Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
11,394 results · page 14 of 228
Oct 13, 2026IDX Broker IMPress for IDX Broker idx-broker-platinum: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-54869 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in IDX Broker IMPress for IDX Broker idx-broker-platinum allows Stored XSS.This issue affects IMPress for IDX Broker: from n/a through 3.3.1.
- Product
- IDX Broker IMPress for IDX Broker idx-broker-platinum
- Affected
- up to 3.3.1
- What to do
- Affects up to 3.3.1. Update IDX Broker IMPress for IDX Broker idx-broker-platinum to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 13, 2026FolioVision FV Simpler SEO fv-all-in-one-seo-pack: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-54868 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FolioVision FV Simpler SEO fv-all-in-one-seo-pack allows Stored XSS.This issue affects FV Simpler SEO: from n/a through 1.9.7.
- Product
- FolioVision FV Simpler SEO fv-all-in-one-seo-pack
- Affected
- up to 1.9.7
- What to do
- Affects up to 1.9.7. Update FolioVision FV Simpler SEO fv-all-in-one-seo-pack to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 13, 2026Griden Responsive Slider responsive-slider: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-54867 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Griden Responsive Slider responsive-slider allows Stored XSS.This issue affects Responsive Slider: from n/a through 0.1.9.
- Product
- Griden Responsive Slider responsive-slider
- Affected
- up to 0.1.9
- What to do
- Affects up to 0.1.9. Update Griden Responsive Slider responsive-slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 12, 2026RocketGeek WP-Members wp-members: Missing AuthorizationCVE-2026-61994 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in RocketGeek WP-Members wp-members allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP-Members: from n/a through 3.5.7.
- Product
- RocketGeek WP-Members wp-members
- Affected
- up to 3.5.7
- What to do
- Affects up to 3.5.7. Update RocketGeek WP-Members wp-members to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 12, 2026Pixelite Events Manager events-manager: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')CVE-2026-42689 · WordPress plugins & themes · reported by PatchstackLow 3.7
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Pixelite Events Manager events-manager allows Leveraging Race Conditions.This issue affects Events Manager: from n/a through 7.4.7.
- Product
- Pixelite Events Manager events-manager
- Affected
- up to 7.4.7
- What to do
- Affects up to 7.4.7. Update Pixelite Events Manager events-manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 12, 2026WPMU DEV Forminator forminator: Missing AuthorizationCVE-2026-108486 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WPMU DEV Forminator forminator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Forminator: from n/a through 1.58.0.
- Product
- WPMU DEV Forminator forminator
- Affected
- up to 1.58.0
- What to do
- Affects up to 1.58.0. Update WPMU DEV Forminator forminator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 12, 2026LeapWorx Premium Addons for Elementor premium-addons-for-elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-108482 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LeapWorx Premium Addons for Elementor premium-addons-for-elementor allows Stored XSS.This issue affects Premium Addons for Elementor: from n/a through 4.11.110.
- Product
- LeapWorx Premium Addons for Elementor premium-addons-for-elementor
- Affected
- up to 4.11.110
- What to do
- Affects up to 4.11.110. Update LeapWorx Premium Addons for Elementor premium-addons-for-elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 12, 2026Patreon Patreon WordPress patreon-connect: Cross-Site Request Forgery (CSRF)CVE-2026-108481 · WordPress plugins & themes · reported by PatchstackHigh 7.4
Cross-Site Request Forgery (CSRF) vulnerability in Patreon Patreon WordPress patreon-connect allows Cross Site Request Forgery.This issue affects Patreon WordPress: from n/a through 1.10.0.
- Product
- Patreon Patreon WordPress patreon-connect
- Affected
- up to 1.10.0
- What to do
- Affects up to 1.10.0. Update Patreon Patreon WordPress patreon-connect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 12, 2026Patreon Patreon WordPress patreon-connect: Cross-Site Request Forgery (CSRF)CVE-2026-108479 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Cross-Site Request Forgery (CSRF) vulnerability in Patreon Patreon WordPress patreon-connect allows Cross Site Request Forgery.This issue affects Patreon WordPress: from n/a through 1.9.17.
