Updated 3 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

544new WordPress flaws this week

391,181entries in the database

5,912 results · page 12 of 119

Sep 5, 2026MemberDash: Insecure Direct Object ReferenceCVE-2026-16310 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The MemberDash plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.8.5 via the 'id' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to change the password of any WordPress user, including administrators, by supplying an arbitrary user ID during registration, and take over their account without any notification sent to the victim.
Product
MemberDash
Affected
up to 1.8.5
What to do
Affects up to 1.8.5. Update MemberDash to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record memberdashwp.com wordfence.com
Sep 5, 2026LearnDash LMS: Authorization bypassCVE-2026-12843 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The LearnDash LMS plugin for WordPress is vulnerable to authorization bypass in versions 4.25.0 - 5.1.6. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to enroll arbitrary users in paid courses without payment verification, bypassing the entire payment system and gaining unauthorized access to premium educational content.
Product
LearnDash LMS
Affected
4.25.0 to 5.1.6
What to do
Affects 4.25.0 to 5.1.6. Update LearnDash LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record docs.nexcess.com wordfence.com
Sep 5, 2026Custom Contact Forms: Authorization bypassCVE-2026-75018 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Custom Contact Forms plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.16. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to permanently force-delete arbitrary posts of any post type (including pages, administrator-authored posts, and WooCommerce products) and write arbitrary ccf_field_* post meta onto any post regardless of ownership or post type. The top-level form ID is checked via edit_post/publish_posts, but the nested fields[].ID and choices[].ID paths processed by _create_and_map_fields() and _create_and_map_choices() carry no equivalent capability or post-type guard, leaving those sinks fully exposed while delete_item() and delete_submission() contain explicit post-type restriction fixes demonstrating the developer's awareness of scoping requirements.
Product
Custom Contact Forms
Affected
up to 7.16
What to do
Affects up to 7.16. Update Custom Contact Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 5, 2026Masteriyo LMS: Does not sanitise and escape some course settings before outputting them in a page available to all visitorsCVE-2026-82846 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Masteriyo LMS WordPress plugin before 3.4.0 does not sanitise and escape some course settings before outputting them in a page available to all visitors, allowing users with a course-author role to perform Stored Cross-Site Scripting attacks that run in the session of anyone viewing the course, including a logged-in administrator.
Product
Masteriyo LMS
Fixed in
3.4.0
What to do
Update Masteriyo LMS to 3.4.0 or newer.
Full record and what to do →NVD record wpscan.com
Sep 5, 2026Smart Post: Does not check whether a post is password protected before returning its content and its stored password through an unauthenticated AJAX actionCVE-2026-78149 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Smart Post WordPress plugin before 4.0.8 does not check whether a post is password protected before returning its content and its stored password through an unauthenticated AJAX action, allowing unauthenticated users to read protected post content and the password that guards it.
Product
Smart Post
Fixed in
4.0.8
What to do
Update Smart Post to 4.0.8 or newer.
Full record and what to do →NVD record wpscan.com
Sep 5, 2026Divi: DOM-Based Stored Cross-Site ScriptingCVE-2026-3853 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Divi theme for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via the `image_src` attribute of the `et_pb_video_slider_item` shortcode in all versions up to, and including, 4.27.6. This is due to the `image_src` field not being included in the `$url_options` whitelist (which only contains `url`, `button_link`, `button_url`), so it never receives `esc_url_raw()` at save time. On the server side, the value is rendered into a `data-image` HTML attribute using `esc_attr()`, which encodes double quotes as `"`. However, the client-side JavaScript carousel code in `custom.unified.js` reads this attribute using jQuery's `.data('image')`, which returns the browser-decoded value (with `"` decoded back to `"`). The decoded value is then concatenated directly into an HTML string and injected into the DOM via `jQuery.after()` without re-escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user hovers over the carousel thumbnail.
Product
Divi
Affected
up to 4.27.6
What to do
Affects up to 4.27.6. Update Divi to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record divichangelog.com wordfence.com
Sep 5, 2026Search Atlas SEO: Does not perform a nonce or capability check before processing a settings update in one of its early-priority handlersCVE-2026-15247 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Search Atlas SEO WordPress plugin before 2.6.24 does not perform a nonce or capability check before processing a settings update in one of its early-priority handlers, allowing any authenticated user such as a Subscriber to overwrite or delete the site's stored Google service-account credentials.
