Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
8,911 results · page 10 of 179
Sep 20, 2026Meow Gallery: Does not perform a proper capability check or restrict results to the requesting user's own posts before returning post dataCVE-2026-92423 · WordPress plugins & themes · reported by WPScanLow 2.7
The Meow Gallery WordPress plugin before 5.5.5 does not perform a proper capability check or restrict results to the requesting user's own posts before returning post data, allowing authenticated users with Author-level access and above to disclose the titles, authors, dates and statuses of other users' draft and private posts.
- Product
- Meow Gallery
- Fixed in
- 5.5.5
- What to do
- Update Meow Gallery to 5.5.5 or newer.
Sep 20, 2026Meow Gallery: Does not properly sanitize a user-supplied value before concatenating it into a shortcode string that it passes to the WordPress shortcode parser on a publicly reachable endpointCVE-2026-92422 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Meow Gallery WordPress plugin before 5.5.5 does not properly sanitize a user-supplied value before concatenating it into a shortcode string that it passes to the WordPress shortcode parser on a publicly reachable endpoint, allowing unauthenticated users to execute arbitrary registered shortcodes and disclose non-public gallery content.
- Product
- Meow Gallery
- Fixed in
- 5.5.5
- What to do
- Update Meow Gallery to 5.5.5 or newer.
Sep 20, 2026Sign-up Sheets: Does not properly validate the CSRF nonce that protects its sign-up deletion actionCVE-2026-92410 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Sign-up Sheets WordPress plugin before 2.4.0 does not properly validate the CSRF nonce that protects its sign-up deletion action, allowing attackers to delete sign-up records via a forged request handled in the session of a logged-in user with the required capability.
- Product
- Sign-up Sheets
- Fixed in
- 2.4.0
- What to do
- Update Sign-up Sheets to 2.4.0 or newer.
Sep 19, 2026Payment Gateway of Stripe for WooCommerce: Improper Verification of Cryptographic SignatureCVE-2026-9832 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Payment Gateway of Stripe for WooCommerce plugin for WordPress is vulnerable to Improper Verification of Cryptographic Signature in all versions up to, and including, 5.0.8. This is due to the publicly accessible `woocommerce_api_wt_stripe` webhook endpoint (`EH_Stripe_Webhook_Handler::handle()`) wrapping the only call to `\Stripe\Webhook::constructEvent()` inside an `if (!empty($endpoint_secret))` guard that is never entered on default installations — because the `eh_stripe_webhook_secret` option is empty after a fresh plugin install — causing the raw, attacker-controlled POST body to be decoded and processed as a fully trusted Stripe event without any signature verification, authentication, or authorization. This makes it possible for unauthenticated attackers to send forged Stripe webhook events to manipulate WooCommerce order statuses, including marking unpaid orders as paid or completed via `payment_complete()`, forcing legitimate orders into a failed state, fabricating dispute notifications, and injecting forged refund events. This vulnerability is only exploitable when the Stripe webhook signing secret has not been configured by an administrator; once a valid signing sec
- Product
- Payment Gateway of Stripe for WooCommerce
- Affected
- up to 5.0.8
- What to do
- Affects up to 5.0.8. Update Payment Gateway of Stripe for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 19, 2026Secure Custom Fields: Does not properly verify that a front-end form submission corresponds to the form that was rendered to the visitorCVE-2026-92403 · WordPress plugins & themes · reported by WPScanLow 3.7
The Secure Custom Fields WordPress plugin before 6.9.4 does not properly verify that a front-end form submission corresponds to the form that was rendered to the visitor, allowing unauthenticated users to submit against a different registered form and modify the title and content of the post that form is bound to.
- Product
- Secure Custom Fields
- Fixed in
- 6.9.4
- What to do
- Update Secure Custom Fields to 6.9.4 or newer.
Sep 18, 2026Hide My WP Ghost: Does not properly validate a loopback security-check request before disabling its login and URL hiding protectionCVE-2026-86800 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Hide My WP Ghost WordPress plugin before 7.0.11 does not properly validate a loopback security-check request before disabling its login and URL hiding protection, dropping that protection precisely when the request's verification value is missing or incorrect, which any visitor can arrange, allowing unauthenticated attackers to re-expose the concealed WordPress login page location.
