Updated 2 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

35added in the last 30 days

585new WordPress flaws this week

391,310entries in the database

11,567 results · page 14 of 232

Sep 16, 2026WP Import Export Lite: Does not properly sanitise and escape some export filter values before using them in SQL statementsCVE-2026-76556 · WordPress plugins & themes · reported by WPScanMedium 6.8
The WP Import Export Lite WordPress plugin before 3.9.33 does not properly sanitise and escape some export filter values before using them in SQL statements, allowing users holding its export permission, which administrators have by default and may also grant to lower roles, to perform SQL injection attacks.
Product
WP Import Export Lite
Fixed in
3.9.33
What to do
Update WP Import Export Lite to 3.9.33 or newer.
Full record and what to do →NVD record wpscan.com
Sep 16, 2026WP Import Export Lite: Does not validate a user-supplied file path before reading it and copying it into a publicly accessible directoryCVE-2026-76555 · WordPress plugins & themes · reported by WPScanMedium 6.8
The WP Import Export Lite WordPress plugin before 3.9.33 does not validate a user-supplied file path before reading it and copying it into a publicly accessible directory, allowing any user whose role an administrator has granted the WP Import Export Lite WordPress plugin before 3.9.33's import permission to disclose sensitive files from the server, including files located outside the web root. The same code path also relaxes the file-system permissions of any path it is given, whether or not the copy succeeds.
Product
WP Import Export Lite
Fixed in
3.9.33
What to do
Update WP Import Export Lite to 3.9.33 or newer.
Full record and what to do →NVD record wpscan.com
Sep 16, 2026WP Import Export Lite: Does not validate a path taken from storedCVE-2026-76553 · WordPress plugins & themes · reported by WPScanMedium 6.5
The WP Import Export Lite WordPress plugin before 3.9.33 does not validate a path taken from stored, user-supplied data before recursively deleting the directory it resolves to, allowing users to whom an administrator has delegated a WP Import Export Lite WordPress plugin before 3.9.33 capability to delete arbitrary directories, and every file within them, including outside the web root.
Product
WP Import Export Lite
Fixed in
3.9.33
What to do
Update WP Import Export Lite to 3.9.33 or newer.
Full record and what to do →NVD record wpscan.com
Sep 16, 2026WP Import Export Lite: Does not validate the typeCVE-2026-76552 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WP Import Export Lite WordPress plugin before 3.9.33 does not validate the type, extension or content of files it retrieves from a user-supplied URL during import, allowing users granted its import permission to store arbitrary files, including executable ones, on the server and achieve remote code execution.
Product
WP Import Export Lite
Fixed in
3.9.33
What to do
Update WP Import Export Lite to 3.9.33 or newer.
Full record and what to do →NVD record wpscan.com
Sep 16, 2026WP Import Export Lite: Does not restrictCVE-2026-76551 · WordPress plugins & themes · reported by WPScanHigh 7.2
The WP Import Export Lite WordPress plugin before 3.9.33 does not restrict which PHP function may be applied to exported field values, allowing users granted its export permission to have arbitrary functions invoked on values they control, leading to remote code execution.
Product
WP Import Export Lite
Fixed in
3.9.33
What to do
Update WP Import Export Lite to 3.9.33 or newer.
Full record and what to do →NVD record wpscan.com
Sep 16, 2026WP Import Export Lite: Does not validate a user-supplied output pathCVE-2026-76550 · WordPress plugins & themes · reported by WPScanHigh 7.2
The WP Import Export Lite WordPress plugin before 3.9.34 does not validate a user-supplied output path when writing export files, allowing users granted its export permission to write files with arbitrary names to arbitrary locations on the server, leading to remote code execution.
Product
WP Import Export Lite
Fixed in
3.9.34
What to do
Update WP Import Export Lite to 3.9.34 or newer.
