Vulnerability database

4,583 results · page 10 of 92

• Sep 30, 2026Unauthenticated Cross Site Scripting (XSS) in WPFunnels <= 3.13.1 versions.CVE-2026-27371 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in WPFunnels <= 3.13.1 versions.

  Affected

  up to 3.13.1

  What to do

  Affects up to 3.13.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 30, 2026Unauthenticated Cross Site Request Forgery (CSRF) in Photo Gallery by Supsystic <= 1.21.0 versions.CVE-2026-102399 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Unauthenticated Cross Site Request Forgery (CSRF) in Photo Gallery by Supsystic <= 1.21.0 versions.

  Affected

  up to 1.21.0

  What to do

  Affects up to 1.21.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 30, 2026Unauthenticated Cross Site Scripting (XSS) in Popup by Supsystic <= 1.13.1 versions.CVE-2026-102398 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in Popup by Supsystic <= 1.13.1 versions.

  Affected

  up to 1.13.1

  What to do

  Affects up to 1.13.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 30, 2026Unauthenticated Cross Site Scripting (XSS) in Ultimate Maps by Supsystic <= 1.5.5 versions.CVE-2026-102396 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in Ultimate Maps by Supsystic <= 1.5.5 versions.

  Affected

  up to 1.5.5

  What to do

  Affects up to 1.5.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 30, 2026Unauthenticated Cross Site Scripting (XSS) in Easy Google Maps <= 1.14.6 versions.CVE-2026-102395 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in Easy Google Maps <= 1.14.6 versions.

  Affected

  up to 1.14.6

  What to do

  Affects up to 1.14.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 30, 2026Unauthenticated Cross Site Scripting (XSS) in Ninja Forms <= 3.15.3 versions.CVE-2026-102385 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in Ninja Forms <= 3.15.3 versions.

  Affected

  up to 3.15.3

  What to do

  Affects up to 3.15.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 30, 2026Unauthenticated Denial of Service Attack in Two Factor <= 0.16.0 versions.CVE-2026-100508 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Unauthenticated Denial of Service Attack in Two Factor <= 0.16.0 versions.

  Affected

  up to 0.16.0

  What to do

  Affects up to 0.16.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 30, 2026EWWW Image Optimizer: Does not prevent authenticated users with author-level permissions from storing a serialized value in a post meta field that is deserializedCVE-2026-91051 · WordPress plugins & themes · reported by WPScanMedium 6.6

  The EWWW Image Optimizer WordPress plugin before 8.8.0 does not prevent authenticated users with author-level permissions from storing a serialized value in a post meta field that is deserialized when the post is rendered, allowing them to perform PHP Object Injection, which can lead to remote code execution when a suitable gadget chain is present via another installed EWWW Image Optimizer WordPress plugin before 8.8.0 or .

  Product

  EWWW Image Optimizer

  Fixed in

  8.8.0

  What to do

  Update EWWW Image Optimizer to 8.8.0 or newer.

  Full record and what to do →NVD recordwpscan.com

• Sep 30, 2026New User Approve: Does not properly verify authentication on a set of integration REST API routesCVE-2026-83560 · WordPress plugins & themes · reported by WPScanMedium 5.3

  The New User Approve WordPress plugin before 3.2.10 does not properly verify authentication on a set of integration REST API routes when the integration is unconfigured, allowing unauthenticated attackers to retrieve personal data (id, username, email address and registration date) of registered users.

  Product

  New User Approve

  Fixed in

  3.2.10

  What to do

  Update New User Approve to 3.2.10 or newer.

  Full record and what to do →NVD recordwpscan.com

• Sep 28, 2026The Blacklist Manager for WooCommerce WordPress plugin from 1.3.0 to 2.3.1 does not enforce its user blocking on every authentication path, allowing the holder CVE-2026-88828 · WordPress plugins & themes · reported by WPScanMedium 5.4

  The Blacklist Manager for WooCommerce WordPress plugin from 1.3.0 to 2.3.1 does not enforce its user blocking on every authentication path, allowing the holder of an account the site owner has blocked to keep authenticating with that account's privileges, without the block being enforced or recorded.

