Updated 7 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

542new WordPress flaws this week

391,181entries in the database

9,038 results · page 16 of 181

Sep 18, 2026WP2Social Auto Publish: Stored Cross-Site ScriptingCVE-2026-12042 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The WP2Social Auto Publish plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.4.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
WP2Social Auto Publish
Affected
up to 2.4.12
What to do
Affects up to 2.4.12. Update WP2Social Auto Publish to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 18, 2026WPComplete: Stored Cross-Site ScriptingCVE-2026-77820 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WPComplete plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'empty' Shortcode Attribute in all versions up to, and including, 2.9.9.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the premium version of the software in order to exploit. Please note this only affects the pro version.
Product
WPComplete
Affected
up to 2.9.9.0
What to do
Affects up to 2.9.9.0. Update WPComplete to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 18, 2026WP Recipe Maker: Stored Cross-Site ScriptingCVE-2026-90884 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The WP Recipe Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'notes' parameter in all versions up to, and including, 10.8.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WP Recipe Maker
Affected
up to 10.8.1
What to do
Affects up to 10.8.1. Update WP Recipe Maker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 18, 2026Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder: Stored Cross-Site ScriptingCVE-2026-87915 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via values[Name] Parameter in all versions up to, and including, 1.24.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The wp_kses sanitization applied on output is insufficient in this context because HTML entities within allowed attribute values survive normalization intact and are later evaluated by the jQuery(link.attr('href')) sink in wp-admin/js/common.js when a contextual help tab anchor is clicked.
Product
Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder
Affected
up to 1.24.0
What to do
Affects up to 1.24.0. Update Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 18, 2026Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for: Stored Cross-Site ScriptingCVE-2026-18405 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to, and including, 3.2.16 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires that the targeted post also renders a legitimate Jeg Kit Countdown widget, which causes the countdown frontend script to be enqueued and to initialize on any matching DOM element — including forged widget markup stored in comments.
Product
Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for
Affected
up to 3.2.16
What to do
Affects up to 3.2.16. Update Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 18, 2026Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder: Stored Cross-Site ScriptingCVE-2026-15797 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via post_title in all versions up to, and including, 1.24.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the attacker to create a post with an HTML entity-encoded payload in the title, which bypasses sanitize_text_field on save and is later decoded and executed by the browser when rendered by the Select2 component.
Product
Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder
Affected
up to 1.24.0
What to do
Affects up to 1.24.0. Update Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 18, 2026The Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits plugin for WordPress is vulnerableCVE-2026-85410 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.2.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to modify the title and metadata of arbitrary WordPress posts or permanently delete arbitrary WordPress posts by supplying an attacker-controlled popup_id. The required nonce is emitted on the edit-jltma_popup admin screen, which is accessible to Contributors because the jltma_popup custom post type is registered with capability_type='post'.
Affected
up to 3.2.2
What to do
Affects up to 3.2.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 18, 2026Complianz GDPR/CCPA Cookie Consent Banner: Stored Cross-Site ScriptingCVE-2026-83561 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Complianz GDPR/CCPA Cookie Consent Banner plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Elementor Cookie Blocker Regex in all versions up to, and including, 7.5.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires an administrator to approve the attacker's comment, and the site must have both the Elementor plugin installed and Complianz configured with the Twitter or Facebook cookie/script blocker enabled.
Product
Complianz GDPR/CCPA Cookie Consent Banner
Affected
up to 7.5.4
What to do
Affects up to 7.5.4. Update Complianz GDPR/CCPA Cookie Consent Banner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 18, 2026CSS & JavaScript Toolbox: Stored Cross-Site ScriptingCVE-2025-13533 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The CSS & JavaScript Toolbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 12.0.6 via the Assignment Engine fields. This is due to insufficient input sanitization and output escaping on assignment data fields including Expressions, URLs, and Advanced assignment data. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the CJT block edit screen in the admin dashboard.
Product
CSS & JavaScript Toolbox
Affected
up to 12.0.6
What to do
Affects up to 12.0.6. Update CSS & JavaScript Toolbox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record gist.github.com plugins.trac.wordpress.org
Sep 18, 2026Strong Testimonials: Stored Cross-Site ScriptingCVE-2026-92622 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Strong Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'lightbox_class' Shortcode Attribute in all versions up to, and including, 3.3.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that the targeted testimonial view has at least one published testimonial with a featured image and the lightbox wrapper enabled, as the vulnerable code path is only reached when a thumbnail is rendered.