Full record and what to do →NVD record wpscan.com
Sep 15, 20263D FlipBook – PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery: Sensitive Information ExposureCVE-2026-15758 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The 3D FlipBook – PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.16.20 via the 'id' parameter. This makes it possible for unauthenticated attackers to extract sensitive data including the full metadata payload of password-protected flipbooks — including title, outline, props, and the serialized data blob containing the underlying PDF file's direct URL — bypassing WordPress post-password confidentiality. Flipbook post IDs can be pre-enumerated via the also-unauthenticated fb3d_send_posts AJAX action, requiring no prior knowledge to target specific flipbooks.
Product
3D FlipBook – PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery
Affected
up to 1.16.20
What to do
Affects up to 1.16.20. Update 3D FlipBook – PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 14, 2026Really Simple Security: Missing authorization checkCVE-2026-82519 · WordPress plugins & themes · reported by VulnCheckLow 2.3
Really Simple Security plugin for WordPress before 9.8.2 contains a missing authorization check vulnerability that allows authenticated low-privileged attackers to bypass enforced two-factor authentication indefinitely by exploiting an unguarded code path in the profile-page update handler. Attackers can submit a crafted POST request without the two-factor-authentication field to skip nonce verification and trigger delete_two_fa_meta(), which resets the grace period anchor timestamp on every login cycle, causing mandatory 2FA enforcement to be deferred indefinitely.
Product
Really Simple Security
Fixed in
9.8.2
What to do
Update Really Simple Security to 9.8.2 or newer.
Full record and what to do →NVD record wordpress.org vulncheck.com
Sep 13, 2026The Hoo Companion WordPress plugin 1.0.2 does not have any authorisation or validation checks in one of its import features, and does not sanitise the data submCVE-2026-85129 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Hoo Companion WordPress plugin 1.0.2 does not have any authorisation or validation checks in one of its import features, and does not sanitise the data submitted to it before storing it as the active theme's settings, allowing unauthenticated attackers to inject arbitrary web scripts which will execute for anyone viewing the site, including administrators. The same request destroys the site's existing theme settings.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record wpscan.com
Sep 13, 2026Really Simple Security: Does not prevent an unauthenticated request from resetting an account's completed email two-factor enrolmentCVE-2026-89080 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Really Simple Security WordPress plugin before 9.8.1 does not prevent an unauthenticated request from resetting an account's completed email two-factor enrolment, allowing an attacker who already knows the account's password to bypass the second factor and obtain that user's session, up to administrator.
Product
Really Simple Security
Fixed in
9.8.1
What to do
Update Really Simple Security to 9.8.1 or newer.
Full record and what to do →NVD record wpscan.com
Sep 13, 2026Simple Membership: Does not validate that the membership level supplied in a PayPal payment notification matches the level configured for the paid payment buttonCVE-2026-88764 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Simple Membership WordPress plugin before 4.7.8 does not validate that the membership level supplied in a PayPal payment notification matches the level configured for the paid payment button, allowing members to pay for a lower-priced membership while being granted a higher, more privileged membership level.
Product
Simple Membership
Fixed in
4.7.8
What to do
Update Simple Membership to 4.7.8 or newer.
Full record and what to do →NVD record wpscan.com
Sep 12, 2026rtMedia for WordPress, BuddyPress and bbPress: Time-based blind SQL InjectionCVE-2026-16482 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The rtMedia for WordPress, BuddyPress and bbPress plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'compare' parameter in all versions up to, and including, 4.7.11 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This is exploitable on any public page containing an rtMedia shortcode (e.g., [rtmedia_gallery]) when the rtmedia_shortcode GET parameter is set, because RTMediaQuery::query() merges $_REQUEST into the internal query while only validating top-level array keys, allowing the nested 'compare' subvalue to reach the vulnerable sink without authentication.
Product
rtMedia for WordPress, BuddyPress and bbPress
Affected
up to 4.7.11
What to do
Affects up to 4.7.11. Update rtMedia for WordPress, BuddyPress and bbPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 12, 2026WP images upload on piclect: Does not validate the name or type of uploaded files before writing them to a publicly accessible directoryCVE-2026-84171 · WordPress plugins & themes · reported by WPScanCritical 9.8
The WP images upload on piclect WordPress plugin through 1.0 does not validate the name or type of uploaded files before writing them to a publicly accessible directory, allowing unauthenticated attackers to upload arbitrary files and execute arbitrary code on the server.