Product
Search Atlas SEO
Fixed in
2.6.24
What to do
Update Search Atlas SEO to 2.6.24 or newer.
Full record and what to do →NVD record wpscan.com
Sep 5, 2026Mstore Api: Authentication BypassCVE-2026-13447 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Mstore Api plugin for WordPress is vulnerable to Authentication Bypass via JWT Forgery in versions up to, and including, 4.20.0 This is due to missing cryptographic signature verification in the FirebasePhoneAuthHelper::verify_id_token() function, which decodes and validates Firebase ID token claims (alg, kid, aud, iss) but never calls openssl_verify() or any equivalent to validate the JWT signature against Google's actual public key certificates. This makes it possible for unauthenticated attackers to forge a Firebase Phone Auth JWT signed with a self-generated RSA key pair and impersonate any phone number, resulting in unauthorized access to existing WordPress accounts or creation of new arbitrary accounts.
Product
Mstore Api
Affected
up to 4.20.0
What to do
Affects up to 4.20.0. Update Mstore Api to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 4, 2026LearnDash LMS: Unrestricted File Type UploadCVE-2026-12483 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The LearnDash LMS plugin for WordPress is vulnerable to Unrestricted File Type Upload in versions up to and including 5.1.5. This is due to insufficient input validation in the 'learndash_fileupload_process' function, which iterates through an entire array and validates only the first file. This makes it possible for authenticated attackers, with subscriber-level access and above who are enrolled in a course with assignment uploads enabled, to upload arbitrary disallowed files, including PHP files, to the server's wp-content/uploads/learndash/assignments/ directory. The uploaded files can only be used for Remote Code Execution if default server configurations have been changed to allow for execution.
Product
LearnDash LMS
Affected
up to 5.1.5
What to do
Affects up to 5.1.5. Update LearnDash LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record liquidweb.com wordfence.com
Sep 4, 2026E-cab Taxi Booking Manager for Woocommerce: Does not validate a client-supplied trip distance and base-price value on the server before pricing a bookingCVE-2026-84045 · WordPress plugins & themes · reported by WPScanMedium 5.3
The E-cab Taxi Booking Manager for Woocommerce WordPress plugin before 2.0.5 does not validate a client-supplied trip distance and base-price value on the server before pricing a booking, allowing unauthenticated attackers to manipulate the order total down to zero and place real taxi-booking orders at an arbitrary price.
Product
E-cab Taxi Booking Manager for Woocommerce
Fixed in
2.0.5
What to do
Update E-cab Taxi Booking Manager for Woocommerce to 2.0.5 or newer.
Full record and what to do →NVD record wpscan.com
Sep 4, 2026WP Rentals: Authorization Bypass Through User-Controlled KeyCVE-2026-27432 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Authorization Bypass Through User-Controlled Key vulnerability in sc Internet Vivoo WP Rentals allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WP Rentals: from n/a before 3.16.0.
Product
WP Rentals
Fixed in
3.16.0
What to do
Update WP Rentals to 3.16.0 or newer.
Full record and what to do →NVD record patchstack.com
Sep 4, 2026Directorist: AI-Powered Business Directory, Listings & Classified Ads: Does not verify that the requesting user owns the post being modified before writing uploaded file references to its metadataCVE-2026-84066 · WordPress plugins & themes · reported by WPScanLow 3.1
The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9 does not verify that the requesting user owns the post being modified before writing uploaded file references to its metadata, allowing users with the subscriber role and above to overwrite image metadata on posts belonging to other users.
Product
Directorist: AI-Powered Business Directory, Listings & Classified Ads
Fixed in
8.9
What to do
Update Directorist: AI-Powered Business Directory, Listings & Classified Ads to 8.9 or newer.
Full record and what to do →NVD record wpscan.com
Sep 4, 2026WPFunnels: Does not verify that the product requested through a checkout order bump is the product that bump's discount was configured forCVE-2026-79630 · WordPress plugins & themes · reported by WPScanMedium 5.3
The WPFunnels WordPress plugin before 3.13.0 does not verify that the product requested through a checkout order bump is the product that bump's discount was configured for, allowing unauthenticated users to obtain any purchasable product at a discount intended for a different one, with the reduced price carried through to the total of the order they place.