- Product
- Patreon Patreon WordPress patreon-connect
- Affected
- up to 1.9.17
- What to do
- Affects up to 1.9.17. Update Patreon Patreon WordPress patreon-connect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 12, 2026ExpressTech Quiz And Survey Master quiz-master-next: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-107862 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows DOM-Based XSS.This issue affects Quiz And Survey Master: from n/a through 11.2.7.
- Product
- ExpressTech Quiz And Survey Master quiz-master-next
- Affected
- up to 11.2.7
- What to do
- Affects up to 11.2.7. Update ExpressTech Quiz And Survey Master quiz-master-next to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 12, 2026Arraytics Booktics booktics: Missing AuthorizationCVE-2026-107418 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Arraytics Booktics booktics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booktics: from n/a through 1.0.28.
- Product
- Arraytics Booktics booktics
- Affected
- up to 1.0.28
- What to do
- Affects up to 1.0.28. Update Arraytics Booktics booktics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 12, 2026VillaTheme Salevo woo-boost-sales: External Control of Assumed-Immutable Web ParameterCVE-2026-103080 · WordPress plugins & themes · reported by PatchstackMedium 5.3
External Control of Assumed-Immutable Web Parameter vulnerability in VillaTheme Salevo woo-boost-sales allows Input Data Manipulation.This issue affects Salevo: from n/a through 1.3.0.
- Product
- VillaTheme Salevo woo-boost-sales
- Affected
- up to 1.3.0
- What to do
- Affects up to 1.3.0. Update VillaTheme Salevo woo-boost-sales to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 12, 2026BdThemes Element Pack Elementor Addons bdthemes-element-pack-lite: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-108478 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BdThemes Element Pack Elementor Addons bdthemes-element-pack-lite allows Stored XSS.This issue affects Element Pack Elementor Addons: from n/a through 8.8.8.
- Product
- BdThemes Element Pack Elementor Addons bdthemes-element-pack-lite
- Affected
- up to 8.8.8
- What to do
- Affects up to 8.8.8. Update BdThemes Element Pack Elementor Addons bdthemes-element-pack-lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 12, 2026Arraytics Booktics booktics: Missing AuthorizationCVE-2026-108477 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Arraytics Booktics booktics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booktics: from n/a through 1.0.28.
- Product
- Arraytics Booktics booktics
- Affected
- up to 1.0.28
- What to do
- Affects up to 1.0.28. Update Arraytics Booktics booktics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 12, 2026VideoWhisper: Missing AuthorizationCVE-2026-108476 · WordPress plugins & themes · reported by PatchstackMedium 5
Missing Authorization vulnerability in VideoWhisper.com Paid Videochat Turnkey Site ppv-live-webcams allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Paid Videochat Turnkey Site: from n/a through 7.5.13.
- Product
- VideoWhisper
- Affected
- up to 7.5.13
- What to do
- Affects up to 7.5.13. Update VideoWhisper to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 12, 2026VideoWhisper: Missing AuthorizationCVE-2026-108475 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in VideoWhisper.com Broadcast Live Video videowhisper-live-streaming-integration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Broadcast Live Video: from n/a through 7.3.6.
- Product
- VideoWhisper
- Affected
- up to 7.3.6
- What to do
- Affects up to 7.3.6. Update VideoWhisper to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 12, 2026DLX Plugins Custom Query Blocks post-type-archive-mapping: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-108168 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DLX Plugins Custom Query Blocks post-type-archive-mapping allows Stored XSS.This issue affects Custom Query Blocks: from n/a through 5.6.0.
- Product
- DLX Plugins Custom Query Blocks post-type-archive-mapping
- Affected
- up to 5.6.0
- What to do
- Affects up to 5.6.0. Update DLX Plugins Custom Query Blocks post-type-archive-mapping to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 12, 2026WP Desk Flexible Subscriptions flexible-subscriptions: Missing AuthorizationCVE-2026-107869 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WP Desk Flexible Subscriptions flexible-subscriptions allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Flexible Subscriptions: from n/a through 1.8.4.
