Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
13,899 results · page 16 of 278
Oct 13, 2026Ad Inserter – Ad Manager & AdSense Ads: Sensitive Information ExposureCVE-2026-89097 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.8.18 via the ai_wp_footer_hook. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract sensitive data including the server's internal IP address, PHP configuration, WordPress and theme versions, hardening constants, the plugin's full block matrix, and all post meta values including underscore-prefixed protected keys such as API tokens and private integration state written by other plugins.
- Product
- Ad Inserter – Ad Manager & AdSense Ads
- Affected
- up to 2.8.18
- What to do
- Affects up to 2.8.18. Update Ad Inserter – Ad Manager & AdSense Ads to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 13, 2026Animated Number Counters: Generic SQL InjectionCVE-2026-15399 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The Animated Number Counters plugin for WordPress is vulnerable to generic SQL Injection via the 'counterid' parameter in all versions up to, and including, 3.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with editor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This is a second-order SQL injection: the write path correctly uses $wpdb->prepare(), but that protection is not carried forward to the read path, where the retrieved value is concatenated unsanitized into unprepared queries in both a single-quoted string context and a bare numeric context.
- Product
- Animated Number Counters
- Affected
- up to 3.0
- What to do
- Affects up to 3.0. Update Animated Number Counters to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 13, 2026WPGraphQL WPGraphQL wp-graphql: Missing AuthorizationCVE-2026-109703 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WPGraphQL WPGraphQL wp-graphql allows Retrieve Embedded Sensitive Data.This issue affects WPGraphQL: from n/a through 2.23.1.
- Product
- WPGraphQL WPGraphQL wp-graphql
- Affected
- up to 2.23.1
- What to do
- Affects up to 2.23.1. Update WPGraphQL WPGraphQL wp-graphql to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 13, 2026AcyMailing: Stored Cross-Site ScriptingCVE-2026-102562 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The AcyMailing plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the customField[] parameter of the public frontusers::subscribe endpoint in versions up to, and including, 11.1.0. This is due to insufficient input sanitization and output escaping in the acym_cleanVar() sanitizer, whose HTML-tag stripper only matches complete tags (requiring a closing '>'), together with SubscriberInsertion::replaceUserInformation() and the archive view template, which substitute the stored subscriber field value into the mail body and emit it without HTML encoding. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses the online-archive URL for the poisoned subscriber, including administrators who click the plugin-generated link in the Subscribers → History screen.
- Product
- AcyMailing
- Affected
- up to 11.1.0
- What to do
- Affects up to 11.1.0. Update AcyMailing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 13, 2026Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation: Stored Cross-Site ScriptingCVE-2026-102007 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'field mapped to notification_content (attacker-chosen key, e.g. payload_text)' parameter in all versions up to, and including, 2.10.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires a site administrator to have preconfigured a Bit Integrations flow that binds the public Bit Assist webhook to a BuddyBoss "Send Notification" action with a form field mapped to notification_content, and the attacker to know the flow's UUID callback URL.
- Product
- Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation
- Affected
- up to 2.10.6
- What to do
- Affects up to 2.10.6. Update Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 13, 2026WP-BusinessDirectory: Does not restrict the type or destination of files saved by an unauthenticated upload handlerCVE-2026-89271 · WordPress plugins & themes · reported by WPScanMedium 5.3
The WP-BusinessDirectory WordPress plugin through 4.0.2 does not restrict the type or destination of files saved by an unauthenticated upload handler, allowing unauthenticated attackers to write files with arbitrary content to arbitrary locations, though not to execute code on a default server configuration.
- Product
- WP-BusinessDirectory
- Affected
- up to 4.0.2
- What to do
- Affects up to 4.0.2. Update WP-BusinessDirectory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 13, 2026WP Testimonials: Does not properly escape testimonial content and reverses WordPress's HTML sanitizationCVE-2026-89269 · WordPress plugins & themes · reported by WPScanMedium 6.8
The WP Testimonials WordPress plugin through 1.4.13 does not properly escape testimonial content and reverses WordPress's HTML sanitization when rendering it, allowing users with the Author role and above to store JavaScript that executes in the session of any user viewing the testimonials, including administrators.
