Updated 12 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

456new WordPress flaws this week

390,714entries in the database

6,237 results · page 11 of 125

Sep 11, 2026teddy-bear-customize-addon: Does not perform any authorization or ownership checks before returning WooCommerce order metadata and the URLs of customer-uploaded attachmentsCVE-2026-14562 · WordPress plugins & themes · reported by WPScanMedium 5.3
The teddy-bear-customize-addon WordPress plugin through 1.0.5 does not perform any authorization or ownership checks before returning WooCommerce order metadata and the URLs of customer-uploaded attachments, allowing unauthenticated attackers to disclose other customers' order and attachment data.
Product
teddy-bear-customize-addon
Affected
up to 1.0.5
What to do
Affects up to 1.0.5. Update teddy-bear-customize-addon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Sep 11, 2026Booktics – Booking Calendar for Appointments and Service Businesses: Unauthorized modification of dataCVE-2026-11446 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Booktics – Booking Calendar for Appointments and Service Businesses plugin for WordPress is vulnerable to unauthorized modification of data in all versions up to, and including, 1.0.23. This is due to the create_order_permission() permission callback on the POST /wp-json/booktics/v1/orders REST route unconditionally returning true, combined with find_and_update_guest() overwriting an existing customer record's stored name, phone, and wp_user_id whenever the caller-supplied email matches, with no proof of ownership. This makes it possible for unauthenticated attackers to overwrite the contact details (name and phone) of any existing customer whose email address they know, poisoning downstream reminder emails, SMS, calendar invites, and CRM data.
Product
Booktics – Booking Calendar for Appointments and Service Businesses
Affected
up to 1.0.23
What to do
Affects up to 1.0.23. Update Booktics – Booking Calendar for Appointments and Service Businesses to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 10, 2026Salon booking system: Missing AuthorizationCVE-2026-81793 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Dimitri Grassi Salon booking system salon-booking-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Salon booking system: from n/a through 10.31.9.
Product
Salon booking system
Affected
up to 10.31.9
What to do
Affects up to 10.31.9. Update Salon booking system to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 10, 2026zipMoney(Zip Co) Payments Plugin for WooCommerce: Does not perform any authorisation checks on one of its front-end request handlersCVE-2026-78361 · WordPress plugins & themes · reported by WPScanCritical 9.1
The zipMoney(Zip Co) Payments Plugin for WooCommerce WordPress plugin before 2.4.0 does not perform any authorisation checks on one of its front-end request handlers, and does not restrict which option name a caller may supply, allowing unauthenticated users to delete arbitrary WordPress options. This can be used to destroy site and access control configuration, deactivate every installed zipMoney(Zip Co) Payments Plugin for WooCommerce WordPress plugin before 2.4.0, and take the site offline.
Product
zipMoney(Zip Co) Payments Plugin for WooCommerce
Fixed in
2.4.0
What to do
Update zipMoney(Zip Co) Payments Plugin for WooCommerce to 2.4.0 or newer.
Full record and what to do →NVD record wpscan.com
Sep 10, 2026Ultimate Gift Cards for WooCommerce: Does not have any authorisation checkCVE-2026-19439 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Ultimate Gift Cards for WooCommerce WordPress plugin before 3.2.10 does not have any authorisation check when displaying gift card details, allowing unauthenticated users to retrieve the gift cards attached to arbitrary orders and disclose customer personal data, balances, dates and, in 3.2.9, the live redemption code, which anyone holding it can spend. Versions from 3.0.3 to 3.2.8 disclose the same data without the redemption code.
Product
Ultimate Gift Cards for WooCommerce
Fixed in
3.2.10
What to do
Update Ultimate Gift Cards for WooCommerce to 3.2.10 or newer.
Full record and what to do →NVD record wpscan.com
Sep 10, 2026Advanced Contact form 7 DB: Authorization bypassCVE-2026-18594 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Advanced Contact form 7 DB plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.1.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with custom-level access and above, to import forged CSV submission records into any Contact Form 7 form managed by the plugin.