- Product
- WP Desk Flexible Subscriptions flexible-subscriptions
- Affected
- up to 1.8.4
- What to do
- Affects up to 1.8.4. Update WP Desk Flexible Subscriptions flexible-subscriptions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 12, 2026Crocoblock JetElements For Elementor jet-elements: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-107866 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetElements For Elementor jet-elements allows Stored XSS.This issue affects JetElements For Elementor: from n/a through 2.9.2.3.
- Product
- Crocoblock JetElements For Elementor jet-elements
- Affected
- up to 2.9.2.3
- What to do
- Affects up to 2.9.2.3. Update Crocoblock JetElements For Elementor jet-elements to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 12, 2026Crocoblock JetMenu jet-menu: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-107865 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetMenu jet-menu allows Stored XSS.This issue affects JetMenu: from n/a through 3.0.5.
- Product
- Crocoblock JetMenu jet-menu
- Affected
- up to 3.0.5
- What to do
- Affects up to 3.0.5. Update Crocoblock JetMenu jet-menu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 12, 2026Igor Funa Ad Inserter ad-inserter: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-107864 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Igor Funa Ad Inserter ad-inserter allows Stored XSS.This issue affects Ad Inserter: from n/a through 2.8.18.
- Product
- Igor Funa Ad Inserter ad-inserter
- Affected
- up to 2.8.18
- What to do
- Affects up to 2.8.18. Update Igor Funa Ad Inserter ad-inserter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 12, 2026Codection Products Restricted Users for WooCommerce woo-products-restricted-users: Missing AuthorizationCVE-2026-107863 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Codection Products Restricted Users for WooCommerce woo-products-restricted-users allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Products Restricted Users for WooCommerce: from n/a through 0.7.
- Product
- Codection Products Restricted Users for WooCommerce woo-products-restricted-users
- Affected
- up to 0.7
- What to do
- Affects up to 0.7. Update Codection Products Restricted Users for WooCommerce woo-products-restricted-users to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 12, 2026WP User Manager WP User Manager wp-user-manager: Missing AuthorizationCVE-2026-107423 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WP User Manager WP User Manager wp-user-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP User Manager: from n/a through 2.9.22.
- Product
- WP User Manager WP User Manager wp-user-manager
- Affected
- up to 2.9.22
- What to do
- Affects up to 2.9.22. Update WP User Manager WP User Manager wp-user-manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 12, 2026Pluggabl LLC: Insertion of Sensitive Information Into Sent DataCVE-2023-25996 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Insertion of Sensitive Information Into Sent Data vulnerability in Pluggabl LLC. Booster Elite for WooCommerce booster-elite-for-woocommerce allows Retrieve Embedded Sensitive Data.This issue affects Booster Elite for WooCommerce: from n/a before 8.4.0.
- Product
- Pluggabl LLC
- Fixed in
- 8.4.0
- What to do
- Update Pluggabl LLC to 8.4.0 or newer.
Oct 12, 2026NOUS Ouvert Utile et Simple Event post event-post: Missing AuthorizationCVE-2026-107432 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in NOUS Ouvert Utile et Simple Event post event-post allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event post: from n/a through 6.1.1.
- Product
- NOUS Ouvert Utile et Simple Event post event-post
- Affected
- up to 6.1.1
- What to do
- Affects up to 6.1.1. Update NOUS Ouvert Utile et Simple Event post event-post to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 12, 2026VideoWhisper: Missing AuthorizationCVE-2026-107430 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in VideoWhisper.com VideoWhisper Site Manager for ChatGPT, Claude, Codex videowhisper-site-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VideoWhisper Site Manager for ChatGPT, Claude, Codex: from n/a through 1.2.10.
- Product
- VideoWhisper
- Affected
- up to 1.2.10
- What to do
- Affects up to 1.2.10. Update VideoWhisper to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 12, 2026VideoWhisper: Improper Validation of Specified Quantity in InputCVE-2026-107429 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Improper Validation of Specified Quantity in Input vulnerability in VideoWhisper.com Paid Videochat Turnkey Site ppv-live-webcams allows Input Data Manipulation.This issue affects Paid Videochat Turnkey Site: from n/a through 7.5.12.