  What to do

  Update the plugin to the newest version.

  Full record and what to do →NVD recordwpscan.com

• Sep 27, 2026Mailchimp for WooCommerce: Does not require authentication or verify ownership before loading a saved cart from a request-supplied identifier that is derived from a customer's email addressCVE-2026-92436 · WordPress plugins & themes · reported by WPScanMedium 5.3

  The Mailchimp for WooCommerce WordPress plugin before 6.3 does not require authentication or verify ownership before loading a saved cart from a request-supplied identifier that is derived from a customer's email address, allowing an unauthenticated attacker who knows a customer's email address to confirm that the customer shops at the store and to read that customer's saved cart contents.

  Product

  Mailchimp for WooCommerce

  Fixed in

  6.3

  What to do

  Update Mailchimp for WooCommerce to 6.3 or newer.

  Full record and what to do →NVD recordwpscan.com

• Sep 26, 2026miniOrange OTP Login, Verification and SMS Notifications: Authentication BypassCVE-2026-85984 · WordPress plugins & themes · reported by WordfenceCritical 9.8

  The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress is vulnerable to Authentication Bypass via the mo_wp_login_intent parameter in all versions up to, and including, 5.5.5. This is due to a missing password-intent guard in the skip_pass_fallback-enabled configuration branch of the mo_by_pass_login() function, which treats administrator role membership alone as sufficient authentication whenever the unauthenticated, unverified POST parameter mo_wp_login_intent is submitted with the value otp, causing mo_get_user() to skip wp_authenticate_username_password() and resolve a WP_User purely from a username lookup. This makes it possible for unauthenticated attackers to log in as any existing administrator account by supplying only a known username and an empty password alongside mo_wp_login_intent=otp, with no password or OTP verification required. Exploitation is conditional on a site administrator having simultaneously enabled the following plugin options: WP Login OTP, Login with Only OTP, Allow Users to Login with Username and Password, and Admin OTP Bypass.

  Product

  miniOrange OTP Login, Verification and SMS Notifications

  Affected

  up to 5.5.5

  What to do

  Affects up to 5.5.5. Update miniOrange OTP Login, Verification and SMS Notifications to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Sep 26, 2026MCP Server for WordPress: Does not correctly verify the WordPress REST API nonce for cookie-authenticated requestsCVE-2026-96524 · WordPress plugins & themes · reported by WPScanHigh 8.8

  The MCP Server for WordPress WordPress plugin before 1.8.2 does not correctly verify the WordPress REST API nonce for cookie-authenticated requests when a condition an attacker can influence is present, allowing unauthenticated attackers to perform administrator-only actions, including creating a new administrator account, by tricking a logged-in administrator into visiting a crafted page.

  Product

  MCP Server for WordPress

  Fixed in

  1.8.2

  What to do

  Update MCP Server for WordPress to 1.8.2 or newer.

  Full record and what to do →NVD recordwpscan.com

• Sep 26, 2026File Manager: Does not prevent unauthenticated users from downloading its database backup archivesCVE-2026-19708 · WordPress plugins & themes · reported by WPScanMedium 5.9

  The File Manager WordPress plugin before 8.0.5 does not prevent unauthenticated users from downloading its database backup archives, and in some cases writes them under a fixed filename, allowing unauthenticated attackers to retrieve a full database dump including every user's email address and password hash on servers that do not apply the directory's .htaccess file.

  Product

  File Manager

  Fixed in

  8.0.5

  What to do

  Update File Manager to 8.0.5 or newer.

