Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
14,808 results · page 11 of 297
Oct 11, 2026Envira Gallery: Does not verify that a user is authorized to read a gallery before rendering itCVE-2026-104684 · WordPress plugins & themes · reported by WPScanLow 2.7
The Envira Gallery WordPress plugin before 1.16.2 does not verify that a user is authorized to read a gallery before rendering it, allowing authors to embed and expose other users' non-public gallery metadata to unauthenticated visitors.
- Product
- Envira Gallery
- Fixed in
- 1.16.2
- What to do
- Update Envira Gallery to 1.16.2 or newer.
Oct 11, 2026Envira Gallery: Does not correctly check authorization on its gallery-conversion featureCVE-2026-104682 · WordPress plugins & themes · reported by WPScanLow 2.7
The Envira Gallery WordPress plugin before 1.16.2 does not correctly check authorization on its gallery-conversion feature, verifying that the requester can edit an arbitrary post they name rather than that they are allowed to create the Envira Gallery WordPress plugin before 1.16.2's own gallery content, allowing users with contributor-level access to create and publish gallery posts that the Envira Gallery WordPress plugin before 1.16.2's settings otherwise withhold from them.
- Product
- Envira Gallery
- Fixed in
- 1.16.2
- What to do
- Update Envira Gallery to 1.16.2 or newer.
Oct 11, 2026Envira Gallery: Does not verify that an image identifier added to a gallery refers to a media attachment the caller is permitted to viewCVE-2026-104681 · WordPress plugins & themes · reported by WPScanLow 2.7
The Envira Gallery WordPress plugin before 1.16.2 does not verify that an image identifier added to a gallery refers to a media attachment the caller is permitted to view, allowing any user able to create and edit a gallery (Author and above by default) to disclose the title and excerpt of other users' private, draft, pending and trashed posts that WordPress would otherwise withhold from them.
- Product
- Envira Gallery
- Fixed in
- 1.16.2
- What to do
- Update Envira Gallery to 1.16.2 or newer.
Oct 11, 2026Envira Gallery: Does not verify that a user holds the capability WordPress reserves for installing Envira Gallery WordPress plugin before 1CVE-2026-104680 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Envira Gallery WordPress plugin before 1.16.2 does not verify that a user holds the capability WordPress reserves for installing Envira Gallery WordPress plugin before 1.16.2 code before processing its setup-wizard Envira Gallery WordPress plugin before 1.16.2-installation request, and does not restrict the installation to its own curated list, allowing a Multisite subsite Administrator to install an arbitrary WordPress.org-published Envira Gallery WordPress plugin before 1.16.2 into the network-shared Envira Gallery WordPress plugin before 1.16.2 directory, a privilege Multisite reserves for the network Super Admin.
- Product
- Envira Gallery
- Fixed in
- 1.16.2
- What to do
- Update Envira Gallery to 1.16.2 or newer.
Oct 11, 2026Mobile builder: Does not sanitise and escape a parameter before using it in a SQL statementCVE-2026-103695 · WordPress plugins & themes · reported by WPScanHigh 8.6
The Mobile builder WordPress plugin through 1.4.2 does not sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks.
- Product
- Mobile builder
- Affected
- up to 1.4.2
- What to do
- Affects up to 1.4.2. Update Mobile builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 11, 2026Mobile builder: Does not properly restrictCVE-2026-103694 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Mobile builder WordPress plugin through 1.4.2 does not properly restrict which user meta keys a logged-in user can update through one of its REST routes, allowing any user with a self-registered account, such as a customer, to grant themselves the administrator role.
- Product
- Mobile builder
- Affected
- up to 1.4.2
- What to do
- Affects up to 1.4.2. Update Mobile builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026Subscriber Arbitrary File Deletion in FoodBakery <= 4.6 versions.CVE-2026-78530 · WordPress plugins & themes · reported by PatchstackHigh 7.7
Subscriber Arbitrary File Deletion in FoodBakery <= 4.6 versions.
- Affected
- up to 4.6
- What to do
- Affects up to 4.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026Unauthenticated Local File Inclusion in Ambient <= 1.7 versions.CVE-2026-66566 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Local File Inclusion in Ambient <= 1.7 versions.
