Updated 55 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

585new WordPress flaws this week

391,310entries in the database

11,567 results · page 13 of 232

Sep 23, 2026Points and Rewards for WooCommerce: Does not validate the claimed reward amount or restrict who can call its Win Wheel claim handlerCVE-2026-93510 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Points and Rewards for WooCommerce WordPress plugin before 2.10.4 does not validate the claimed reward amount or restrict who can call its Win Wheel claim handler, allowing authenticated users, Subscriber and above, to credit their own account with an arbitrary and unlimited amount of loyalty points and, where a companion wallet Points and Rewards for WooCommerce WordPress plugin before 2.10.4 is active, wallet balance.
Product
Points and Rewards for WooCommerce
Fixed in
2.10.4
What to do
Update Points and Rewards for WooCommerce to 2.10.4 or newer.
Full record and what to do →NVD record wpscan.com
Sep 23, 2026Product Badge, Label, Countdown Timer for WooCommerce: Does not check whether a product is published before returning its details to unauthenticated usersCVE-2026-88929 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Product Badge, Label, Countdown Timer for WooCommerce WordPress plugin before 7.5.2 does not check whether a product is published before returning its details to unauthenticated users, allowing them to read the title, description and price of draft, pending and private products.
Product
Product Badge, Label, Countdown Timer for WooCommerce
Fixed in
7.5.2
What to do
Update Product Badge, Label, Countdown Timer for WooCommerce to 7.5.2 or newer.
Full record and what to do →NVD record wpscan.com
Sep 23, 2026divi-dash: Does not validate the source of the client IP address it uses for rate limiting and banningCVE-2026-14321 · WordPress plugins & themes · reported by WPScanHigh 8.2
The divi-dash WordPress plugin before 1.0.7 does not validate the source of the client IP address it uses for rate limiting and banning, allowing unauthenticated attackers to spoof arbitrary IP addresses in order to bypass rate limiting, ban chosen addresses from the feature, and grow a stored option without bound, resulting in denial of service.
Product
divi-dash
Fixed in
1.0.7
What to do
Update divi-dash to 1.0.7 or newer.
Full record and what to do →NVD record wpscan.com
Sep 22, 2026HashBar – WordPress Notification Bar: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-94117 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in DevItems HashBar – WordPress Notification Bar allows Blind SQL Injection. This issue affects HashBar – WordPress Notification Bar: from n/a through 2.0.3.
Product
HashBar – WordPress Notification Bar
Affected
up to 2.0.3
What to do
Affects up to 2.0.3. Update HashBar – WordPress Notification Bar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2026The WP Ultimate Review: Arbitrary shortcode executionCVE-2026-92235 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The The WP Ultimate Review plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.4.2. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for authenticated attackers, with subscriber-level access and above, to execute arbitrary shortcodes.
Product
The WP Ultimate Review
Affected
up to 2.4.2
What to do
Affects up to 2.4.2. Update The WP Ultimate Review to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 22, 2026Image Buzz: Unauthorized API key modificationCVE-2025-14484 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Image Buzz plugin for WordPress is vulnerable to unauthorized API key modification due to missing authorization checks in all versions up to, and including, 1.0.3. This makes it possible for unauthenticated attackers to modify arbitrary API keys (Pixabay, Unsplash, Pixels) configured by site administrators via the 'pixabay_api', 'unsplash_api', or 'pixels_api' parameters.
Product
Image Buzz
Affected
up to 1.0.3
What to do
Affects up to 1.0.3. Update Image Buzz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codecanyon.net wordfence.com
Sep 21, 2026To Do List Member: Does not have authorisation or nonce checks in an import routineCVE-2026-86802 · WordPress plugins & themes · reported by WPScanLow 3.7
The To Do List Member WordPress plugin through 1.6 does not have authorisation or nonce checks in an import routine, and does not validate the location it fetches the imported data from, allowing unauthenticated users to create arbitrary published posts and taxonomy terms on the site.
Product
To Do List Member
Affected
up to 1.6
What to do
Affects up to 1.6. Update To Do List Member to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Sep 21, 2026GiveWP: Does not remove shortcode delimiters from donor-supplied values before rendering them on public pagesCVE-2026-85113 · WordPress plugins & themes · reported by WPScanMedium 6.5
The GiveWP WordPress plugin before 4.16.9 does not remove shortcode delimiters from donor-supplied values before rendering them on public pages, and the shortcode stripping it applies can be defeated by nesting, allowing unauthenticated users to execute arbitrary shortcodes registered on the site.