Product
WPFunnels
Fixed in
3.13.0
What to do
Update WPFunnels to 3.13.0 or newer.
Full record and what to do →NVD record wpscan.com
Sep 4, 2026Classified Listing: Does not verify that the caller owns or can edit the target listing before its AI image-editing AJAX action deletes or attaches mediaCVE-2026-16281 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Classified Listing WordPress plugin before 6.1.1 does not verify that the caller owns or can edit the target listing before its AI image-editing AJAX action deletes or attaches media, allowing any authenticated user, including a subscriber, to permanently delete attachments from, and attach files to, any listing owned by another user.
Product
Classified Listing
Fixed in
6.1.1
What to do
Update Classified Listing to 6.1.1 or newer.
Full record and what to do →NVD record wpscan.com
Sep 3, 2026SureForms: Authorization Bypass Through User-Controlled KeyCVE-2026-85308 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Authorization Bypass Through User-Controlled Key vulnerability in Brainstorm Force SureForms allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects SureForms: from n/a through 2.12.5.
Product
SureForms
Affected
up to 2.12.5
What to do
Affects up to 2.12.5. Update SureForms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 3, 2026Unauthenticated Bypass Vulnerability in Pre-Orders for WooCommerce <= 2.3 versions.CVE-2026-84849 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Bypass Vulnerability in Pre-Orders for WooCommerce <= 2.3 versions.
Affected
up to 2.3
What to do
Affects up to 2.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 3, 2026Unauthenticated Bypass Vulnerability in BookIt <= 2.6.0.3 versions.CVE-2026-84767 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Bypass Vulnerability in BookIt <= 2.6.0.3 versions.
Affected
up to 2.6.0.3
What to do
Affects up to 2.6.0.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 3, 2026Unauthenticated Bypass Vulnerability in FluentBooking Pro <= 2.2.1 versions.CVE-2026-84766 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Unauthenticated Bypass Vulnerability in FluentBooking Pro <= 2.2.1 versions.
Affected
up to 2.2.1
What to do
Affects up to 2.2.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 3, 2026Unauthenticated Bypass Vulnerability in WP EasyPay <= 4.5.3 versions.CVE-2026-84762 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Bypass Vulnerability in WP EasyPay <= 4.5.3 versions.
Affected
up to 4.5.3
What to do
Affects up to 4.5.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 2, 2026WP Express Checkout: Does not verify server-side that a payment was actually completed before marking an orderCVE-2026-83533 · WordPress plugins & themes · reported by WPScanMedium 5.3
The WP Express Checkout WordPress plugin before 2.4.9 does not verify server-side that a payment was actually completed before marking an order as paid, allowing unauthenticated users to forge a completed order without paying.
Product
WP Express Checkout
Fixed in
2.4.9
What to do
Update WP Express Checkout to 2.4.9 or newer.
Full record and what to do →NVD record wpscan.com
Sep 2, 2026Brave: Does not prevent a URL parameter used to pre-fill a form field from being passed to WordPress's shortcode engineCVE-2026-81571 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Brave WordPress plugin before 0.8.8 does not prevent a URL parameter used to pre-fill a form field from being passed to WordPress's shortcode engine, allowing unauthenticated attackers to have arbitrary shortcodes registered on the site executed server-side.
Product
Brave
Fixed in
0.8.8
What to do
Update Brave to 0.8.8 or newer.
Full record and what to do →NVD record wpscan.com
Sep 2, 2026HIPAA FORMS: Contains a hardcoded authentication bypass via a hardcoded parameter alongside all AJAX requestsCVE-2026-2688 · WordPress plugins & themes · reported by WPScanMedium 6.5
The HIPAA FORMS WordPress plugin before 3.2.0 contains a hardcoded authentication bypass via a hardcoded parameter alongside all AJAX requests. The server explicitly checks for this value to skip nonce validation entirely. This allows unauthenticated attackers to access protected AJAX endpoints.
Product
HIPAA FORMS
Fixed in
3.2.0
What to do
Update HIPAA FORMS to 3.2.0 or newer.
