Updated 35 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

37added in the last 30 days

544new WordPress flaws this week

391,181entries in the database

9,038 results · page 12 of 181

Oct 1, 2026Unlimited Elements For Elementor (Free Widgets, Addons, Templates): Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-103338 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor allows Blind SQL Injection.This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 2.0.20.
Product
Unlimited Elements For Elementor (Free Widgets, Addons, Templates)
Affected
up to 2.0.20
What to do
Affects up to 2.0.20. Update Unlimited Elements For Elementor (Free Widgets, Addons, Templates) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 1, 2026ElementsKit Elementor addons Lite: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-103064 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wpmet ElementsKit Elementor addons Lite elementskit-lite allows Stored XSS.This issue affects ElementsKit Elementor addons Lite: from n/a through 4.0.6.
Product
ElementsKit Elementor addons Lite
Affected
up to 4.0.6
What to do
Affects up to 4.0.6. Update ElementsKit Elementor addons Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 1, 2026ElementsKit Elementor addons Lite: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-103063 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wpmet ElementsKit Elementor addons Lite elementskit-lite allows Stored XSS.This issue affects ElementsKit Elementor addons Lite: from n/a through 4.0.6.
Product
ElementsKit Elementor addons Lite
Affected
up to 4.0.6
What to do
Affects up to 4.0.6. Update ElementsKit Elementor addons Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 1, 2026Essential Addons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-102394 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPDeveloper Essential Addons for Elementor essential-addons-for-elementor-lite allows Stored XSS.This issue affects Essential Addons for Elementor: from n/a through 6.8.4.
Product
Essential Addons for Elementor
Affected
up to 6.8.4
What to do
Affects up to 6.8.4. Update Essential Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 1, 2026LA-Studio Element Kit for Elementor: Server-Side Request Forgery (SSRF)CVE-2026-103082 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Server-Side Request Forgery (SSRF) vulnerability in LA-Studio LA-Studio Element Kit for Elementor lastudio-element-kit allows Server Side Request Forgery.This issue affects LA-Studio Element Kit for Elementor: from n/a through 1.6.2.
Product
LA-Studio Element Kit for Elementor
Affected
up to 1.6.2
What to do
Affects up to 1.6.2. Update LA-Studio Element Kit for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 1, 2026Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns: Stored Cross-Site ScriptingCVE-2026-96256 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Google Map block's 'marker' attribute in versions up to, and including, 6.4.5 This is due to insufficient input sanitization and output escaping on marker title/content values, which are stored as JSON and then decoded and concatenated directly into raw HTML by the frontend script's InfoWindow content builder. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns
Affected
up to 6.4.5
What to do
Affects up to 6.4.5. Update Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 1, 2026Forminator Forms – Contact Form, Payment Form & Custom Form Builder: Stored Cross-Site ScriptingCVE-2026-92144 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'postdata-1[post-custom]' Parameter in all versions up to, and including, 1.57.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The required form submission nonce is freely obtainable by unauthenticated users via the publicly accessible wp_ajax_nopriv_forminator_get_nonce endpoint, making the full attack chain exploitable without any authentication or prior account.
Product
Forminator Forms – Contact Form, Payment Form & Custom Form Builder
Affected
up to 1.57.2
What to do
Affects up to 1.57.2. Update Forminator Forms – Contact Form, Payment Form & Custom Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 1, 2026Business Essentials for Contact Form 7: Stored Cross-Site ScriptingCVE-2026-97661 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Business Essentials for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'gateway' Form Field in all versions up to, and including, 1.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the Payments module to be enabled and a form to be configured to accept both PayPal and Stripe as payment gateways.
Product
Business Essentials for Contact Form 7
Affected
up to 1.2.1
What to do
Affects up to 1.2.1. Update Business Essentials for Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 1, 2026Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder: Stored Cross-Site ScriptingCVE-2026-96813 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Mark on Map Longitude/Latitude Fields in all versions up to, and including, 1.15.47 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder
Affected
up to 1.15.47
What to do
Affects up to 1.15.47. Update Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 1, 2026Appointment Hour Booking – Booking Calendar: Stored DOM-Based Cross-Site ScriptingCVE-2026-96573 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Appointment Hour Booking – Booking Calendar plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via Booking Form Single-Line Field via Schedule Calendar List Renderer in all versions up to, and including, 1.5.97 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the 'list_readmore_numberofwords' Other Parameters setting to be configured with a positive integer value; the default value of 0 bypasses the decode-and-truncate branch entirely and is not exploitable through this sink.
