Updated 12 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

512new WordPress flaws this week

391,181entries in the database

12,356 results · page 10 of 248

Oct 9, 2026WP Associate Post R2: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-105870 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Delight Star Inc. WP Associate Post R2 wp-associate-post-r2 allows Reflected XSS.This issue affects WP Associate Post R2: from n/a through 5.0.1.
Product
WP Associate Post R2
Affected
up to 5.0.1
What to do
Affects up to 5.0.1. Update WP Associate Post R2 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 9, 2026AcyMailing SMTP Newsletter: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-105318 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Datasolution AcyMailing SMTP Newsletter acymailing allows Reflected XSS.This issue affects AcyMailing SMTP Newsletter: from n/a through 11.1.0.
Product
AcyMailing SMTP Newsletter
Affected
up to 11.1.0
What to do
Affects up to 11.1.0. Update AcyMailing SMTP Newsletter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 9, 2026Scripts n Styles: Missing AuthorizationCVE-2026-62042 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in unFocus Projects Scripts n Styles scripts-n-styles allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Scripts n Styles: from n/a through 3.5.8.
Product
Scripts n Styles
Affected
up to 3.5.8
What to do
Affects up to 3.5.8. Update Scripts n Styles to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 9, 2026Html5 Audio Player: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-62039 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Html5 Audio Player html5-audio-player allows Stored XSS.This issue affects Html5 Audio Player: from n/a through 2.8.8.
Product
Html5 Audio Player
Affected
up to 2.8.8
What to do
Affects up to 2.8.8. Update Html5 Audio Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 9, 2026Welcart e-Commerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-96761 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Welcart Welcart e-Commerce usc-e-shop allows Reflected XSS.This issue affects Welcart e-Commerce: from n/a through 2.12.3.
Product
Welcart e-Commerce
Affected
up to 2.12.3
What to do
Affects up to 2.12.3. Update Welcart e-Commerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 9, 2026NEX-Forms: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-96607 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Basix NEX-Forms nex-forms-express-wp-form-builder allows Reflected XSS.This issue affects NEX-Forms: from n/a through 9.3.1.
Product
NEX-Forms
Affected
up to 9.3.1
What to do
Affects up to 9.3.1. Update NEX-Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 9, 2026FiboSearch: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-96553 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Damian Góra FiboSearch ajax-search-for-woocommerce allows Reflected XSS.This issue affects FiboSearch: from n/a through 1.34.1.
Product
FiboSearch
Affected
up to 1.34.1
What to do
Affects up to 1.34.1. Update FiboSearch to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 9, 2026Simple Payment: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-96332 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in yalla ya! Simple Payment simple-payment allows Reflected XSS.This issue affects Simple Payment: from n/a through 2.5.4.
Product
Simple Payment
Affected
up to 2.5.4
What to do
Affects up to 2.5.4. Update Simple Payment to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 9, 2026Media LIbrary Assistant: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-95609 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Lingren Media LIbrary Assistant media-library-assistant allows Stored XSS.This issue affects Media LIbrary Assistant: from n/a through 3.41.
Product
Media LIbrary Assistant
Affected
up to 3.41
What to do
Affects up to 3.41. Update Media LIbrary Assistant to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 9, 2026HUSKY: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-95608 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PluginUs.Net HUSKY woocommerce-products-filter allows Reflected XSS.This issue affects HUSKY: from n/a through 1.4.3.2.
Product
HUSKY
Affected
up to 1.4.3.2
What to do
Affects up to 1.4.3.2. Update HUSKY to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 9, 2026Search in Place: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-95598 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in codepeople Search in Place search-in-place allows Reflected XSS.This issue affects Search in Place: from n/a through 1.5.5.
Product
Search in Place
Affected
up to 1.5.5
What to do
Affects up to 1.5.5. Update Search in Place to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 9, 2026ShopBuilder – Elementor WooCommerce Builder Addons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-95596 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mamunur Rashid ShopBuilder – Elementor WooCommerce Builder Addons shopbuilder allows Reflected XSS.This issue affects ShopBuilder – Elementor WooCommerce Builder Addons: from n/a through 3.4.1.
Product
ShopBuilder – Elementor WooCommerce Builder Addons
Affected
up to 3.4.1
What to do
Affects up to 3.4.1. Update ShopBuilder – Elementor WooCommerce Builder Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 9, 2026VikBooking Hotel Booking Engine & PMS: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-95591 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e4jvikwp VikBooking Hotel Booking Engine & PMS vikbooking allows Reflected XSS.This issue affects VikBooking Hotel Booking Engine & PMS: from n/a through 1.8.14.