- Product
- WP Testimonials
- Affected
- up to 1.4.13
- What to do
- Affects up to 1.4.13. Update WP Testimonials to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 13, 2026wpweaver Weaver Xtreme Theme Support weaverx-theme-support: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-54870 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpweaver Weaver Xtreme Theme Support weaverx-theme-support allows Stored XSS.This issue affects Weaver Xtreme Theme Support: from n/a through 7.0.1.
- Product
- wpweaver Weaver Xtreme Theme Support weaverx-theme-support
- Affected
- up to 7.0.1
- What to do
- Affects up to 7.0.1. Update wpweaver Weaver Xtreme Theme Support weaverx-theme-support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 13, 2026IDX Broker IMPress for IDX Broker idx-broker-platinum: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-54869 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in IDX Broker IMPress for IDX Broker idx-broker-platinum allows Stored XSS.This issue affects IMPress for IDX Broker: from n/a through 3.3.1.
- Product
- IDX Broker IMPress for IDX Broker idx-broker-platinum
- Affected
- up to 3.3.1
- What to do
- Affects up to 3.3.1. Update IDX Broker IMPress for IDX Broker idx-broker-platinum to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 13, 2026FolioVision FV Simpler SEO fv-all-in-one-seo-pack: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-54868 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FolioVision FV Simpler SEO fv-all-in-one-seo-pack allows Stored XSS.This issue affects FV Simpler SEO: from n/a through 1.9.7.
- Product
- FolioVision FV Simpler SEO fv-all-in-one-seo-pack
- Affected
- up to 1.9.7
- What to do
- Affects up to 1.9.7. Update FolioVision FV Simpler SEO fv-all-in-one-seo-pack to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 13, 2026Griden Responsive Slider responsive-slider: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-54867 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Griden Responsive Slider responsive-slider allows Stored XSS.This issue affects Responsive Slider: from n/a through 0.1.9.
- Product
- Griden Responsive Slider responsive-slider
- Affected
- up to 0.1.9
- What to do
- Affects up to 0.1.9. Update Griden Responsive Slider responsive-slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 12, 2026RocketGeek WP-Members wp-members: Missing AuthorizationCVE-2026-61994 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in RocketGeek WP-Members wp-members allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP-Members: from n/a through 3.5.7.
- Product
- RocketGeek WP-Members wp-members
- Affected
- up to 3.5.7
- What to do
- Affects up to 3.5.7. Update RocketGeek WP-Members wp-members to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 12, 2026Pixelite Events Manager events-manager: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')CVE-2026-42689 · WordPress plugins & themes · reported by PatchstackLow 3.7
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Pixelite Events Manager events-manager allows Leveraging Race Conditions.This issue affects Events Manager: from n/a through 7.4.7.
- Product
- Pixelite Events Manager events-manager
- Affected
- up to 7.4.7
- What to do
- Affects up to 7.4.7. Update Pixelite Events Manager events-manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 12, 2026WPMU DEV Forminator forminator: Missing AuthorizationCVE-2026-108486 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WPMU DEV Forminator forminator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Forminator: from n/a through 1.58.0.
- Product
- WPMU DEV Forminator forminator
- Affected
- up to 1.58.0
- What to do
- Affects up to 1.58.0. Update WPMU DEV Forminator forminator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 12, 2026LeapWorx Premium Addons for Elementor premium-addons-for-elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-108482 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LeapWorx Premium Addons for Elementor premium-addons-for-elementor allows Stored XSS.This issue affects Premium Addons for Elementor: from n/a through 4.11.110.