  Full record and what to do →NVD recordwpscan.com

• Sep 26, 2026WP Directory Kit: Does not sanitize and escape some of its category and location fields before outputting them in page attributesCVE-2026-16591 · WordPress plugins & themes · reported by WPScanHigh 7.2

  The WP Directory Kit WordPress plugin before 1.5.8 does not sanitize and escape some of its category and location fields before outputting them in page attributes, allowing users with a WP Directory Kit WordPress plugin before 1.5.8-specific listing-management role (and without the unfiltered_html capability) to perform Stored Cross-Site Scripting attacks that execute for any visitor of the affected page.

  Product

  WP Directory Kit

  Fixed in

  1.5.8

  What to do

  Update WP Directory Kit to 1.5.8 or newer.

  Full record and what to do →NVD recordwpscan.com

• Sep 26, 2026Team Members: Does not perform any authorization or visibility check in an unauthenticated AJAX action that returns full team member records by IDCVE-2026-11871 · WordPress plugins & themes · reported by WPScanMedium 5.3

  The Team Members WordPress plugin before 9.3 does not perform any authorization or visibility check in an unauthenticated AJAX action that returns full team member records by ID, allowing unauthenticated attackers to enumerate and disclose details, including email addresses and phone numbers, of team members the administrator has not published publicly.

  Product

  Team Members

  Fixed in

  9.3

  What to do

  Update Team Members to 9.3 or newer.

  Full record and what to do →NVD recordwpscan.com

• Sep 25, 2026SSL Zen — SSL Certificate Installer & HTTPS Redirects: Directory TraversalCVE-2026-17602 · WordPress plugins & themes · reported by WordfenceMedium 4.9

  The SSL Zen — SSL Certificate Installer & HTTPS Redirects plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.7.42 via the 'file_name' parameter parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.

  Product

  SSL Zen — SSL Certificate Installer & HTTPS Redirects

  Affected

  up to 4.7.42

  What to do

  Affects up to 4.7.42. Update SSL Zen — SSL Certificate Installer & HTTPS Redirects to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Sep 25, 2026WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters: Local File InclusionCVE-2026-13456 · WordPress plugins & themes · reported by WordfenceHigh 7.5

  The WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.9.8 via the 'page' parameter parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.

  Product

  WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters

  Affected

  up to 4.9.8

  What to do

  Affects up to 4.9.8. Update WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Sep 25, 2026WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters: Stored Cross-Site ScriptingCVE-2026-13179 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shapes_values Parameter in all versions up to, and including, 4.9.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The fc-call-nonce nonce required by the endpoint is exposed to all frontend visitors who view a map page via window.wpgmp_local.nonce, enabling any authenticated subscriber to read the nonce and craft a valid request; additionally, the secondary _wpnonce check in the drawing handler can be bypassed by simply omitting the _wpnonce parameter from the request.

  Product

  WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters

  Affected

  up to 4.9.8

  What to do

  Affects up to 4.9.8. Update WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Sep 25, 2026Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code: Privilege EscalationCVE-2026-14281 · WordPress plugins & themes · reported by WordfenceCritical 9.8

  The Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.8.6. This is due to missing permission enforcement on the publicly accessible REST route `POST /wp-json/wawp/v1/signup/<op>` and the absence of a key allowlist in the `finish_registration_logic` function, which copies the attacker-controlled `wawp_custom_fields` parameter directly into `update_user_meta()` — allowing sensitive meta keys such as `wp_capabilities` and `wp_user_level` to be set by the caller. This makes it possible for unauthenticated attackers to register a new account with the administrator role and gain full administrative access to the site. When OTP verification is enabled at signup, the OTP session token (`otp_transient`) is returned in plaintext in the HTTP response body, and the `handle_magic_link_request()` handler marks that token as verified on any unauthenticated GET request containing it without ever checking the OTP code value — making the OTP step trivially bypassable with no inbox or SMS access required.

  Product

  Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code

  Affected

  up to 4.8.6

  What to do

  Affects up to 4.8.6. Update Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Sep 24, 2026MailerLite – Signup forms (official): Unauthorized modification of dataCVE-2026-3253 · WordPress plugins & themes · reported by WordfenceMedium 4.3

  The MailerLite – Signup forms (official) plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the forms() method of the AdminController class in all versions up to, and including, 1.7.21. This makes it possible for authenticated attackers, with Contributor-level access and above, to create or delete arbitrary signup forms.