- Affected
- up to 1.7
- What to do
- Affects up to 1.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026Author Arbitrary File Deletion in Presto Player Pro <= 3.0.1 versions.CVE-2026-66481 · WordPress plugins & themes · reported by PatchstackMedium 6.8
Author Arbitrary File Deletion in Presto Player Pro <= 3.0.1 versions.
- Affected
- up to 3.0.1
- What to do
- Affects up to 3.0.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026Unauthenticated Arbitrary Content Deletion in Forminator <= 1.57.3 versions.CVE-2026-65459 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Arbitrary Content Deletion in Forminator <= 1.57.3 versions.
- Affected
- up to 1.57.3
- What to do
- Affects up to 1.57.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026Contributor Arbitrary File Upload in Creator LMS <= 1.2.21 versions.CVE-2026-62129 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Contributor Arbitrary File Upload in Creator LMS <= 1.2.21 versions.
- Affected
- up to 1.2.21
- What to do
- Affects up to 1.2.21. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026Unauthenticated Local File Inclusion in KuteShop <= 4.2.9 versions.CVE-2026-62115 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Local File Inclusion in KuteShop <= 4.2.9 versions.
- Affected
- up to 4.2.9
- What to do
- Affects up to 4.2.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026Unauthenticated Local File Inclusion in Boutique <= 2.3.3 versions.CVE-2026-62099 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Local File Inclusion in Boutique <= 2.3.3 versions.
- Affected
- up to 2.3.3
- What to do
- Affects up to 2.3.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026Unauthenticated Local File Inclusion in Biolife <= 3.2.3 versions.CVE-2026-62096 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Local File Inclusion in Biolife <= 3.2.3 versions.
- Affected
- up to 3.2.3
- What to do
- Affects up to 3.2.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026Unauthenticated Local File Inclusion in TechOne <= 3.0.3 versions.CVE-2026-62094 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Local File Inclusion in TechOne <= 3.0.3 versions.
- Affected
- up to 3.0.3
- What to do
- Affects up to 3.0.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026Unauthenticated Local File Inclusion in Armania <= 1.4.8 versions.CVE-2026-62092 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Local File Inclusion in Armania <= 1.4.8 versions.
- Affected
- up to 1.4.8
- What to do
- Affects up to 1.4.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026Unauthenticated PHP Object Injection in Kalles <= 1.1.7.1 versions.CVE-2026-62076 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in Kalles <= 1.1.7.1 versions.
- Affected
- up to 1.1.7.1
- What to do
- Affects up to 1.1.7.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026Unauthenticated Local File Inclusion in Backhoe <= 2.0 versions.CVE-2026-62075 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Local File Inclusion in Backhoe <= 2.0 versions.
- Affected
- up to 2.0
- What to do
- Affects up to 2.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026Unauthenticated Local File Inclusion in Ozeum <= 1.3.0 versions.CVE-2026-62074 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Local File Inclusion in Ozeum <= 1.3.0 versions.
- Affected
- up to 1.3.0
- What to do
- Affects up to 1.3.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026Unauthenticated Local File Inclusion in Flipmart <= 2.8 versions.CVE-2026-62070 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Local File Inclusion in Flipmart <= 2.8 versions.
- Affected
- up to 2.8
- What to do
- Affects up to 2.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026Unauthenticated Local File Inclusion in Fabius <= 1.0 versions.CVE-2026-62069 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Local File Inclusion in Fabius <= 1.0 versions.
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026Unauthenticated Local File Inclusion in Teoro <= 1.1 versions.CVE-2026-62068 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Local File Inclusion in Teoro <= 1.1 versions.
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026Unauthenticated Local File Inclusion in Kaven <= 1.2 versions.CVE-2026-62067 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Local File Inclusion in Kaven <= 1.2 versions.
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026Unauthenticated Local File Inclusion in Volos <= 1.2 versions.CVE-2026-62066 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Local File Inclusion in Volos <= 1.2 versions.