- Product
- Hide My WP Ghost
- Fixed in
- 7.0.11
- What to do
- Update Hide My WP Ghost to 7.0.11 or newer.
Sep 18, 2026WordPress: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-93485 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic WordPress wordpress allows DOM-Based XSS.This issue affects WordPress: from n/a through 7.1.
- Product
- WordPress
- Affected
- up to 7.1
- What to do
- Affects up to 7.1. Update WordPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 18, 2026All Bootstrap Blocks: Does not properly escape a block attribute before outputting it in HTML tag-name positionCVE-2026-88993 · WordPress plugins & themes · reported by WPScanMedium 6.8
The All Bootstrap Blocks WordPress plugin through 1.3.31 does not properly escape a block attribute before outputting it in HTML tag-name position, allowing users with Contributor-level access and above to inject arbitrary web scripts that execute when the affected content is viewed.
- Product
- All Bootstrap Blocks
- Affected
- up to 1.3.31
- What to do
- Affects up to 1.3.31. Update All Bootstrap Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 17, 2026Contributor Cross Site Scripting (XSS) in PropertyHive <= 2.2.6 versions.CVE-2026-66578 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Cross Site Scripting (XSS) in PropertyHive <= 2.2.6 versions.
- Affected
- up to 2.2.6
- What to do
- Affects up to 2.2.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 17, 2026Checkout Field Manager (Checkout Manager) for WooCommerce: Does not properly validate the ownership of an attachment before deleting itCVE-2026-87831 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Checkout Field Manager (Checkout Manager) for WooCommerce WordPress plugin before 7.9.7 does not properly validate the ownership of an attachment before deleting it, allowing any authenticated user such as a customer to delete arbitrary media attachments belonging to other users.
- Product
- Checkout Field Manager (Checkout Manager) for WooCommerce
- Fixed in
- 7.9.7
- What to do
- Update Checkout Field Manager (Checkout Manager) for WooCommerce to 7.9.7 or newer.
Sep 17, 2026Checkout Field Manager (Checkout Manager) for WooCommerce: Does not properly validate the ownership of an attachment before deleting itCVE-2026-87829 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Checkout Field Manager (Checkout Manager) for WooCommerce WordPress plugin before 7.9.7 does not properly validate the ownership of an attachment before deleting it, allowing any authenticated user such as a customer to delete arbitrary media attachments belonging to other users.
- Product
- Checkout Field Manager (Checkout Manager) for WooCommerce
- Fixed in
- 7.9.7
- What to do
- Update Checkout Field Manager (Checkout Manager) for WooCommerce to 7.9.7 or newer.
Sep 17, 2026EWWW Image Optimizer: Does not properly escape image attribute valuesCVE-2026-91011 · WordPress plugins & themes · reported by WPScanMedium 6.8
The EWWW Image Optimizer WordPress plugin before 8.7.7 does not properly escape image attribute values when it rewrites page output, allowing authenticated users with author-level access and above to inject arbitrary JavaScript that is stored in published content and executes in the browser of any user who later views the affected page.
- Product
- EWWW Image Optimizer
- Fixed in
- 8.7.7
- What to do
- Update EWWW Image Optimizer to 8.7.7 or newer.
Sep 17, 2026PuppyFW: Does not have proper authorisation on one of its REST routesCVE-2026-88904 · WordPress plugins & themes · reported by WPScanHigh 8.8
The PuppyFW WordPress plugin through 0.4.4 does not have proper authorisation on one of its REST routes, which tests the caller against a capability taken from the request itself, allowing any authenticated user, including subscribers, to add, modify and delete arbitrary blog options and thereby escalate their privileges.
- Product
- PuppyFW
- Affected
- up to 0.4.4
- What to do
- Affects up to 0.4.4. Update PuppyFW to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 16, 2026WP Mega Menu: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-92465 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeum WP Mega Menu allows Blind SQL Injection. This issue affects WP Mega Menu: from n/a through 1.4.2.
