Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
11,363 results · page 10 of 228
Oct 15, 2026Mang Board WP: Stored Cross-Site ScriptingCVE-2026-88043 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Mang Board WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data_type' parameter in all versions up to, and including, 2.4.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Mang Board WP
- Affected
- up to 2.4.0
- What to do
- Affects up to 2.4.0. Update Mang Board WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 15, 2026The Ocean Extra: Arbitrary shortcode executionCVE-2026-86803 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The The Ocean Extra plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.6.0 This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
- Product
- The Ocean Extra
- Affected
- up to 2.6.0
- What to do
- Affects up to 2.6.0. Update The Ocean Extra to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 15, 2026VK Blocks: Stored Cross-Site ScriptingCVE-2026-78087 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The VK Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Group Block 'linkToPost' Feature in all versions up to, and including, 1.126.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- VK Blocks
- Affected
- up to 1.126.1
- What to do
- Affects up to 1.126.1. Update VK Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 15, 2026Post and Page Builder by BoldGrid – Visual Drag and Drop Editor: Stored Cross-Site ScriptingCVE-2026-78001 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Post and Page Builder by BoldGrid – Visual Drag and Drop Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Table Designer 'data-label' Attribute in all versions up to, and including, 1.27.13 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Post and Page Builder by BoldGrid – Visual Drag and Drop Editor
- Affected
- up to 1.27.13
- What to do
- Affects up to 1.27.13. Update Post and Page Builder by BoldGrid – Visual Drag and Drop Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 15, 2026Premium Packages – Sell Digital Products Securely: Unauthenticated Stored Cross-Site ScriptingCVE-2026-18586 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting via 'order_email' in all versions up to, and including, 7.0.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Premium Packages – Sell Digital Products Securely
- Affected
- up to 7.0.5
- What to do
- Affects up to 7.0.5. Update Premium Packages – Sell Digital Products Securely to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 15, 2026Photo Gallery by 10Web – Mobile-Friendly Image Gallery: Reflected Cross-Site ScriptingCVE-2026-18557 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'title' parameter in all versions up to, and including, 1.8.42 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- Photo Gallery by 10Web – Mobile-Friendly Image Gallery
- Affected
- up to 1.8.42
- What to do
- Affects up to 1.8.42. Update Photo Gallery by 10Web – Mobile-Friendly Image Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 15, 2026Groundhogg — CRM, Newsletters, and Marketing Automation: Stored Cross-Site ScriptingCVE-2026-18548 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ref' parameter in all versions up to, and including, 4.5.14 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Groundhogg — CRM, Newsletters, and Marketing Automation
- Affected
- up to 4.5.14
- What to do
- Affects up to 4.5.14. Update Groundhogg — CRM, Newsletters, and Marketing Automation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 15, 2026Checkout Field Manager (Checkout Manager) for WooCommerce: Authorization bypassCVE-2026-17031 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Checkout Field Manager (Checkout Manager) for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.9.6 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary Media Library attachments.
- Product
- Checkout Field Manager (Checkout Manager) for WooCommerce
- Affected
- up to 7.9.6
- What to do
- Affects up to 7.9.6. Update Checkout Field Manager (Checkout Manager) for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 15, 2026Import and export users and customers: Stored Cross-Site ScriptingCVE-2026-17001 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Import and export users and customers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Custom Column User Meta Profile Fields in all versions up to, and including, 2.4.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with custom-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Import and export users and customers
- Affected
- up to 2.4.5
- What to do
- Affects up to 2.4.5. Update Import and export users and customers to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 15, 2026Tracking Code Manager: Reflected Cross-Site ScriptingCVE-2026-15180 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Tracking Code Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'TCM_ErrorMessages' POST Parameter in all versions up to, and including, 2.6.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- Tracking Code Manager
- Affected
- up to 2.6.0
- What to do
- Affects up to 2.6.0. Update Tracking Code Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 15, 2026Link Library: Time-based SQL InjectionCVE-2026-15090 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Link Library plugin for WordPress is vulnerable to time-based SQL Injection via the 'link_url' parameter in all versions up to, and including, 7.9.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- Link Library
- Affected
- up to 7.9.2
- What to do
- Affects up to 7.9.2. Update Link Library to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 15, 2026PhastPress: Server-Side Request ForgeryCVE-2026-3712 · WordPress plugins & themes · reported by WordfenceHigh 7.3
The PhastPress plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.10 This is due to the scripts service endpoint constructing its URL whitelist dynamically from the attacker-controlled HTTP 'Host' header. This makes it possible for unauthenticated attackers to spoof the header to match any target URL, bypassing the whitelist and forcing the server to make HTTP requests to arbitrary internal or external destinations and return the response content.