Product
Advanced Contact form 7 DB
Affected
up to 2.1.3
What to do
Affects up to 2.1.3. Update Advanced Contact form 7 DB to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 10, 2026Builderall Cheetah For Wp: Unauthorized modification of dataCVE-2026-15823 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Builderall Cheetah For Wp plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the disable() function in versions up to, and including, 3.0.2. The wp_ajax_ba_cheetah_disable AJAX handler is registered without any capability or nonce verification, and the target post_id is sourced directly from user-controlled $_POST['ba_cheetah_data']['post_id']. This makes it possible for authenticated attackers, with Subscriber-level access and above, to disable the page builder layout on arbitrary posts by setting the _ba_cheetah_enabled post meta to false, including on posts owned by other users.
Product
Builderall Cheetah For Wp
Affected
up to 3.0.2
What to do
Affects up to 3.0.2. Update Builderall Cheetah For Wp to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 9, 2026Checkout Custom Fields Builder for WooCommerce: Authorization bypassCVE-2026-19802 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Checkout Custom Fields Builder for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.1.5. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to install and activate an arbitrary attacker-hosted plugin, resulting in remote code execution on the server. The required nonce is emitted inline on all admin pages accessible to subscribers when WooCommerce is inactive, meaning any subscriber-level user can harvest it and trigger the exploit without any additional privileges.
Product
Checkout Custom Fields Builder for WooCommerce
Affected
up to 1.1.5
What to do
Affects up to 1.1.5. Update Checkout Custom Fields Builder for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 9, 2026Reviso Exporter for WooCommerce: Unauthorized modification of dataCVE-2026-8615 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Reviso Exporter for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check and missing nonce verification on the disconnect_callback() function in versions up to, and including, 1.2.3. The function is registered to the 'wp_ajax_wcefr-disconnect' AJAX action and unconditionally calls delete_option('wcefr-agt'), which removes the Reviso Agreement Grant Token used to authenticate API calls. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete the plugin's stored Agreement Grant Token, breaking the connection between WooCommerce and the Reviso service.
Product
Reviso Exporter for WooCommerce
Affected
up to 1.2.3
What to do
Affects up to 1.2.3. Update Reviso Exporter for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Sep 9, 2026WPFunnels: Missing AuthorizationCVE-2026-84908 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WPFunnels plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 3.12.13. This is due to the plugin registering the 'wpfnl_load_payment' AJAX action for both authenticated and unauthenticated (wp_ajax_nopriv_) users and the underlying add_offer_product_to_cart() function performing no nonce verification, no capability check, and no validation that the attacker-supplied product_id is the offer product actually configured on the attacker-supplied step_id. This makes it possible for unauthenticated attackers to add arbitrary WooCommerce products to a cart at any discounted price configured on any funnel step, enabling price manipulation and revenue loss at checkout.
Product
WPFunnels
Affected
up to 3.12.13
What to do
Affects up to 3.12.13. Update WPFunnels to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 9, 2026Masteriyo LMS: Does not perform any authorization check before returning a course enrolment record over its REST APICVE-2026-82848 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Masteriyo LMS WordPress plugin before 3.4.0 does not perform any authorization check before returning a course enrolment record over its REST API, allowing unauthenticated users to read any learner's enrolment status, timestamps and course-progress data by walking sequential record identifiers. A related gap lets any enrolled user retrieve other learners' enrolment records as well.
Product
Masteriyo LMS
Fixed in
3.4.0
What to do
Update Masteriyo LMS to 3.4.0 or newer.
Full record and what to do →NVD record wpscan.com
Sep 9, 2026WPLP Cookie Consent: Does not have any authorisation or CSRF checksCVE-2026-82184 · WordPress plugins & themes · reported by WPScanMedium 5.3
The WPLP Cookie Consent WordPress plugin before 4.4.2 does not have any authorisation or CSRF checks when storing visitor consent state, and the code that does so runs on every front-end page load, allowing unauthenticated attackers to overwrite a site-wide option with arbitrary data.
Product
WPLP Cookie Consent
Fixed in
4.4.2
What to do
Update WPLP Cookie Consent to 4.4.2 or newer.