- Product
- LeapWorx Premium Addons for Elementor premium-addons-for-elementor
- Affected
- up to 4.11.110
- What to do
- Affects up to 4.11.110. Update LeapWorx Premium Addons for Elementor premium-addons-for-elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 12, 2026Patreon Patreon WordPress patreon-connect: Cross-Site Request Forgery (CSRF)CVE-2026-108481 · WordPress plugins & themes · reported by PatchstackHigh 7.4
Cross-Site Request Forgery (CSRF) vulnerability in Patreon Patreon WordPress patreon-connect allows Cross Site Request Forgery.This issue affects Patreon WordPress: from n/a through 1.10.0.
- Product
- Patreon Patreon WordPress patreon-connect
- Affected
- up to 1.10.0
- What to do
- Affects up to 1.10.0. Update Patreon Patreon WordPress patreon-connect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 12, 2026Patreon Patreon WordPress patreon-connect: Cross-Site Request Forgery (CSRF)CVE-2026-108479 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Cross-Site Request Forgery (CSRF) vulnerability in Patreon Patreon WordPress patreon-connect allows Cross Site Request Forgery.This issue affects Patreon WordPress: from n/a through 1.9.17.
- Product
- Patreon Patreon WordPress patreon-connect
- Affected
- up to 1.9.17
- What to do
- Affects up to 1.9.17. Update Patreon Patreon WordPress patreon-connect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 12, 2026ExpressTech Quiz And Survey Master quiz-master-next: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-107862 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows DOM-Based XSS.This issue affects Quiz And Survey Master: from n/a through 11.2.7.
- Product
- ExpressTech Quiz And Survey Master quiz-master-next
- Affected
- up to 11.2.7
- What to do
- Affects up to 11.2.7. Update ExpressTech Quiz And Survey Master quiz-master-next to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 12, 2026Arraytics Booktics booktics: Missing AuthorizationCVE-2026-107418 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Arraytics Booktics booktics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booktics: from n/a through 1.0.28.
- Product
- Arraytics Booktics booktics
- Affected
- up to 1.0.28
- What to do
- Affects up to 1.0.28. Update Arraytics Booktics booktics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 12, 2026VillaTheme Salevo woo-boost-sales: External Control of Assumed-Immutable Web ParameterCVE-2026-103080 · WordPress plugins & themes · reported by PatchstackMedium 5.3
External Control of Assumed-Immutable Web Parameter vulnerability in VillaTheme Salevo woo-boost-sales allows Input Data Manipulation.This issue affects Salevo: from n/a through 1.3.0.
- Product
- VillaTheme Salevo woo-boost-sales
- Affected
- up to 1.3.0
- What to do
- Affects up to 1.3.0. Update VillaTheme Salevo woo-boost-sales to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 12, 2026BdThemes Element Pack Elementor Addons bdthemes-element-pack-lite: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-108478 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BdThemes Element Pack Elementor Addons bdthemes-element-pack-lite allows Stored XSS.This issue affects Element Pack Elementor Addons: from n/a through 8.8.8.
- Product
- BdThemes Element Pack Elementor Addons bdthemes-element-pack-lite
- Affected
- up to 8.8.8
- What to do
- Affects up to 8.8.8. Update BdThemes Element Pack Elementor Addons bdthemes-element-pack-lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 12, 2026Arraytics Booktics booktics: Missing AuthorizationCVE-2026-108477 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Arraytics Booktics booktics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booktics: from n/a through 1.0.28.
- Product
- Arraytics Booktics booktics
- Affected
- up to 1.0.28
- What to do
- Affects up to 1.0.28. Update Arraytics Booktics booktics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 12, 2026VideoWhisper: Missing AuthorizationCVE-2026-108476 · WordPress plugins & themes · reported by PatchstackMedium 5
Missing Authorization vulnerability in VideoWhisper.com Paid Videochat Turnkey Site ppv-live-webcams allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Paid Videochat Turnkey Site: from n/a through 7.5.13.