Product
Appointment Hour Booking – Booking Calendar
Affected
up to 1.5.97
What to do
Affects up to 1.5.97. Update Appointment Hour Booking – Booking Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 1, 2026Awesome Support – WordPress HelpDesk & Support: Stored Cross-Site ScriptingCVE-2026-96268 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Awesome Support – WordPress HelpDesk & Support Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'gdpr-data' parameter in all versions up to, and including, 6.4.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable by Subscriber-level users against other accounts because the AJAX handlers accept an arbitrary gdpr-user ID without verifying it belongs to the requester, and the required wpas-gdpr-nonce is emitted via wp_localize_script to every logged-in user on frontend plugin pages and on /wp-admin/profile.php.
Product
Awesome Support – WordPress HelpDesk & Support
Affected
up to 6.4.0
What to do
Affects up to 6.4.0. Update Awesome Support – WordPress HelpDesk & Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 1, 2026PDF Invoices & Packing Slips for WooCommerce: Stored Cross-Site ScriptingCVE-2026-92244 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Billing First Name / Last Name / Company Fields in all versions up to, and including, 5.16.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload survives initial storage because WooCommerce's sanitize_text_field() and wc_clean() do not strip entity-encoded strings containing no literal '<' character, allowing unauthenticated guest-checkout orders to plant the malicious content.
Product
PDF Invoices & Packing Slips for WooCommerce
Affected
up to 5.16.1
What to do
Affects up to 5.16.1. Update PDF Invoices & Packing Slips for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 1, 2026Redux Framework: Stored Cross-Site ScriptingCVE-2026-90992 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via User Meta Merge via 'user-mediaurl' Media Field in all versions up to, and including, 4.5.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable by Subscriber-level users who can store a payload in user meta fields such as the biography, session_tokens (via a crafted User-Agent at login), or persisted_preferences (via the REST API), which are then promoted to the site-wide redux_demo option when a media URL repair is triggered on the demo panel.
Product
Redux Framework
Affected
up to 4.5.14
What to do
Affects up to 4.5.14. Update Redux Framework to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 1, 2026Duplicate Post: Stored Cross-Site ScriptingCVE-2026-89424 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Duplicate Post plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'noti_token' parameter in all versions up to, and including, 1.5.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires that the site owner has enabled the plugin's User Level Permissions for the Subscriber role, as this grants access to the i_saw_this_noti AJAX branch needed to deliver the payload.
Product
Duplicate Post
Affected
up to 1.5.6
What to do
Affects up to 1.5.6. Update Duplicate Post to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 1, 2026Forminator Forms – Contact Form, Payment Form & Custom Form Builder: Stored Cross-Site ScriptingCVE-2026-85235 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Rich-Text Textarea Field in all versions up to, and including, 1.57.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires an administrator to open the stored submission entry in the Forminator Entries view and interact with the planted link, at which point WordPress core's jQuery-based click handler on `.contextual-help-tabs a` evaluates the entity-decoded href as HTML, firing the attacker's payload in the administrator's authenticated wp-admin session.
Product
Forminator Forms – Contact Form, Payment Form & Custom Form Builder
Affected
up to 1.57.2
What to do
Affects up to 1.57.2. Update Forminator Forms – Contact Form, Payment Form & Custom Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 1, 2026Super Forms – Drag & Drop Form Builder: Arbitrary File/Directory DeletionCVE-2026-15983 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Arbitrary File/Directory Deletion in all versions up to, and including, 6.3.316. This is due to the `super_save_form` AJAX handler performing no capability check — allowing Subscriber-level authenticated users to create or modify Super Forms and enable the `file_upload_submission_delete` setting — combined with the `super_submit_form` handler's `submit_form` function passing the attacker-controlled `files[].subdir` value from `$_POST['data']` directly into `SUPER_Common::delete_dir()` without sanitization, and a trivially bypassed `ABSPATH` guard that a `subdir` value of `wp-config.php` defeats because `dirname(realpath(ABSPATH . $subdir))` resolves to the WordPress root while the naive `ABSPATH !== $dir` string check fails to match due to a trailing-slash mismatch. This makes it possible for authenticated attackers, with Subscriber-level access and above, to recursively delete arbitrary files and directories on the server, up to and including the entire WordPress installation, resulting in full site takedown and potential remote code execution if critical files such as `wp-config.php` are removed and
Product
Super Forms – Drag & Drop Form Builder
Affected
up to 6.3.316
What to do
Affects up to 6.3.316. Update Super Forms – Drag & Drop Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wordfence.com
Oct 1, 2026Autoptimize: Stored Cross-Site ScriptingCVE-2026-14995 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Autoptimize plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REQUEST_URI Path in all versions up to, and including, 3.1.15.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the Critical CSS feature to be active with a valid API key configured, as this is the precondition for unauthenticated frontend requests to trigger queue entries via ao_ccss_enqueue().