  Product

  MailerLite – Signup forms (official)

  Affected

  up to 1.7.21

  What to do

  Affects up to 1.7.21. Update MailerLite – Signup forms (official) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com

• Sep 24, 2026Events Manager: Does not force the scope of its logged-in event and location searchCVE-2026-93662 · WordPress plugins & themes · reported by WPScanMedium 4.3

  The Events Manager WordPress plugin before 7.4.5 does not force the scope of its logged-in event and location search when a caller supplies their own owner value, letting a low-privileged user read other accounts' unpublished, pending or trashed event and venue content, including full street addresses.

  Product

  Events Manager

  Fixed in

  7.4.5

  What to do

  Update Events Manager to 7.4.5 or newer.

  Full record and what to do →NVD recordwpscan.com

• Sep 23, 2026EthPress – Web3 Login: Authentication BypassCVE-2026-19125 · WordPress plugins & themes · reported by WordfenceHigh 8.1

  The EthPress – Web3 Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 2.3.5. This is due to the verify_login() function in app/Login.php containing a missing return statement in the signature verification failure branch — when Signature::verify2() reports a mismatch, the function only assigns a WP_Error to a local variable and continues executing, causing unconditional fall-through to the login block where Address::log_in() calls wp_set_auth_cookie() regardless of whether the submitted signature is valid. This makes it possible for unauthenticated attackers to log in as any WordPress user who has a linked wallet address — including administrators — by submitting that user's public wallet address alongside an arbitrary well-formed signature, enabling full site takeover.

  Product

  EthPress – Web3 Login

  Affected

  up to 2.3.5

  What to do

  Affects up to 2.3.5. Update EthPress – Web3 Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Sep 23, 2026Unauthenticated Broken Access Control in Loops & Logic <= 4.2.4 versions.CVE-2026-95604 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Unauthenticated Broken Access Control in Loops & Logic <= 4.2.4 versions.

  Affected

  up to 4.2.4

  What to do

  Affects up to 4.2.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 23, 2026Unauthenticated SQL Injection in Product Filter by WBW <= 3.1.7 versions.CVE-2026-95601 · WordPress plugins & themes · reported by PatchstackCritical 9.3

  Unauthenticated SQL Injection in Product Filter by WBW <= 3.1.7 versions.

  Affected

  up to 3.1.7

  What to do

  Affects up to 3.1.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 23, 2026Unauthenticated Sensitive Data Exposure in TrustedLogin Connector <= 2.0.3 versions.CVE-2026-95600 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Unauthenticated Sensitive Data Exposure in TrustedLogin Connector <= 2.0.3 versions.

  Affected

  up to 2.0.3

  What to do

  Affects up to 2.0.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 23, 2026Unauthenticated Insecure Direct Object References (IDOR) in Team <= 6.0.0 versions.CVE-2026-95592 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Unauthenticated Insecure Direct Object References (IDOR) in Team <= 6.0.0 versions.

  Affected

  up to 6.0.0

  What to do

  Affects up to 6.0.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 23, 2026Unauthenticated Cross Site Scripting (XSS) in Calculated Fields Form <= 5.5.1.1 versions.CVE-2026-95529 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in Calculated Fields Form <= 5.5.1.1 versions.

  Affected

  up to 5.5.1.1

  What to do

  Affects up to 5.5.1.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 23, 2026Unauthenticated Cross Site Scripting (XSS) in Core Web Vitals & PageSpeed Booster <= 1.0.31 versions.CVE-2026-95528 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in Core Web Vitals & PageSpeed Booster <= 1.0.31 versions.

  Affected

  up to 1.0.31

  What to do

  Affects up to 1.0.31. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 23, 2026Unauthenticated Broken Access Control in Conekta Payment Gateway <= 6.2.4 versions.CVE-2026-95527 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Unauthenticated Broken Access Control in Conekta Payment Gateway <= 6.2.4 versions.