- Product
- WP Mega Menu
- Affected
- up to 1.4.2
- What to do
- Affects up to 1.4.2. Update WP Mega Menu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 16, 2026Royal Elementor Addons: Does not properly sanitize and escape values submitted through its form widget before including them in the body of administrator notification emailsCVE-2026-13407 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Royal Elementor Addons WordPress plugin before 1.7.1067 does not properly sanitize and escape values submitted through its form widget before including them in the body of administrator notification emails, allowing unauthenticated attackers to inject arbitrary HTML into emails sent to the site administrator on form submission.
- Product
- Royal Elementor Addons
- Fixed in
- 1.7.1067
- What to do
- Update Royal Elementor Addons to 1.7.1067 or newer.
Sep 16, 2026FluentBoards: Does not properly verify that a user holds board-manager privileges before performing several board-management operationsCVE-2026-89328 · WordPress plugins & themes · reported by WPScanLow 3.8
The FluentBoards WordPress plugin before 2.0.15 does not properly verify that a user holds board-manager privileges before performing several board-management operations, checking only board membership. This allows any member of a board to carry out manager-only actions on it, including adding or removing members and enabling public access to a private board.
- Product
- FluentBoards
- Fixed in
- 2.0.15
- What to do
- Update FluentBoards to 2.0.15 or newer.
Sep 16, 2026FluentBoards: Does not properly verify authorizationCVE-2026-85349 · WordPress plugins & themes · reported by WPScanMedium 4.3
The FluentBoards WordPress plugin before 2.0.15 does not properly verify authorization when returning the list of boards a user belongs to, allowing any authenticated user, including a Subscriber with no board access, to disclose the private board memberships of arbitrary users by referencing their user ID.
- Product
- FluentBoards
- Fixed in
- 2.0.15
- What to do
- Update FluentBoards to 2.0.15 or newer.
Sep 16, 2026Eventin: Does not properly authorise order finalisationCVE-2026-84907 · WordPress plugins & themes · reported by WPScanLow 3.7
The Eventin WordPress plugin before 4.1.24 does not properly authorise order finalisation when its offline (local) payment method is enabled, relying on a nonce that is exposed to unauthenticated visitors and never checking that the caller owns the order, allowing unauthenticated attackers to reset any existing order and its attendees to a pending state and thereby invalidate paid tickets.
- Product
- Eventin
- Fixed in
- 4.1.24
- What to do
- Update Eventin to 4.1.24 or newer.
Sep 16, 2026Optimole: Does not properly escape a user supplied value before using it to build an image tag attributeCVE-2026-84829 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Optimole WordPress plugin before 4.2.12 does not properly escape a user supplied value before using it to build an image tag attribute, allowing unauthenticated users to inject arbitrary attributes into pages served to every visitor, which leads to Stored Cross-Site Scripting.
- Product
- Optimole
- Fixed in
- 4.2.12
- What to do
- Update Optimole to 4.2.12 or newer.
Sep 16, 2026WP Import Export Lite: Does not properly validate URLs before requesting them during the import processCVE-2026-76559 · WordPress plugins & themes · reported by WPScanMedium 4.1
The WP Import Export Lite WordPress plugin before 3.9.33 does not properly validate URLs before requesting them during the import process, allowing users with the import capability, which administrators hold by default, to make the site issue requests to internal hosts and services and read their responses. This is an incomplete fix for CVE-2026-11397.
- Product
- WP Import Export Lite
- Fixed in
- 3.9.33
- What to do
- Update WP Import Export Lite to 3.9.33 or newer.
Sep 16, 2026WP Import Export Lite: Does not properly sanitise and escape some import configuration values before using them in SQL statementsCVE-2026-76557 · WordPress plugins & themes · reported by WPScanMedium 6.8
The WP Import Export Lite WordPress plugin before 3.9.33 does not properly sanitise and escape some import configuration values before using them in SQL statements, allowing users whose role an administrator has granted the WP Import Export Lite WordPress plugin before 3.9.33's import permission to perform SQL injection attacks.