Product
WP images upload on piclect
Affected
up to 1.0
What to do
Affects up to 1.0. Update WP images upload on piclect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Sep 12, 2026Export & Import WPBakery Page Builder: Does not perform any CSRF check on its template-import feature and does not sanitise the imported data before storing it and echoing it backCVE-2026-81429 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Export & Import WPBakery Page Builder WordPress plugin through 1.0.2 does not perform any CSRF check on its template-import feature and does not sanitise the imported data before storing it and echoing it back, allowing attackers to make a logged-in administrator import a crafted template via a forged request that results in Stored Cross-Site Scripting executed in the administrator's session.
Product
Export & Import WPBakery Page Builder
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update Export & Import WPBakery Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Sep 11, 2026Contributor Insecure Direct Object References (IDOR) in Slim SEO <= 4.10.0 versions.CVE-2026-62113 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Contributor Insecure Direct Object References (IDOR) in Slim SEO <= 4.10.0 versions.
Affected
up to 4.10.0
What to do
Affects up to 4.10.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 11, 2026Contributor Cross Site Scripting (XSS) in Simple Payment <= 2.5.4 versions.CVE-2026-62111 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Cross Site Scripting (XSS) in Simple Payment <= 2.5.4 versions.
Affected
up to 2.5.4
What to do
Affects up to 2.5.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 11, 2026The Simple CAPTCHA with Cloudflare Turnstile WordPress plugin from 1.2.2 before 1.42.3 runs the shortcode parser over the whole rendered Contact Form 7 form, inCVE-2026-85116 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Simple CAPTCHA with Cloudflare Turnstile WordPress plugin from 1.2.2 before 1.42.3 runs the shortcode parser over the whole rendered Contact Form 7 form, including the values a visitor submitted, allowing unauthenticated users to execute arbitrary shortcodes registered on the site.
Fixed in
1.42.3
What to do
Update the plugin to 1.42.3 or newer.
Full record and what to do →NVD record wpscan.com
Sep 11, 2026Featured Image with URL: Does not sanitise and escape a stored image attribute value before outputting itCVE-2026-86780 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Featured Image with URL WordPress plugin before 1.0.6 does not sanitise and escape a stored image attribute value before outputting it, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks that execute in the browser of any user viewing the affected post, including higher-privileged users such as Editors and Administrators.
Product
Featured Image with URL
Fixed in
1.0.6
What to do
Update Featured Image with URL to 1.0.6 or newer.
Full record and what to do →NVD record wpscan.com
Sep 11, 2026Simple Ajax Chat – Add a Fast, Secure Chat Box: Stored Cross-Site ScriptingCVE-2026-81825 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Simple Ajax Chat – Add a Fast, Secure Chat Box plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Chat Message in all versions up to, and including, <= 20260811 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The nonce protecting chat message submission is publicly visible on the chat page, rendering it ineffective as an authentication barrier and allowing fully unauthenticated attackers to submit malicious messages that are stored persistently and rendered to all visitors on every page load.
Product
Simple Ajax Chat – Add a Fast, Secure Chat Box
Affected
up to 20260811
What to do
Affects up to 20260811. Update Simple Ajax Chat – Add a Fast, Secure Chat Box to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 11, 2026Bold Timeline Lite: Stored Cross-Site ScriptingCVE-2026-7438 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Bold Timeline Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `supertitle` and `subtitle` attributes of the `bold_timeline_item` shortcode in all versions up to, and including, 1.2.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Bold Timeline Lite
Affected
up to 1.2.8
What to do
Affects up to 1.2.8. Update Bold Timeline Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 11, 2026Unlimited Elements For Elementor: Reflected Cross-Site ScriptingCVE-2026-77150 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Unlimited Elements For Elementor plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'data[name]' Parameter in all versions up to, and including, 2.0.16 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. The show_preview AJAX action is registered for unauthenticated users and is gated only by a nonce, which an unauthenticated attacker can retrieve by loading any publicly accessible page that emits it.