- Product
- VideoWhisper
- Affected
- up to 7.5.13
- What to do
- Affects up to 7.5.13. Update VideoWhisper to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 12, 2026VideoWhisper: Missing AuthorizationCVE-2026-108475 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in VideoWhisper.com Broadcast Live Video videowhisper-live-streaming-integration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Broadcast Live Video: from n/a through 7.3.6.
- Product
- VideoWhisper
- Affected
- up to 7.3.6
- What to do
- Affects up to 7.3.6. Update VideoWhisper to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 12, 2026DLX Plugins Custom Query Blocks post-type-archive-mapping: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-108168 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DLX Plugins Custom Query Blocks post-type-archive-mapping allows Stored XSS.This issue affects Custom Query Blocks: from n/a through 5.6.0.
- Product
- DLX Plugins Custom Query Blocks post-type-archive-mapping
- Affected
- up to 5.6.0
- What to do
- Affects up to 5.6.0. Update DLX Plugins Custom Query Blocks post-type-archive-mapping to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 12, 2026WP Desk Flexible Subscriptions flexible-subscriptions: Missing AuthorizationCVE-2026-107869 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WP Desk Flexible Subscriptions flexible-subscriptions allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Flexible Subscriptions: from n/a through 1.8.4.
- Product
- WP Desk Flexible Subscriptions flexible-subscriptions
- Affected
- up to 1.8.4
- What to do
- Affects up to 1.8.4. Update WP Desk Flexible Subscriptions flexible-subscriptions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 12, 2026Crocoblock JetElements For Elementor jet-elements: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-107866 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetElements For Elementor jet-elements allows Stored XSS.This issue affects JetElements For Elementor: from n/a through 2.9.2.3.
- Product
- Crocoblock JetElements For Elementor jet-elements
- Affected
- up to 2.9.2.3
- What to do
- Affects up to 2.9.2.3. Update Crocoblock JetElements For Elementor jet-elements to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 12, 2026Crocoblock JetMenu jet-menu: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-107865 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetMenu jet-menu allows Stored XSS.This issue affects JetMenu: from n/a through 3.0.5.
- Product
- Crocoblock JetMenu jet-menu
- Affected
- up to 3.0.5
- What to do
- Affects up to 3.0.5. Update Crocoblock JetMenu jet-menu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 12, 2026Igor Funa Ad Inserter ad-inserter: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-107864 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Igor Funa Ad Inserter ad-inserter allows Stored XSS.This issue affects Ad Inserter: from n/a through 2.8.18.
- Product
- Igor Funa Ad Inserter ad-inserter
- Affected
- up to 2.8.18
- What to do
- Affects up to 2.8.18. Update Igor Funa Ad Inserter ad-inserter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 12, 2026Codection Products Restricted Users for WooCommerce woo-products-restricted-users: Missing AuthorizationCVE-2026-107863 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Codection Products Restricted Users for WooCommerce woo-products-restricted-users allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Products Restricted Users for WooCommerce: from n/a through 0.7.
- Product
- Codection Products Restricted Users for WooCommerce woo-products-restricted-users
- Affected
- up to 0.7
- What to do
- Affects up to 0.7. Update Codection Products Restricted Users for WooCommerce woo-products-restricted-users to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 12, 2026WP User Manager WP User Manager wp-user-manager: Missing AuthorizationCVE-2026-107423 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WP User Manager WP User Manager wp-user-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP User Manager: from n/a through 2.9.22.
- Product
- WP User Manager WP User Manager wp-user-manager
- Affected
- up to 2.9.22
- What to do
- Affects up to 2.9.22. Update WP User Manager WP User Manager wp-user-manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 12, 2026Pluggabl LLC: Insertion of Sensitive Information Into Sent DataCVE-2023-25996 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Insertion of Sensitive Information Into Sent Data vulnerability in Pluggabl LLC. Booster Elite for WooCommerce booster-elite-for-woocommerce allows Retrieve Embedded Sensitive Data.This issue affects Booster Elite for WooCommerce: from n/a before 8.4.0.
- Product
- Pluggabl LLC
- Fixed in
- 8.4.0
- What to do
- Update Pluggabl LLC to 8.4.0 or newer.
