Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
13,868 results · page 11 of 278
Oct 16, 2026RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator: Stored Cross-Site ScriptingCVE-2026-109207 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'media:thumbnail@url' parameter in all versions up to, and including, 5.2.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the attacker to control an external RSS feed that the target site has already configured for import; no WordPress account or special plugin configuration is needed beyond that condition.
- Product
- RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator
- Affected
- up to 5.2.11
- What to do
- Affects up to 5.2.11. Update RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 16, 2026Colibri Page Builder: Stored Cross-Site ScriptingCVE-2026-107758 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 1.0.390 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload survives storage because the widened comment allow-list permits SVG elements with arbitrary data-* attributes; execution occurs because colibri.js, enqueued globally on every front-end page, reads the stored data-target value via jQuery.data() — which HTML-entity-decodes it — and passes the resulting string directly into jQuery(), which parses a leading '<' as HTML and fires the embedded event handler.
- Product
- Colibri Page Builder
- Affected
- up to 1.0.390
- What to do
- Affects up to 1.0.390. Update Colibri Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 16, 2026Debloat – Remove Unused CSS, Optimize JS: Directory TraversalCVE-2026-104769 · WordPress plugins & themes · reported by WordfenceMedium 5.9
The Debloat – Remove Unused CSS, Optimize JS plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.3.0 via the 's' parameter parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. Exploitation requires that the site administrator has enabled the Optimize CSS feature (with the default Inline Google Fonts option active), but once that condition is met the attack is trivially triggered by an unauthenticated visitor with a single crafted GET request to the public search URL.
- Product
- Debloat – Remove Unused CSS, Optimize JS
- Affected
- up to 1.3.0
- What to do
- Affects up to 1.3.0. Update Debloat – Remove Unused CSS, Optimize JS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 16, 2026Customer Email Verification for WooCommerce: Privilege EscalationCVE-2026-104745 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Customer Email Verification for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation via the `alg_wc_ev_verify_email` parameter in versions up to, and including, 3.3.0. The vulnerability exists because `alg_wc_ev_generate_user_code()` generates the per-user activation secret using `wp_rand(100)` when the plugin's 'Encoding method' is set to 'hashids', producing only ~101 possible values (~7 bits of entropy); the resulting token is a reversible Hashids encoding with no cryptographic MAC, and the unauthenticated `verify()` handler — hooked to `init` at `PHP_INT_MAX` with no nonce check and no rate limiting — accepts and acts on the attacker-controlled `?alg_wc_ev_verify_email=` GET parameter directly. This makes it possible for unauthenticated attackers to gain authentication as any unverified WordPress account, including administrator-level accounts, by brute-forcing the trivially small activation code space via a forged verification URL. Exploitation requires that the 'Encoding method' setting be changed to 'hashids' (non-default), that the attacker recover or brute-force the Hashids salt (which defaults to an `md5(time())` value set at first initialization),
- Product
- Customer Email Verification for WooCommerce
- Affected
- up to 3.3.0
- What to do
- Affects up to 3.3.0. Update Customer Email Verification for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 16, 2026FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler: Generic SQL InjectionCVE-2026-103518 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler plugin for WordPress is vulnerable to generic SQL Injection via the 'products[*].variants[*].<attacker-chosen key>' parameter in all versions up to, and including, 1.7.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with custom-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. On FluentCart Pro installs, non-administrator users assigned the Manager shop role also hold the products/edit permission and are therefore able to exploit this vulnerability without administrator-level access.
- Product
- FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler
- Affected
- up to 1.7.0
- What to do
- Affects up to 1.7.0. Update FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 15, 2026Popup Box: Arbitrary Shortcode ExecutionCVE-2026-100159 · WordPress plugins & themes · reported by WordfenceMedium 4.8
The Popup Box plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions 6.4.1 to 6.4.2. This is due to the ays_popup_get_user_ip() function reading the client-controlled Client-IP / X-Forwarded-For / Forwarded / X-Forwarded / Forwarded-For request headers, sanitizing them only with sanitize_text_field() (which does not strip the bracket, quote, space, or '=' characters used by shortcode syntax), substituting the value into a popup body wherever the %%user_ip_address%% token appears (a raw str_replace with no escaping in Ays_Pb_Data::replace_message_variables()), and then passing the resulting body to do_shortcode() in Ays_Pb_Public::ays_autoembed() at output on the wp_footer hook. This makes it possible for unauthenticated attackers to execute arbitrary registered shortcodes with attacker-supplied attributes on the server whenever an administrator has added the %%user_ip_address%% token to a popup's Custom Content body, which can be leveraged to read arbitrary data or perform other actions exposed by shortcodes installed on the site.