- Product
- WP Import Export Lite
- Fixed in
- 3.9.33
- What to do
- Update WP Import Export Lite to 3.9.33 or newer.
Sep 16, 2026WP Import Export Lite: Does not properly sanitise and escape some export filter values before using them in SQL statementsCVE-2026-76556 · WordPress plugins & themes · reported by WPScanMedium 6.8
The WP Import Export Lite WordPress plugin before 3.9.33 does not properly sanitise and escape some export filter values before using them in SQL statements, allowing users holding its export permission, which administrators have by default and may also grant to lower roles, to perform SQL injection attacks.
- Product
- WP Import Export Lite
- Fixed in
- 3.9.33
- What to do
- Update WP Import Export Lite to 3.9.33 or newer.
Sep 13, 2026Bookit — Booking & Appointment Calendar: Does not properly restrict the data returned by an availability-check requestCVE-2026-88995 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Bookit — Booking & Appointment Calendar WordPress plugin before 2.6.0.1 does not properly restrict the data returned by an availability-check request, allowing unauthenticated users to retrieve other customers' appointment details, including free-text booking comments and contact information.
- Product
- Bookit — Booking & Appointment Calendar
- Fixed in
- 2.6.0.1
- What to do
- Update Bookit — Booking & Appointment Calendar to 2.6.0.1 or newer.
Sep 13, 2026User Registration & Membership: Does not properly restrict who may author a membership plan or validate the plan a user attaches to their own accountCVE-2026-80071 · WordPress plugins & themes · reported by WPScanHigh 7.2
The User Registration & Membership WordPress plugin before 5.2.8 does not properly restrict who may author a membership plan or validate the plan a user attaches to their own account, allowing authenticated users with Author-level access and above to assign themselves an arbitrary role and escalate their privileges to Administrator.
- Product
- User Registration & Membership
- Fixed in
- 5.2.8
- What to do
- Update User Registration & Membership to 5.2.8 or newer.
Sep 12, 2026Album Cover Finder: Does not properly sanitize and escape a parameter before using it in a SQL queryCVE-2026-84047 · WordPress plugins & themes · reported by WPScanHigh 8.6
The Album Cover Finder WordPress plugin through 0.7.0 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks.
- Product
- Album Cover Finder
- Affected
- up to 0.7.0
- What to do
- Affects up to 0.7.0. Update Album Cover Finder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 12, 2026SAMO Forms: Does not properly sanitise and escape user input before using it in SQL queries in several unauthenticated actionsCVE-2026-80491 · WordPress plugins & themes · reported by WPScanHigh 8.6
The SAMO Forms WordPress plugin through 1.0.0 does not properly sanitise and escape user input before using it in SQL queries in several unauthenticated actions, allowing unauthenticated attackers to perform SQL injection attacks.
- Product
- SAMO Forms
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update SAMO Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 11, 2026MetForm: Does not properly neutralize newline characters in user-submitted values that are placed into notification email headersCVE-2026-86813 · WordPress plugins & themes · reported by WPScanMedium 4.8
The MetForm WordPress plugin before 4.1.9 does not properly neutralize newline characters in user-submitted values that are placed into notification email headers, allowing unauthenticated attackers to inject additional email headers, such as Bcc, into the emails the site sends when a submitted field value is configured to populate a header.
- Product
- MetForm
- Fixed in
- 4.1.9
- What to do
- Update MetForm to 4.1.9 or newer.
Sep 11, 2026BackWPup: Does not properly restrict access to several of its REST API routes for jobCVE-2026-86815 · WordPress plugins & themes · reported by WPScanMedium 5.5
The BackWPup WordPress plugin before 5.7.5 does not properly restrict access to several of its REST API routes for job, backup-destination, and backup-execution management, allowing users holding a BackWPup WordPress plugin before 5.7.5-defined, administrator-assigned limited role to create and run backup jobs and exfiltrate a full database backup to an attacker-controlled destination.
