of quotes and HTML attributes rather than HTML tags. When preset values are retrieved and rendered, they are directly assigned to template variables without esc_attr() escaping and then inserted into input element value attributes via simple string replacement. This makes it possible for authenticated attackers, with Author-level access and above (upload_files capability), to inject arbitrary web scripts that execute when an administrator imports the poisoned preset and the targeted input field receives focus.
Product
Media Library Assistant
Affected
up to 3.35
What to do
Affects up to 3.35. Update Media Library Assistant to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 11, 2026Media Library Assistant: Stored Cross-Site ScriptingCVE-2026-6641 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Media Library Assistant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mla_gallery' shortcode in versions up to and including 3.35. This is due to insufficient input sanitization and output escaping on the mla_link_href parameter when mla_output is set to 'paginate_links', where the _paginate_links() function processes the value through mla_process_shortcode_parameter() and _replace_query_parameter() without proper URL escaping, then outputs it directly in href attributes without applying esc_url(). This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Media Library Assistant
Affected
up to 3.35
What to do
Affects up to 3.35. Update Media Library Assistant to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 11, 2026Media Library Assistant: Stored Cross-Site ScriptingCVE-2026-6640 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Media Library Assistant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mla_link_attributes' parameter in all versions up to, and including, 3.35 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Media Library Assistant
Affected
up to 3.35
What to do
Affects up to 3.35. Update Media Library Assistant to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 11, 2026AI Builder: Does not sanitise custom JavaScript saved against a post before echoing it inside a script tag on the front endCVE-2026-85678 · WordPress plugins & themes · reported by WPScanMedium 6.8
The AI Builder WordPress plugin before 2.7.8 does not sanitise custom JavaScript saved against a post before echoing it inside a script tag on the front end, allowing users with contributor level access and above to store arbitrary JavaScript that will execute in the browser of anyone who views the post, including the editor or administrator who reviews it.
Product
AI Builder
Fixed in
2.7.8
What to do
Update AI Builder to 2.7.8 or newer.
Full record and what to do →NVD record wpscan.com
Sep 11, 2026advanced-customized-prompts: Does not verify the password before issuing an authenticated session for a supplied email address in an unauthenticated actionCVE-2026-14563 · WordPress plugins & themes · reported by WPScanCritical 9.8
The advanced-customized-prompts WordPress plugin through 1.0.1 does not verify the password before issuing an authenticated session for a supplied email address in an unauthenticated action, allowing unauthenticated attackers to log in as any registered user, including administrators, or to create arbitrary new accounts.
Product
advanced-customized-prompts
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update advanced-customized-prompts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Sep 11, 2026teddy-bear-customize-addon: Does not verify a user's password before authenticating themCVE-2026-14559 · WordPress plugins & themes · reported by WPScanCritical 9.8
The teddy-bear-customize-addon WordPress plugin through 1.0.5 does not verify a user's password before authenticating them, allowing unauthenticated attackers to log in as any registered user, including administrators, by supplying only that user's email address.
Product
teddy-bear-customize-addon
Affected
up to 1.0.5
What to do
Affects up to 1.0.5. Update teddy-bear-customize-addon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Sep 11, 2026Simple Ajax Chat – Add a Fast, Secure Chat Box: Stored Cross-Site ScriptingCVE-2026-81825 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Simple Ajax Chat – Add a Fast, Secure Chat Box plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Chat Message in all versions up to, and including, <= 20260811 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The nonce protecting chat message submission is publicly visible on the chat page, rendering it ineffective as an authentication barrier and allowing fully unauthenticated attackers to submit malicious messages that are stored persistently and rendered to all visitors on every page load.
Product
Simple Ajax Chat – Add a Fast, Secure Chat Box
Affected
up to 20260811
What to do
Affects up to 20260811. Update Simple Ajax Chat – Add a Fast, Secure Chat Box to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 11, 2026OTP Login & Register Woocommerce: Authentication BypassCVE-2026-12215 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The OTP Login & Register Woocommerce plugin for WordPress is vulnerable to Authentication Bypass via OTP Brute Force in all versions up to, and including, 2.7.2. The vulnerability exists because the OTP rate-limit attempt counter in `process_otp_form` is keyed exclusively on the attacker-controlled `xoo_ml_user_ip_data` cookie's `ip_address` field, allowing unlimited counter resets by simply rotating the cookie, while the OTP itself is generated with PHP's non-cryptographic `rand()` function over a default space of only 9,000 possible values (1000–9999), and both the OTP issuance endpoint (`xoo_ml_login_with_otp`) and verification endpoint (`xoo_ml_otp_form_submit`) are registered as unauthenticated `wp_ajax_nopriv` actions with no nonce or capability checks. This makes it possible for unauthenticated attackers to brute-force the OTP for any registered account and obtain a full WordPress authentication session — including for administrator accounts — via `wp_set_auth_cookie()` in `login_user_with_otp()`. Exploitation requires the attacker to know the target user's registered phone number, which is used to trigger OTP issuance via the unauthenticated `xoo_ml_login_with_otp` endpoint
Product
OTP Login & Register Woocommerce
Affected
up to 2.7.2
What to do
Affects up to 2.7.2. Update OTP Login & Register Woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.