Full record and what to do →NVD record wpscan.com
Sep 2, 2026User Frontend: Does not enforce its subscription-purchase requirementCVE-2026-17563 · WordPress plugins & themes · reported by WPScanMedium 5.3
The User Frontend WordPress plugin before 4.3.11 does not enforce its subscription-purchase requirement when processing frontend post submissions, only when rendering the form, allowing unauthenticated users to create and, depending on the form's configuration, immediately publish posts through forms restricted to paying subscribers.
Product
User Frontend
Fixed in
4.3.11
What to do
Update User Frontend to 4.3.11 or newer.
Full record and what to do →NVD record wpscan.com
Sep 2, 2026Yoast SEO Premium: Does not sanitize control characters from redirect origins before writing them to the site's Apache configuration fileCVE-2026-10821 · WordPress plugins & themes · reported by WPScanMedium 6.6
The Yoast SEO Premium WordPress plugin before 27.6.1 does not sanitize control characters from redirect origins before writing them to the site's Apache configuration file when the file-based redirect mode is enabled, and the redirect-creation endpoint is reachable by users with only Author-level access. This allows such users to inject arbitrary newline-delimited Apache directives into the root .htaccess file. On Apache servers that honour PHP directives, the injection can be chained with the user's own media upload (a polyglot image carrying a PHP payload) and an auto_prepend_file directive to achieve Remote Code Execution.
Product
Yoast SEO Premium
Fixed in
27.6.1
What to do
Update Yoast SEO Premium to 27.6.1 or newer.
Full record and what to do →NVD record wpscan.com yoast.com
Sep 2, 2026Wp Edit Password Protected: Allows protecting page contentCVE-2025-8945 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Wp Edit Password Protected WordPress plugin before 1.3.5 allows protecting page content, but this protection can be bypassed by using the REST API.
Product
Wp Edit Password Protected
Fixed in
1.3.5
What to do
Update Wp Edit Password Protected to 1.3.5 or newer.
Full record and what to do →NVD record wpscan.com
Sep 2, 2026Passster: Has a flaw in its global protection checksCVE-2025-15490 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Passster WordPress plugin before 4.2.26 has a flaw in its global protection checks, allowing unauthenticated users to bypass the protection offered via crafted URLs
Product
Passster
Fixed in
4.2.26
What to do
Update Passster to 4.2.26 or newer.
Full record and what to do →NVD record wpscan.com
Sep 2, 2026Passster: Does not handle input properly in an AJAX actionCVE-2025-15489 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Passster WordPress plugin before 4.2.24 does not handle input properly in an AJAX action, allowing unauthenticated users to retrieve the value of password protected content
Product
Passster
Fixed in
4.2.24
What to do
Update Passster to 4.2.24 or newer.
Full record and what to do →NVD record wpscan.com
Sep 2, 2026Classified Listing: Missing AuthorizationCVE-2026-84217 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Mamunur Rashid Classified Listing classified-listing allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Classified Listing: from n/a through 6.1.3.
Product
Classified Listing
Affected
up to 6.1.3
What to do
Affects up to 6.1.3. Update Classified Listing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 2, 2026Booking Hub: Incorrect Privilege AssignmentCVE-2026-81769 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Incorrect Privilege Assignment vulnerability in LiquidThemes Booking Hub allows Privilege Escalation. This issue affects Booking Hub: from n/a through 1.3.1.
Product
Booking Hub
Affected
up to 1.3.1
What to do
Affects up to 1.3.1. Update Booking Hub to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 2, 2026Unauthenticated Cross Site Scripting (XSS) in MP3 Audio Player for Music, Radio & Podcast by Sonaar <= 5.13.1 versions.CVE-2026-81289 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in MP3 Audio Player for Music, Radio & Podcast by Sonaar <= 5.13.1 versions.
Affected
up to 5.13.1
What to do
Affects up to 5.13.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 2, 2026Easy Waveform Player: Stored Cross-Site ScriptingCVE-2025-7963 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Easy Waveform Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the shortcode_easywaveformplayer() function in all versions up to, and including, 1.2.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Easy Waveform Player
Affected
up to 1.2.2
What to do
Affects up to 1.2.2. Update Easy Waveform Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 2, 2026OAuth Single Sign On: Does not verify the identity assertion returned by its Steam single sign-on flowCVE-2026-82183 · WordPress plugins & themes · reported by WPScanHigh 8.1
The OAuth Single Sign On WordPress plugin before 7.0.1 does not verify the identity assertion returned by its Steam single sign-on flow, allowing unauthenticated attackers to log in as an arbitrary non-administrator user, and to create new accounts.