Product
GiveWP
Fixed in
4.16.9
What to do
Update GiveWP to 4.16.9 or newer.
Full record and what to do →NVD record wpscan.com
Sep 20, 2026Import and export users and customers: Does not enforce the promote_users capability in its front-end import functionalityCVE-2026-92541 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Import and export users and customers WordPress plugin before 2.5.2 does not enforce the promote_users capability in its front-end import functionality, allowing users with only the create_users capability to change the role of existing users, including promoting them to administrator.
Product
Import and export users and customers
Fixed in
2.5.2
What to do
Update Import and export users and customers to 2.5.2 or newer.
Full record and what to do →NVD record wpscan.com
Sep 20, 2026Import and export users and customers: Does not correctly enforce the promote_users capabilityCVE-2026-92540 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Import and export users and customers WordPress plugin before 2.5.2 does not correctly enforce the promote_users capability when assigning roles during a CSV import, allowing users with only the create_users capability to create new administrator accounts or promote existing users to administrator.
Product
Import and export users and customers
Fixed in
2.5.2
What to do
Update Import and export users and customers to 2.5.2 or newer.
Full record and what to do →NVD record wpscan.com
Sep 20, 2026Unlimited Elements For Elementor: Does not perform a capability check on an AJAX action and deserializes attacker-controlled stored data through itCVE-2026-85017 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Unlimited Elements For Elementor WordPress plugin before 2.0.20 does not perform a capability check on an AJAX action and deserializes attacker-controlled stored data through it, which makes it possible for authenticated attackers with subscriber-level access to inject arbitrary PHP objects. A partial fix in the 2.0.18 to 2.0.19 releases raised the privilege required to reach the vulnerable action to editor-level, and the issue was fully resolved in 2.0.20.
Product
Unlimited Elements For Elementor
Fixed in
2.0.20
What to do
Update Unlimited Elements For Elementor to 2.0.20 or newer.
Full record and what to do →NVD record wpscan.com
Sep 20, 2026Photo Gallery, Sliders, Proofing and: Does not check that a user holds its options capability before saving image sizing settingsCVE-2026-81654 · WordPress plugins & themes · reported by WPScanLow 3.1
The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not check that a user holds its options capability before saving image sizing settings, allowing users granted only its gallery-management capability by an administrator to change settings that apply across the whole site.
Product
Photo Gallery, Sliders, Proofing and
Fixed in
4.5.0
What to do
Update Photo Gallery, Sliders, Proofing and to 4.5.0 or newer.
Full record and what to do →NVD record wpscan.com
Sep 20, 2026Photo Gallery, Sliders, Proofing and: Does not verify that the user acting on an image owns the gallery it belongs toCVE-2026-81653 · WordPress plugins & themes · reported by WPScanMedium 4.2
The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not verify that the user acting on an image owns the gallery it belongs to, allowing users granted its gallery-management capability by an administrator to delete, copy and re-tag any image on the site, including images in galleries belonging to other users.
Product
Photo Gallery, Sliders, Proofing and
Fixed in
4.5.0
What to do
Update Photo Gallery, Sliders, Proofing and to 4.5.0 or newer.
Full record and what to do →NVD record wpscan.com
Sep 20, 2026Photo Gallery, Sliders, Proofing and: Does not verify that the requesting user is entitled to a given image record before returning itCVE-2026-81652 · WordPress plugins & themes · reported by WPScanLow 2.7
The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not verify that the requesting user is entitled to a given image record before returning it, allowing users with the Contributor role and above to read the stored metadata of any image on the site, including images in galleries belonging to other users. The disclosed data includes the image's stored EXIF subset, covering camera make and model and capture timestamp, along with internal checksums and identifiers that the Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0's own capability-gated read path reserves to administrators.
Product
Photo Gallery, Sliders, Proofing and
Fixed in
4.5.0
What to do
Update Photo Gallery, Sliders, Proofing and to 4.5.0 or newer.