Full record and what to do →NVD record wpscan.com
Sep 9, 2026SupportCandy: Does not validate a submitted per-ticket authorization code before disclosing the real code to the requesterCVE-2026-81022 · WordPress plugins & themes · reported by WPScanMedium 5.3
The SupportCandy WordPress plugin before 3.5.3 does not validate a submitted per-ticket authorization code before disclosing the real code to the requester, allowing unauthenticated users to read the contents of any support ticket.
Product
SupportCandy
Fixed in
3.5.3
What to do
Update SupportCandy to 3.5.3 or newer.
Full record and what to do →NVD record wpscan.com
Sep 9, 2026SupportCandy: Does not perform an authorization check on one of its support-ticket attachment download pathsCVE-2026-81021 · WordPress plugins & themes · reported by WPScanMedium 5.3
The SupportCandy WordPress plugin before 3.5.3 does not perform an authorization check on one of its support-ticket attachment download paths, allowing unauthenticated attackers to read protected customer-uploaded attachments by enumerating sequential attachment identifiers.
Product
SupportCandy
Fixed in
3.5.3
What to do
Update SupportCandy to 3.5.3 or newer.
Full record and what to do →NVD record wpscan.com
Sep 9, 2026WP Recipe Maker: Authorization bypassCVE-2026-75905 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP Recipe Maker plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 10.8.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to take ownership of any admin-authored recipe by rewriting its post_author to the attacker's user ID, and unpublish it by overwriting its post_status with the contributor's draft or pending post status. This requires the default 'recipe_use_author' setting to be set to 'parent' for the ownership transfer to occur, though unpublishing remains possible regardless of this setting.
Product
WP Recipe Maker
Affected
up to 10.8.0
What to do
Affects up to 10.8.0. Update WP Recipe Maker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 9, 2026Awesome Support: Missing AuthorizationCVE-2026-19946 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Awesome Support plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 6.3.9. This is due to a missing capability check on the wpas_do_mr_deny_user() function, which unlike its counterpart wpas_do_mr_activate_user() does not enforce current_user_can('edit_users') or current_user_can('edit_user', $user_id), relying solely on a nonce that is not scoped to the target user. This makes it possible for authenticated attackers, with subscriber-level access and above, to set the mr_user_denied flag on any user account — including administrators — permanently blocking their moderated activation and dispatching a denial notification email to the victim.
Product
Awesome Support
Affected
up to 6.3.9
What to do
Affects up to 6.3.9. Update Awesome Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 9, 2026WP Travel: Does not verify that the requester is authorized to act on the booking targeted by one of its front-end payment-message handlersCVE-2026-18042 · WordPress plugins & themes · reported by WPScanMedium 5.3
The WP Travel WordPress plugin before 12.0.2 does not verify that the requester is authorized to act on the booking targeted by one of its front-end payment-message handlers, allowing unauthenticated attackers to cancel the payment on any customer's booking.
Product
WP Travel
Fixed in
12.0.2
What to do
Update WP Travel to 12.0.2 or newer.
Full record and what to do →NVD record wpscan.com
Sep 9, 2026WP Travel: Does not properly verify that the requester is authorized to modify the targeted booking on one branch of its bank-deposit handlerCVE-2026-13144 · WordPress plugins & themes · reported by WPScanLow 3.7
The WP Travel WordPress plugin before 12.0.2 does not properly verify that the requester is authorized to modify the targeted booking on one branch of its bank-deposit handler, allowing an unauthenticated attacker who knows the target customer's email address to reset that customer's booking payment to an unpaid state and wipe its stored deposit-reconciliation data.
Product
WP Travel
Fixed in
12.0.2
What to do
Update WP Travel to 12.0.2 or newer.
Full record and what to do →NVD record wpscan.com
Sep 9, 2026Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered): Authorization bypassCVE-2026-11821 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.1.17. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to view, create, update, clone, and delete notification flow event automation workflows that should be restricted to administrators.
