Updated 5 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

456new WordPress flaws this week

390,714entries in the database

9,016 results · page 12 of 181

Oct 1, 2026AI Engine – The Chatbot, AI Framework & MCP for: Stored Cross-Site ScriptingCVE-2026-96561 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.8.0 This is due to a chain of missing input neutralization and output escaping across the /mwai-ui/v1/chats/submit REST endpoint, the PHP error-log parser (MeowKit_MWAI_Helpers::php_error_logs), the Advisor task (Meow_MWAI_Modules_Advisor::run_advisor), and the Advisor dashboard widget (advisor_metabox): the server-parameter denylist in chat_submit strips only exact key names such as 'model' while convert_keys() later canonicalizes 'model_' back to 'model', allowing an unauthenticated caller to place an attacker-controlled string (including CR/LF) into $query->model; final_checks() throws an Exception whose message embeds that raw string, and the non-streaming, non-admin catch branch writes it to the PHP error log unmodified — creating a forged log line that the plugin's own parser subsequently returns as recent PHP-error content; run_advisor() then appends that content verbatim to the AI prompt (indirect prompt injection — CWE-1427), the returned JSON is stored in the mwai_advisor_data option with no schema validation o
Product
AI Engine – The Chatbot, AI Framework & MCP for
Affected
up to 3.8.0
What to do
Affects up to 3.8.0. Update AI Engine – The Chatbot, AI Framework & MCP for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 30, 2026Contributor PHP Object Injection in Schema & Structured Data for WP & AMP <= 1.66 versions.CVE-2026-97291 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Contributor PHP Object Injection in Schema & Structured Data for WP & AMP <= 1.66 versions.
Affected
up to 1.66
What to do
Affects up to 1.66. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 30, 2026Editor PHP Object Injection in Page Builder by SiteOrigin <= 2.36.0 versions.CVE-2026-97256 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Editor PHP Object Injection in Page Builder by SiteOrigin <= 2.36.0 versions.
Affected
up to 2.36.0
What to do
Affects up to 2.36.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 30, 2026Contributor PHP Object Injection in Photo Gallery by 10Web <= 1.8.46 versions.CVE-2026-102377 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Contributor PHP Object Injection in Photo Gallery by 10Web <= 1.8.46 versions.
Affected
up to 1.8.46
What to do
Affects up to 1.8.46. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 30, 2026Contributor PHP Object Injection in Nested Pages <= 3.3.2 versions.CVE-2026-100512 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Contributor PHP Object Injection in Nested Pages <= 3.3.2 versions.
Affected
up to 3.3.2
What to do
Affects up to 3.3.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 30, 2026Business Directory: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-62097 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPTasty Business Directory business-directory-plugin allows Blind SQL Injection.This issue affects Business Directory: from n/a through 6.4.27.
Product
Business Directory
Affected
up to 6.4.27
What to do
Affects up to 6.4.27. Update Business Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 30, 2026Contributor Cross Site Scripting (XSS) in Cool Formkit Lite <= 2.7.8 versions.CVE-2026-97301 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Cross Site Scripting (XSS) in Cool Formkit Lite <= 2.7.8 versions.
Affected
up to 2.7.8
What to do
Affects up to 2.7.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 30, 2026Contributor Cross Site Scripting (XSS) in King Addons for Elementor <= 51.1.86 versions.CVE-2026-97298 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Cross Site Scripting (XSS) in King Addons for Elementor <= 51.1.86 versions.
Affected
up to 51.1.86
What to do
Affects up to 51.1.86. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 30, 2026Contributor SQL Injection in Media LIbrary Assistant <= 3.41 versions.CVE-2026-97293 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Contributor SQL Injection in Media LIbrary Assistant <= 3.41 versions.
Affected
up to 3.41
What to do
Affects up to 3.41. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 30, 2026Contributor Cross Site Scripting (XSS) in OAuth Server <= 4.5.1 versions.CVE-2026-97288 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Cross Site Scripting (XSS) in OAuth Server <= 4.5.1 versions.
Affected
up to 4.5.1
What to do
Affects up to 4.5.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 30, 2026Contributor Broken Access Control in The Events Calendar <= 6.17.5 versions.CVE-2026-97285 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Contributor Broken Access Control in The Events Calendar <= 6.17.5 versions.