Full record and what to do →NVD record wpscan.com
Sep 20, 2026Import and export users and customers: Does not validate a user-supplied URL before requesting it server-side during a CSV importCVE-2026-16542 · WordPress plugins & themes · reported by WPScanMedium 4.1
The Import and export users and customers WordPress plugin before 2.4.5 does not validate a user-supplied URL before requesting it server-side during a CSV import, allowing high-privileged users to perform Server-Side Request Forgery attacks.
Product
Import and export users and customers
Fixed in
2.4.5
What to do
Update Import and export users and customers to 2.4.5 or newer.
Full record and what to do →NVD record wpscan.com
Sep 19, 2026Payment Gateway of Stripe for WooCommerce: Improper Verification of Cryptographic SignatureCVE-2026-9832 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Payment Gateway of Stripe for WooCommerce plugin for WordPress is vulnerable to Improper Verification of Cryptographic Signature in all versions up to, and including, 5.0.8. This is due to the publicly accessible `woocommerce_api_wt_stripe` webhook endpoint (`EH_Stripe_Webhook_Handler::handle()`) wrapping the only call to `\Stripe\Webhook::constructEvent()` inside an `if (!empty($endpoint_secret))` guard that is never entered on default installations — because the `eh_stripe_webhook_secret` option is empty after a fresh plugin install — causing the raw, attacker-controlled POST body to be decoded and processed as a fully trusted Stripe event without any signature verification, authentication, or authorization. This makes it possible for unauthenticated attackers to send forged Stripe webhook events to manipulate WooCommerce order statuses, including marking unpaid orders as paid or completed via `payment_complete()`, forcing legitimate orders into a failed state, fabricating dispute notifications, and injecting forged refund events. This vulnerability is only exploitable when the Stripe webhook signing secret has not been configured by an administrator; once a valid signing sec
Product
Payment Gateway of Stripe for WooCommerce
Affected
up to 5.0.8
What to do
Affects up to 5.0.8. Update Payment Gateway of Stripe for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 19, 2026Flex Import: Missing AuthorizationCVE-2026-9615 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Flex Import plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.0. This is due to the license_activate_fleximp() and license_deactivate_fleximp() functions, hooked to the wp_ajax_license_activate_fleximp and wp_ajax_license_deactivate_fleximp AJAX actions, lacking both a capability check (current_user_can()) and nonce verification (the client-side script sends a 'wpnonce' value but the handlers never validate it). This makes it possible for authenticated attackers, with subscriber-level access and above, to activate an arbitrary/fraudulent license key (persisting it via update_option('fleximp_is_premium') and toggling validation, suspension, and bundle status options) or deactivate the site's legitimate license (deleting the stored key and setting fleximp_validation_status to false), thereby disrupting the plugin's premium functionality.
Product
Flex Import
Affected
up to 3.0
What to do
Affects up to 3.0. Update Flex Import to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 19, 2026MC4WP: Mailchimp for: Reflected Cross-Site ScriptingCVE-2026-87917 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The MC4WP: Mailchimp for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'data' Dynamic Content Tag in all versions up to, and including, 4.14.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
MC4WP: Mailchimp for
Affected
up to 4.14.0
What to do
Affects up to 4.14.0. Update MC4WP: Mailchimp for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 19, 2026WP Optimizer: SQL InjectionCVE-2026-6295 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The WP Optimizer plugin for WordPress is vulnerable to SQL Injection via the 's' parameter in all versions up to and including 2.5.0. This is due to an unsafe subquery-detection branch in the Query::parse_key_compare_field() method that, when the user-supplied value matches the regex ^[(\s]*SELECT\s+, wraps the value in parentheses and embeds it directly into the SQL string without any escaping or quoting. While the normal LIKE code path correctly uses esc_sql($wpdb->esc_like(...)) and wraps the value in single quotes, this branch completely bypasses those protections. Because the attack payload (SELECT ...) contains no single quotes, WordPress's wp_magic_quotes() provides no protection. This makes it possible for authenticated attackers with administrator-level access to inject arbitrary SQL subqueries — including time-based blind payloads — that can be used to extract sensitive information from the database.