Product
Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered)
Affected
up to 4.1.17
What to do
Affects up to 4.1.17. Update Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 8, 2026WP Event Solution (Eventin): Missing AuthorizationCVE-2026-12956 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WP Event Solution (Eventin) plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 4.1.22 via the create_item() handler for the /wp-json/eventin/v2/orders REST endpoint. The endpoint's create_item_permissions_check() function only verifies a wp_rest nonce (which is leaked to every visitor through the etn-public script's localized_data_obj on every frontend page) and accepts a user-supplied 'status' value in prepare_item_for_database() with no whitelist validation. This makes it possible for unauthenticated attackers to create etn-order posts with status='completed' that are counted as sold by etn_get_sold_tickets_by_event(); because the auto-cleanup wp_schedule_single_event() in create_item() only fires for status='pending' orders, the forged completed orders persist indefinitely and exhaust ticket inventory.
Product
WP Event Solution (Eventin)
Affected
up to 4.1.22
What to do
Affects up to 4.1.22. Update WP Event Solution (Eventin) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 8, 2026Event Tickets and Registration: Unauthorized modification of dataCVE-2026-3174 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Event Tickets and Registration plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the Stripe OAuth return endpoint in all versions up to, and including, 5.27.4. This makes it possible for unauthenticated attackers to overwrite the site's Stripe merchant credentials (access tokens, publishable keys, and account ID), diverting all subsequent payment processing to the attacker's Stripe account.
Product
Event Tickets and Registration
Affected
up to 5.27.4
What to do
Affects up to 5.27.4. Update Event Tickets and Registration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 8, 2026Online Scheduling and Appointment Booking System – Bookly: Unauthorized modification of dataCVE-2026-2520 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'updateAddon' function in all versions up to, and including, 27.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update any plugin with a main file of 'main.php' to its latest version.
Product
Online Scheduling and Appointment Booking System – Bookly
Affected
up to 27.2
What to do
Affects up to 27.2. Update Online Scheduling and Appointment Booking System – Bookly to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 8, 2026EDD Product Catalog Feed by PixelYourSite: Unauthorized modification of data that can lead to a denial of serviceCVE-2026-9331 · WordPress plugins & themes · reported by WordfenceHigh 7.1
The EDD Product Catalog Feed by PixelYourSite plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capability check on the wpeddpcf_delete_feed function in all versions up to, and including, 1.0.2. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary option values on the WordPress site. This can be leveraged to delete an option that would create an error on the site and deny service to legitimate users.
Product
EDD Product Catalog Feed by PixelYourSite
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update EDD Product Catalog Feed by PixelYourSite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record pixelyoursite.com wordfence.com
Sep 8, 2026Csomagpontok és szállítási címkék WooCommerce-hez: Missing AuthorizationCVE-2026-81790 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in Viszt Péter Csomagpontok és szállítási címkék WooCommerce-hez allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Csomagpontok és szállítási címkék WooCommerce-hez: from n/a before 4.2.8.
Product
Csomagpontok és szállítási címkék WooCommerce-hez
Fixed in
4.2.8
What to do
Update Csomagpontok és szállítási címkék WooCommerce-hez to 4.2.8 or newer.
Full record and what to do →NVD record patchstack.com
Sep 8, 2026Unbounce Landing Pages: Missing AuthorizationCVE-2026-81781 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Missing Authorization vulnerability in Unbounce Unbounce Landing Pages unbounce allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Unbounce Landing Pages: from n/a through 1.1.4.
Product
Unbounce Landing Pages
Affected
up to 1.1.4
What to do
Affects up to 1.1.4. Update Unbounce Landing Pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 7, 2026Masteriyo LMS: Unauthorized data deletionCVE-2026-8279 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Masteriyo LMS plugin for WordPress is vulnerable to unauthorized data deletion due to a missing capability check on the 'delete_item_permissions_check' function in the CourseProgressItemsController in all versions up to, and including, 2.2.0. This makes it possible for unauthenticated attackers to delete arbitrary course progress records belonging to any student.
Product
Masteriyo LMS
Affected
up to 2.2.0
What to do
Affects up to 2.2.0. Update Masteriyo LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 7, 2026Flamingo: Authorization bypassCVE-2026-12853 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Flamingo plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to enumerate taxonomy terms including channel names derived from Contact Form 7 form titles that may reveal internal form purposes, department names, or workflow identifiers, as well as submission counts per channel and contact tag names. The plugin's flamingo_map_meta_cap() filter restricts access to Flamingo's admin UI but does not extend to WordPress core APIs such as XML-RPC wp.getTerms and admin-ajax ajax-tag-search.