- Product
- BackWPup
- Fixed in
- 5.7.5
- What to do
- Update BackWPup to 5.7.5 or newer.
Sep 11, 2026Visualizer: Does not properly authorise access to its chart-building actionsCVE-2026-86782 · WordPress plugins & themes · reported by WPScanMedium 5.5
The Visualizer WordPress plugin before 4.0.6 does not properly authorise access to its chart-building actions, allowing users with the Contributor role and above to publish, rename, and overwrite the content of posts and pages they do not own, including other users' private drafts.
- Product
- Visualizer
- Fixed in
- 4.0.6
- What to do
- Update Visualizer to 4.0.6 or newer.
Sep 11, 2026Visualizer: Does not properly authorise chart-deletion requestsCVE-2026-86779 · WordPress plugins & themes · reported by WPScanLow 2.7
The Visualizer WordPress plugin before 4.0.6 does not properly authorise chart-deletion requests, performing only a site-wide capability check with no per-object ownership verification, allowing users with the Contributor role and above to permanently delete any chart on the site, including charts created by other users such as administrators.
- Product
- Visualizer
- Fixed in
- 4.0.6
- What to do
- Update Visualizer to 4.0.6 or newer.
Sep 11, 2026CoolClock: Does not properly escape a skin setting before outputting it within an HTML attributeCVE-2026-83546 · WordPress plugins & themes · reported by WPScanMedium 6.8
The CoolClock WordPress plugin before 4.3.8 does not properly escape a skin setting before outputting it within an HTML attribute, allowing users with contributor-level access and above to inject arbitrary web scripts that execute when the content is viewed.
- Product
- CoolClock
- Fixed in
- 4.3.8
- What to do
- Update CoolClock to 4.3.8 or newer.
Sep 11, 2026CoolClock: Does not properly escape a custom skin setting before outputting it inside an inline scriptCVE-2026-83545 · WordPress plugins & themes · reported by WPScanMedium 6.8
The CoolClock WordPress plugin before 4.3.8 does not properly escape a custom skin setting before outputting it inside an inline script, allowing users with contributor-level access and above to inject arbitrary JavaScript that executes when the content is viewed.
- Product
- CoolClock
- Fixed in
- 4.3.8
- What to do
- Update CoolClock to 4.3.8 or newer.
Sep 11, 2026teddy-bear-customize-addon: Does not properly validate uploaded filesCVE-2026-14560 · WordPress plugins & themes · reported by WPScanCritical 10
The teddy-bear-customize-addon WordPress plugin through 1.0.5 does not properly validate uploaded files, relying on a client-supplied content type and preserving the original filename, allowing unauthenticated attackers to upload arbitrary PHP files and execute code on the server.
- Product
- teddy-bear-customize-addon
- Affected
- up to 1.0.5
- What to do
- Affects up to 1.0.5. Update teddy-bear-customize-addon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 10, 2026Advanced Product Fields Extended for WooCommerce: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2026-81789 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Studio Wombat Advanced Product Fields Extended for WooCommerce allows Path Traversal. This issue affects Advanced Product Fields Extended for WooCommerce: from n/a through 3.1.6.
- Product
- Advanced Product Fields Extended for WooCommerce
- Affected
- up to 3.1.6
- What to do
- Affects up to 3.1.6. Update Advanced Product Fields Extended for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 9, 2026Quentn WP: Does not properly sanitise and escape a parameter before using it in an SQL queryCVE-2026-84113 · WordPress plugins & themes · reported by WPScanMedium 4.1
The Quentn WP WordPress plugin before 1.2.15 does not properly sanitise and escape a parameter before using it in an SQL query, allowing high privilege users such as administrators to perform SQL injection attacks.
- Product
- Quentn WP
- Fixed in
- 1.2.15
- What to do
- Update Quentn WP to 1.2.15 or newer.
Sep 9, 2026Sina Extension for Elementor: Does not properly escape a Table widget setting before outputting it within an HTML attributeCVE-2026-83541 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Sina Extension for Elementor WordPress plugin before 3.10.4 does not properly escape a Table widget setting before outputting it within an HTML attribute, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Sina Extension for Elementor
- Fixed in
- 3.10.4
- What to do
- Update Sina Extension for Elementor to 3.10.4 or newer.