- Product
- PhastPress
- Affected
- up to 3.10
- What to do
- Affects up to 3.10. Update PhastPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 15, 2026Kirki – Freeform Page Builder, Website Builder & Customizer: Stored Cross-Site ScriptingCVE-2026-14572 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Page Builder Text Content in all versions up to, and including, 6.2.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with kirki_content_access capability granted by an administrator, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Kirki – Freeform Page Builder, Website Builder & Customizer
- Affected
- up to 6.2.0
- What to do
- Affects up to 6.2.0. Update Kirki – Freeform Page Builder, Website Builder & Customizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 15, 202610Web Booster – Website speed optimization, Cache & Page Speed optimizer: Arbitrary File UploadCVE-2026-108587 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.34.10 via the compressCustom function. This is due to missing file type validation and extension filtering on the page_id parameter, combined with a world-readable leaked nonce that bypasses authentication checks. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. This exploit chain requires obtaining the plugin's REST nonce (tenwebio_rest), which is automatically serialized to a world-readable file under wp-content/uploads/ whenever a bulk optimisation batch pauses; because the nonce is generated in a cron/loopback context with a user ID of 0, it is valid for unauthenticated visitors.
- Product
- 10Web Booster – Website speed optimization, Cache & Page Speed optimizer
- Affected
- up to 2.34.10
- What to do
- Affects up to 2.34.10. Update 10Web Booster – Website speed optimization, Cache & Page Speed optimizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 14, 2026FV Flowplayer Video Player: Limited Arbitrary File UploadCVE-2026-86461 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The FV Flowplayer Video Player plugin for WordPress is vulnerable to Limited Arbitrary File Upload in all versions up to, and including, 7.5.54.7212 via the check_mimetype function. This is due to incomplete file type validation in the check_mimetype function — while some extension checking is present, it can be bypassed, allowing attacker-supplied remote file content to be written with insufficient extension enforcement and no MIME check or WordPress upload helper. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload files that may be executable, which makes remote code execution possible. Exploitation requires the plugin's 'profile videos on bio' option to be enabled, as this causes the nonce to be emitted on the subscriber-accessible profile page; without this setting, authenticated users below Editor cannot obtain the required nonce.
- Product
- FV Flowplayer Video Player
- Affected
- up to 7.5.54.7212
- What to do
- Affects up to 7.5.54.7212. Update FV Flowplayer Video Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 14, 2026WPManageNinja Best Payments Plugin for WP wp-payment-form: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-108484 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPManageNinja Best Payments Plugin for WP wp-payment-form allows Stored XSS.This issue affects Best Payments Plugin for WP: from n/a through 4.6.27.
- Product
- WPManageNinja Best Payments Plugin for WP wp-payment-form
- Affected
- up to 4.6.27
- What to do
- Affects up to 4.6.27. Update WPManageNinja Best Payments Plugin for WP wp-payment-form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 14, 2026hippooo Hippoo Mobile App for WooCommerce hippoo: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-108483 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hippooo Hippoo Mobile App for WooCommerce hippoo allows Reflected XSS.This issue affects Hippoo Mobile App for WooCommerce: from n/a through 1.12.0.
- Product
- hippooo Hippoo Mobile App for WooCommerce hippoo
- Affected
- up to 1.12.0
- What to do
- Affects up to 1.12.0. Update hippooo Hippoo Mobile App for WooCommerce hippoo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 14, 2026Skydropx Skydropx skydropx: Missing AuthorizationCVE-2026-108480 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Missing Authorization vulnerability in Skydropx Skydropx skydropx allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Skydropx: from n/a through 2.1.4.