- Product
- VideoWhisper
- Affected
- up to 7.5.12
- What to do
- Affects up to 7.5.12. Update VideoWhisper to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 12, 2026NOUS Ouvert Utile et Simple Event post event-post: Authorization Bypass Through User-Controlled KeyCVE-2026-107427 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Authorization Bypass Through User-Controlled Key vulnerability in NOUS Ouvert Utile et Simple Event post event-post allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event post: from n/a through 6.1.1.
- Product
- NOUS Ouvert Utile et Simple Event post event-post
- Affected
- up to 6.1.1
- What to do
- Affects up to 6.1.1. Update NOUS Ouvert Utile et Simple Event post event-post to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 12, 2026WP Desk Flexible Quantity – Measurement Price Calculator for WooCommerce flexible-quantity-measurement-price-calculator-for-woocommerce: Improper Validation of Specified Quantity in InputCVE-2026-106605 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Improper Validation of Specified Quantity in Input vulnerability in WP Desk Flexible Quantity – Measurement Price Calculator for WooCommerce flexible-quantity-measurement-price-calculator-for-woocommerce allows Input Data Manipulation.This issue affects Flexible Quantity – Measurement Price Calculator for WooCommerce: from n/a through 2.3.22.
- Product
- WP Desk Flexible Quantity – Measurement Price Calculator for WooCommerce flexible-quantity-measurement-price-calculator-for-woocommerce
- Affected
- up to 2.3.22
- What to do
- Affects up to 2.3.22. Update WP Desk Flexible Quantity – Measurement Price Calculator for WooCommerce flexible-quantity-measurement-price-calculator-for-woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 12, 2026VillaTheme TMDS tmds-dropshipping-for-temu-and-woo: Missing AuthorizationCVE-2026-103356 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in VillaTheme TMDS tmds-dropshipping-for-temu-and-woo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects TMDS: from n/a through 1.0.15.
- Product
- VillaTheme TMDS tmds-dropshipping-for-temu-and-woo
- Affected
- up to 1.0.15
- What to do
- Affects up to 1.0.15. Update VillaTheme TMDS tmds-dropshipping-for-temu-and-woo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 12, 2026Hotel Booking: Does not verify that a booking record belongs to the user requesting itCVE-2026-84167 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Hotel Booking WordPress plugin through 3.8 does not verify that a booking record belongs to the user requesting it, allowing any authenticated user such as a Subscriber to read other customers' booking details, including their name, email address, phone number and postal address, by referencing an identifier they do not own.
- Product
- Hotel Booking
- Affected
- up to 3.8
- What to do
- Affects up to 3.8. Update Hotel Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 12, 2026Hotel Booking: Does not implement CSRF protection on its administrative booking order managementCVE-2026-84166 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Hotel Booking WordPress plugin through 3.8 does not implement CSRF protection on its administrative booking order management, allowing attackers to trick a logged-in administrator into creating, deleting, or modifying arbitrary booking order records via a forged request.
- Product
- Hotel Booking
- Affected
- up to 3.8
- What to do
- Affects up to 3.8. Update Hotel Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 12, 2026WP Comment Cleaner: Does not perform a capability check or validate a nonce on one of its bulk comment-deletion routinesCVE-2026-107791 · WordPress plugins & themes · reported by WPScanMedium 6.5
The WP Comment Cleaner WordPress plugin before 7.2 does not perform a capability check or validate a nonce on one of its bulk comment-deletion routines, allowing authenticated users with minimal permissions, such as subscribers, to permanently delete all comments on the site.
- Product
- WP Comment Cleaner
- Fixed in
- 7.2
- What to do
- Update WP Comment Cleaner to 7.2 or newer.
Oct 12, 2026HireZoot: Does not sanitise and escape one of its job specification settings before it is reflected back into an admin-area settings pageCVE-2025-15703 · WordPress plugins & themes · reported by WPScanLow 3.5
The HireZoot WordPress plugin before 4.0.0 does not sanitise and escape one of its job specification settings before it is reflected back into an admin-area settings page, allowing users with the HireZoot WordPress plugin before 4.0.0's management capability (Administrator by default) to store a payload that is executed in the browser of any administrator who later opens that page. As the unfiltered_html capability is not available to administrators on multisite (or where DISALLOW_UNFILTERED_HTML is set), this leads to Stored Cross-Site Scripting.