Product
WP Optimizer
Affected
up to 2.5.0
What to do
Affects up to 2.5.0. Update WP Optimizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 19, 2026Search Atlas SEO – Premier SEO Plugin for One-Click WP Publishing & Integrated AI Optimization: Authorization bypassCVE-2026-15946 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Search Atlas SEO – Premier SEO Plugin for One-Click WP Publishing & Integrated AI Optimization plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6.23. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to overwrite the whitelabel settings password to an attacker-controlled value, enabling them to unlock whitelabel-protected admin settings tabs including whitelabel, general, and advanced configuration.
Product
Search Atlas SEO – Premier SEO Plugin for One-Click WP Publishing & Integrated AI Optimization
Affected
up to 2.6.23
What to do
Affects up to 2.6.23. Update Search Atlas SEO – Premier SEO Plugin for One-Click WP Publishing & Integrated AI Optimization to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 19, 2026Mailchimp for WooCommerce: Does not verify that the requesting user holds the required capability in the permission callback for several of its REST API routesCVE-2026-92435 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Mailchimp for WooCommerce WordPress plugin before 6.1.1 does not verify that the requesting user holds the required capability in the permission callback for several of its REST API routes, allowing unauthenticated users to reach administrator-oriented endpoints and trigger a persistent state change.
Product
Mailchimp for WooCommerce
Fixed in
6.1.1
What to do
Update Mailchimp for WooCommerce to 6.1.1 or newer.
Full record and what to do →NVD record wpscan.com
Sep 19, 2026Ultimate Member: Does not escape a value derived from user supplied profile names before outputting it in the page titleCVE-2026-85680 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Ultimate Member WordPress plugin before 2.13.1 does not escape a value derived from user supplied profile names before outputting it in the page title, and decodes HTML entities in it after its own sanitisation has already run, allowing unauthenticated attackers who register an account to store JavaScript that will execute when any visitor, including an administrator, views their profile.
Product
Ultimate Member
Fixed in
2.13.1
What to do
Update Ultimate Member to 2.13.1 or newer.
Full record and what to do →NVD record wpscan.com
Sep 19, 2026WP Import Export Lite: Does not verify that the user running an import is permitted to create or modify user accounts and assign rolesCVE-2026-76554 · WordPress plugins & themes · reported by WPScanHigh 7.2
The WP Import Export Lite WordPress plugin before 3.9.35 does not verify that the user running an import is permitted to create or modify user accounts and assign roles, allowing users granted a delegated WP Import Export Lite WordPress plugin before 3.9.35 permission, who cannot otherwise manage users, to create administrator accounts and to overwrite the credentials and role of existing accounts, including administrators.
Product
WP Import Export Lite
Fixed in
3.9.35
What to do
Update WP Import Export Lite to 3.9.35 or newer.
Full record and what to do →NVD record wpscan.com
Sep 19, 2026Nimble Page Builder: Does not perform an authorization checkCVE-2026-16557 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Nimble Page Builder WordPress plugin through 3.3.8 does not perform an authorization check when returning page-builder content through an authenticated AJAX action, allowing any authenticated user (Subscriber+) to disclose the page-builder content of arbitrary non-public (draft, pending, private, scheduled) posts and pages.
Product
Nimble Page Builder
Affected
up to 3.3.8
What to do
Affects up to 3.3.8. Update Nimble Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Sep 18, 2026Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder: Stored Cross-Site ScriptingCVE-2026-87915 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via values[Name] Parameter in all versions up to, and including, 1.24.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The wp_kses sanitization applied on output is insufficient in this context because HTML entities within allowed attribute values survive normalization intact and are later evaluated by the jQuery(link.attr('href')) sink in wp-admin/js/common.js when a contextual help tab anchor is clicked.
Product
Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder
Affected
up to 1.24.0
What to do
Affects up to 1.24.0. Update Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 18, 2026Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder: Stored Cross-Site ScriptingCVE-2026-15797 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via post_title in all versions up to, and including, 1.24.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the attacker to create a post with an HTML entity-encoded payload in the title, which bypasses sanitize_text_field on save and is later decoded and executed by the browser when rendered by the Select2 component.
Product
Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder
Affected
up to 1.24.0
What to do
Affects up to 1.24.0. Update Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 18, 2026Strong Testimonials: Stored Cross-Site ScriptingCVE-2026-92622 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Strong Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'lightbox_class' Shortcode Attribute in all versions up to, and including, 3.3.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that the targeted testimonial view has at least one published testimonial with a featured image and the lightbox wrapper enabled, as the vulnerable code path is only reached when a thumbnail is rendered.