- Product
- Popup Box
- Affected
- 6.4.1 to 6.4.2
- What to do
- Affects 6.4.1 to 6.4.2. Update Popup Box to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 15, 2026WPExperts WP EasyPay wp-easy-pay: Missing AuthorizationCVE-2026-96449 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WPExperts WP EasyPay wp-easy-pay allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP EasyPay: from n/a through 4.5.4.
- Product
- WPExperts WP EasyPay wp-easy-pay
- Affected
- up to 4.5.4
- What to do
- Affects up to 4.5.4. Update WPExperts WP EasyPay wp-easy-pay to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 15, 2026WP E-Signature Ninja Forms Signature Contract Add-On ninja-signature-contract-forms-add-on: Missing AuthorizationCVE-2026-110378 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WP E-Signature Ninja Forms Signature Contract Add-On ninja-signature-contract-forms-add-on allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ninja Forms Signature Contract Add-On: from n/a through 3.2.5.
- Product
- WP E-Signature Ninja Forms Signature Contract Add-On ninja-signature-contract-forms-add-on
- Affected
- up to 3.2.5
- What to do
- Affects up to 3.2.5. Update WP E-Signature Ninja Forms Signature Contract Add-On ninja-signature-contract-forms-add-on to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 15, 2026WP Chill Download Monitor download-monitor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-110375 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Download Monitor download-monitor allows Stored XSS.This issue affects Download Monitor: from n/a through 5.3.3.
- Product
- WP Chill Download Monitor download-monitor
- Affected
- up to 5.3.3
- What to do
- Affects up to 5.3.3. Update WP Chill Download Monitor download-monitor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 15, 2026Hamid Alinia Login with phone number login-with-phone-number: Missing AuthorizationCVE-2026-110374 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Hamid Alinia Login with phone number login-with-phone-number allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Login with phone number: from n/a through 1.8.77.
- Product
- Hamid Alinia Login with phone number login-with-phone-number
- Affected
- up to 1.8.77
- What to do
- Affects up to 1.8.77. Update Hamid Alinia Login with phone number login-with-phone-number to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 15, 2026WP Desk Flexible Quantity – Measurement Price Calculator for WooCommerce flexible-quantity-measurement-price-calculator-for-woocommerce: Missing AuthorizationCVE-2026-110364 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WP Desk Flexible Quantity – Measurement Price Calculator for WooCommerce flexible-quantity-measurement-price-calculator-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Flexible Quantity – Measurement Price Calculator for WooCommerce: from n/a through 2.3.23.
- Product
- WP Desk Flexible Quantity – Measurement Price Calculator for WooCommerce flexible-quantity-measurement-price-calculator-for-woocommerce
- Affected
- up to 2.3.23
- What to do
- Affects up to 2.3.23. Update WP Desk Flexible Quantity – Measurement Price Calculator for WooCommerce flexible-quantity-measurement-price-calculator-for-woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 15, 2026Planet studio PlanetStudio Payment Gateway planetstudio-payment-gateway: Missing AuthorizationCVE-2026-110362 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Planet studio PlanetStudio Payment Gateway planetstudio-payment-gateway allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PlanetStudio Payment Gateway: from n/a through 1.3.3.
- Product
- Planet studio PlanetStudio Payment Gateway planetstudio-payment-gateway
- Affected
- up to 1.3.3
- What to do
- Affects up to 1.3.3. Update Planet studio PlanetStudio Payment Gateway planetstudio-payment-gateway to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 15, 2026ClikIT Infinite Uploads infinite-uploads: Insertion of Sensitive Information Into Sent DataCVE-2026-110361 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Insertion of Sensitive Information Into Sent Data vulnerability in ClikIT Infinite Uploads infinite-uploads allows Retrieve Embedded Sensitive Data.This issue affects Infinite Uploads: from n/a through 3.4.1.
- Product
- ClikIT Infinite Uploads infinite-uploads
- Affected
- up to 3.4.1
- What to do
- Affects up to 3.4.1. Update ClikIT Infinite Uploads infinite-uploads to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 15, 2026WPdreams Ajax Search Lite ajax-search-lite: Missing AuthorizationCVE-2026-110360 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WPdreams Ajax Search Lite ajax-search-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ajax Search Lite: from n/a through 4.14.5.