Affected
up to 6.17.5
What to do
Affects up to 6.17.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 30, 2026Contributor Cross Site Scripting (XSS) in Polylang <= 3.8.9 versions.CVE-2026-97279 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Cross Site Scripting (XSS) in Polylang <= 3.8.9 versions.
Affected
up to 3.8.9
What to do
Affects up to 3.8.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 30, 2026Contributor Cross Site Scripting (XSS) in Virtue/Ascend/Pinnacle Toolkit <= 4.9.12.1 versions.CVE-2026-97266 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Cross Site Scripting (XSS) in Virtue/Ascend/Pinnacle Toolkit <= 4.9.12.1 versions.
Affected
up to 4.9.12.1
What to do
Affects up to 4.9.12.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 30, 2026Contributor Cross Site Scripting (XSS) in Visual Composer Website Builder <= 45.16.2 versions.CVE-2026-97262 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Cross Site Scripting (XSS) in Visual Composer Website Builder <= 45.16.2 versions.
Affected
up to 45.16.2
What to do
Affects up to 45.16.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 30, 2026Contributor Path Traversal in Creator LMS <= 1.2.19 versions.CVE-2026-97244 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Contributor Path Traversal in Creator LMS <= 1.2.19 versions.
Affected
up to 1.2.19
What to do
Affects up to 1.2.19. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 30, 2026Subscriber Broken Access Control in AllAble Connector <= 0.13.4 versions.CVE-2026-97243 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Subscriber Broken Access Control in AllAble Connector <= 0.13.4 versions.
Affected
up to 0.13.4
What to do
Affects up to 0.13.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 30, 2026Contributor Cross Site Scripting (XSS) in EWWW Image Optimizer <= 8.7.7 versions.CVE-2026-97067 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Cross Site Scripting (XSS) in EWWW Image Optimizer <= 8.7.7 versions.
Affected
up to 8.7.7
What to do
Affects up to 8.7.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 30, 2026Contributor Remote Code Execution (RCE) in CartFlows <= 3.2.0 versions.CVE-2026-96837 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Contributor Remote Code Execution (RCE) in CartFlows <= 3.2.0 versions.
Affected
up to 3.2.0
What to do
Affects up to 3.2.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 30, 2026Contributor Cross Site Scripting (XSS) in King Addons for Elementor <= 51.1.85 versions.CVE-2026-96835 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Cross Site Scripting (XSS) in King Addons for Elementor <= 51.1.85 versions.
Affected
up to 51.1.85
What to do
Affects up to 51.1.85. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 30, 2026Editor PHP Object Injection in Ultimate Addons for Contact Form 7 <= 3.5.51 versions.CVE-2026-96833 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Editor PHP Object Injection in Ultimate Addons for Contact Form 7 <= 3.5.51 versions.
Affected
up to 3.5.51
What to do
Affects up to 3.5.51. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 30, 2026Contributor PHP Object Injection in Themify Builder <= 7.8.1 versions.CVE-2026-96831 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Contributor PHP Object Injection in Themify Builder <= 7.8.1 versions.
Affected
up to 7.8.1
What to do
Affects up to 7.8.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 30, 2026Contributor Cross Site Scripting (XSS) in The Plus Addons for Elementor Page Builder Lite <= 6.5.1 versions.CVE-2026-96829 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Cross Site Scripting (XSS) in The Plus Addons for Elementor Page Builder Lite <= 6.5.1 versions.
Affected
up to 6.5.1
What to do
Affects up to 6.5.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 30, 2026Administrator SQL Injection in Category Discount Woocommerce <= 5.18 versions.CVE-2026-96828 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Administrator SQL Injection in Category Discount Woocommerce <= 5.18 versions.
Affected
up to 5.18
What to do
Affects up to 5.18. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 30, 2026Administrator SQL Injection in Admin Notices Manager <= 1.6.0 versions.CVE-2026-96827 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Administrator SQL Injection in Admin Notices Manager <= 1.6.0 versions.
Affected
up to 1.6.0
What to do
Affects up to 1.6.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 30, 2026Editor Arbitrary File Deletion in Template Kit – Import <= 1.0.16 versions.CVE-2026-96824 · WordPress plugins & themes · reported by PatchstackMedium 6.8
Editor Arbitrary File Deletion in Template Kit – Import <= 1.0.16 versions.