Product
Unlimited Elements For Elementor
Affected
up to 2.0.16
What to do
Affects up to 2.0.16. Update Unlimited Elements For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 11, 2026Unlimited Elements For Elementor: SQL InjectionCVE-2026-18561 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Unlimited Elements For Elementor plugin for WordPress is vulnerable to SQL Injection via the 'addontype' parameter in versions up to, and including, 2.0.16. This is due to insufficient escaping on the user-supplied parameter and the lack of sufficient preparation on the existing SQL query in the getWhereString() function; when the parameter is supplied as an array, element zero is used verbatim as the SQL comparison operator and concatenated into the WHERE clause without sanitization, while normalizeAjaxInputData() strips WordPress's magic_quotes protection from the value. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Unlimited Elements For Elementor
Affected
up to 2.0.16
What to do
Affects up to 2.0.16. Update Unlimited Elements For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 10, 2026AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for: Directory TraversalCVE-2026-77807 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 11.0.4 via the `user[name]` Parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. Exploitation requires "Embed images" option in AcyMailing configuration being enabled.
Product
AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for
Affected
up to 11.0.4
What to do
Affects up to 11.0.4. Update AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 10, 2026import_contacts Path Traversal in Groundhogg <= 4.7.1 versions.CVE-2026-85310 · WordPress plugins & themes · reported by PatchstackMedium 6.5
import_contacts Path Traversal in Groundhogg <= 4.7.1 versions.
Affected
up to 4.7.1
What to do
Affects up to 4.7.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 10, 2026Advanced Product Fields Extended for WooCommerce: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2026-81789 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Studio Wombat Advanced Product Fields Extended for WooCommerce allows Path Traversal. This issue affects Advanced Product Fields Extended for WooCommerce: from n/a through 3.1.6.
Product
Advanced Product Fields Extended for WooCommerce
Affected
up to 3.1.6
What to do
Affects up to 3.1.6. Update Advanced Product Fields Extended for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 10, 2026Subscriber Broken Access Control in IMPress for IDX Broker <= 3.3.0 versions.CVE-2026-81788 · WordPress plugins & themes · reported by PatchstackMedium 6.3
Subscriber Broken Access Control in IMPress for IDX Broker <= 3.3.0 versions.
Affected
up to 3.3.0
What to do
Affects up to 3.3.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 10, 2026Unauthenticated Broken Authentication in IMPress for IDX Broker <= 3.3.0 versions.CVE-2026-81787 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Broken Authentication in IMPress for IDX Broker <= 3.3.0 versions.
Affected
up to 3.3.0
What to do
Affects up to 3.3.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 10, 2026Unauthenticated Bypass Vulnerability in Simple Cloudflare Turnstile <= 1.42.1 versions.CVE-2026-66674 · WordPress plugins & themes · reported by PatchstackMedium 5.6
Unauthenticated Bypass Vulnerability in Simple Cloudflare Turnstile <= 1.42.1 versions.
Affected
up to 1.42.1
What to do
Affects up to 1.42.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 10, 2026Unauthenticated Content Injection in Simple Cloudflare Turnstile <= 1.42.1 versions.CVE-2026-66632 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Content Injection in Simple Cloudflare Turnstile <= 1.42.1 versions.
Affected
up to 1.42.1
What to do
Affects up to 1.42.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 10, 2026Registration Form for WooCommerce: Does not validate that the form referenced during registration is a legitimate registration formCVE-2026-81431 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Registration Form for WooCommerce WordPress plugin before 1.1.3 does not validate that the form referenced during registration is a legitimate registration form, reading the permitted-role allow-list from an arbitrary attacker-controlled post instead. A user able to create a post (Contributor and above) can therefore register a new account with an arbitrary role, including Administrator, leading to full site takeover. This is an incomplete fix of CVE-2026-54807.
Product
Registration Form for WooCommerce
Fixed in
1.1.3
What to do
Update Registration Form for WooCommerce to 1.1.3 or newer.
Full record and what to do →NVD record wpscan.com
Sep 10, 2026miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA: Does not scope its second-factor attempt limit to the account being attackedCVE-2026-77771 · WordPress plugins & themes · reported by WPScanHigh 7.5
The miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA WordPress plugin before 19.3 does not scope its second-factor attempt limit to the account being attacked, keying it instead to an identifier the client supplies and can change at will, allowing an attacker who already knows a victim's password to make unlimited one-time-passcode guesses and defeat the second factor. A second validation endpoint applies no attempt limit at all.