- Product
- WPdreams Ajax Search Lite ajax-search-lite
- Affected
- up to 4.14.5
- What to do
- Affects up to 4.14.5. Update WPdreams Ajax Search Lite ajax-search-lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 15, 2026WP Chill Strong Testimonials strong-testimonials: Missing AuthorizationCVE-2026-109897 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in WP Chill Strong Testimonials strong-testimonials allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Strong Testimonials: from n/a through 3.3.12.
- Product
- WP Chill Strong Testimonials strong-testimonials
- Affected
- up to 3.3.12
- What to do
- Affects up to 3.3.12. Update WP Chill Strong Testimonials strong-testimonials to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 15, 2026Brainstorm Force Presto Player presto-player: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-109893 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force Presto Player presto-player allows Stored XSS.This issue affects Presto Player: from n/a through 4.5.3.
- Product
- Brainstorm Force Presto Player presto-player
- Affected
- up to 4.5.3
- What to do
- Affects up to 4.5.3. Update Brainstorm Force Presto Player presto-player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 15, 2026WP Sunshine Sunshine Photo Cart sunshine-photo-cart: Missing AuthorizationCVE-2026-109689 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WP Sunshine Sunshine Photo Cart sunshine-photo-cart allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sunshine Photo Cart: from n/a through 3.7.4.
- Product
- WP Sunshine Sunshine Photo Cart sunshine-photo-cart
- Affected
- up to 3.7.4
- What to do
- Affects up to 3.7.4. Update WP Sunshine Sunshine Photo Cart sunshine-photo-cart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 15, 2026WebberZone Knowledge Base knowledgebase: Missing AuthorizationCVE-2026-108499 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WebberZone Knowledge Base knowledgebase allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Knowledge Base: from n/a through 3.2.0.
- Product
- WebberZone Knowledge Base knowledgebase
- Affected
- up to 3.2.0
- What to do
- Affects up to 3.2.0. Update WebberZone Knowledge Base knowledgebase to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 15, 2026YITH YITH WooCommerce Compare yith-woocommerce-compare: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-106604 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in YITH YITH WooCommerce Compare yith-woocommerce-compare allows Stored XSS.This issue affects YITH WooCommerce Compare: from n/a through 3.15.0.
- Product
- YITH YITH WooCommerce Compare yith-woocommerce-compare
- Affected
- up to 3.15.0
- What to do
- Affects up to 3.15.0. Update YITH YITH WooCommerce Compare yith-woocommerce-compare to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 15, 2026ELEXtensions ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes elex-bulk-edit-products-prices-attributes-for-woocommerce-basic: Authorization Bypass Through User-Controlled KeyCVE-2026-103083 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Authorization Bypass Through User-Controlled Key vulnerability in ELEXtensions ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes elex-bulk-edit-products-prices-attributes-for-woocommerce-basic allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes: from n/a through 1.5.3.
- Product
- ELEXtensions ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes elex-bulk-edit-products-prices-attributes-for-woocommerce-basic
- Affected
- up to 1.5.3
- What to do
- Affects up to 1.5.3. Update ELEXtensions ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes elex-bulk-edit-products-prices-attributes-for-woocommerce-basic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 15, 2026WordLift Srl WordLift wordlift: Missing AuthorizationCVE-2026-110891 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in WordLift Srl WordLift wordlift allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WordLift: from n/a through 3.54.15.
- Product
- WordLift Srl WordLift wordlift
- Affected
- up to 3.54.15
- What to do
- Affects up to 3.54.15. Update WordLift Srl WordLift wordlift to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 15, 2026Crocoblock JetSmartFilters jet-smart-filters: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-110890 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetSmartFilters jet-smart-filters allows Stored XSS.This issue affects JetSmartFilters: from n/a through 3.8.6.
- Product
- Crocoblock JetSmartFilters jet-smart-filters
- Affected
- up to 3.8.6
- What to do
- Affects up to 3.8.6. Update Crocoblock JetSmartFilters jet-smart-filters to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 15, 2026Meow Apps AI Engine ai-engine: Missing AuthorizationCVE-2026-110888 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Meow Apps AI Engine ai-engine allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AI Engine: from n/a through 3.8.3.
- Product
- Meow Apps AI Engine ai-engine
- Affected
- up to 3.8.3
- What to do
- Affects up to 3.8.3. Update Meow Apps AI Engine ai-engine to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 15, 2026NSquared Simply Schedule Appointments simply-schedule-appointments: Authorization Bypass Through User-Controlled KeyCVE-2026-110381 · WordPress plugins & themes · reported by PatchstackMedium 6.3
Authorization Bypass Through User-Controlled Key vulnerability in NSquared Simply Schedule Appointments simply-schedule-appointments allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simply Schedule Appointments: from n/a through 1.6.12.35.