Product
Flamingo
Affected
up to 2.6.2
What to do
Affects up to 2.6.2. Update Flamingo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 6, 2026SureCart: Does not ensure that the account affected by a customer update is the same account its permission check authorisedCVE-2026-18480 · WordPress plugins & themes · reported by WPScanHigh 8.8
The SureCart WordPress plugin before 4.6.3 does not ensure that the account affected by a customer update is the same account its permission check authorised, allowing users with a subscriber-level account to change another user's email address, including an administrator's, and take over that account via a password reset. It further allows an attacker-controlled customer record to be associated with an arbitrary user, and discloses customer identifiers and email addresses to any authenticated user, which together make the takeover reachable from a subscriber-level account alone.
Product
SureCart
Fixed in
4.6.3
What to do
Update SureCart to 4.6.3 or newer.
Full record and what to do →NVD record wpscan.com
Sep 5, 2026Ninja Forms - Save Progress: Missing AuthorizationCVE-2026-15550 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Ninja Forms - Save Progress plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 3.0.30. This is due to the lack of capability checks and nonce verification in the 'bulk_actions' function. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary database records from the 'wp_nf3_objects' table, such as saved submissions.
Product
Ninja Forms - Save Progress
Affected
up to 3.0.30
What to do
Affects up to 3.0.30. Update Ninja Forms - Save Progress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record ninjaforms.com wordfence.com
Sep 5, 2026LearnDash LMS: Authorization bypassCVE-2026-12843 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The LearnDash LMS plugin for WordPress is vulnerable to authorization bypass in versions 4.25.0 - 5.1.6. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to enroll arbitrary users in paid courses without payment verification, bypassing the entire payment system and gaining unauthorized access to premium educational content.
Product
LearnDash LMS
Affected
4.25.0 to 5.1.6
What to do
Affects 4.25.0 to 5.1.6. Update LearnDash LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record docs.nexcess.com wordfence.com
Sep 5, 2026Nokri – Job Board: Unauthorized modification of dataCVE-2025-9049 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Nokri – Job Board WordPress Theme theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'nokri_account_member_permissions' function in all versions up to, and including, 1.6.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to add new Subscriber users with employer account member permissions, who in turn can escalate privileges by updating the email address of any user, including Administrator users.
Product
Nokri – Job Board
Affected
up to 1.6.4
What to do
Affects up to 1.6.4. Update Nokri – Job Board to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Sep 5, 2026Custom Contact Forms: Authorization bypassCVE-2026-75018 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Custom Contact Forms plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.16. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to permanently force-delete arbitrary posts of any post type (including pages, administrator-authored posts, and WooCommerce products) and write arbitrary ccf_field_* post meta onto any post regardless of ownership or post type. The top-level form ID is checked via edit_post/publish_posts, but the nested fields[].ID and choices[].ID paths processed by _create_and_map_fields() and _create_and_map_choices() carry no equivalent capability or post-type guard, leaving those sinks fully exposed while delete_item() and delete_submission() contain explicit post-type restriction fixes demonstrating the developer's awareness of scoping requirements.
Product
Custom Contact Forms
Affected
up to 7.16
What to do
Affects up to 7.16. Update Custom Contact Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 5, 2026EmbedPress: Does not have proper authorization on a public review-loading actionCVE-2026-84936 · WordPress plugins & themes · reported by WPScanMedium 5.3
The EmbedPress WordPress plugin before 4.6.4 does not have proper authorization on a public review-loading action, allowing unauthenticated users to force the site to make repeated billable third-party API requests using the site's own configured API key, and to create an unbounded number of attacker-controlled rows in the database.
Product
EmbedPress
Fixed in
4.6.4
What to do
Update EmbedPress to 4.6.4 or newer.
Full record and what to do →NVD record wpscan.com
Sep 5, 2026EmbedPress: Does not perform a sufficient authorization check on one of its Google Reviews REST API routesCVE-2026-84927 · WordPress plugins & themes · reported by WPScanLow 2.7
The EmbedPress WordPress plugin before 4.6.4 does not perform a sufficient authorization check on one of its Google Reviews REST API routes, allowing users with the Contributor role and above to modify a site-wide store, deleting entries an administrator configured and injecting their own, which are rendered publicly across the site.