Product
Strong Testimonials
Affected
up to 3.3.8
What to do
Affects up to 3.3.8. Update Strong Testimonials to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 18, 2026ShopLentor – All-in-One WooCommerce Growth & Store Enhancement: Reflected Cross-Site ScriptingCVE-2026-92554 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via Query-String Parameter Name in all versions up to, and including, 3.5.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. The vulnerability is triggered via the WL: Product Horizontal Filter widget, which reflects attacker-supplied query-string parameter names from the current URL into option element value attributes without escaping, allowing payload breakout from the value="..." attribute context.
Product
ShopLentor – All-in-One WooCommerce Growth & Store Enhancement
Affected
up to 3.5.1
What to do
Affects up to 3.5.1. Update ShopLentor – All-in-One WooCommerce Growth & Store Enhancement to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 18, 2026Qi Addons For Elementor: Reflected Cross-Site ScriptingCVE-2026-92249 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Qi Addons For Elementor plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in all versions up to, and including, 1.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the Table of Contents widget to be placed on a template that renders on the WordPress search-results page (e.g., a sitewide header or footer template) with the 'Limit ToC to Main Page Content' option left at its default value of No, so the widget scans the search-results heading that reflects the unsanitized `s` parameter.
Product
Qi Addons For Elementor
Affected
up to 1.11
What to do
Affects up to 1.11. Update Qi Addons For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 18, 2026WP Inventory Manager: SQL InjectionCVE-2026-17607 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The WP Inventory Manager plugin for WordPress is vulnerable to SQL Injection via the 'where' shortcode attribute of the [wpinventory] shortcode in versions up to, and including, 2.5.1. This is due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the existing SQL query in the WPIMItem::get_all() function — parse_custom_where() only performs html_entity_decode(), strips semicolons, and does field-label name replacements, without using $wpdb->prepare() or a whitelist. The resulting string is concatenated into a raw SELECT statement that is executed via $wpdb->get_results(). This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
WP Inventory Manager
Affected
up to 2.5.1
What to do
Affects up to 2.5.1. Update WP Inventory Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 18, 2026VK All in One Expansion Unit: Stored Cross-Site ScriptingCVE-2026-17586 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The VK All in One Expansion Unit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'vkExUnit_cta_img_position' Post Meta in all versions up to, and including, 9.118.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The sanitize_text_field callback applied on save does not strip double-quote characters or on* event-handler attributes, and the output filter Vk_Call_To_Action::safe_kses_post() only rewrites disallowed iframe elements while returning all other content verbatim, leaving the injected payload intact in the rendered HTML.
Product
VK All in One Expansion Unit
Affected
up to 9.118.0
What to do
Affects up to 9.118.0. Update VK All in One Expansion Unit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 18, 2026Store Exporter – Export WooCommerce Products, Orders, Subscriptions, Customers: Directory TraversalCVE-2026-16777 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The Store Exporter – Export WooCommerce Products, Orders, Subscriptions, Customers plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.8.0 via the 'filename' parameter parameter. This makes it possible for authenticated attackers, with shop manager-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.
Product
Store Exporter – Export WooCommerce Products, Orders, Subscriptions, Customers
Affected
up to 2.8.0
What to do
Affects up to 2.8.0. Update Store Exporter – Export WooCommerce Products, Orders, Subscriptions, Customers to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 18, 2026WP Multi Store Locator Pro: Generic SQL InjectionCVE-2026-15275 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The WP Multi Store Locator Pro plugin for WordPress is vulnerable to generic SQL Injection via the 'store_locatore_search_radius' parameter in all versions up to, and including, 4.5.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The injection occurs in a numeric, unquoted SQL context, meaning WordPress's wp_magic_quotes() addslashes-based protection cannot neutralize the payload, and the AJAX handler is registered on wp_ajax_nopriv_make_search_request with no nonce or capability check, making it fully accessible without authentication.
Product
WP Multi Store Locator Pro
Affected
up to 4.5.1
What to do
Affects up to 4.5.1. Update WP Multi Store Locator Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codecanyon.net wordfence.com
Sep 18, 2026FileBird – WordPress Media Library Folders & File Manager: Stored Cross-Site ScriptingCVE-2026-15004 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The FileBird – WordPress Media Library Folders & File Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via image alt text in all versions up to, and including, 6.5.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
FileBird – WordPress Media Library Folders & File Manager
Affected
up to 6.5.6
What to do
Affects up to 6.5.6. Update FileBird – WordPress Media Library Folders & File Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 18, 2026Kubio AI Page Builder: Stored Cross-Site ScriptingCVE-2026-14472 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Kubio AI Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via kubio/copyright Block Content in all versions up to, and including, 2.8.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This bypasses both the WordPress core kses-on-save filter and the plugin's own wp_kses_post() call, because entity-encoded script tags are treated as inert text by kses but are decoded into live HTML by the subsequent html_entity_decode() call in CopyrightBlock::render_template().