Product
miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA
Fixed in
6.3.1
What to do
Update miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA to 6.3.1 or newer.
Full record and what to do →NVD record wpscan.com
Sep 10, 2026Ultimate Gift Cards for WooCommerce: Does not have any authorisation checkCVE-2026-19439 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Ultimate Gift Cards for WooCommerce WordPress plugin before 3.2.10 does not have any authorisation check when displaying gift card details, allowing unauthenticated users to retrieve the gift cards attached to arbitrary orders and disclose customer personal data, balances, dates and, in 3.2.9, the live redemption code, which anyone holding it can spend. Versions from 3.0.3 to 3.2.8 disclose the same data without the redemption code.
Product
Ultimate Gift Cards for WooCommerce
Fixed in
3.2.10
What to do
Update Ultimate Gift Cards for WooCommerce to 3.2.10 or newer.
Full record and what to do →NVD record wpscan.com
Sep 10, 2026Ultimate Gift Cards for WooCommerce: Does not reconcile the value of the gift card coupon it issues against the amount actually collected at checkoutCVE-2026-19436 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Ultimate Gift Cards for WooCommerce WordPress plugin before 3.2.10 does not reconcile the value of the gift card coupon it issues against the amount actually collected at checkout, allowing unauthenticated users to obtain store credit worth more than they paid.
Product
Ultimate Gift Cards for WooCommerce
Fixed in
3.2.10
What to do
Update Ultimate Gift Cards for WooCommerce to 3.2.10 or newer.
Full record and what to do →NVD record wpscan.com
Sep 9, 2026Rara One Click Demo Import: Arbitrary file uploadCVE-2026-26212 · WordPress plugins & themes · reported by VulnCheckHigh 8.6
Rara One Click Demo Import plugin for WordPress before 1.3.5 contains an arbitrary file upload vulnerability that allows authenticated attackers with Administrator privileges to upload arbitrary PHP files by passing a false value to wp_handle_upload() that disables WordPress core's file type validation checks across all three file parameters in the process_uploaded_files() function. Attackers can upload a malicious PHP file to the uploads directory and execute it over HTTP to achieve remote code execution in the web server process, with the uploaded file persisting on disk even after plugin deactivation and leaving no media library record to evade standard integrity checks.
Product
Rara One Click Demo Import
Fixed in
1.3.5
What to do
Update Rara One Click Demo Import to 1.3.5 or newer.
Full record and what to do →NVD record wordpress.com vulncheck.com
Sep 9, 2026WPMR Google Feed Manager for WooCommerce – Sell on Google Merchant Center & Shopping: Time-based SQL InjectionCVE-2026-19778 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The WPMR Google Feed Manager for WooCommerce – Sell on Google Merchant Center & Shopping plugin for WordPress is vulnerable to time-based SQL Injection via the 'feed' parameter in all versions up to, and including, 2.23.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
WPMR Google Feed Manager for WooCommerce – Sell on Google Merchant Center & Shopping
Affected
up to 2.23.7
What to do
Affects up to 2.23.7. Update WPMR Google Feed Manager for WooCommerce – Sell on Google Merchant Center & Shopping to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 9, 2026Ultimate Gift Cards for WooCommerce: Does not verify that the user redeeming a gift card is its intended recipientCVE-2026-75861 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Ultimate Gift Cards for WooCommerce WordPress plugin before 3.2.10 does not verify that the user redeeming a gift card is its intended recipient, allowing any authenticated user, such as a subscriber, to redeem gift cards belonging to other users, zeroing their balance and crediting the value to themselves. In 3.2.9 an ownership check was added on one of the two affected redemption paths; the one that remains requires a companion Ultimate Gift Cards for WooCommerce WordPress plugin before 3.2.10 from the same vendor to be active.
Product
Ultimate Gift Cards for WooCommerce
Fixed in
3.2.10
What to do
Update Ultimate Gift Cards for WooCommerce to 3.2.10 or newer.