  Affected

  up to 6.2.4

  What to do

  Affects up to 6.2.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 23, 2026Unauthenticated Bypass Vulnerability in WP User Frontend <= 4.3.11 versions.CVE-2026-95524 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Unauthenticated Bypass Vulnerability in WP User Frontend <= 4.3.11 versions.

  Affected

  up to 4.3.11

  What to do

  Affects up to 4.3.11. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 23, 2026Unauthenticated Cross Site Scripting (XSS) in Ninja Forms <= 3.15.3 versions.CVE-2026-95515 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in Ninja Forms <= 3.15.3 versions.

  Affected

  up to 3.15.3

  What to do

  Affects up to 3.15.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 23, 2026Unauthenticated Bypass Vulnerability in Netgsm <= 2.10.0 versions.CVE-2026-95514 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Unauthenticated Bypass Vulnerability in Netgsm <= 2.10.0 versions.

  Affected

  up to 2.10.0

  What to do

  Affects up to 2.10.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 23, 2026Unauthenticated Broken Access Control in Online Booking & Scheduling Calendar for WordPress by vcita <= 4.6.0 versions.CVE-2026-95513 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Unauthenticated Broken Access Control in Online Booking & Scheduling Calendar for WordPress by vcita <= 4.6.0 versions.

  Affected

  up to 4.6.0

  What to do

  Affects up to 4.6.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 23, 2026Unauthenticated Broken Access Control in AppMySite <= 3.15.4 versions.CVE-2026-94498 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Unauthenticated Broken Access Control in AppMySite <= 3.15.4 versions.

  Affected

  up to 3.15.4

  What to do

  Affects up to 3.15.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 23, 2026Unauthenticated Cross Site Request Forgery (CSRF) in PublishPress Capabilities <= 2.50.1 versions.CVE-2026-94487 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Unauthenticated Cross Site Request Forgery (CSRF) in PublishPress Capabilities <= 2.50.1 versions.

  Affected

  up to 2.50.1

  What to do

  Affects up to 2.50.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 23, 2026Unauthenticated Bypass Vulnerability in Captcha Code <= 3.32 versions.CVE-2026-94457 · WordPress plugins & themes · reported by PatchstackMedium 4.8

  Unauthenticated Bypass Vulnerability in Captcha Code <= 3.32 versions.

  Affected

  up to 3.32

  What to do

  Affects up to 3.32. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 23, 2026Unauthenticated Cross Site Scripting (XSS) in Razorpay Payment Button <= 2.4.9 versions.CVE-2026-94179 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in Razorpay Payment Button <= 2.4.9 versions.

  Affected

  up to 2.4.9

  What to do

  Affects up to 2.4.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 23, 2026Unauthenticated Cross Site Scripting (XSS) in Mang Board WP <= 2.4.1 versions.CVE-2026-94176 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in Mang Board WP <= 2.4.1 versions.

  Affected

  up to 2.4.1

  What to do

  Affects up to 2.4.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 23, 2026Unauthenticated Broken Access Control in MarketKing <= 2.1.70 versions.CVE-2026-94080 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Unauthenticated Broken Access Control in MarketKing <= 2.1.70 versions.

  Affected

  up to 2.1.70

  What to do

  Affects up to 2.1.70. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 23, 2026Unauthenticated Broken Access Control in WP User Manager <= 2.9.19 versions.CVE-2026-94079 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Unauthenticated Broken Access Control in WP User Manager <= 2.9.19 versions.

  Affected

  up to 2.9.19

  What to do

  Affects up to 2.9.19. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 23, 2026Unauthenticated Cross Site Scripting (XSS) in WP Photo Album Plus <= 9.3.02.002 versions.CVE-2026-93774 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in WP Photo Album Plus <= 9.3.02.002 versions.