Product
Kubio AI Page Builder
Affected
up to 2.8.4
What to do
Affects up to 2.8.4. Update Kubio AI Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 18, 2026Printcart Web to Print Product Designer for WooCommerce: Directory TraversalCVE-2026-14323 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Printcart Web to Print Product Designer for WooCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.8.5 via the 'mockups' parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. A valid nonce is obtainable by unauthenticated users via the companion nbd_check_use_logged_in nopriv AJAX endpoint, which freely mints and returns a nbdesigner-get-data nonce to any visitor; additionally, if the NBDESIGNER_ENABLE_NONCE constant is disabled, even this nonce gate is bypassed entirely.
Product
Printcart Web to Print Product Designer for WooCommerce
Affected
up to 2.8.5
What to do
Affects up to 2.8.5. Update Printcart Web to Print Product Designer for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 18, 2026Custom Twitter Feeds – A Tweets Widget or X Feed Widget: Stored Cross-Site ScriptingCVE-2026-84909 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Custom Twitter Feeds – A Tweets Widget or X Feed Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'buttoncolor' Shortcode Attribute in all versions up to, and including, 2.8.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability is exploitable on common installs where the admin has configured access tokens with zero or multiple legacy feeds, as this causes the ctf_statuses support_legacy_shortcode option to be set to boolean true by default, activating the unfiltered legacy shortcode attribute code path.
Product
Custom Twitter Feeds – A Tweets Widget or X Feed Widget
Affected
up to 2.8.0
What to do
Affects up to 2.8.0. Update Custom Twitter Feeds – A Tweets Widget or X Feed Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 18, 2026Magazine Blocks: Stored Cross-Site ScriptingCVE-2026-75016 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Magazine Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the News Ticker block's clientId attribute in versions up to, and including, 1.8.6. This is due to insufficient input sanitization and output escaping in the NewsTicker::render() method, which concatenates the clientId block attribute into an HTML class attribute without applying esc_attr(). This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Magazine Blocks
Affected
up to 1.8.6
What to do
Affects up to 1.8.6. Update Magazine Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 18, 2026VikBooking Hotel Booking Engine & PMS: Does not restrict the type of files unauthenticated visitors may attach to its live chatCVE-2026-85127 · WordPress plugins & themes · reported by WPScanHigh 8.8
The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.8.15 does not restrict the type of files unauthenticated visitors may attach to its live chat, nor sanitize their contents, allowing them to store active content which is executed in the context of an administrator viewing the conversation.
Product
VikBooking Hotel Booking Engine & PMS
Fixed in
1.8.15
What to do
Update VikBooking Hotel Booking Engine & PMS to 1.8.15 or newer.
Full record and what to do →NVD record wpscan.com
Sep 18, 2026Easy Form Builder by WhiteStudio: Does not validate a submitted value against the stored configuration for some of its form typesCVE-2026-85123 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Easy Form Builder by WhiteStudio WordPress plugin before 4.2.0 does not validate a submitted value against the stored configuration for some of its form types, allowing unauthenticated users to create WordPress accounts on a site whose owner has disabled registration.
Product
Easy Form Builder by WhiteStudio
Fixed in
4.2.0
What to do
Update Easy Form Builder by WhiteStudio to 4.2.0 or newer.
Full record and what to do →NVD record wpscan.com
Sep 18, 2026Easy Form Builder by WhiteStudio: Does not validate a submitted value against the stored configuration for some of its form typesCVE-2026-85122 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Easy Form Builder by WhiteStudio WordPress plugin before 4.2.0 does not validate a submitted value against the stored configuration for some of its form types, allowing unauthenticated users to store arbitrary content which is then rendered unescaped in an admin page, leading to Stored XSS.
Product
Easy Form Builder by WhiteStudio
Fixed in
4.2.0
What to do
Update Easy Form Builder by WhiteStudio to 4.2.0 or newer.