Product
EmbedPress
Fixed in
4.6.4
What to do
Update EmbedPress to 4.6.4 or newer.
Full record and what to do →NVD record wpscan.com
Sep 5, 2026Eventin: Does not properly check authorization on several of its event-management REST routesCVE-2026-84901 · WordPress plugins & themes · reported by WPScanMedium 4.9
The Eventin WordPress plugin before 4.1.22 does not properly check authorization on several of its event-management REST routes, allowing users with contributor-level access and above to change the site's front-page setting to an event they do not own and to create, edit and delete global event and speaker taxonomy terms they should not be able to manage.
Product
Eventin
Fixed in
4.1.22
What to do
Update Eventin to 4.1.22 or newer.
Full record and what to do →NVD record wpscan.com
Sep 5, 2026JetFormBuilder — Dynamic Blocks Form Builder: Does not perform authorisation checksCVE-2026-19858 · WordPress plugins & themes · reported by WPScanHigh 7.5
The JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin before 3.6.5.2 does not perform authorisation checks when resolving request-derived data during page rendering, allowing unauthenticated users to read arbitrary user, post and term properties and metadata, including password hashes, private and draft content, and secrets other JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin before 3.6.5.2 store in metadata.
Product
JetFormBuilder — Dynamic Blocks Form Builder
Fixed in
3.6.5.2
What to do
Update JetFormBuilder — Dynamic Blocks Form Builder to 3.6.5.2 or newer.
Full record and what to do →NVD record wpscan.com
Sep 5, 2026Theme My Login: Missing AuthorizationCVE-2026-83628 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Theme My Login plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 7.1.15 on Multisite installations. This is due to the `tml_ms_signup_handler()` function's `gimmeanotherblog` branch failing to enforce the network's `active_signup` registration policy, checking only `is_user_logged_in()` while sibling branches such as `validate-blog-signup` apply the full policy gate. This makes it possible for authenticated attackers, with Subscriber-level access and above, to directly POST `stage=gimmeanotherblog` to Theme My Login's signup route, bypassing the configured registration policy entirely — even when it is set to `none` or `user` — which causes `wpmu_create_blog()` to execute with the attacker's user ID, after which WordPress core assigns the Administrator role on the newly created subsite via `add_user_to_blog()`. The privilege gain is scoped to the newly created subsite only; the attacker's account retains Subscriber-level access on the main site and does not obtain Super Admin or network-level capabilities such as `manage_network` or `manage_sites`.
Product
Theme My Login
Affected
up to 7.1.15
What to do
Affects up to 7.1.15. Update Theme My Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 4, 2026JetPopup: Missing AuthorizationCVE-2026-27347 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Crocoblock JetPopup allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects JetPopup: from n/a through 2.0.20.2.
Product
JetPopup
Affected
up to 2.0.20.2
What to do
Affects up to 2.0.20.2. Update JetPopup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 4, 2026The AI Website Builder WordPress plugin (GitHub build) 1.0.0 does not perform any authorisation or nonce check on its REST API routes, allowing unauthenticated CVE-2026-82923 · WordPress plugins & themes · reported by WPScanCritical 9.8
The AI Website Builder WordPress plugin (GitHub build) 1.0.0 does not perform any authorisation or nonce check on its REST API routes, allowing unauthenticated attackers to install and activate plugins and themes, import content from a URL under their control, write a file of their choosing into the uploads directory, and delete site content and media. On a host that serves PHP from the uploads directory, that file write is remote code execution.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record wpscan.com
Sep 4, 2026MarketKing: Missing AuthorizationCVE-2026-85311 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Kings Plugins MarketKing allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects MarketKing: from n/a through 2.1.60.
Product
MarketKing
Affected
up to 2.1.60
What to do
Affects up to 2.1.60. Update MarketKing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 4, 2026WCFM Membership: Missing AuthorizationCVE-2026-32480 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WC Lovers WCFM Membership allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WCFM Membership: from n/a through 2.11.11.