- Product
- NSquared Simply Schedule Appointments simply-schedule-appointments
- Affected
- up to 1.6.12.35
- What to do
- Affects up to 1.6.12.35. Update NSquared Simply Schedule Appointments simply-schedule-appointments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 15, 2026WP Chill Strong Testimonials strong-testimonials: Missing AuthorizationCVE-2026-110371 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WP Chill Strong Testimonials strong-testimonials allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Strong Testimonials: from n/a through 3.3.12.
- Product
- WP Chill Strong Testimonials strong-testimonials
- Affected
- up to 3.3.12
- What to do
- Affects up to 3.3.12. Update WP Chill Strong Testimonials strong-testimonials to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 15, 2026WPExperts APIExperts Square for WooCommerce woosquare: Missing AuthorizationCVE-2026-110367 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WPExperts APIExperts Square for WooCommerce woosquare allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects APIExperts Square for WooCommerce: from n/a through 4.7.5.
- Product
- WPExperts APIExperts Square for WooCommerce woosquare
- Affected
- up to 4.7.5
- What to do
- Affects up to 4.7.5. Update WPExperts APIExperts Square for WooCommerce woosquare to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 15, 2026PluginUs: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-108175 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PluginUs.Net MDTF wp-meta-data-filter-and-taxonomy-filter allows Stored XSS.This issue affects MDTF: from n/a through 1.4.0.
- Product
- PluginUs
- Affected
- up to 1.4.0
- What to do
- Affects up to 1.4.0. Update PluginUs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 15, 2026Magepeople inc: Improper Validation of Specified Quantity in InputCVE-2026-103350 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Improper Validation of Specified Quantity in Input vulnerability in Magepeople inc. Booking and Rental Manager booking-and-rental-manager-for-woocommerce allows Removing Important Client Functionality.This issue affects Booking and Rental Manager: from n/a through 2.8.0.
- Product
- Magepeople inc
- Affected
- up to 2.8.0
- What to do
- Affects up to 2.8.0. Update Magepeople inc to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 15, 20268theme: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-105065 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 8theme.com XStore xstore allows Reflected XSS.This issue affects XStore: from n/a before 9.7.9.
- Product
- 8theme
- Fixed in
- 9.7.9
- What to do
- Update 8theme to 9.7.9 or newer.
Oct 15, 2026Shabti Kaplan Frontend Admin by DynamiApps acf-frontend-form-element: Incorrect Privilege AssignmentCVE-2026-109892 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Incorrect Privilege Assignment vulnerability in Shabti Kaplan Frontend Admin by DynamiApps acf-frontend-form-element allows Privilege Escalation.This issue affects Frontend Admin by DynamiApps: from n/a through 3.29.13.
- Product
- Shabti Kaplan Frontend Admin by DynamiApps acf-frontend-form-element
- Affected
- up to 3.29.13
- What to do
- Affects up to 3.29.13. Update Shabti Kaplan Frontend Admin by DynamiApps acf-frontend-form-element to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 15, 2026maxfoundry Social Share Buttons share-button: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-109702 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in maxfoundry Social Share Buttons share-button allows Stored XSS.This issue affects Social Share Buttons: from n/a through 1.31.
- Product
- maxfoundry Social Share Buttons share-button
- Affected
- up to 1.31
- What to do
- Affects up to 1.31. Update maxfoundry Social Share Buttons share-button to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 15, 2026Kitae Park Mang Board WP mangboard: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-109698 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Kitae Park Mang Board WP mangboard allows SQL Injection.This issue affects Mang Board WP: from n/a through 2.4.4.
- Product
- Kitae Park Mang Board WP mangboard
- Affected
- up to 2.4.4
- What to do
- Affects up to 2.4.4. Update Kitae Park Mang Board WP mangboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 15, 2026WP ManageNinja LLC Fluent CRM fluent-crm: Incorrect Privilege AssignmentCVE-2026-109693 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Incorrect Privilege Assignment vulnerability in WP ManageNinja LLC Fluent CRM fluent-crm allows Privilege Escalation.This issue affects Fluent CRM: from n/a through 3.2.5.