Product
OAuth Single Sign On
Fixed in
7.0.1
What to do
Update OAuth Single Sign On to 7.0.1 or newer.
Full record and what to do →NVD record wpscan.com
Sep 2, 2026MasterStudy LMS: Does not perform an authorization check before returning a student's learning statisticsCVE-2026-81199 · WordPress plugins & themes · reported by WPScanMedium 5.3
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not perform an authorization check before returning a student's learning statistics, allowing unauthenticated attackers to disclose the course counts, points, certificates, quiz and assignment totals of any registered user.
Product
MasterStudy LMS
Fixed in
3.7.46
What to do
Update MasterStudy LMS to 3.7.46 or newer.
Full record and what to do →NVD record wpscan.com
Sep 2, 2026MasterStudy LMS: Does not properly verify ownership of a curriculum object before acting on itCVE-2026-81198 · WordPress plugins & themes · reported by WPScanLow 3.8
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not properly verify ownership of a curriculum object before acting on it, allowing authenticated users with the instructor role to delete or modify curriculum sections and materials belonging to courses owned by other instructors.
Product
MasterStudy LMS
Fixed in
3.7.46
What to do
Update MasterStudy LMS to 3.7.46 or newer.
Full record and what to do →NVD record wpscan.com
Sep 2, 2026MasterStudy LMS: Does not restrict access to a REST route that lists an author's coursesCVE-2026-81197 · WordPress plugins & themes · reported by WPScanMedium 5.3
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not restrict access to a REST route that lists an author's courses, nor does it filter that listing by publication status, allowing unauthenticated users to read the titles and IDs of unpublished (draft, pending and private) courses.
Product
MasterStudy LMS
Fixed in
3.7.46
What to do
Update MasterStudy LMS to 3.7.46 or newer.
Full record and what to do →NVD record wpscan.com
Sep 2, 2026MasterStudy LMS: Does not properly verify ownership of quiz question identifiersCVE-2026-81196 · WordPress plugins & themes · reported by WPScanLow 2.7
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not properly verify ownership of quiz question identifiers, allowing users with instructor access to read other instructors' quiz questions, including the correct answers and explanations.
Product
MasterStudy LMS
Fixed in
3.7.46
What to do
Update MasterStudy LMS to 3.7.46 or newer.
Full record and what to do →NVD record wpscan.com
Sep 2, 2026MasterStudy LMS: Does not perform an authorization check before returning per-student course enrollment and progress dataCVE-2026-81195 · WordPress plugins & themes · reported by WPScanMedium 5.3
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not perform an authorization check before returning per-student course enrollment and progress data, allowing unauthenticated attackers to disclose the enrolled courses and learning progress of any registered user.
Product
MasterStudy LMS
Fixed in
3.7.46
What to do
Update MasterStudy LMS to 3.7.46 or newer.
Full record and what to do →NVD record wpscan.com
Sep 2, 2026MasterStudy LMS: Does not properly verify authorizationCVE-2026-81194 · WordPress plugins & themes · reported by WPScanMedium 4.3
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not properly verify authorization when retrieving order line-item data, allowing any authenticated user including Subscribers to read other instructors' course sales records by supplying another user's identifier.
Product
MasterStudy LMS
Fixed in
3.7.46
What to do
Update MasterStudy LMS to 3.7.46 or newer.
Full record and what to do →NVD record wpscan.com
Sep 2, 2026Rank Math SEO: Does not verify that the metadata row being updated belongs to the object the user was authorised againstCVE-2026-77788 · WordPress plugins & themes · reported by WPScanMedium 4.9
The Rank Math SEO WordPress plugin before 1.0.277 does not verify that the metadata row being updated belongs to the object the user was authorised against, allowing users with the Author role and above to overwrite arbitrary post and user metadata, including that belonging to higher-privileged users.
Product
Rank Math SEO
Fixed in
1.0.277
What to do
Update Rank Math SEO to 1.0.277 or newer.
Full record and what to do →NVD record wpscan.com
Sep 2, 2026Rank Math SEO: Does not check whether a post is password protected before using its content to build publicly generated SEO metadataCVE-2026-77782 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Rank Math SEO WordPress plugin before 1.0.277.1 does not check whether a post is password protected before using its content to build publicly generated SEO metadata, allowing unauthenticated users to read the content of password-protected posts.