Product
VikBooking Hotel Booking Engine & PMS
Affected
up to 1.8.14
What to do
Affects up to 1.8.14. Update VikBooking Hotel Booking Engine & PMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 9, 2026Salon booking system: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-94668 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dimitri Grassi Salon booking system salon-booking-system allows Reflected XSS.This issue affects Salon booking system: from n/a through 10.31.5.
Product
Salon booking system
Affected
up to 10.31.5
What to do
Affects up to 10.31.5. Update Salon booking system to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 9, 2026JetReviews: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-94667 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetReviews jet-reviews allows Stored XSS.This issue affects JetReviews: from n/a through 3.1.2.
Product
JetReviews
Affected
up to 3.1.2
What to do
Affects up to 3.1.2. Update JetReviews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 9, 2026Classified Listing: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-94665 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mamunur Rashid Classified Listing classified-listing allows Stored XSS.This issue affects Classified Listing: from n/a through 6.1.2.
Product
Classified Listing
Affected
up to 6.1.2
What to do
Affects up to 6.1.2. Update Classified Listing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 9, 2026JetBlog: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-94661 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetBlog jet-blog allows Reflected XSS.This issue affects JetBlog: from n/a through 2.4.10.
Product
JetBlog
Affected
up to 2.4.10
What to do
Affects up to 2.4.10. Update JetBlog to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 9, 2026UsersWP: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-94641 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Stiofan UsersWP userswp allows Reflected XSS.This issue affects UsersWP: from n/a through 1.2.73.
Product
UsersWP
Affected
up to 1.2.73
What to do
Affects up to 1.2.73. Update UsersWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 9, 2026BlockStrap Page Builder - Bootstrap Blocks: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-94632 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Stiofan BlockStrap Page Builder - Bootstrap Blocks blockstrap-page-builder-blocks allows Reflected XSS.This issue affects BlockStrap Page Builder - Bootstrap Blocks: from n/a through 0.1.58.
Product
BlockStrap Page Builder - Bootstrap Blocks
Affected
up to 0.1.58
What to do
Affects up to 0.1.58. Update BlockStrap Page Builder - Bootstrap Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 9, 2026Betheme: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-94415 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Muffingroup Betheme betheme allows Reflected XSS.This issue affects Betheme: from n/a through 28.5.8.
Product
Betheme
Affected
up to 28.5.8
What to do
Affects up to 28.5.8. Update Betheme to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 9, 2026Sassy Social Share: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-94170 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Heateor Support Sassy Social Share sassy-social-share allows Reflected XSS.This issue affects Sassy Social Share: from n/a through 3.3.79.
Product
Sassy Social Share
Affected
up to 3.3.79
What to do
Affects up to 3.3.79. Update Sassy Social Share to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 9, 2026Kubio AI Page Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-94167 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Extend Themes Kubio AI Page Builder kubio allows Reflected XSS.This issue affects Kubio AI Page Builder: from n/a through 2.9.3.
Product
Kubio AI Page Builder
Affected
up to 2.9.3
What to do
Affects up to 2.9.3. Update Kubio AI Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 9, 2026UpSolution Core: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-94166 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in UpSolution UpSolution Core us-core allows Reflected XSS.This issue affects UpSolution Core: from n/a through 8.44.
Product
UpSolution Core
Affected
up to 8.44
What to do
Affects up to 8.44. Update UpSolution Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 9, 2026Grand Restaurant: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-94161 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods Grand Restaurant grandrestaurant allows Reflected XSS.This issue affects Grand Restaurant: from n/a before 7.0.11.
Product
Grand Restaurant
Fixed in
7.0.11
What to do
Update Grand Restaurant to 7.0.11 or newer.
Full record and what to do →NVD record patchstack.com
Oct 9, 2026Total Donations: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-94159 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in KlbTheme Total Donations totaldonations allows Stored XSS.This issue affects Total Donations: from n/a through 2.0.5.
Product
Total Donations
Affected
up to 2.0.5
What to do
Affects up to 2.0.5. Update Total Donations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 9, 2026Gloria Admin Panel: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-94158 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bkninja Gloria Admin Panel gloria-admin-panel allows Reflected XSS.This issue affects Gloria Admin Panel: from n/a through 1.3.
Product
Gloria Admin Panel
Affected
up to 1.3
What to do
Affects up to 1.3. Update Gloria Admin Panel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 9, 2026JetBlocks For Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-62049 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetBlocks For Elementor jet-blocks allows Stored XSS.This issue affects JetBlocks For Elementor: from n/a through 1.5.2.1.
Product
JetBlocks For Elementor
Affected
up to 1.5.2.1
What to do
Affects up to 1.5.2.1. Update JetBlocks For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 9, 2026Ocean Pro Demos and Ocean eComm Treasure Box: Stored Cross-Site ScriptingCVE-2026-81929 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Ocean Pro Demos and Ocean eComm Treasure Box plugins for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content' parameter in all versions up to, and including, 1.5.4, and 1.8.0, respectively, due to insufficient authorization, input sanitization, and output escaping in the Popup Builder's save_popup_content AJAX action. This makes it possible for unauthenticated attackers to inject arbitrary web scripts into a published Gutenberg popup that will execute whenever a user accesses a page on which the popup is configured to display. A valid premium license, the Popup Builder module, and at least one published Gutenberg popup configured for display are required.