- Product
- WP ManageNinja LLC Fluent CRM fluent-crm
- Affected
- up to 3.2.5
- What to do
- Affects up to 3.2.5. Update WP ManageNinja LLC Fluent CRM fluent-crm to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 15, 2026ThemeGrill User Registration user-registration: Missing AuthorizationCVE-2026-109692 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Missing Authorization vulnerability in ThemeGrill User Registration user-registration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Registration: from n/a through 5.2.8.
- Product
- ThemeGrill User Registration user-registration
- Affected
- up to 5.2.8
- What to do
- Affects up to 5.2.8. Update ThemeGrill User Registration user-registration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 15, 2026Link Whisper INC Link Whisper Free link-whisper: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-109688 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Link Whisper INC Link Whisper Free link-whisper allows Blind SQL Injection.This issue affects Link Whisper Free: from n/a through 0.9.7.
- Product
- Link Whisper INC Link Whisper Free link-whisper
- Affected
- up to 0.9.7
- What to do
- Affects up to 0.9.7. Update Link Whisper INC Link Whisper Free link-whisper to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 15, 2026Link Whisper INC Link Whisper Free link-whisper: Deserialization of Untrusted DataCVE-2026-109686 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in Link Whisper INC Link Whisper Free link-whisper allows Object Injection.This issue affects Link Whisper Free: from n/a through 0.9.7.
- Product
- Link Whisper INC Link Whisper Free link-whisper
- Affected
- up to 0.9.7
- What to do
- Affects up to 0.9.7. Update Link Whisper INC Link Whisper Free link-whisper to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 15, 2026Link Whisper INC Link Whisper Free link-whisper: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-109685 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Link Whisper INC Link Whisper Free link-whisper allows Reflected XSS.This issue affects Link Whisper Free: from n/a through 0.9.7.
- Product
- Link Whisper INC Link Whisper Free link-whisper
- Affected
- up to 0.9.7
- What to do
- Affects up to 0.9.7. Update Link Whisper INC Link Whisper Free link-whisper to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 15, 2026Webba Plugins Webba Booking webba-booking-lite: Authorization Bypass Through User-Controlled KeyCVE-2026-107416 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Authorization Bypass Through User-Controlled Key vulnerability in Webba Plugins Webba Booking webba-booking-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Webba Booking: from n/a through 6.5.2.
- Product
- Webba Plugins Webba Booking webba-booking-lite
- Affected
- up to 6.5.2
- What to do
- Affects up to 6.5.2. Update Webba Plugins Webba Booking webba-booking-lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 15, 2026ThemeGrill User Registration user-registration: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-105882 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGrill User Registration user-registration allows Stored XSS.This issue affects User Registration: from n/a through 5.2.8.
- Product
- ThemeGrill User Registration user-registration
- Affected
- up to 5.2.8
- What to do
- Affects up to 5.2.8. Update ThemeGrill User Registration user-registration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 15, 2026WPMU DEV Broken Link Checker broken-link-checker: Improper Control of Generation of Code ('Code Injection')CVE-2026-102389 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Control of Generation of Code ('Code Injection') vulnerability in WPMU DEV Broken Link Checker broken-link-checker allows Code Injection.This issue affects Broken Link Checker: from n/a through 2.4.14.1.
- Product
- WPMU DEV Broken Link Checker broken-link-checker
- Affected
- up to 2.4.14.1
- What to do
- Affects up to 2.4.14.1. Update WPMU DEV Broken Link Checker broken-link-checker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 15, 2026WholesaleX – B2B & Wholesale Plugin for WooCommerce with Wholesale Prices: Limited Privilege EscalationCVE-2026-8145 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The WholesaleX – B2B & Wholesale Plugin for WooCommerce with Wholesale Prices plugin for WordPress is vulnerable to Limited Privilege Escalation in all versions up to, and including, 3.0.8 via the 'process_registration' due to missing validation on the 'wholesalex_registration_role' parameter. This makes it possible for unauthenticated attackers to register as any existing WholesaleX role. The vulnerability was partially patched in version 2.3.8.
- Product
- WholesaleX – B2B & Wholesale Plugin for WooCommerce with Wholesale Prices
- Affected
- up to 3.0.8
- What to do
- Affects up to 3.0.8. Update WholesaleX – B2B & Wholesale Plugin for WooCommerce with Wholesale Prices to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 15, 2026WPManageNinja FluentCart fluent-cart: Insertion of Sensitive Information Into Sent DataCVE-2026-109695 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Insertion of Sensitive Information Into Sent Data vulnerability in WPManageNinja FluentCart fluent-cart allows Retrieve Embedded Sensitive Data.This issue affects FluentCart: from n/a through 1.7.1.