Sep 9, 2026ELEX WooCommerce Request a Quote: Does not properly sanitise and escape a parameter before using it in a SQL queryCVE-2026-14962 · WordPress plugins & themes · reported by WPScanHigh 8.6
The ELEX WooCommerce Request a Quote WordPress plugin before 2.4.1 does not properly sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks and extract arbitrary data from the database.
- Product
- ELEX WooCommerce Request a Quote
- Fixed in
- 2.4.1
- What to do
- Update ELEX WooCommerce Request a Quote to 2.4.1 or newer.
Sep 9, 2026WP Travel: Does not properly verify that the requester owns the booking targeted by its bank-deposit slip submissionCVE-2026-13146 · WordPress plugins & themes · reported by WPScanLow 3.7
The WP Travel WordPress plugin before 12.0.2 does not properly verify that the requester owns the booking targeted by its bank-deposit slip submission, allowing an unauthenticated attacker who knows the target customer's email address to change that customer's booking payment state and attach a file to it.
- Product
- WP Travel
- Fixed in
- 12.0.2
- What to do
- Update WP Travel to 12.0.2 or newer.
Sep 9, 2026WP Travel: Does not properly verify that the requester is authorized to modify the targeted booking on one branch of its bank-deposit handlerCVE-2026-13144 · WordPress plugins & themes · reported by WPScanLow 3.7
The WP Travel WordPress plugin before 12.0.2 does not properly verify that the requester is authorized to modify the targeted booking on one branch of its bank-deposit handler, allowing an unauthenticated attacker who knows the target customer's email address to reset that customer's booking payment to an unpaid state and wipe its stored deposit-reconciliation data.
- Product
- WP Travel
- Fixed in
- 12.0.2
- What to do
- Update WP Travel to 12.0.2 or newer.
Sep 9, 2026Content Mask: Does not properly sanitise and escape content submitted with a post before outputting it in the pages it generatesCVE-2025-15690 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Content Mask WordPress plugin before 1.8.5.6 does not properly sanitise and escape content submitted with a post before outputting it in the pages it generates, allowing users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks against any user viewing or previewing the affected page. The Content Mask WordPress plugin before 1.8.5.6's option to restrict its use by role does not prevent this.
- Product
- Content Mask
- Fixed in
- 1.8.5.6
- What to do
- Update Content Mask to 1.8.5.6 or newer.
Sep 8, 2026Easy Appointments: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-81798 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Easy Appointments allows DOM-Based XSS. This issue affects Easy Appointments: from n/a through 4.0.2.1.
- Product
- Easy Appointments
- Affected
- up to 4.0.2.1
- What to do
- Affects up to 4.0.2.1. Update Easy Appointments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 5, 2026Video Player for YouTube: Does not properly sanitise and escape user-supplied input before using it in a SQL statementCVE-2026-84937 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Video Player for YouTube WordPress plugin before 2.1.0 does not properly sanitise and escape user-supplied input before using it in a SQL statement, allowing users with the Contributor role and above to perform SQL injection attacks and read arbitrary data from the database.
- Product
- Video Player for YouTube
- Fixed in
- 2.1.0
- What to do
- Update Video Player for YouTube to 2.1.0 or newer.
Sep 5, 2026EmbedPress: Does not have proper authorization on a public review-loading actionCVE-2026-84936 · WordPress plugins & themes · reported by WPScanMedium 5.3
The EmbedPress WordPress plugin before 4.6.4 does not have proper authorization on a public review-loading action, allowing unauthenticated users to force the site to make repeated billable third-party API requests using the site's own configured API key, and to create an unbounded number of attacker-controlled rows in the database.
- Product
- EmbedPress
- Fixed in
- 4.6.4
- What to do
- Update EmbedPress to 4.6.4 or newer.