Full record and what to do →NVD record wpscan.com
Sep 8, 2026WPML Multilingual CMS: Time-based SQL InjectionCVE-2026-17509 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The WPML Multilingual CMS plugin for WordPress is vulnerable to time-based SQL Injection via the ‘elementIds’ parameter in all versions up to, and including, 4.9.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This vulnerability is exploitable due to an authorization bypass where the registered authorization callback fails to execute, allowing any authenticated user regardless of role to access administrative translation functionalities.
Product
WPML Multilingual CMS
Affected
up to 4.9.5
What to do
Affects up to 4.9.5. Update WPML Multilingual CMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpml.org wordfence.com
Sep 8, 2026Unauthenticated Cross Site Scripting (XSS) in Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 2.0.17 versions.CVE-2026-84820 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 2.0.17 versions.
Affected
up to 2.0.17
What to do
Affects up to 2.0.17. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 8, 2026Easy Appointments: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-81798 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Easy Appointments allows DOM-Based XSS. This issue affects Easy Appointments: from n/a through 4.0.2.1.
Product
Easy Appointments
Affected
up to 4.0.2.1
What to do
Affects up to 4.0.2.1. Update Easy Appointments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 8, 2026WooCommerce: Allocation of Resources Without Limits or ThrottlingCVE-2026-48888 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Allocation of Resources Without Limits or Throttling vulnerability in Automattic WooCommerce allows HTTP DoS. This issue affects WooCommerce: from n/a before 11.1.0.
Product
WooCommerce
Fixed in
11.1.0
What to do
Update WooCommerce to 11.1.0 or newer.
Full record and what to do →NVD record patchstack.com
Sep 6, 2026B2BKing — Ultimate WooCommerce B2B and Wholesale Plugin — Wholesale Prices, Bulk Order Form & More: Does not verify that a role selected during registration is one actually offered on the registration formCVE-2026-85038 · WordPress plugins & themes · reported by WPScanMedium 5.3
The B2BKing — Ultimate WooCommerce B2B and Wholesale Plugin — Wholesale Prices, Bulk Order Form & More WordPress plugin before 5.2.40 does not verify that a role selected during registration is one actually offered on the registration form, allowing unauthenticated users to assign themselves to restricted B2B customer groups and to skip the manual account-approval workflow during self-registration.
Product
B2BKing — Ultimate WooCommerce B2B and Wholesale Plugin — Wholesale Prices, Bulk Order Form & More
Fixed in
5.2.40
What to do
Update B2BKing — Ultimate WooCommerce B2B and Wholesale Plugin — Wholesale Prices, Bulk Order Form & More to 5.2.40 or newer.
Full record and what to do →NVD record wpscan.com
Sep 5, 2026Unlimited Elements For Elementor: Reflected Cross-Site ScriptingCVE-2026-75586 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Unlimited Elements For Elementor plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'formData[id]' Parameter in all versions up to, and including, 2.0.17 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. The front-end AJAX handler is registered on the public 'wp' action with no nonce, capability, or referer check, and the raw attacker-controlled id value is interpolated verbatim into an exception message that is echoed back without escaping; when the response is served as text/html rather than application/json, the browser parses the injected markup.
Product
Unlimited Elements For Elementor
Affected
up to 2.0.17
What to do
Affects up to 2.0.17. Update Unlimited Elements For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 5, 2026JCH Optimize: Does not perform a capability check on one of its authenticated AJAX actions and lets the request chooseCVE-2026-84934 · WordPress plugins & themes · reported by WPScanHigh 8
The JCH Optimize WordPress plugin before 6.0.1 does not perform a capability check on one of its authenticated AJAX actions and lets the request choose which internal action runs, allowing any authenticated users such as Subscribers to import arbitrary JCH Optimize WordPress plugin before 6.0.1 settings and store a script that executes in the browser of any visitor or administrator viewing the site.
Product
JCH Optimize
Fixed in
6.0.1
What to do
Update JCH Optimize to 6.0.1 or newer.