Full record and what to do →NVD record wpscan.com
Sep 18, 2026King Addons for Elementor: Does not perform per-object authorization checks on a group of image-optimization actionsCVE-2026-84904 · WordPress plugins & themes · reported by WPScanLow 3.8
The King Addons for Elementor WordPress plugin before 51.1.81 does not perform per-object authorization checks on a group of image-optimization actions, gating them only on a coarse capability that lower-privileged users also hold and never confirming ownership of the targeted object, allowing authenticated users with author-level access and above to disclose absolute file paths for, overwrite the bytes of, and site-wide re-reference media belonging to other users, including administrators.
Product
King Addons for Elementor
Fixed in
51.1.81
What to do
Update King Addons for Elementor to 51.1.81 or newer.
Full record and what to do →NVD record wpscan.com
Sep 18, 2026King Addons for Elementor: Does not perform any capabilityCVE-2026-84903 · WordPress plugins & themes · reported by WPScanLow 2.7
The King Addons for Elementor WordPress plugin before 51.1.81 does not perform any capability, post-status, or password check before rendering the content of a user-supplied post, allowing users with Contributor-level access and above to read the content of private, draft, pending, and password-protected posts they are not authorized to access.
Product
King Addons for Elementor
Fixed in
51.1.81
What to do
Update King Addons for Elementor to 51.1.81 or newer.
Full record and what to do →NVD record wpscan.com
Sep 18, 2026King Addons for Elementor: Does not perform an object-level authorization checkCVE-2026-84902 · WordPress plugins & themes · reported by WPScanMedium 6.8
The King Addons for Elementor WordPress plugin before 51.1.81 does not perform an object-level authorization check when importing template content into a page, allowing users with contributor-level access and above to overwrite the Elementor content of arbitrary posts and pages, including those owned by administrators, and to inject JavaScript through a widget setting that is output without escaping, resulting in Stored Cross-Site Scripting that executes in the session of any user who views the affected page.
Product
King Addons for Elementor
Fixed in
51.1.81
What to do
Update King Addons for Elementor to 51.1.81 or newer.
Full record and what to do →NVD record wpscan.com
Sep 17, 2026RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg: Stored Cross-Site ScriptingCVE-2026-15650 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'pointer_menu_item' Block Attribute in all versions up to, and including, 1.5.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload bypasses wp_kses_post filtering applied to post content on save because it contains no HTML tags and survives intact inside the block comment's JSON attributes, reaching the walker unescaped at render time.
Product
RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg
Affected
up to 1.5.2
What to do
Affects up to 1.5.2. Update RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 17, 2026RT Mega Menu: Stored Cross-Site ScriptingCVE-2026-14855 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The RT Mega Menu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'css[left]' parameter in all versions up to, and including, 1.5.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
RT Mega Menu
Affected
up to 1.5.1
What to do
Affects up to 1.5.1. Update RT Mega Menu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 17, 2026Brizy – Page Builder: Stored Cross-Site ScriptingCVE-2026-2585 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Brizy – Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘rootAttributes’ parameter in all versions up to, and including, 2.8.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Brizy – Page Builder
Affected
up to 2.8.14
What to do
Affects up to 2.8.14. Update Brizy – Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 17, 2026Motors – Car Dealership & Classified Listings: Unauthorized access of dataCVE-2026-16750 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to unauthorized access of data due to missing authorization checks in mvl_ajax_dealer_load_cars() function in all versions up to, and including, 1.4.120. This makes it possible for unauthenticated attackers to retrieve draft, pending, private, and future car listings belonging to arbitrary users.
Product
Motors – Car Dealership & Classified Listings
Affected
up to 1.4.120
What to do
Affects up to 1.4.120. Update Motors – Car Dealership & Classified Listings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 17, 2026Unauthenticated Cross Site Scripting (XSS) in Visitor Traffic Real Time Statistics Pro <= 11.21 versions.CVE-2026-90986 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Visitor Traffic Real Time Statistics Pro <= 11.21 versions.
Affected
up to 11.21
What to do
Affects up to 11.21. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 17, 2026Unauthenticated Cross Site Scripting (XSS) in WP Inventory Manager <= 2.5.4 versions.CVE-2026-90887 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in WP Inventory Manager <= 2.5.4 versions.
Affected
up to 2.5.4
What to do
Affects up to 2.5.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 17, 2026Contributor Cross Site Scripting (XSS) in Geo Mashup <= 1.13.21 versions.CVE-2026-78294 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Cross Site Scripting (XSS) in Geo Mashup <= 1.13.21 versions.
Affected
up to 1.13.21
What to do
Affects up to 1.13.21. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 17, 2026Contributor Broken Access Control in Simple Membership <= 4.8.2 versions.CVE-2026-74000 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Contributor Broken Access Control in Simple Membership <= 4.8.2 versions.