- Product
- WPManageNinja FluentCart fluent-cart
- Affected
- up to 1.7.1
- What to do
- Affects up to 1.7.1. Update WPManageNinja FluentCart fluent-cart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 15, 2026WP ManageNinja LLC Fluent CRM fluent-crm: Incorrect Privilege AssignmentCVE-2026-109694 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Incorrect Privilege Assignment vulnerability in WP ManageNinja LLC Fluent CRM fluent-crm allows Privilege Escalation.This issue affects Fluent CRM: from n/a through 3.2.5.
- Product
- WP ManageNinja LLC Fluent CRM fluent-crm
- Affected
- up to 3.2.5
- What to do
- Affects up to 3.2.5. Update WP ManageNinja LLC Fluent CRM fluent-crm to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 15, 2026bannersky BSK PDF Manager bsk-pdf-manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-108498 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bannersky BSK PDF Manager bsk-pdf-manager allows Stored XSS.This issue affects BSK PDF Manager: from n/a through 3.8.1.
- Product
- bannersky BSK PDF Manager bsk-pdf-manager
- Affected
- up to 3.8.1
- What to do
- Affects up to 3.8.1. Update bannersky BSK PDF Manager bsk-pdf-manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 15, 2026TMS Amelia ameliabooking: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-108497 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TMS Amelia ameliabooking allows SQL Injection.This issue affects Amelia: from n/a through 2.4.10.
- Product
- TMS Amelia ameliabooking
- Affected
- up to 2.4.10
- What to do
- Affects up to 2.4.10. Update TMS Amelia ameliabooking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 15, 2026Everest Forms Everest Forms everest-forms: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-108491 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Everest Forms Everest Forms everest-forms allows Stored XSS.This issue affects Everest Forms: from n/a through 3.6.1.
- Product
- Everest Forms Everest Forms everest-forms
- Affected
- up to 3.6.1
- What to do
- Affects up to 3.6.1. Update Everest Forms Everest Forms everest-forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 15, 2026Blog2Social – Social Media Auto Post & Scheduler: Insecure Direct Object ReferenceCVE-2026-108092 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Blog2Social – Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 9.1.4. This is due to the b2s_ship_item and b2s_ship_item_reload_url AJAX handlers lacking per-object authorization on the postId parameter. This makes it possible for authenticated attackers with Contributor-level access and above to read the title and content of any post, including private and pending posts belonging to other users.
- Product
- Blog2Social – Social Media Auto Post & Scheduler
- Affected
- up to 9.1.4
- What to do
- Affects up to 9.1.4. Update Blog2Social – Social Media Auto Post & Scheduler to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 15, 2026Tutor LMS: Does not perform a capability check in a routine that regenerates its managed pagesCVE-2026-96537 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Tutor LMS WordPress plugin before 4.1.1 does not perform a capability check in a routine that regenerates its managed pages, allowing unauthenticated users to force-publish unpublished pages and overwrite their content, create missing ones, and change the options that reference them.
- Product
- Tutor LMS
- Fixed in
- 4.1.1
- What to do
- Update Tutor LMS to 4.1.1 or newer.
Oct 15, 2026Rede Itaú for WooCommerce: Does not verify the authenticity of a payment gateway webhook before updating an order's statusCVE-2026-92429 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Rede Itaú for WooCommerce WordPress plugin before 5.5.3 does not verify the authenticity of a payment gateway webhook before updating an order's status, allowing unauthenticated attackers to change the status of arbitrary WooCommerce orders, including marking unpaid orders as paid and cancelling completed orders.
- Product
- Rede Itaú for WooCommerce
- Fixed in
- 5.5.3
- What to do
- Update Rede Itaú for WooCommerce to 5.5.3 or newer.
Oct 15, 2026Rede Itaú for WooCommerce: Does not verify the authenticity of a payment gateway webhook before updating an order's statusCVE-2026-92428 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Rede Itaú for WooCommerce WordPress plugin before 5.5.3 does not verify the authenticity of a payment gateway webhook before updating an order's status, allowing unauthenticated attackers to change the status of arbitrary WooCommerce orders, including orders that were already paid or completed.
- Product
- Rede Itaú for WooCommerce
- Fixed in
- 5.5.3
- What to do
- Update Rede Itaú for WooCommerce to 5.5.3 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. The WordPress, CMS and hosting-panel entries come from the National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan and others); we show who. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, a booking system, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.