Affected
up to 1.0.16
What to do
Affects up to 1.0.16. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 30, 2026Contributor Cross Site Scripting (XSS) in pixfort Core < 4.3.3 versions.CVE-2026-96450 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Contributor Cross Site Scripting (XSS) in pixfort Core < 4.3.3 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Sep 30, 2026Administrator SQL Injection in Estatik <= 4.3.5 versions.CVE-2026-96345 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Administrator SQL Injection in Estatik <= 4.3.5 versions.
Affected
up to 4.3.5
What to do
Affects up to 4.3.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 30, 2026Unauthenticated Broken Access Control in Hostinger Migrator <= 1.0 versions.CVE-2026-95587 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in Hostinger Migrator <= 1.0 versions.
Affected
up to 1.0
What to do
Affects up to 1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 30, 2026Contributor PHP Object Injection in DesignSetGo <= 2.8.0 versions.CVE-2026-94683 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Contributor PHP Object Injection in DesignSetGo <= 2.8.0 versions.
Affected
up to 2.8.0
What to do
Affects up to 2.8.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 30, 2026Unauthenticated Denial of Service Attack in WP Store Locator < 3.0.0 versions.CVE-2026-94681 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Unauthenticated Denial of Service Attack in WP Store Locator < 3.0.0 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Sep 30, 2026Contributor PHP Object Injection in Go Live Update Urls <= 7.0.8 versions.CVE-2026-94678 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Contributor PHP Object Injection in Go Live Update Urls <= 7.0.8 versions.
Affected
up to 7.0.8
What to do
Affects up to 7.0.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 30, 2026Contributor Cross Site Scripting (XSS) in Pixel Manager for WooCommerce <= 1.69.0 versions.CVE-2026-94674 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Cross Site Scripting (XSS) in Pixel Manager for WooCommerce <= 1.69.0 versions.
Affected
up to 1.69.0
What to do
Affects up to 1.69.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 30, 2026Contributor Insecure Direct Object References (IDOR) in Safe SVG <= 2.5.0 versions.CVE-2026-94672 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Contributor Insecure Direct Object References (IDOR) in Safe SVG <= 2.5.0 versions.
Affected
up to 2.5.0
What to do
Affects up to 2.5.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 30, 2026Contributor Insecure Direct Object References (IDOR) in Business Directory <= 6.4.27 versions.CVE-2026-94173 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Contributor Insecure Direct Object References (IDOR) in Business Directory <= 6.4.27 versions.
Affected
up to 6.4.27
What to do
Affects up to 6.4.27. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 30, 2026Editor PHP Object Injection in Responsive Slider Gallery <= 1.5.5 versions.CVE-2026-94122 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Editor PHP Object Injection in Responsive Slider Gallery <= 1.5.5 versions.
Affected
up to 1.5.5
What to do
Affects up to 1.5.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 30, 2026Contributor PHP Object Injection in 10Web Booster – Website speed optimization, Cache & Page Speed optimizer <= 2.33.6 versions.CVE-2026-94121 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Contributor PHP Object Injection in 10Web Booster – Website speed optimization, Cache & Page Speed optimizer <= 2.33.6 versions.
Affected
up to 2.33.6
What to do
Affects up to 2.33.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 30, 2026Contributor SQL Injection in Easy Pricing Tables <= 4.1.2 versions.CVE-2026-94115 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Contributor SQL Injection in Easy Pricing Tables <= 4.1.2 versions.
Affected
up to 4.1.2
What to do
Affects up to 4.1.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 30, 2026Contributor Cross Site Scripting (XSS) in Safe SVG <= 2.5.0 versions.CVE-2026-94077 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Cross Site Scripting (XSS) in Safe SVG <= 2.5.0 versions.
Affected
up to 2.5.0
What to do
Affects up to 2.5.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 30, 2026Contributor PHP Object Injection in SEO Plugin by Squirrly SEO <= 14.2.5 versions.CVE-2026-94076 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Contributor PHP Object Injection in SEO Plugin by Squirrly SEO <= 14.2.5 versions.