Product
Autoptimize
Affected
up to 3.1.15.1
What to do
Affects up to 3.1.15.1. Update Autoptimize to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 1, 2026bbp style pack: Stored Cross-Site ScriptingCVE-2026-101925 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The bbp style pack plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'display_name (via /wp-admin/profile.php) + bbp_reply_content (via bbPress reply form)' parameter in all versions up to, and including, 6.4.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires the attacker to wrap their crafted reply in a <pre> block, which prevents WordPress's wpautop/wptexturize processors from converting straight double quotes in the stored display name into typographic curly-quote entities that would otherwise neutralize the attribute-injection.
Product
bbp style pack
Affected
up to 6.4.8
What to do
Affects up to 6.4.8. Update bbp style pack to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 1, 2026ByteCoreStack – MCP Connector for AI Tools: Privilege EscalationCVE-2026-19807 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The ByteCoreStack – MCP Connector for AI Tools plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.2.3 This is due to the `wp_update_user_meta` MCP tool in `execute_tool` gating writes solely with `current_user_can('edit_user', $uid)` — a check that WordPress core's `map_meta_cap` resolves to the `read` primitive when the target user ID matches the caller's own — while enforcing an incomplete meta key blocklist that covers only `user_pass`, `user_activation_key`, and `session_tokens`, leaving the `wp_capabilities` and `wp_user_level` meta keys entirely unprotected. This makes it possible for authenticated attackers with Subscriber-level access and above to elevate their privileges to Administrator by issuing a `wp_update_user_meta` call over the MCP JSON-RPC endpoint with `key=wp_capabilities` and an arbitrary role array such as `{'administrator': true}` targeting their own user ID, causing WordPress to load that account as an Administrator on the next request.
Product
ByteCoreStack – MCP Connector for AI Tools
Affected
up to 1.2.3
What to do
Affects up to 1.2.3. Update ByteCoreStack – MCP Connector for AI Tools to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 1, 2026If-So Dynamic Content: Does not sanitize a conversion name before storing itCVE-2026-87973 · WordPress plugins & themes · reported by WPScanLow 3.1
The If-So Dynamic Content WordPress plugin before 1.10.2 does not sanitize a conversion name before storing it, nor escape it when rendering the analytics page, allowing users with editor-level access to store JavaScript that executes in the session of a higher-privileged user who views that page.
Product
If-So Dynamic Content
Fixed in
1.10.2
What to do
Update If-So Dynamic Content to 1.10.2 or newer.
Full record and what to do →NVD record wpscan.com
Oct 1, 2026Extendify: Stored Cross-Site ScriptingCVE-2026-85679 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Extendify plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'styles.blocks' Block Type Key in all versions up to, and including, 3.1.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is possible because registerIncoming() is hooked on rest_request_before_callbacks and runs before WordPress evaluates the route's permission_callback, meaning any unauthenticated POST, PUT, or PATCH request to a /wp/v2/global-styles route can trigger the vulnerable code path.
Product
Extendify
Affected
up to 3.1.6
What to do
Affects up to 3.1.6. Update Extendify to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 1, 2026Paytm Payment Gateway: Does not sanitize and escape data it stores from payment callbacks before outputting it in an admin pageCVE-2026-81739 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Paytm Payment Gateway WordPress plugin before 2.8.9 does not sanitize and escape data it stores from payment callbacks before outputting it in an admin page, and the integrity check on those callbacks can be forged when the gateway is enabled without credentials, allowing unauthenticated users to store scripts that will run in the session of a store administrator.
Product
Paytm Payment Gateway
Fixed in
2.8.9
What to do
Update Paytm Payment Gateway to 2.8.9 or newer.