  Affected

  up to 9.3.02.002

  What to do

  Affects up to 9.3.02.002. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 23, 2026Unauthenticated Insecure Direct Object References (IDOR) in AI Engine <= 3.7.8 versions.CVE-2026-93623 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Unauthenticated Insecure Direct Object References (IDOR) in AI Engine <= 3.7.8 versions.

  Affected

  up to 3.7.8

  What to do

  Affects up to 3.7.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 23, 2026Unauthenticated Cross Site Scripting (XSS) in WPS Limit Login <= 1.5.9.3 versions.CVE-2026-93622 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in WPS Limit Login <= 1.5.9.3 versions.

  Affected

  up to 1.5.9.3

  What to do

  Affects up to 1.5.9.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 23, 2026Unauthenticated Broken Access Control in PayPlus Payment Gateway <= 8.2.5 versions.CVE-2026-93620 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Unauthenticated Broken Access Control in PayPlus Payment Gateway <= 8.2.5 versions.

  Affected

  up to 8.2.5

  What to do

  Affects up to 8.2.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 23, 2026Unauthenticated Cross Site Scripting (XSS) in Event Tickets <= 5.29.4 versions.CVE-2026-93526 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in Event Tickets <= 5.29.4 versions.

  Affected

  up to 5.29.4

  What to do

  Affects up to 5.29.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 23, 2026SUMIT Payment Gateway for WooCommerce: Does not verify with the payment provider that a payment notification is genuine before marking the corresponding orderCVE-2026-84091 · WordPress plugins & themes · reported by WPScanMedium 5.3

  The SUMIT Payment Gateway for WooCommerce WordPress plugin before 4.0.0 does not verify with the payment provider that a payment notification is genuine before marking the corresponding order as paid, allowing unauthenticated users to mark a pending order paid without completing payment.

  Product

  SUMIT Payment Gateway for WooCommerce

  Fixed in

  4.0.0

  What to do

  Update SUMIT Payment Gateway for WooCommerce to 4.0.0 or newer.

  Full record and what to do →NVD recordwpscan.com

• Sep 23, 2026The MPCX Lightbox WordPress plugin 1.2.2 through 1.2.5 does not have any authorisation or authentication on one of its AJAX actions available to unauthenticatedCVE-2026-87848 · WordPress plugins & themes · reported by WPScanLow 3.7

  The MPCX Lightbox WordPress plugin 1.2.2 through 1.2.5 does not have any authorisation or authentication on one of its AJAX actions available to unauthenticated users, nor does it check the status of the requested post, allowing unauthenticated visitors to retrieve the title, content or excerpt of arbitrary posts, including private, draft, pending, trashed and password-protected ones.

  Affected

  up to 1.2.5

  What to do

  Affects up to 1.2.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordwpscan.com

• Sep 23, 2026Premium Packages: Does not verify PayPal's webhook signature before processing payment and subscription notificationsCVE-2026-93511 · WordPress plugins & themes · reported by WPScanMedium 5.3

  The Premium Packages WordPress plugin before 7.2.1 does not verify PayPal's webhook signature before processing payment and subscription notifications, allowing unauthenticated attackers to forge payment confirmations and subscription-cancellation events against any order whose transaction id they know.

  Product

  Premium Packages

  Fixed in

  7.2.1

  What to do

  Update Premium Packages to 7.2.1 or newer.

  Full record and what to do →NVD recordwpscan.com

• Sep 23, 2026Paid Membership Subscriptions: Does not bind one of its unauthenticated payment actions to the requesting userCVE-2026-90951 · WordPress plugins & themes · reported by WPScanLow 3.7

  The Paid Membership Subscriptions WordPress plugin before 3.1.0 does not bind one of its unauthenticated payment actions to the requesting user, allowing someone who holds another member's in-flight payment identifier to delete that member's checkout state.

  Product

  Paid Membership Subscriptions

  Fixed in

  3.1.0

  What to do

  Update Paid Membership Subscriptions to 3.1.0 or newer.

  Full record and what to do →NVD recordwpscan.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.