Full record and what to do →NVD record wpscan.com
Sep 5, 2026Greenshift: Does not properly escape a block animation attribute before outputting it within an HTML attributeCVE-2026-83544 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Greenshift WordPress plugin before 13.2.0 does not properly escape a block animation attribute before outputting it within an HTML attribute, allowing users with contributor-level access and above to inject arbitrary web scripts that execute when the content is viewed.
Product
Greenshift
Fixed in
13.2.0
What to do
Update Greenshift to 13.2.0 or newer.
Full record and what to do →NVD record wpscan.com
Sep 5, 2026JCH Optimize: Does not properly restrict a directory path provided to one of its administrative image-browsing features to within the siteCVE-2025-15693 · WordPress plugins & themes · reported by WPScanLow 2.7
The JCH Optimize WordPress plugin before 5.0.1 does not properly restrict a directory path provided to one of its administrative image-browsing features to within the site, allowing high-privilege users, administrators on single-site and sub-site administrators on multisite, to enumerate directories and file names outside the web root.
Product
JCH Optimize
Fixed in
5.0.1
What to do
Update JCH Optimize to 5.0.1 or newer.
Full record and what to do →NVD record wpscan.com
Sep 5, 2026Hummingbird – Speed Optimization, Caching, Minify, Compress & CDN: Remote Code ExecutionCVE-2026-83627 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Hummingbird – Speed Optimization, Caching, Minify, Compress & CDN plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 3.21.0 via the log_msg() function in core/modules/class-page-cache.php. The page-cache debug log is written to wp-content/wphb-logs/page-caching-log.php, a directly web-accessible PHP file that is supposed to be protected by a leading '<?php die(); ?>' header. That header is guarded by class_exists( 'Filesystem' ), which can never match because class_exists() resolves string arguments in the global namespace while the class is Hummingbird\Core\Filesystem; when the log is created during a front-end request the header is therefore omitted entirely. get_cookies() then writes the raw name of any cookie matching the wphb_cache_ prefix into that file without sanitization. This makes it possible for unauthenticated attackers to write arbitrary PHP into the log file with a single anonymous request and execute it by requesting the file directly, resulting in full remote code execution. Exploitation requires the site administrator to have enabled Page Caching with the Debug Log option (non-default), and the log file to be crea
Product
Hummingbird – Speed Optimization, Caching, Minify, Compress & CDN
Affected
up to 3.21.0
What to do
Affects up to 3.21.0. Update Hummingbird – Speed Optimization, Caching, Minify, Compress & CDN to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 4, 2026WoodMart: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-27086 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Xtemos WoodMart allows DOM-Based XSS. This issue affects WoodMart: from n/a before 8.3.8.
Product
WoodMart
Fixed in
8.3.8
What to do
Update WoodMart to 8.3.8 or newer.
Full record and what to do →NVD record patchstack.com
Sep 4, 2026WooCommerce: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-57777 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Automattic WooCommerce allows Blind SQL Injection. This issue affects WooCommerce: from n/a before 11.0.
Product
WooCommerce
Fixed in
11.0
What to do
Update WooCommerce to 11.0 or newer.
Full record and what to do →NVD record github.com patchstack.com
Sep 4, 2026Classified Listing: Does not verify that the caller owns or can edit the target listing before its AI image-editing AJAX action deletes or attaches mediaCVE-2026-16281 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Classified Listing WordPress plugin before 6.1.1 does not verify that the caller owns or can edit the target listing before its AI image-editing AJAX action deletes or attaches media, allowing any authenticated user, including a subscriber, to permanently delete attachments from, and attach files to, any listing owned by another user.
Product
Classified Listing
Fixed in
6.1.1
What to do
Update Classified Listing to 6.1.1 or newer.
Full record and what to do →NVD record wpscan.com
Sep 3, 2026Ultimate Maps by Supsystic: Missing AuthorizationCVE-2026-85309 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Supsystic Ultimate Maps by Supsystic allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Ultimate Maps by Supsystic: from n/a through 1.5.3.
Product
Ultimate Maps by Supsystic
Affected
up to 1.5.3
What to do
Affects up to 1.5.3. Update Ultimate Maps by Supsystic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.