Product
WCFM Membership
Affected
up to 2.11.11
What to do
Affects up to 2.11.11. Update WCFM Membership to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 4, 2026WP Rentals: Authorization Bypass Through User-Controlled KeyCVE-2026-27432 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Authorization Bypass Through User-Controlled Key vulnerability in sc Internet Vivoo WP Rentals allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WP Rentals: from n/a before 3.16.0.
Product
WP Rentals
Fixed in
3.16.0
What to do
Update WP Rentals to 3.16.0 or newer.
Full record and what to do →NVD record patchstack.com
Sep 4, 2026WPFunnels: Does not perform any authorisation or nonce check in one of its opt-in submission handlersCVE-2026-79632 · WordPress plugins & themes · reported by WPScanMedium 5.3
The WPFunnels WordPress plugin before 3.13.0 does not perform any authorisation or nonce check in one of its opt-in submission handlers, and takes the notification recipients and subject from the request, allowing unauthenticated users to make the site send emails to arbitrary recipients with an arbitrary subject.
Product
WPFunnels
Fixed in
3.13.0
What to do
Update WPFunnels to 3.13.0 or newer.
Full record and what to do →NVD record wpscan.com
Sep 3, 2026LearnPress WordPress Plugin before 4.4.6 contains a broken object-level authorization vulnerability that allows authenticated attackers with the Instructor roleCVE-2026-82023 · WordPress plugins & themes · reported by VulnCheckMedium 5.3
LearnPress WordPress Plugin before 4.4.6 contains a broken object-level authorization vulnerability that allows authenticated attackers with the Instructor role to add answers to quiz questions owned by other instructors by exploiting a missing ownership check on the question answer insert path. Attackers can supply arbitrary question identifiers during answer insertion, bypassing instructor-boundary restrictions to persistently modify quiz content across courses they do not own.
Fixed in
4.4.6
What to do
Update the plugin to 4.4.6 or newer.
Full record and what to do →NVD record wordpress.org vulncheck.com
Sep 3, 2026Ultimate Maps by Supsystic: Missing AuthorizationCVE-2026-85309 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Supsystic Ultimate Maps by Supsystic allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Ultimate Maps by Supsystic: from n/a through 1.5.3.
Product
Ultimate Maps by Supsystic
Affected
up to 1.5.3
What to do
Affects up to 1.5.3. Update Ultimate Maps by Supsystic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 3, 2026SureForms: Authorization Bypass Through User-Controlled KeyCVE-2026-85308 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Authorization Bypass Through User-Controlled Key vulnerability in Brainstorm Force SureForms allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects SureForms: from n/a through 2.12.5.
Product
SureForms
Affected
up to 2.12.5
What to do
Affects up to 2.12.5. Update SureForms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 3, 2026MountDev AI MCP Connector for: Missing AuthorizationCVE-2026-85306 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Cascadia Web Services MountDev AI MCP Connector for WordPress allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects MountDev AI MCP Connector for WordPress: from n/a through 1.6.5.
Product
MountDev AI MCP Connector for
Affected
up to 1.6.5
What to do
Affects up to 1.6.5. Update MountDev AI MCP Connector for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 3, 2026Unlimited Elements For Elementor (Free Widgets, Addons, Templates): Missing AuthorizationCVE-2026-85304 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 2.0.17.
Product
Unlimited Elements For Elementor (Free Widgets, Addons, Templates)
Affected
up to 2.0.17
What to do
Affects up to 2.0.17. Update Unlimited Elements For Elementor (Free Widgets, Addons, Templates) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 2, 2026Auto x LINE: Does not have authorization checks in some of its REST endpointsCVE-2025-15485 · WordPress plugins & themes · reported by WPScanHigh 8.2
The Auto x LINE WordPress plugin through 1.0.0 does not have authorization checks in some of its REST endpoints, allowing unauthenticated users to call them and update the plugin settings, clear logs etc
Product
Auto x LINE
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Auto x LINE to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Sep 2, 2026Rentsyst: Missing AuthorizationCVE-2026-84835 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in DimaFreund Rentsyst rentsyst allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Rentsyst: from n/a through 2.1.5.
Product
Rentsyst
Affected
up to 2.1.5
What to do
Affects up to 2.1.5. Update Rentsyst to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.