Product
Strong Testimonials
Affected
up to 3.3.8
What to do
Affects up to 3.3.8. Update Strong Testimonials to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 18, 2026Photo Gallery by 10Web – Mobile-Friendly Image Gallery: Time-based SQL InjectionCVE-2026-85652 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to time-based SQL Injection via 'album_id' Shortcode Attribute in all versions up to, and including, 1.8.44 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with author-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. An Author-level user can store a SQL injection payload inside a published post's shortcode attribute, causing the payload to execute when any visitor renders the post; notably, the unsanitized value appears on both sides of a UNION query, potentially doubling the observable time-based delay.
Product
Photo Gallery by 10Web – Mobile-Friendly Image Gallery
Affected
up to 1.8.44
What to do
Affects up to 1.8.44. Update Photo Gallery by 10Web – Mobile-Friendly Image Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 18, 2026NEX-Forms – Ultimate Forms Plugin for: Generic SQL InjectionCVE-2026-75961 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to generic SQL Injection via the 'additional_params' parameter in all versions up to, and including, 9.3.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with custom-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The operator allowlist applied by get_table_records() when building its own WHERE fragment is not enforced on the same tainted additional_params array when it is forwarded to get_total_records(), leaving the SQL sink unprotected.
Product
NEX-Forms – Ultimate Forms Plugin for
Affected
up to 9.3.0
What to do
Affects up to 9.3.0. Update NEX-Forms – Ultimate Forms Plugin for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 18, 2026All Bootstrap Blocks: Does not validate a block attribute before using it to build a filesystem path that is included at render timeCVE-2026-88994 · WordPress plugins & themes · reported by WPScanMedium 6.6
The All Bootstrap Blocks WordPress plugin through 1.3.31 does not validate a block attribute before using it to build a filesystem path that is included at render time, allowing users with contributor-level access and above to include arbitrary local files, disclose their contents, and execute PHP where a local file containing PHP code can be reached. Exploitation requires the plugin's Lightspeed subsystem to be enabled, which is not the default.
Product
All Bootstrap Blocks
Affected
up to 1.3.31
What to do
Affects up to 1.3.31. Update All Bootstrap Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Sep 18, 2026Foxtool All-in-One: Contact chat button, Custom login, Media optimize images: Authorization bypassCVE-2026-18317 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Foxtool All-in-One: Contact chat button, Custom login, Media optimize images plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.5.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to modify arbitrary subkeys of the foxtool_settings option, including enabling site-wide SVG uploads by toggling the media-up3 key, which can facilitate stored cross-site scripting via malicious SVG files.
Product
Foxtool All-in-One: Contact chat button, Custom login, Media optimize images
Affected
up to 2.5.3
What to do
Affects up to 2.5.3. Update Foxtool All-in-One: Contact chat button, Custom login, Media optimize images to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 18, 2026Auto Upload Images: Limited Server-Side Request ForgeryCVE-2026-12106 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Auto Upload Images plugin for WordPress is vulnerable to Limited Server-Side Request Forgery in all versions up to, and including, 3.3.2 via the downloadImage function. This makes it possible for authenticated attackers, with contributor-level access and above, to make web requests to arbitrary locations originating from the web application. The plugin uses wp_remote_get() rather than wp_safe_remote_get(), and the validate() method only rejects URLs whose host matches the site's own hostname, failing to block requests to private, loopback, or link-local addresses (e.g., 127.0.0.1, 10.0.0.0/8, 169.254.169.254). Attackers can trigger this by embedding a crafted <img> tag with a src attribute pointing to internal network hosts in post content and submitting it for processing.
Product
Auto Upload Images
Affected
up to 3.3.2
What to do
Affects up to 3.3.2. Update Auto Upload Images to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 18, 2026WordPress: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-93485 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic WordPress wordpress allows DOM-Based XSS.This issue affects WordPress: from n/a through 7.1.