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026Unauthenticated Local File Inclusion in Cardea <= 2.3 versions.CVE-2026-62065 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Local File Inclusion in Cardea <= 2.3 versions.
- Affected
- up to 2.3
- What to do
- Affects up to 2.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026Unauthenticated PHP Object Injection in Splendour <= 1.23 versions.CVE-2026-62050 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in Splendour <= 1.23 versions.
- Affected
- up to 1.23
- What to do
- Affects up to 1.23. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026Unauthenticated Local File Inclusion in DirectoryPress <= 3.6.27 versions.CVE-2026-62032 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated Local File Inclusion in DirectoryPress <= 3.6.27 versions.
- Affected
- up to 3.6.27
- What to do
- Affects up to 3.6.27. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026Unauthenticated Arbitrary File Upload in Tailored Tools <= 3.0.3 versions.CVE-2026-62025 · WordPress plugins & themes · reported by PatchstackCritical 9
Unauthenticated Arbitrary File Upload in Tailored Tools <= 3.0.3 versions.
- Affected
- up to 3.0.3
- What to do
- Affects up to 3.0.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026Subscriber Arbitrary File Upload in CodeBard Help Desk <= 1.1.2 versions.CVE-2026-62024 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Subscriber Arbitrary File Upload in CodeBard Help Desk <= 1.1.2 versions.
- Affected
- up to 1.1.2
- What to do
- Affects up to 1.1.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026Unauthenticated Privilege Escalation in Tonda Membership <= 1.0.1 versions.CVE-2026-62022 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated Privilege Escalation in Tonda Membership <= 1.0.1 versions.
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026Unauthenticated Local File Inclusion in TouchUp < 1.4 versions.CVE-2026-62020 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Local File Inclusion in TouchUp < 1.4 versions.
- What to do
- Update the plugin to the newest version.
Oct 10, 2026Unauthenticated Local File Inclusion in DukaMarket <= 1.3.0 versions.CVE-2026-48194 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Local File Inclusion in DukaMarket <= 1.3.0 versions.
- Affected
- up to 1.3.0
- What to do
- Affects up to 1.3.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026Unauthenticated Local File Inclusion in Uminex <= 1.0.9 versions.CVE-2026-48193 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Local File Inclusion in Uminex <= 1.0.9 versions.
- Affected
- up to 1.0.9
- What to do
- Affects up to 1.0.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026Unauthenticated Local File Inclusion in Aalto <= 1.8 versions.CVE-2026-42777 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Local File Inclusion in Aalto <= 1.8 versions.
- Affected
- up to 1.8
- What to do
- Affects up to 1.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026Unauthenticated Local File Inclusion in CleanSkin <= 1.5.0 versions.CVE-2026-42724 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Local File Inclusion in CleanSkin <= 1.5.0 versions.
- Affected
- up to 1.5.0
- What to do
- Affects up to 1.5.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026Unauthenticated PHP Object Injection in CleanSkin <= 1.5.0 versions.CVE-2026-42723 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in CleanSkin <= 1.5.0 versions.
- Affected
- up to 1.5.0
- What to do
- Affects up to 1.5.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026Administrator SQL Injection in Leyka <= 3.32.3 versions.CVE-2026-42717 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Administrator SQL Injection in Leyka <= 3.32.3 versions.
- Affected
- up to 3.32.3
- What to do
- Affects up to 3.32.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026Unauthenticated Cross Site Scripting (XSS) in Photo Gallery by 10Web <= 1.8.47 versions.CVE-2026-42715 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Photo Gallery by 10Web <= 1.8.47 versions.
- Affected
- up to 1.8.47
- What to do
- Affects up to 1.8.47. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026Unauthenticated Local File Inclusion in Kids Care <= 3.2.4 versions.CVE-2026-42704 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Local File Inclusion in Kids Care <= 3.2.4 versions.
- Affected
- up to 3.2.4
- What to do
- Affects up to 3.2.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026Subscriber Arbitrary File Deletion in PeepSo <= 9.0.5.4 versions.CVE-2026-40805 · WordPress plugins & themes · reported by PatchstackHigh 7.7
Subscriber Arbitrary File Deletion in PeepSo <= 9.0.5.4 versions.