- Product
- Skydropx Skydropx skydropx
- Affected
- up to 2.1.4
- What to do
- Affects up to 2.1.4. Update Skydropx Skydropx skydropx to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 14, 2026PluginUs: Improper Control of Generation of Code ('Code Injection')CVE-2026-108151 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Improper Control of Generation of Code ('Code Injection') vulnerability in PluginUs.Net MDTF wp-meta-data-filter-and-taxonomy-filter allows Code Injection.This issue affects MDTF: from n/a through 1.3.9.
- Product
- PluginUs
- Affected
- up to 1.3.9
- What to do
- Affects up to 1.3.9. Update PluginUs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 14, 2026SimplyRETS SimplyRETS Real Estate IDX simply-rets: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-105066 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SimplyRETS SimplyRETS Real Estate IDX simply-rets allows Reflected XSS.This issue affects SimplyRETS Real Estate IDX: from n/a through 3.2.9.
- Product
- SimplyRETS SimplyRETS Real Estate IDX simply-rets
- Affected
- up to 3.2.9
- What to do
- Affects up to 3.2.9. Update SimplyRETS SimplyRETS Real Estate IDX simply-rets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 14, 2026VillaTheme Salevo woo-boost-sales: Improper Control of Generation of Code ('Code Injection')CVE-2026-103081 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Generation of Code ('Code Injection') vulnerability in VillaTheme Salevo woo-boost-sales allows Code Injection.This issue affects Salevo: from n/a through 1.3.0.
- Product
- VillaTheme Salevo woo-boost-sales
- Affected
- up to 1.3.0
- What to do
- Affects up to 1.3.0. Update VillaTheme Salevo woo-boost-sales to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 14, 2026Crocoblock JetEngine jet-engine: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-107870 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetEngine jet-engine allows DOM-Based XSS.This issue affects JetEngine: from n/a through 3.8.16.
- Product
- Crocoblock JetEngine jet-engine
- Affected
- up to 3.8.16
- What to do
- Affects up to 3.8.16. Update Crocoblock JetEngine jet-engine to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 14, 2026WP SYNTEX Polylang polylang: Deserialization of Untrusted DataCVE-2026-97278 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Deserialization of Untrusted Data vulnerability in WP SYNTEX Polylang polylang allows Object Injection.This issue affects Polylang: from n/a through 3.8.9.
- Product
- WP SYNTEX Polylang polylang
- Affected
- up to 3.8.9
- What to do
- Affects up to 3.8.9. Update WP SYNTEX Polylang polylang to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 14, 2026itthinx Affiliates affiliates: Deserialization of Untrusted DataCVE-2026-108291 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in itthinx Affiliates affiliates allows Object Injection.This issue affects Affiliates: from n/a through 7.0.1.
- Product
- itthinx Affiliates affiliates
- Affected
- up to 7.0.1
- What to do
- Affects up to 7.0.1. Update itthinx Affiliates affiliates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 14, 2026Crocoblock JetProductTables jet-product-tables: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-107867 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetProductTables jet-product-tables allows Reflected XSS.This issue affects JetProductTables: from n/a through 1.2.4.
- Product
- Crocoblock JetProductTables jet-product-tables
- Affected
- up to 1.2.4
- What to do
- Affects up to 1.2.4. Update Crocoblock JetProductTables jet-product-tables to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 14, 2026miniOrange WP OAuth Server miniorange-oauth-20-server: Missing AuthorizationCVE-2026-107433 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in miniOrange WP OAuth Server miniorange-oauth-20-server allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP OAuth Server: from n/a through 6.4.0.
- Product
- miniOrange WP OAuth Server miniorange-oauth-20-server
- Affected
- up to 6.4.0
- What to do
- Affects up to 6.4.0. Update miniOrange WP OAuth Server miniorange-oauth-20-server to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 14, 2026VideoWhisper: Missing AuthorizationCVE-2026-107426 · WordPress plugins & themes · reported by PatchstackHigh 7.3
Missing Authorization vulnerability in VideoWhisper.com Paid Videochat Turnkey Site ppv-live-webcams allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Paid Videochat Turnkey Site: from n/a through 7.5.12.