Sep 5, 2026CatFolders Document Gallery & PDF Library: Does not properly validate a block attribute before using itCVE-2026-84930 · WordPress plugins & themes · reported by WPScanMedium 6.8
The CatFolders Document Gallery & PDF Library WordPress plugin before 2.0.7 does not properly validate a block attribute before using it as an HTML tag name in its gallery output, allowing users with the Author role and above to inject arbitrary web scripts that execute in the browser of anyone who views the affected post.
- Product
- CatFolders Document Gallery & PDF Library
- Fixed in
- 2.0.7
- What to do
- Update CatFolders Document Gallery & PDF Library to 2.0.7 or newer.
Sep 5, 2026Eventin: Does not properly check authorization on several of its event-management REST routesCVE-2026-84901 · WordPress plugins & themes · reported by WPScanMedium 4.9
The Eventin WordPress plugin before 4.1.22 does not properly check authorization on several of its event-management REST routes, allowing users with contributor-level access and above to change the site's front-page setting to an event they do not own and to create, edit and delete global event and speaker taxonomy terms they should not be able to manage.
- Product
- Eventin
- Fixed in
- 4.1.22
- What to do
- Update Eventin to 4.1.22 or newer.
Sep 5, 2026Eventin: Does not properly validate a template path value before using it to include a local fileCVE-2026-84898 · WordPress plugins & themes · reported by WPScanMedium 6.6
The Eventin WordPress plugin before 4.1.21 does not properly validate a template path value before using it to include a local file, allowing users with contributor-level access and above to include and execute arbitrary local PHP files.
- Product
- Eventin
- Fixed in
- 4.1.21
- What to do
- Update Eventin to 4.1.21 or newer.
Sep 5, 2026Bold Page Builder: Does not properly validate a link URL before outputting it in an HTML attributeCVE-2026-84021 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Bold Page Builder WordPress plugin before 5.9.8 does not properly validate a link URL before outputting it in an HTML attribute, relying on a filter that can be evaded, allowing users with the Contributor role and above to inject arbitrary web scripts that execute when a user clicks the affected link.
- Product
- Bold Page Builder
- Fixed in
- 5.9.8
- What to do
- Update Bold Page Builder to 5.9.8 or newer.
Sep 5, 2026Greenshift: Does not properly escape a block animation attribute before outputting it within an HTML attributeCVE-2026-83544 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Greenshift WordPress plugin before 13.2.0 does not properly escape a block animation attribute before outputting it within an HTML attribute, allowing users with contributor-level access and above to inject arbitrary web scripts that execute when the content is viewed.
- Product
- Greenshift
- Fixed in
- 13.2.0
- What to do
- Update Greenshift to 13.2.0 or newer.
Sep 5, 2026JetFormBuilder — Dynamic Blocks Form Builder: Does not properly sanitise and escape a form field's value before including it in the HTML notification emails it sendsCVE-2026-19861 · WordPress plugins & themes · reported by WPScanMedium 4.7
The JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin before 3.6.5.2 does not properly sanitise and escape a form field's value before including it in the HTML notification emails it sends, allowing unauthenticated users to inject arbitrary HTML into messages delivered to administrators and other recipients. Whether injected script executes depends on the recipient's mail client, but the injected markup is rendered regardless.
- Product
- JetFormBuilder — Dynamic Blocks Form Builder
- Fixed in
- 3.6.5.2
- What to do
- Update JetFormBuilder — Dynamic Blocks Form Builder to 3.6.5.2 or newer.
Sep 5, 2026JCH Optimize: Does not properly restrict a directory path provided to one of its administrative image-browsing features to within the siteCVE-2025-15693 · WordPress plugins & themes · reported by WPScanLow 2.7
The JCH Optimize WordPress plugin before 5.0.1 does not properly restrict a directory path provided to one of its administrative image-browsing features to within the site, allowing high-privilege users, administrators on single-site and sub-site administrators on multisite, to enumerate directories and file names outside the web root.
- Product
- JCH Optimize
- Fixed in
- 5.0.1
- What to do
- Update JCH Optimize to 5.0.1 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.