Affected
up to 4.8.2
What to do
Affects up to 4.8.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 17, 2026Contributor Insecure Direct Object References (IDOR) in Cooked <= 1.16.0 versions.CVE-2026-73999 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Contributor Insecure Direct Object References (IDOR) in Cooked <= 1.16.0 versions.
Affected
up to 1.16.0
What to do
Affects up to 1.16.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 17, 2026Administrator SQL Injection in MC Woocommerce Wishlist <= 1.9.21 versions.CVE-2026-66631 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Administrator SQL Injection in MC Woocommerce Wishlist <= 1.9.21 versions.
Affected
up to 1.9.21
What to do
Affects up to 1.9.21. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 17, 2026Administrator SQL Injection in PublishPress Series <= 3.1.3 versions.CVE-2026-66630 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Administrator SQL Injection in PublishPress Series <= 3.1.3 versions.
Affected
up to 3.1.3
What to do
Affects up to 3.1.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 17, 2026Editor SQL Injection in SKT Addons for Elementor <= 4.0 versions.CVE-2026-66626 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Editor SQL Injection in SKT Addons for Elementor <= 4.0 versions.
Affected
up to 4.0
What to do
Affects up to 4.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 17, 2026Administrator SQL Injection in WC Vendors Marketplace <= 2.7.2.1 versions.CVE-2026-66625 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Administrator SQL Injection in WC Vendors Marketplace <= 2.7.2.1 versions.
Affected
up to 2.7.2.1
What to do
Affects up to 2.7.2.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 17, 2026Administrator SQL Injection in WPMasterToolKit <= 2.22.0 versions.CVE-2026-66624 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Administrator SQL Injection in WPMasterToolKit <= 2.22.0 versions.
Affected
up to 2.22.0
What to do
Affects up to 2.22.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 17, 2026Administrator SQL Injection in Newsletters <= 4.18 versions.CVE-2026-66619 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Administrator SQL Injection in Newsletters <= 4.18 versions.
Affected
up to 4.18
What to do
Affects up to 4.18. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 17, 2026Administrator SQL Injection in WP Maps <= 4.9.9 versions.CVE-2026-66618 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Administrator SQL Injection in WP Maps <= 4.9.9 versions.
Affected
up to 4.9.9
What to do
Affects up to 4.9.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 17, 2026Contributor Cross Site Scripting (XSS) in PublishPress Series <= 3.1.3 versions.CVE-2026-66617 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Cross Site Scripting (XSS) in PublishPress Series <= 3.1.3 versions.
Affected
up to 3.1.3
What to do
Affects up to 3.1.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 17, 2026Contributor Server Side Request Forgery (SSRF) in Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 2.0.19 versions.CVE-2026-66608 · WordPress plugins & themes · reported by PatchstackMedium 6.4
Contributor Server Side Request Forgery (SSRF) in Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 2.0.19 versions.
Affected
up to 2.0.19
What to do
Affects up to 2.0.19. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 17, 2026Contributor SQL Injection in Product Feed Manager <= 7.12.0 versions.CVE-2026-66580 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Contributor SQL Injection in Product Feed Manager <= 7.12.0 versions.
Affected
up to 7.12.0
What to do
Affects up to 7.12.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 17, 2026Contributor Cross Site Scripting (XSS) in JetElements For Elementor <= 2.9.2.1 versions.CVE-2026-66579 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Cross Site Scripting (XSS) in JetElements For Elementor <= 2.9.2.1 versions.
Affected
up to 2.9.2.1
What to do
Affects up to 2.9.2.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 17, 2026Contributor Cross Site Scripting (XSS) in PropertyHive <= 2.2.6 versions.CVE-2026-66578 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Cross Site Scripting (XSS) in PropertyHive <= 2.2.6 versions.
Affected
up to 2.2.6
What to do
Affects up to 2.2.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 17, 2026Contributor Cross Site Scripting (XSS) in JetSearch <= 3.6.3 versions.CVE-2026-66577 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Cross Site Scripting (XSS) in JetSearch <= 3.6.3 versions.
Affected
up to 3.6.3
What to do
Affects up to 3.6.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 17, 2026Contributor Cross Site Scripting (XSS) in JetBlocks For Elementor <= 1.5.2 versions.CVE-2026-66576 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Cross Site Scripting (XSS) in JetBlocks For Elementor <= 1.5.2 versions.
Affected
up to 1.5.2
What to do
Affects up to 1.5.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.