Product
Rank Math SEO
Fixed in
1.0.277.1
What to do
Update Rank Math SEO to 1.0.277.1 or newer.
Full record and what to do →NVD record wpscan.com
Sep 2, 2026Social Media Share Buttons & Social Sharing Icons: Does not properly escape a value taken from the incoming request before outputting it in an inline JavaScript event handlerCVE-2026-19723 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Social Media Share Buttons & Social Sharing Icons WordPress plugin before 3.0.1 does not properly escape a value taken from the incoming request before outputting it in an inline JavaScript event handler, leading to Reflected Cross-Site Scripting which is triggered when a user interacts with the affected button. Exploitation requires the Social Media Share Buttons & Social Sharing Icons WordPress plugin before 3.0.1 to be running a non-default icon display configuration.
Product
Social Media Share Buttons & Social Sharing Icons
Fixed in
3.0.1
What to do
Update Social Media Share Buttons & Social Sharing Icons to 3.0.1 or newer.
Full record and what to do →NVD record wpscan.com
Sep 2, 2026Social Media Share Buttons & Social Sharing Icons: Does not escape the post title before outputting it in an inline JavaScript event handlerCVE-2026-19719 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Social Media Share Buttons & Social Sharing Icons WordPress plugin before 3.0.1 does not escape the post title before outputting it in an inline JavaScript event handler, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks which are triggered when a visitor interacts with the affected button. Exploitation requires the Social Media Share Buttons & Social Sharing Icons WordPress plugin before 3.0.1 to be running a non-default icon display configuration.
Product
Social Media Share Buttons & Social Sharing Icons
Fixed in
3.0.1
What to do
Update Social Media Share Buttons & Social Sharing Icons to 3.0.1 or newer.
Full record and what to do →NVD record wpscan.com
Sep 2, 2026Comments: Does not validate a value used to build a database queryCVE-2026-19704 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Comments WordPress plugin before 7.6.66 does not validate a value used to build a database query, allowing unauthenticated users to inject SQL and read comments they are not entitled to see, including comments awaiting moderation, comments marked as spam or trashed, and comments on private and draft posts. The injected text reaches the query as grammar rather than as data and does not yield extraction of arbitrary data, so the confidentiality impact is the disclosed comment content rather than the database at large.
Product
Comments
Fixed in
7.6.66
What to do
Update Comments to 7.6.66 or newer.
Full record and what to do →NVD record wpscan.com
Sep 2, 2026Ultimate Member: Does not check whether a comment has been approvedCVE-2026-19251 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Ultimate Member WordPress plugin before 2.13.0 does not check whether a comment has been approved, or whether the profile it belongs to is private, before returning profile activity to unauthenticated visitors, allowing them to read the content of comments still awaiting moderation.
Product
Ultimate Member
Fixed in
2.13.0
What to do
Update Ultimate Member to 2.13.0 or newer.
Full record and what to do →NVD record wpscan.com
Sep 1, 2026Simple Membership: Authentication Bypass leading to Administrator Account TakeoverCVE-2026-77194 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Simple Membership plugin for WordPress is vulnerable to Authentication Bypass leading to Administrator Account Takeover in versions up to, and including, 4.8.0. This is due to improper identity verification during the public registration flow in WordPress Multisite environments, where the plugin binds new Simple Membership records to existing global WordPress users based solely on matching username and email, without requiring password verification or ownership proof, and fails to properly detect Administrator roles on child sites. This makes it possible for unauthenticated attackers to take over Administrator accounts on child sites in a Multisite network by registering a Simple Membership account with a victim's credentials on a site where public registration is enabled, then updating the victim's global WordPress password through the profile edit functionality. The vulnerability was partially patched in version 4.8.1.
Product
Simple Membership
Affected
up to 4.8.0
What to do
Affects up to 4.8.0. Update Simple Membership to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 1, 2026WP Fastest Cache: Does not include a set of tracking-related query parameters in its page-cache key while still caching pages requested with themCVE-2026-74916 · WordPress plugins & themes · reported by WPScanMedium 6.5
The WP Fastest Cache WordPress plugin before 1.5.1 does not include a set of tracking-related query parameters in its page-cache key while still caching pages requested with them, allowing unauthenticated attackers to have a page rendered under their own request context stored under, and served from, the clean URL's cache entry to every subsequent visitor.