Product
WordPress
Affected
up to 7.1
What to do
Affects up to 7.1. Update WordPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 18, 2026Generate PDF using Contact Form 7: Does not restrict the destination of the image fetch its PDF renderer performs on submitted form contentCVE-2026-90984 · WordPress plugins & themes · reported by WPScanMedium 5.8
The Generate PDF using Contact Form 7 WordPress plugin before 4.2.2 does not restrict the destination of the image fetch its PDF renderer performs on submitted form content, allowing unauthenticated users to make the server request internal resources and read the response back through the generated PDF.
Product
Generate PDF using Contact Form 7
Fixed in
4.2.2
What to do
Update Generate PDF using Contact Form 7 to 4.2.2 or newer.
Full record and what to do →NVD record wpscan.com
Sep 18, 2026Really Simple Security: Does not validate a client-supplied address value before using itCVE-2026-88798 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Really Simple Security WordPress plugin before 9.8.3 does not validate a client-supplied address value before using it as a storage key in one of its own options, allowing unauthenticated attackers to grow that option without bound and to slow the site's handling of missing pages.
Product
Really Simple Security
Fixed in
9.8.3
What to do
Update Really Simple Security to 9.8.3 or newer.
Full record and what to do →NVD record wpscan.com
Sep 18, 2026King Addons for Elementor: Does not perform per-object authorization checks on a group of image-optimization actionsCVE-2026-84904 · WordPress plugins & themes · reported by WPScanLow 3.8
The King Addons for Elementor WordPress plugin before 51.1.81 does not perform per-object authorization checks on a group of image-optimization actions, gating them only on a coarse capability that lower-privileged users also hold and never confirming ownership of the targeted object, allowing authenticated users with author-level access and above to disclose absolute file paths for, overwrite the bytes of, and site-wide re-reference media belonging to other users, including administrators.
Product
King Addons for Elementor
Fixed in
51.1.81
What to do
Update King Addons for Elementor to 51.1.81 or newer.
Full record and what to do →NVD record wpscan.com
Sep 18, 2026AF Companion: Does not validate the type of files uploaded through one of its import featuresCVE-2026-84738 · WordPress plugins & themes · reported by WPScanCritical 9.1
The AF Companion WordPress plugin before 2.2.0 does not validate the type of files uploaded through one of its import features, allowing users with a low-privileged store-management role to upload arbitrary files, including PHP ones, leading to Remote Code Execution.
Product
AF Companion
Fixed in
2.2.0
What to do
Update AF Companion to 2.2.0 or newer.
Full record and what to do →NVD record wpscan.com
Sep 18, 2026ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF: PHP Object InjectionCVE-2026-17086 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.5.5 via deserialization of untrusted input . This makes it possible for authenticated attackers, with author-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.
Product
ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF
Affected
up to 6.5.5
What to do
Affects up to 6.5.5. Update ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 17, 2026Unauthenticated Cross Site Scripting (XSS) in Visitor Traffic Real Time Statistics Pro <= 11.21 versions.CVE-2026-90986 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Visitor Traffic Real Time Statistics Pro <= 11.21 versions.
Affected
up to 11.21
What to do
Affects up to 11.21. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 17, 2026Contributor Broken Access Control in Simple Membership <= 4.8.2 versions.CVE-2026-74000 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Contributor Broken Access Control in Simple Membership <= 4.8.2 versions.
Affected
up to 4.8.2
What to do
Affects up to 4.8.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 17, 2026Contributor Server Side Request Forgery (SSRF) in Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 2.0.19 versions.CVE-2026-66608 · WordPress plugins & themes · reported by PatchstackMedium 6.4
Contributor Server Side Request Forgery (SSRF) in Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 2.0.19 versions.
Affected
up to 2.0.19
What to do
Affects up to 2.0.19. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 17, 2026EWWW Image Optimizer: Does not properly escape image attribute valuesCVE-2026-91011 · WordPress plugins & themes · reported by WPScanMedium 6.8
The EWWW Image Optimizer WordPress plugin before 8.7.7 does not properly escape image attribute values when it rewrites page output, allowing authenticated users with author-level access and above to inject arbitrary JavaScript that is stored in published content and executes in the browser of any user who later views the affected page.
Product
EWWW Image Optimizer
Fixed in
8.7.7
What to do
Update EWWW Image Optimizer to 8.7.7 or newer.