Product
Ocean Pro Demos and Ocean eComm Treasure Box
Affected
up to 1.5.4
What to do
Affects up to 1.5.4. Update Ocean Pro Demos and Ocean eComm Treasure Box to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record docs.oceanwp.org docs.oceanwp.org
Oct 8, 2026aBlocks: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-40804 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kodezen LLC aBlocks ablocks allows Reflected XSS.This issue affects aBlocks: from n/a through 2.16.0.
Product
aBlocks
Affected
up to 2.16.0
What to do
Affects up to 2.16.0. Update aBlocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 8, 2026Zotpress: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-27420 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Katie Seaborn Zotpress zotpress allows Stored XSS.This issue affects Zotpress: from n/a through 7.4.4.
Product
Zotpress
Affected
up to 7.4.4
What to do
Affects up to 7.4.4. Update Zotpress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 8, 2026WP Plugin Info Card: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-62127 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MediaRon LLC WP Plugin Info Card wp-plugin-info-card allows Stored XSS.This issue affects WP Plugin Info Card: from n/a through 6.3.5.
Product
WP Plugin Info Card
Affected
up to 6.3.5
What to do
Affects up to 6.3.5. Update WP Plugin Info Card to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 8, 2026Gutenberg Blocks by Kadence Blocks: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-105890 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / StellarWP Gutenberg Blocks by Kadence Blocks kadence-blocks allows Stored XSS.This issue affects Gutenberg Blocks by Kadence Blocks: from n/a through 3.7.12.
Product
Gutenberg Blocks by Kadence Blocks
Affected
up to 3.7.12
What to do
Affects up to 3.7.12. Update Gutenberg Blocks by Kadence Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 8, 2026Robo Gallery: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-105887 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Robosoft Robo Gallery robo-gallery allows Stored XSS.This issue affects Robo Gallery: from n/a through 5.1.6.
Product
Robo Gallery
Affected
up to 5.1.6
What to do
Affects up to 5.1.6. Update Robo Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 8, 2026MasterStudy LMS: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-105079 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in StylemixThemes MasterStudy LMS masterstudy-lms-learning-management-system allows Stored XSS.This issue affects MasterStudy LMS: from n/a through 3.7.52.
Product
MasterStudy LMS
Affected
up to 3.7.52
What to do
Affects up to 3.7.52. Update MasterStudy LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 8, 2026WP Store Locator: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-105078 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Store Locator WP Store Locator wp-store-locator allows Stored XSS.This issue affects WP Store Locator: from n/a through 3.0.3.
Product
WP Store Locator
Affected
up to 3.0.3
What to do
Affects up to 3.0.3. Update WP Store Locator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 8, 2026ShortPixel Image Optimizer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-103070 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ShortPixel ShortPixel Image Optimizer shortpixel-image-optimiser allows Stored XSS.This issue affects ShortPixel Image Optimizer: from n/a through 6.5.6.
Product
ShortPixel Image Optimizer
Affected
up to 6.5.6
What to do
Affects up to 6.5.6. Update ShortPixel Image Optimizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 8, 2026Image Photo Gallery Final Tiles Grid: Does not sanitise several gallery configuration values that can be overridden through its gallery shortcode before printing them into an inline script blockCVE-2026-104646 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.14 does not sanitise several gallery configuration values that can be overridden through its gallery shortcode before printing them into an inline script block, allowing users with contributor-level access and above to inject arbitrary JavaScript that executes in the session of anyone viewing the post, including an administrator previewing a pending submission. No gallery ownership is required: any gallery that already exists on the site can be referenced.
Product
Image Photo Gallery Final Tiles Grid
Fixed in
3.6.14
What to do
Update Image Photo Gallery Final Tiles Grid to 3.6.14 or newer.
Full record and what to do →NVD record wpscan.com
Oct 7, 2026Aurora Heatmap: Stored Cross-Site ScriptingCVE-2026-94154 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Aurora Heatmap plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter in all versions up to, and including, 1.7.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever an admin user clicks the injected heatmap link.
Product
Aurora Heatmap
Affected
up to 1.7.2
What to do
Affects up to 1.7.2. Update Aurora Heatmap to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 7, 2026Disable and Remove Google Fonts | GDPR & DSGVO friendly: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-95595 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Fontsplugin Disable and Remove Google Fonts | GDPR & DSGVO friendly disable-remove-google-fonts allows Reflected XSS. This issue affects Disable and Remove Google Fonts | GDPR & DSGVO friendly: from n/a through 2.0.2.