Affected
up to 14.2.5
What to do
Affects up to 14.2.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 30, 2026Administrator SQL Injection in WP Activity Log <= 5.6.6 versions.CVE-2026-62085 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Administrator SQL Injection in WP Activity Log <= 5.6.6 versions.
Affected
up to 5.6.6
What to do
Affects up to 5.6.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 30, 2026Subscriber Other Vulnerability Type in Creator LMS <= 1.2.19 versions.CVE-2026-62083 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Subscriber Other Vulnerability Type in Creator LMS <= 1.2.19 versions.
Affected
up to 1.2.19
What to do
Affects up to 1.2.19. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 30, 2026Contributor Insecure Direct Object References (IDOR) in Flexible PDF Coupons <= 1.14.11 versions.CVE-2026-62081 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Contributor Insecure Direct Object References (IDOR) in Flexible PDF Coupons <= 1.14.11 versions.
Affected
up to 1.14.11
What to do
Affects up to 1.14.11. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 30, 2026Contributor Cross Site Scripting (XSS) in Happy Addons for Elementor <= 3.23.1 versions.CVE-2026-62080 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Cross Site Scripting (XSS) in Happy Addons for Elementor <= 3.23.1 versions.
Affected
up to 3.23.1
What to do
Affects up to 3.23.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 30, 2026Contributor Cross Site Scripting (XSS) in Qi Addons For Elementor <= 1.11 versions.CVE-2026-62079 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Cross Site Scripting (XSS) in Qi Addons For Elementor <= 1.11 versions.
Affected
up to 1.11
What to do
Affects up to 1.11. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 30, 2026Contributor Cross Site Scripting (XSS) in Premium Addons for Elementor <= 4.11.105 versions.CVE-2026-62078 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Cross Site Scripting (XSS) in Premium Addons for Elementor <= 4.11.105 versions.
Affected
up to 4.11.105
What to do
Affects up to 4.11.105. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 30, 2026Contributor Cross Site Scripting (XSS) in CF7 Views – Complete Entry Management for Contact Form 7 <= 3.2.5 versions.CVE-2026-100513 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Cross Site Scripting (XSS) in CF7 Views – Complete Entry Management for Contact Form 7 <= 3.2.5 versions.
Affected
up to 3.2.5
What to do
Affects up to 3.2.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 30, 2026Unauthenticated Denial of Service Attack in Two Factor <= 0.16.0 versions.CVE-2026-100508 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Denial of Service Attack in Two Factor <= 0.16.0 versions.
Affected
up to 0.16.0
What to do
Affects up to 0.16.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 30, 2026Post Views Stats Counter: Stored Cross-Site ScriptingCVE-2026-97347 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Post Views Stats Counter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via User-Agent Header in all versions up to, and including, 1.1.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The plugin's only input filter is a substring blacklist for known bot signatures (e.g. 'bot', 'spider', 'crawler'), which can be trivially bypassed by crafting a User-Agent payload that omits those strings.
Product
Post Views Stats Counter
Affected
up to 1.1.7
What to do
Affects up to 1.1.7. Update Post Views Stats Counter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 30, 2026Real Estate Manager – Property Listing and Agent Management: Stored Cross-Site ScriptingCVE-2026-93908 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Real Estate Manager – Property Listing and Agent Management plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'before_price_text' parameter in all versions up to, and including, 7.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerability is further enabled by the absence of any capability, nonce, or ownership check on the wp_ajax_rem_create_pro_ajax handler, and because the value is persisted via update_post_meta rather than post_content, the wp_kses filtering tied to the unfiltered_html capability does not apply.
Product
Real Estate Manager – Property Listing and Agent Management
Affected
up to 7.3
What to do
Affects up to 7.3. Update Real Estate Manager – Property Listing and Agent Management to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Sep 30, 2026ReactPress – Create React App for: Stored Cross-Site ScriptingCVE-2026-92712 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The ReactPress – Create React App for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'permalink' parameter in all versions up to, and including, 3.4.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is possible because the permalink parameter is only passed through sanitize_url(), which does not prevent fetching attacker-controlled remote URLs whose response body — including script tags and event-handler attributes — is written verbatim to disk via file_put_contents().
Product
ReactPress – Create React App for
Affected
up to 3.4.0
What to do
Affects up to 3.4.0. Update ReactPress – Create React App for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.