Full record and what to do →NVD record wpscan.com
Oct 1, 2026AI Engine – The Chatbot, AI Framework & MCP for: Stored Cross-Site ScriptingCVE-2026-96561 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.8.0 This is due to a chain of missing input neutralization and output escaping across the /mwai-ui/v1/chats/submit REST endpoint, the PHP error-log parser (MeowKit_MWAI_Helpers::php_error_logs), the Advisor task (Meow_MWAI_Modules_Advisor::run_advisor), and the Advisor dashboard widget (advisor_metabox): the server-parameter denylist in chat_submit strips only exact key names such as 'model' while convert_keys() later canonicalizes 'model_' back to 'model', allowing an unauthenticated caller to place an attacker-controlled string (including CR/LF) into $query->model; final_checks() throws an Exception whose message embeds that raw string, and the non-streaming, non-admin catch branch writes it to the PHP error log unmodified — creating a forged log line that the plugin's own parser subsequently returns as recent PHP-error content; run_advisor() then appends that content verbatim to the AI prompt (indirect prompt injection — CWE-1427), the returned JSON is stored in the mwai_advisor_data option with no schema validation o
Product
AI Engine – The Chatbot, AI Framework & MCP for
Affected
up to 3.8.0
What to do
Affects up to 3.8.0. Update AI Engine – The Chatbot, AI Framework & MCP for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 30, 2026Contributor PHP Object Injection in Schema & Structured Data for WP & AMP <= 1.66 versions.CVE-2026-97291 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Contributor PHP Object Injection in Schema & Structured Data for WP & AMP <= 1.66 versions.
Affected
up to 1.66
What to do
Affects up to 1.66. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 30, 2026Editor PHP Object Injection in Page Builder by SiteOrigin <= 2.36.0 versions.CVE-2026-97256 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Editor PHP Object Injection in Page Builder by SiteOrigin <= 2.36.0 versions.
Affected
up to 2.36.0
What to do
Affects up to 2.36.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 30, 2026Contributor PHP Object Injection in Photo Gallery by 10Web <= 1.8.46 versions.CVE-2026-102377 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Contributor PHP Object Injection in Photo Gallery by 10Web <= 1.8.46 versions.
Affected
up to 1.8.46
What to do
Affects up to 1.8.46. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 30, 2026Contributor PHP Object Injection in Nested Pages <= 3.3.2 versions.CVE-2026-100512 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Contributor PHP Object Injection in Nested Pages <= 3.3.2 versions.
Affected
up to 3.3.2
What to do
Affects up to 3.3.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 30, 2026Business Directory: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-62097 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPTasty Business Directory business-directory-plugin allows Blind SQL Injection.This issue affects Business Directory: from n/a through 6.4.27.
Product
Business Directory
Affected
up to 6.4.27
What to do
Affects up to 6.4.27. Update Business Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 30, 2026Contributor Cross Site Scripting (XSS) in Cool Formkit Lite <= 2.7.8 versions.CVE-2026-97301 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Cross Site Scripting (XSS) in Cool Formkit Lite <= 2.7.8 versions.
Affected
up to 2.7.8
What to do
Affects up to 2.7.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 30, 2026Contributor Cross Site Scripting (XSS) in King Addons for Elementor <= 51.1.86 versions.CVE-2026-97298 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Cross Site Scripting (XSS) in King Addons for Elementor <= 51.1.86 versions.
Affected
up to 51.1.86
What to do
Affects up to 51.1.86. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 30, 2026Contributor SQL Injection in Media LIbrary Assistant <= 3.41 versions.CVE-2026-97293 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Contributor SQL Injection in Media LIbrary Assistant <= 3.41 versions.
Affected
up to 3.41
What to do
Affects up to 3.41. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 30, 2026Contributor Cross Site Scripting (XSS) in OAuth Server <= 4.5.1 versions.CVE-2026-97288 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Cross Site Scripting (XSS) in OAuth Server <= 4.5.1 versions.
Affected
up to 4.5.1
What to do
Affects up to 4.5.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 30, 2026Contributor Broken Access Control in The Events Calendar <= 6.17.5 versions.CVE-2026-97285 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Contributor Broken Access Control in The Events Calendar <= 6.17.5 versions.
Affected
up to 6.17.5
What to do
Affects up to 6.17.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 30, 2026Contributor Cross Site Scripting (XSS) in Polylang <= 3.8.9 versions.CVE-2026-97279 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Cross Site Scripting (XSS) in Polylang <= 3.8.9 versions.
Affected
up to 3.8.9
What to do
Affects up to 3.8.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 30, 2026Contributor Cross Site Scripting (XSS) in Virtue/Ascend/Pinnacle Toolkit <= 4.9.12.1 versions.CVE-2026-97266 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Cross Site Scripting (XSS) in Virtue/Ascend/Pinnacle Toolkit <= 4.9.12.1 versions.