- Product
- HireZoot
- Fixed in
- 4.0.0
- What to do
- Update HireZoot to 4.0.0 or newer.
Oct 11, 2026ngx_cache_purge before 3.0.4 can allow file deletion via a symlink attack in certain situations where nginx and a served application (e.g., WordPress) run underCVE-2026-108981 · WordPress plugins & themes · reported by MITRELow 3.6
ngx_cache_purge before 3.0.4 can allow file deletion via a symlink attack in certain situations where nginx and a served application (e.g., WordPress) run under the same user account. The attacker must be able to create a symlink inside the cache path. Version 3.0.4 fixes this for the case of a symlink created at an arbitrary earlier time, but does not resolve an applicable TOCTOU race condition. (The ngx_cache_purge module follows symlinks while walking the cache directory tree during purge operations. The module relies on nginx's ngx_walk_tree(), which relies on stat() and therefore follows symlinks.)
- Fixed in
- 3.0.4
- What to do
- Update the plugin to 3.0.4 or newer.
Oct 11, 2026WP-Invoice: Does not perform capability checks in several of its AJAX handlersCVE-2026-97183 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WP-Invoice WordPress plugin through 4.3.1 does not perform capability checks in several of its AJAX handlers, allowing any authenticated user, such as a Subscriber, to retrieve the email addresses, display names and profile details of all registered users.
- Product
- WP-Invoice
- Affected
- up to 4.3.1
- What to do
- Affects up to 4.3.1. Update WP-Invoice to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 11, 2026Piotnet Forms: Does not authenticate or validate a form-submission file-upload request and permits browser-renderable file types to be storedCVE-2026-96227 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Piotnet Forms WordPress plugin through 1.0.30 does not authenticate or validate a form-submission file-upload request and permits browser-renderable file types to be stored, allowing unauthenticated attackers to store a file that executes arbitrary JavaScript in the site's origin when it is opened (Stored XSS).
- Product
- Piotnet Forms
- Affected
- up to 1.0.30
- What to do
- Affects up to 1.0.30. Update Piotnet Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 11, 2026MemberHero: Does not perform any capability or nonce check on one of its AJAX actionsCVE-2026-94235 · WordPress plugins & themes · reported by WPScanMedium 4.3
The MemberHero WordPress plugin through 6.9 does not perform any capability or nonce check on one of its AJAX actions, allowing any authenticated user, such as a subscriber, to make the site send arbitrary HTML emails to arbitrary recipients from its own mail system, which can be abused to relay phishing carrying the site's identity and domain reputation.
- Product
- MemberHero
- Affected
- up to 6.9
- What to do
- Affects up to 6.9. Update MemberHero to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 11, 2026Veeqo for WooCommerce: Does not restrict who can trigger its remote bridge-installation process or validate the URL it is given before downloading and extracting itCVE-2026-93550 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Veeqo for WooCommerce WordPress plugin through 2.2.8 does not restrict who can trigger its remote bridge-installation process or validate the URL it is given before downloading and extracting it, allowing users with Subscriber-level access and above to make the Veeqo for WooCommerce WordPress plugin through 2.2.8 download and extract an attacker-controlled archive containing arbitrary PHP files into the WordPress root.
- Product
- Veeqo for WooCommerce
- Affected
- up to 2.2.8
- What to do
- Affects up to 2.2.8. Update Veeqo for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 11, 2026Subscribe to Comments: Does not properly validate a parameter before reflecting it into a link targetCVE-2026-91829 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Subscribe to Comments WordPress plugin before 2.3.3 does not properly validate a parameter before reflecting it into a link target, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting via a crafted URL against anyone who clicks it, including administrators.
- Product
- Subscribe to Comments
- Fixed in
- 2.3.3
- What to do
- Update Subscribe to Comments to 2.3.3 or newer.
Oct 11, 2026paymendo: Does not properly sanitize and escape a parameter before using it in a SQL queryCVE-2026-89305 · WordPress plugins & themes · reported by WPScanMedium 6.5
The paymendo WordPress plugin through 1.1 does not properly sanitize and escape a parameter before using it in a SQL query, allowing any authenticated user to perform SQL injection attacks.