- Product
- VideoWhisper
- Affected
- up to 7.5.12
- What to do
- Affects up to 7.5.12. Update VideoWhisper to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 14, 2026Magepeople inc: Missing AuthorizationCVE-2026-107425 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Magepeople inc. Bus Ticket Booking with Seat Reservation bus-ticket-booking-with-seat-reservation allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Bus Ticket Booking with Seat Reservation: from n/a through 5.9.7.
- Product
- Magepeople inc
- Affected
- up to 5.9.7
- What to do
- Affects up to 5.9.7. Update Magepeople inc to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 14, 2026M A Vinoth Kumar Frontend Dashboard frontend-dashboard: Incorrect Privilege AssignmentCVE-2026-107424 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Incorrect Privilege Assignment vulnerability in M A Vinoth Kumar Frontend Dashboard frontend-dashboard allows Privilege Escalation.This issue affects Frontend Dashboard: from n/a through 3.0.7.
- Product
- M A Vinoth Kumar Frontend Dashboard frontend-dashboard
- Affected
- up to 3.0.7
- What to do
- Affects up to 3.0.7. Update M A Vinoth Kumar Frontend Dashboard frontend-dashboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 14, 2026axew3: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-107422 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in axew3.com WP w3all phpBB wp-w3all-phpbb-integration allows Stored XSS.This issue affects WP w3all phpBB: from n/a through 3.1.0.
- Product
- axew3
- Affected
- up to 3.1.0
- What to do
- Affects up to 3.1.0. Update axew3 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 14, 2026VideoWhisper: Session FixationCVE-2026-107421 · WordPress plugins & themes · reported by PatchstackHigh 7.3
Session Fixation vulnerability in VideoWhisper.com Broadcast Live Video videowhisper-live-streaming-integration allows Session Hijacking.This issue affects Broadcast Live Video: from n/a through 7.3.2.
- Product
- VideoWhisper
- Affected
- up to 7.3.2
- What to do
- Affects up to 7.3.2. Update VideoWhisper to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 14, 2026Muralidharan Ramasamy Push Notification for Post and BuddyPress push-notification-for-post-and-buddypress: Missing AuthorizationCVE-2026-107417 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Muralidharan Ramasamy Push Notification for Post and BuddyPress push-notification-for-post-and-buddypress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Push Notification for Post and BuddyPress: from n/a through 3.23.
- Product
- Muralidharan Ramasamy Push Notification for Post and BuddyPress push-notification-for-post-and-buddypress
- Affected
- up to 3.23
- What to do
- Affects up to 3.23. Update Muralidharan Ramasamy Push Notification for Post and BuddyPress push-notification-for-post-and-buddypress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 14, 2026Brainstorm Force SureCart surecart: Deserialization of Untrusted DataCVE-2026-106599 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in Brainstorm Force SureCart surecart allows Object Injection.This issue affects SureCart: from n/a through 4.9.3.
- Product
- Brainstorm Force SureCart surecart
- Affected
- up to 4.9.3
- What to do
- Affects up to 4.9.3. Update Brainstorm Force SureCart surecart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 14, 2026Brainstorm Force SureCart surecart: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-105874 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force SureCart surecart allows Reflected XSS.This issue affects SureCart: from n/a through 4.9.3.
- Product
- Brainstorm Force SureCart surecart
- Affected
- up to 4.9.3
- What to do
- Affects up to 4.9.3. Update Brainstorm Force SureCart surecart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 14, 2026Responsive Blocks: Does not sanitise or escape some of the values submitted with its Form block before adding them to the HTML notification email sent to the site ownerCVE-2026-97315 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Responsive Blocks WordPress plugin before 2.3.0 does not sanitise or escape some of the values submitted with its Form block before adding them to the HTML notification email sent to the site owner, allowing unauthenticated users to inject arbitrary HTML, such as phishing links, into that email.
- Product
- Responsive Blocks
- Fixed in
- 2.3.0
- What to do
- Update Responsive Blocks to 2.3.0 or newer.