Affected
up to 4.9.12.1
What to do
Affects up to 4.9.12.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 30, 2026Contributor Cross Site Scripting (XSS) in Visual Composer Website Builder <= 45.16.2 versions.CVE-2026-97262 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Cross Site Scripting (XSS) in Visual Composer Website Builder <= 45.16.2 versions.
Affected
up to 45.16.2
What to do
Affects up to 45.16.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 30, 2026Contributor Path Traversal in Creator LMS <= 1.2.19 versions.CVE-2026-97244 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Contributor Path Traversal in Creator LMS <= 1.2.19 versions.
Affected
up to 1.2.19
What to do
Affects up to 1.2.19. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 30, 2026Subscriber Broken Access Control in AllAble Connector <= 0.13.4 versions.CVE-2026-97243 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Subscriber Broken Access Control in AllAble Connector <= 0.13.4 versions.
Affected
up to 0.13.4
What to do
Affects up to 0.13.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 30, 2026Contributor Cross Site Scripting (XSS) in EWWW Image Optimizer <= 8.7.7 versions.CVE-2026-97067 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Cross Site Scripting (XSS) in EWWW Image Optimizer <= 8.7.7 versions.
Affected
up to 8.7.7
What to do
Affects up to 8.7.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 30, 2026Contributor Remote Code Execution (RCE) in CartFlows <= 3.2.0 versions.CVE-2026-96837 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Contributor Remote Code Execution (RCE) in CartFlows <= 3.2.0 versions.
Affected
up to 3.2.0
What to do
Affects up to 3.2.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 30, 2026Contributor Cross Site Scripting (XSS) in King Addons for Elementor <= 51.1.85 versions.CVE-2026-96835 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Cross Site Scripting (XSS) in King Addons for Elementor <= 51.1.85 versions.
Affected
up to 51.1.85
What to do
Affects up to 51.1.85. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 30, 2026Editor PHP Object Injection in Ultimate Addons for Contact Form 7 <= 3.5.51 versions.CVE-2026-96833 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Editor PHP Object Injection in Ultimate Addons for Contact Form 7 <= 3.5.51 versions.
Affected
up to 3.5.51
What to do
Affects up to 3.5.51. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 30, 2026Contributor PHP Object Injection in Themify Builder <= 7.8.1 versions.CVE-2026-96831 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Contributor PHP Object Injection in Themify Builder <= 7.8.1 versions.
Affected
up to 7.8.1
What to do
Affects up to 7.8.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 30, 2026Contributor Cross Site Scripting (XSS) in The Plus Addons for Elementor Page Builder Lite <= 6.5.1 versions.CVE-2026-96829 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Cross Site Scripting (XSS) in The Plus Addons for Elementor Page Builder Lite <= 6.5.1 versions.
Affected
up to 6.5.1
What to do
Affects up to 6.5.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 30, 2026Administrator SQL Injection in Category Discount Woocommerce <= 5.18 versions.CVE-2026-96828 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Administrator SQL Injection in Category Discount Woocommerce <= 5.18 versions.
Affected
up to 5.18
What to do
Affects up to 5.18. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 30, 2026Administrator SQL Injection in Admin Notices Manager <= 1.6.0 versions.CVE-2026-96827 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Administrator SQL Injection in Admin Notices Manager <= 1.6.0 versions.
Affected
up to 1.6.0
What to do
Affects up to 1.6.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 30, 2026Editor Arbitrary File Deletion in Template Kit – Import <= 1.0.16 versions.CVE-2026-96824 · WordPress plugins & themes · reported by PatchstackMedium 6.8
Editor Arbitrary File Deletion in Template Kit – Import <= 1.0.16 versions.
Affected
up to 1.0.16
What to do
Affects up to 1.0.16. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 30, 2026Contributor Cross Site Scripting (XSS) in pixfort Core < 4.3.3 versions.CVE-2026-96450 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Contributor Cross Site Scripting (XSS) in pixfort Core < 4.3.3 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Sep 30, 2026Administrator SQL Injection in Estatik <= 4.3.5 versions.CVE-2026-96345 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Administrator SQL Injection in Estatik <= 4.3.5 versions.
Affected
up to 4.3.5
What to do
Affects up to 4.3.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 30, 2026Unauthenticated Broken Access Control in Hostinger Migrator <= 1.0 versions.CVE-2026-95587 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in Hostinger Migrator <= 1.0 versions.
Affected
up to 1.0
What to do
Affects up to 1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.