Product
WP Fastest Cache
Fixed in
1.5.1
What to do
Update WP Fastest Cache to 1.5.1 or newer.
Full record and what to do →NVD record wpscan.com
Sep 1, 2026BetterDocs – AI Documentation, Knowledge Base, Docs, Wikis, FAQ with Chatbot: Stored Cross-Site ScriptingCVE-2026-75980 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The BetterDocs – AI Documentation, Knowledge Base, Docs, Wikis, FAQ with Chatbot plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Heading 'id' Attribute in Post Content in all versions up to, and including, 4.8.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit survives wp_kses_post because entity-encoded quotes in a heading id attribute are treated as a single legitimate attribute value at save time; the dangerous payload only materialises after process_content_for_toc() calls html_entity_decode() on the stored content and the broken id is extracted by a lazy regex before being echoed unescaped into the Table of Contents output.
Product
BetterDocs – AI Documentation, Knowledge Base, Docs, Wikis, FAQ with Chatbot
Affected
up to 4.8.1
What to do
Affects up to 4.8.1. Update BetterDocs – AI Documentation, Knowledge Base, Docs, Wikis, FAQ with Chatbot to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 1, 2026The Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits plugin for WordPress is vulnerableCVE-2026-75921 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.1.9 via the upload_template_kit function. This is due to incorrect authorization on the upload_template_kit() AJAX handler, which requires only upload_files capability instead of the manage_options required by all sibling handlers, combined with missing per-entry file type filtering after ZIP extraction. This makes it possible for authenticated attackers, with editor-level access and above, to upload files that may be executable, which makes remote code execution possible. Editors can satisfy the nonce requirement because the required nonces are localized on the standard Pages list screen, which is accessible to any user with the edit_pages capability.
Affected
up to 3.1.9
What to do
Affects up to 3.1.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 1, 2026Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 700+ Patterns, 58 Blocks & Templates: Authorization bypassCVE-2026-19948 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 700+ Patterns, 58 Blocks & Templates plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.2.17. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to retrieve the name, price, short description, image URL, permalink, stock status, and product type of draft, pending, private, and catalog-hidden WooCommerce products not intended to be publicly visible. The sidebarNonce value is emitted unconditionally into public page HTML by multiple block renderers with no login gate, allowing unauthenticated visitors to harvest a valid nonce and pass the only authentication check in the handler.
Product
Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 700+ Patterns, 58 Blocks & Templates
Affected
up to 2.2.17
What to do
Affects up to 2.2.17. Update Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 700+ Patterns, 58 Blocks & Templates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 1, 2026Support Genix – Helpdesk, AI Chatbot, Knowledge Base & Customer Support Ticketing System: Authentication Bypass leading to Administrator Account TakeoverCVE-2026-19806 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Support Genix – Helpdesk, AI Chatbot, Knowledge Base & Customer Support Ticketing System plugin for WordPress is vulnerable to Authentication Bypass leading to Administrator Account Takeover in all versions up to, and including, 1.4.52 via the `guest_ticket_login()` function and its `p` parameter. This is due to the site-wide AES-256-CBC encryption key being derived from only three two-digit `wp_rand(10, 99)` values and a Unix timestamp via `md5()` — yielding approximately 19.5 bits of entropy — combined with a deterministic IV derived from the password, no authentication tag on the ciphertext, and no capability check, nonce, or session validation on the publicly reachable `/sgnix/?p=<token>` endpoint. This makes it possible for authenticated attackers, with subscriber-level access and above, who can obtain a single legitimate guest ticket token as a known-plaintext oracle and bound the plugin activation timestamp, to exhaust the ~729,000-candidate keyspace entirely offline, recover the site-wide encryption key, and forge a self-consistent `{ticket_id, ticket_user}` token targeting any administrator-owned ticket. Submitting the forged token to the unprotected endpoint causes `w
Product
Support Genix – Helpdesk, AI Chatbot, Knowledge Base & Customer Support Ticketing System
Affected
up to 1.4.52
What to do
Affects up to 1.4.52. Update Support Genix – Helpdesk, AI Chatbot, Knowledge Base & Customer Support Ticketing System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.