Oct 14, 2026Tickera: Does not correctly verify the integrity of incoming payment notificationsCVE-2026-88998 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Tickera WordPress plugin before 3.6.0.4 does not correctly verify the integrity of incoming payment notifications, and the validated signature does not cover the order or the amount, allowing unauthenticated attackers to forge a payment confirmation and mark arbitrary orders as paid without paying.
- Product
- Tickera
- Fixed in
- 3.6.0.4
- What to do
- Update Tickera to 3.6.0.4 or newer.
Oct 14, 2026WPForms Lite: Does not verify server-side that a payment was completed before accepting a submission on forms using its PayPal Commerce gatewayCVE-2026-82844 · WordPress plugins & themes · reported by WPScanMedium 5.3
The WPForms Lite WordPress plugin before 2.0.2.2 does not verify server-side that a payment was completed before accepting a submission on forms using its PayPal Commerce gateway, allowing unauthenticated visitors to submit paid forms without paying. The form's confirmation is delivered and its notification emails are sent even though no order exists at the payment provider and no payment is recorded.
- Product
- WPForms Lite
- Fixed in
- 2.0.2.2
- What to do
- Update WPForms Lite to 2.0.2.2 or newer.
Oct 14, 2026Crocoblock JetFormBuilder jetformbuilder: Missing AuthorizationCVE-2026-107431 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in Crocoblock JetFormBuilder jetformbuilder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JetFormBuilder: from n/a through 3.6.6.
- Product
- Crocoblock JetFormBuilder jetformbuilder
- Affected
- up to 3.6.6
- What to do
- Affects up to 3.6.6. Update Crocoblock JetFormBuilder jetformbuilder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 14, 2026Webnus Modern Events Calendar Lite modern-events-calendar-lite: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-105067 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Webnus Modern Events Calendar Lite modern-events-calendar-lite allows Blind SQL Injection.This issue affects Modern Events Calendar Lite: from n/a before 7.37.0.
- Product
- Webnus Modern Events Calendar Lite modern-events-calendar-lite
- Fixed in
- 7.37.0
- What to do
- Update Webnus Modern Events Calendar Lite modern-events-calendar-lite to 7.37.0 or newer.
Oct 14, 2026VillaTheme Email Template Customizer for WooCommerce email-template-customizer-for-woo: Improper Control of Generation of Code ('Code Injection')CVE-2026-103358 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Generation of Code ('Code Injection') vulnerability in VillaTheme Email Template Customizer for WooCommerce email-template-customizer-for-woo allows Code Injection.This issue affects Email Template Customizer for WooCommerce: from n/a through 1.3.4.
- Product
- VillaTheme Email Template Customizer for WooCommerce email-template-customizer-for-woo
- Affected
- up to 1.3.4
- What to do
- Affects up to 1.3.4. Update VillaTheme Email Template Customizer for WooCommerce email-template-customizer-for-woo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 14, 2026Visma Pay for WooCommerce: Does not verify the authenticity of payment gateway return requestsCVE-2026-103308 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Visma Pay for WooCommerce WordPress plugin before 1.2.2 does not verify the authenticity of payment gateway return requests, relying on a merchant secret that is empty on a store which has not entered its credentials, allowing unauthenticated attackers to mark arbitrary orders as paid and to disclose the name, email address and postal address of any order's customer.
- Product
- Visma Pay for WooCommerce
- Fixed in
- 1.2.2
- What to do
- Update Visma Pay for WooCommerce to 1.2.2 or newer.
Oct 14, 2026WPCode: Does not correctly verify that a request is genuinely for the login screen before entering its snippet safe modeCVE-2026-101301 · WordPress plugins & themes · reported by WPScanMedium 5.3
The WPCode WordPress plugin before 2.4.0 does not correctly verify that a request is genuinely for the login screen before entering its snippet safe mode, allowing unauthenticated visitors to disable all of the site's automatically inserted snippets for their own requests.
- Product
- WPCode
- Fixed in
- 2.4.0
- What to do
- Update WPCode to 2.4.0 or newer.
Oct 14, 2026VideoWhisper: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-107428 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VideoWhisper.com Paid Videochat Turnkey Site ppv-live-webcams allows Reflected XSS.This issue affects Paid Videochat Turnkey Site: from n/a through 7.5.12.