- Affected
- up to 9.0.5.4
- What to do
- Affects up to 9.0.5.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026Subscriber Broken Access Control in Wordable <= 8.2.10 versions.CVE-2026-40801 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Subscriber Broken Access Control in Wordable <= 8.2.10 versions.
- Affected
- up to 8.2.10
- What to do
- Affects up to 8.2.10. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026Subscriber SQL Injection in ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes <= 1.5.3 versions.CVE-2026-40800 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Subscriber SQL Injection in ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes <= 1.5.3 versions.
- Affected
- up to 1.5.3
- What to do
- Affects up to 1.5.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026Subscriber Privilege Escalation in AIWU <= 1.5.9 versions.CVE-2026-39801 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Subscriber Privilege Escalation in AIWU <= 1.5.9 versions.
- Affected
- up to 1.5.9
- What to do
- Affects up to 1.5.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026Unauthenticated Cross Site Scripting (XSS) in WP File Download <= 6.3.6 versions.CVE-2026-39799 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in WP File Download <= 6.3.6 versions.
- Affected
- up to 6.3.6
- What to do
- Affects up to 6.3.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026Forminator: Incorrect Privilege AssignmentCVE-2026-96341 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Incorrect Privilege Assignment vulnerability in WPMU DEV Forminator forminator allows Privilege Escalation.This issue affects Forminator: from n/a through 1.57.3.
- Product
- Forminator
- Affected
- up to 1.57.3
- What to do
- Affects up to 1.57.3. Update Forminator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026miniorange otp verification: Incorrect Privilege AssignmentCVE-2026-106610 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Incorrect Privilege Assignment vulnerability in miniOrange miniorange otp verification miniorange-otp-verification allows Privilege Escalation.This issue affects miniorange otp verification: from n/a through 5.5.7.
- Product
- miniorange otp verification
- Affected
- up to 5.5.7
- What to do
- Affects up to 5.5.7. Update miniorange otp verification to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026WooCommerce: Incorrect Privilege AssignmentCVE-2026-106608 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Incorrect Privilege Assignment vulnerability in Automattic WooCommerce woocommerce allows Privilege Escalation.This issue affects WooCommerce: from 9.8.0 through 11.1.2.
- Product
- WooCommerce
- Affected
- up to 11.1.2
- What to do
- Affects up to 11.1.2. Update WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026Tickera: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-105889 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tickera Tickera tickera-event-ticketing-system allows Blind SQL Injection.This issue affects Tickera: from n/a through 3.6.0.6.
- Product
- Tickera
- Affected
- up to 3.6.0.6
- What to do
- Affects up to 3.6.0.6. Update Tickera to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026Divi Plus: Arbitrary File ReadCVE-2026-91136 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Divi Plus plugin for WordPress is vulnerable to Arbitrary File Read in versions up to, and including, 2.4.0 via the 'svg_image' parameter of the /wp-json/elicus/v1/dipl-modules/svg-animator REST endpoint. This is due to the endpoint's permission callback (SVGAnimatorController::index_permission) returning true unconditionally combined with insufficient validation of the 'svg_image' input — sanitize_text_field() and esc_html() do not restrict filesystem paths, the file:// stream wrapper, or arbitrary URLs — before it is passed to file_get_contents() (with a wp_remote_get() fallback) and the raw response body is returned in the JSON 'html' field. This makes it possible for unauthenticated attackers to read arbitrary files on the affected site's server which may make remote code execution possible.
- Product
- Divi Plus
- Affected
- up to 2.4.0
- What to do
- Affects up to 2.4.0. Update Divi Plus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recorddiviplus.iowordfence.com
Oct 10, 2026PeproDev Ultimate Profile Solutions: Stored Cross-Site ScriptingCVE-2026-4791 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The PeproDev Ultimate Profile Solutions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `logout-url` shortcode's 'button' attribute in all versions up to, and including, 8.2.36 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- PeproDev Ultimate Profile Solutions
- Affected
- up to 8.2.36
- What to do
- Affects up to 8.2.36. Update PeproDev Ultimate Profile Solutions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.