Full record and what to do →NVD record wpscan.com
Sep 17, 2026Comments Import & Export: Does not restrict its comment export to users able to moderate commentsCVE-2026-87836 · WordPress plugins & themes · reported by WPScanLow 2.7
The Comments Import & Export WordPress plugin before 2.5.4 does not restrict its comment export to users able to moderate comments, nor scope the export to content owned by the requesting user, allowing users with the Author role and above to retrieve every comment on the site, including commenter email addresses, IP addresses, unapproved comment content and comment meta.
Product
Comments Import & Export
Fixed in
2.5.4
What to do
Update Comments Import & Export to 2.5.4 or newer.
Full record and what to do →NVD record wpscan.com
Sep 17, 2026Dewa Kirim: Does not escape delivery coordinates submitted at checkout before outputting them inside an inline scriptCVE-2026-87786 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Dewa Kirim WordPress plugin through 1.0.0 does not escape delivery coordinates submitted at checkout before outputting them inside an inline script, allowing unauthenticated users to store JavaScript that runs in the session of an administrator who later opens the order.
Product
Dewa Kirim
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Dewa Kirim to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Sep 17, 2026Photo Gallery by 10Web – Mobile-Friendly Image Gallery: Stored Cross-Site ScriptingCVE-2026-86311 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Shortcode Attributes in all versions up to, and including, 1.8.44 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Photo Gallery by 10Web – Mobile-Friendly Image Gallery
Affected
up to 1.8.44
What to do
Affects up to 1.8.44. Update Photo Gallery by 10Web – Mobile-Friendly Image Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 16, 2026WP Mega Menu: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-92465 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeum WP Mega Menu allows Blind SQL Injection. This issue affects WP Mega Menu: from n/a through 1.4.2.
Product
WP Mega Menu
Affected
up to 1.4.2
What to do
Affects up to 1.4.2. Update WP Mega Menu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 16, 2026Optimole: Does not properly escape a user supplied value before using it to build an image tag attributeCVE-2026-84829 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Optimole WordPress plugin before 4.2.12 does not properly escape a user supplied value before using it to build an image tag attribute, allowing unauthenticated users to inject arbitrary attributes into pages served to every visitor, which leads to Stored Cross-Site Scripting.
Product
Optimole
Fixed in
4.2.12
What to do
Update Optimole to 4.2.12 or newer.
Full record and what to do →NVD record wpscan.com
Sep 16, 2026WP Import Export Lite: Does not properly validate URLs before requesting them during the import processCVE-2026-76559 · WordPress plugins & themes · reported by WPScanMedium 4.1
The WP Import Export Lite WordPress plugin before 3.9.33 does not properly validate URLs before requesting them during the import process, allowing users with the import capability, which administrators hold by default, to make the site issue requests to internal hosts and services and read their responses. This is an incomplete fix for CVE-2026-11397.
Product
WP Import Export Lite
Fixed in
3.9.33
What to do
Update WP Import Export Lite to 3.9.33 or newer.
Full record and what to do →NVD record wpscan.com
Sep 16, 2026WP Import Export Lite: Does not escape custom field names retrieved from the database before inserting them into the DOM of one of its administration screensCVE-2026-76558 · WordPress plugins & themes · reported by WPScanMedium 6.8
The WP Import Export Lite WordPress plugin before 3.9.33 does not escape custom field names retrieved from the database before inserting them into the DOM of one of its administration screens, allowing users with a role as low as contributor to perform Stored XSS attacks which will trigger in the browser of a high privileged user, such as an administrator, viewing that screen.
Product
WP Import Export Lite
Fixed in
3.9.33
What to do
Update WP Import Export Lite to 3.9.33 or newer.
Full record and what to do →NVD record wpscan.com
Sep 16, 2026WP Import Export Lite: Does not properly sanitise and escape some import configuration values before using them in SQL statementsCVE-2026-76557 · WordPress plugins & themes · reported by WPScanMedium 6.8
The WP Import Export Lite WordPress plugin before 3.9.33 does not properly sanitise and escape some import configuration values before using them in SQL statements, allowing users whose role an administrator has granted the WP Import Export Lite WordPress plugin before 3.9.33's import permission to perform SQL injection attacks.
Product
WP Import Export Lite
Fixed in
3.9.33
What to do
Update WP Import Export Lite to 3.9.33 or newer.
Full record and what to do →NVD record wpscan.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.