- Product
- VideoWhisper
- Affected
- up to 7.5.12
- What to do
- Affects up to 7.5.12. Update VideoWhisper to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 14, 2026LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes: Local File InclusionCVE-2026-110284 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 10.3.1 via attacker-controlled attributes of the [lifterlms_checkout] shortcode. This is due to the llms_get_template() helper performing extract() on the shortcode attribute array before resolving the template path, which allows the attacker-supplied 'template_name' and 'default_path' shortcode attributes to overwrite the function's local parameters and ultimately control the path passed to a PHP include. This makes it possible for authenticated attackers, with Instructor-level access and above, to include and execute arbitrary files on the server, that can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where files with safe extensions containing attacker-controlled content can be uploaded and included.
- Product
- LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes
- Affected
- up to 10.3.1
- What to do
- Affects up to 10.3.1. Update LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 14, 202610up Restricted Site Access restricted-site-access: Missing AuthorizationCVE-2026-110227 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in 10up Restricted Site Access restricted-site-access allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Restricted Site Access: from n/a through 7.6.2.
- Product
- 10up Restricted Site Access restricted-site-access
- Affected
- up to 7.6.2
- What to do
- Affects up to 7.6.2. Update 10up Restricted Site Access restricted-site-access to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 14, 2026Codepeople CP Multi View Event Calendar cp-multi-view-calendar: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-109901 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Codepeople CP Multi View Event Calendar cp-multi-view-calendar allows SQL Injection.This issue affects CP Multi View Event Calendar : from n/a through 1.4.41.
- Product
- Codepeople CP Multi View Event Calendar cp-multi-view-calendar
- Affected
- up to 1.4.41
- What to do
- Affects up to 1.4.41. Update Codepeople CP Multi View Event Calendar cp-multi-view-calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 14, 2026Gallery Custom Links: Stored Cross-Site ScriptingCVE-2026-107757 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The Gallery Custom Links plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'display_name (profile.php) + comment (wp-comments-post.php)' parameter in all versions up to, and including, 2.3.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit requires two coordinated inputs from the same authenticated attacker: an HTML comment payload stored in a comment body (preserved verbatim by WordPress comment kses) and a matching simple_html_dom noise key placed in the attacker's display_name (which survives esc_attr() intact), with substitution occurring after both filters have run during the plugin's default-on output-buffering pass over the full rendered page.
- Product
- Gallery Custom Links
- Affected
- up to 2.3.3
- What to do
- Affects up to 2.3.3. Update Gallery Custom Links to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 14, 2026Meow Lightbox: Stored Cross-Site ScriptingCVE-2026-107756 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Meow Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'display_name + comment' parameter in all versions up to, and including, 5.6.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability is only exploitable when the plugin's Output Buffering option is enabled (disabled by default), and requires the attacker to have at least one previously approved comment on the site so that subsequent comments are auto-approved by WordPress core.
- Product
- Meow Lightbox
- Affected
- up to 5.6.2
- What to do
- Affects up to 5.6.2. Update Meow Lightbox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 14, 2026GeoDirectory – WP Business Directory Plugin and Classified Listings Directory: Stored Cross-Site ScriptingCVE-2026-107754 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post_images (file_info[2] = title)' parameter in all versions up to, and including, 2.8.190 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- GeoDirectory – WP Business Directory Plugin and Classified Listings Directory
- Affected
- up to 2.8.190
- What to do
- Affects up to 2.8.190. Update GeoDirectory – WP Business Directory Plugin and Classified Listings Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 14, 2026Mang Board: Stored Cross-Site ScriptingCVE-2026-107751 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Mang Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'user_name' parameter in all versions up to, and including, 2.4.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The save-time sanitizer mbw_htmlspecialchars2() is ineffective against this vector because the exploit payload relies solely on unquoted HTML attribute syntax using only spaces, alphanumerics, and characters such as =, parentheses, and dots — none of which are escaped.
- Product
- Mang Board
- Affected
- up to 2.4.3
- What to do
- Affects up to 2.4.3. Update Mang Board to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. The WordPress, CMS and hosting-panel entries come from the National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan and others); we show who. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, a booking system, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.