- Product
- paymendo
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update paymendo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 11, 2026paymendo: Does not properly sanitize and escape a parameter before using it in a SQL queryCVE-2026-89304 · WordPress plugins & themes · reported by WPScanMedium 6.5
The paymendo WordPress plugin through 1.1 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform blind SQL injection attacks.
- Product
- paymendo
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update paymendo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 11, 2026Post Voting System: Does not properly sanitize and escape a parameter before using it in a SQL queryCVE-2026-89302 · WordPress plugins & themes · reported by WPScanHigh 8.6
The Post Voting System WordPress plugin through 1.0 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks.
- Product
- Post Voting System
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Post Voting System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 11, 2026WP Verify API: Does not properly sanitize and escape a parameter before using it in a SQL queryCVE-2026-89299 · WordPress plugins & themes · reported by WPScanHigh 8.6
The WP Verify API WordPress plugin through 1.0.0 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks.
- Product
- WP Verify API
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update WP Verify API to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 11, 2026Loja Automática: Does not properly sanitize and escape a parameter before using it in a SQL queryCVE-2026-89297 · WordPress plugins & themes · reported by WPScanHigh 8.6
The Loja Automática WordPress plugin through 1.0.0 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks.
- Product
- Loja Automática
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Loja Automática to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 11, 2026ASPL Product Quotation: Does not sanitize and escape a parameter before using it in SQL statementsCVE-2026-89287 · WordPress plugins & themes · reported by WPScanHigh 8.6
The ASPL Product Quotation WordPress plugin through 1.1.0 does not sanitize and escape a parameter before using it in SQL statements, allowing unauthenticated attackers to perform SQL injection and read arbitrary data from the database.
- Product
- ASPL Product Quotation
- Affected
- up to 1.1.0
- What to do
- Affects up to 1.1.0. Update ASPL Product Quotation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 11, 2026Datalist it: Does not sanitize and escape several request parameters before using them to build a SQL queryCVE-2026-89285 · WordPress plugins & themes · reported by WPScanHigh 8.6
The Datalist it WordPress plugin through 0.0.3 does not sanitize and escape several request parameters before using them to build a SQL query, allowing unauthenticated attackers to perform SQL injection and read arbitrary data from the database.
- Product
- Datalist it
- Affected
- up to 0.0.3
- What to do
- Affects up to 0.0.3. Update Datalist it to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 11, 2026WP Posts Password Batch Manager: Does not perform any capability or nonce check on a bulk post-password action that runs on an always-loaded admin handlerCVE-2026-89283 · WordPress plugins & themes · reported by WPScanHigh 8.6
The WP Posts Password Batch Manager WordPress plugin through 1.1 does not perform any capability or nonce check on a bulk post-password action that runs on an always-loaded admin handler, allowing unauthenticated attackers to reset or overwrite the password of every published post, disclosing password-protected content or locking all posts behind an attacker-chosen password.
- Product
- WP Posts Password Batch Manager
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update WP Posts Password Batch Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 11, 2026WP-Partner: Does not sanitise and escape a parameter before using it in a SQL queryCVE-2026-89234 · WordPress plugins & themes · reported by WPScanHigh 8.6
The WP-Partner WordPress plugin through 1.2.1 does not sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated attackers to append additional SQL queries and extract sensitive information from the database.
- Product
- WP-Partner
- Affected
- up to 1.2.1
- What to do
- Affects up to 1.2.1. Update WP-Partner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 11, 2026Recordbrowser: Does not sanitise and escape a parameter before using it in a SQL queryCVE-2026-89232 · WordPress plugins & themes · reported by WPScanHigh 8.6
The Recordbrowser WordPress plugin through 1.1.7 does not sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated attackers to append additional SQL queries and extract sensitive information from the database.
- Product
- Recordbrowser
- Affected
- up to 1.1.7
- What to do
- Affects up to 1.1.7. Update Recordbrowser to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. The WordPress, CMS and hosting-panel entries come from the National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan and others); we show who. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, a booking system, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.