Product
Disable and Remove Google Fonts | GDPR & DSGVO friendly
Affected
up to 2.0.2
What to do
Affects up to 2.0.2. Update Disable and Remove Google Fonts | GDPR & DSGVO friendly to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 7, 2026Everest Forms: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-94670 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Everest Forms allows Reflected XSS. This issue affects Everest Forms: from n/a through 3.6.1.
Product
Everest Forms
Affected
up to 3.6.1
What to do
Affects up to 3.6.1. Update Everest Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 7, 2026Unlimited Elements For Elementor (Free Widgets, Addons, Templates): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-94662 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) allows Stored XSS. This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 2.0.19.
Product
Unlimited Elements For Elementor (Free Widgets, Addons, Templates)
Affected
up to 2.0.19
What to do
Affects up to 2.0.19. Update Unlimited Elements For Elementor (Free Widgets, Addons, Templates) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 7, 2026Media LIbrary Assistant: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-97294 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Lingren Media LIbrary Assistant media-library-assistant allows Stored XSS.This issue affects Media LIbrary Assistant: from n/a through 3.41.
Product
Media LIbrary Assistant
Affected
up to 3.41
What to do
Affects up to 3.41. Update Media LIbrary Assistant to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 7, 2026Rocket Lazy Load: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-105884 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Media Rocket Lazy Load rocket-lazy-load allows Stored XSS.This issue affects Rocket Lazy Load: from n/a through 2.4.0.
Product
Rocket Lazy Load
Affected
up to 2.4.0
What to do
Affects up to 2.4.0. Update Rocket Lazy Load to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 7, 2026Prime Slider – Addons For Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-105875 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BdThemes Prime Slider – Addons For Elementor bdthemes-prime-slider-lite allows Stored XSS.This issue affects Prime Slider – Addons For Elementor: from n/a through 4.6.2.
Product
Prime Slider – Addons For Elementor
Affected
up to 4.6.2
What to do
Affects up to 4.6.2. Update Prime Slider – Addons For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 7, 2026Element Pack Elementor Addons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-105873 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BdThemes Element Pack Elementor Addons bdthemes-element-pack-lite allows Stored XSS.This issue affects Element Pack Elementor Addons: from n/a through 8.8.6.
Product
Element Pack Elementor Addons
Affected
up to 8.8.6
What to do
Affects up to 8.8.6. Update Element Pack Elementor Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 7, 2026Element Pack Elementor Addons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-105871 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BdThemes Element Pack Elementor Addons bdthemes-element-pack-lite allows Stored XSS.This issue affects Element Pack Elementor Addons: from n/a through 8.8.6.
Product
Element Pack Elementor Addons
Affected
up to 8.8.6
What to do
Affects up to 8.8.6. Update Element Pack Elementor Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 7, 2026Happy Addons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-104393 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in weDevs Happy Addons for Elementor happy-elementor-addons allows Stored XSS.This issue affects Happy Addons for Elementor: from n/a through 3.50.0.
Product
Happy Addons for Elementor
Affected
up to 3.50.0
What to do
Affects up to 3.50.0. Update Happy Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 7, 2026Quiz And Survey Master: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-104391 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows Stored XSS.This issue affects Quiz And Survey Master: from n/a through 11.2.7.
Product
Quiz And Survey Master
Affected
up to 11.2.7
What to do
Affects up to 11.2.7. Update Quiz And Survey Master to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 7, 2026OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy.: Stored Cross-Site ScriptingCVE-2026-89417 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 's' Search Parameter via comments-atom Feed in all versions up to, and including, 6.3.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires that the front-end server serves the retained .tmp file without a Content-Type or X-Content-Type-Options header, enabling MIME-sniffing browsers such as Chromium to execute the injected script — a condition present by default on many Apache and nginx/php-fpm deployments.
Product
OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy.
Affected
up to 6.3.10
What to do
Affects up to 6.3.10. Update OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 7, 2026Kirki – Freeform Page Builder, Website Builder & Customizer: Stored Cross-Site ScriptingCVE-2026-102173 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via registration metadata in all versions up to, and including, 6.3.1 This is due to insufficient escaping in `ExceptionalElements::image_element()`, which concatenates a user-meta value straight into an `<img src="…">` attribute. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute whenever a user accesses a page rendering a Kirki users collection whose image element is bound to one of the nine registration meta fields. Requires public user registration to be enabled and a published page carrying a `kirki-register` element, which prints the required element nonce into the public markup.
Product
Kirki – Freeform Page Builder, Website Builder & Customizer
Affected
up to 6.3.1
What to do
Affects up to 6.3.1. Update Kirki – Freeform Page Builder, Website Builder & Customizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.