Oct 12, 2026NOUS Ouvert Utile et Simple Event post event-post: Missing AuthorizationCVE-2026-107432 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in NOUS Ouvert Utile et Simple Event post event-post allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event post: from n/a through 6.1.1.
- Product
- NOUS Ouvert Utile et Simple Event post event-post
- Affected
- up to 6.1.1
- What to do
- Affects up to 6.1.1. Update NOUS Ouvert Utile et Simple Event post event-post to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 12, 2026VideoWhisper: Missing AuthorizationCVE-2026-107430 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in VideoWhisper.com VideoWhisper Site Manager for ChatGPT, Claude, Codex videowhisper-site-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VideoWhisper Site Manager for ChatGPT, Claude, Codex: from n/a through 1.2.10.
- Product
- VideoWhisper
- Affected
- up to 1.2.10
- What to do
- Affects up to 1.2.10. Update VideoWhisper to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 12, 2026VideoWhisper: Improper Validation of Specified Quantity in InputCVE-2026-107429 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Improper Validation of Specified Quantity in Input vulnerability in VideoWhisper.com Paid Videochat Turnkey Site ppv-live-webcams allows Input Data Manipulation.This issue affects Paid Videochat Turnkey Site: from n/a through 7.5.12.
- Product
- VideoWhisper
- Affected
- up to 7.5.12
- What to do
- Affects up to 7.5.12. Update VideoWhisper to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 12, 2026NOUS Ouvert Utile et Simple Event post event-post: Authorization Bypass Through User-Controlled KeyCVE-2026-107427 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Authorization Bypass Through User-Controlled Key vulnerability in NOUS Ouvert Utile et Simple Event post event-post allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event post: from n/a through 6.1.1.
- Product
- NOUS Ouvert Utile et Simple Event post event-post
- Affected
- up to 6.1.1
- What to do
- Affects up to 6.1.1. Update NOUS Ouvert Utile et Simple Event post event-post to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 12, 2026WP Desk Flexible Quantity – Measurement Price Calculator for WooCommerce flexible-quantity-measurement-price-calculator-for-woocommerce: Improper Validation of Specified Quantity in InputCVE-2026-106605 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Improper Validation of Specified Quantity in Input vulnerability in WP Desk Flexible Quantity – Measurement Price Calculator for WooCommerce flexible-quantity-measurement-price-calculator-for-woocommerce allows Input Data Manipulation.This issue affects Flexible Quantity – Measurement Price Calculator for WooCommerce: from n/a through 2.3.22.
- Product
- WP Desk Flexible Quantity – Measurement Price Calculator for WooCommerce flexible-quantity-measurement-price-calculator-for-woocommerce
- Affected
- up to 2.3.22
- What to do
- Affects up to 2.3.22. Update WP Desk Flexible Quantity – Measurement Price Calculator for WooCommerce flexible-quantity-measurement-price-calculator-for-woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 12, 2026VillaTheme TMDS tmds-dropshipping-for-temu-and-woo: Missing AuthorizationCVE-2026-103356 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in VillaTheme TMDS tmds-dropshipping-for-temu-and-woo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects TMDS: from n/a through 1.0.15.
- Product
- VillaTheme TMDS tmds-dropshipping-for-temu-and-woo
- Affected
- up to 1.0.15
- What to do
- Affects up to 1.0.15. Update VillaTheme TMDS tmds-dropshipping-for-temu-and-woo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 12, 2026Hotel Booking: Does not verify that a booking record belongs to the user requesting itCVE-2026-84167 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Hotel Booking WordPress plugin through 3.8 does not verify that a booking record belongs to the user requesting it, allowing any authenticated user such as a Subscriber to read other customers' booking details, including their name, email address, phone number and postal address, by referencing an identifier they do not own.
- Product
- Hotel Booking
- Affected
- up to 3.8
- What to do
- Affects up to 3.8. Update Hotel Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 12, 2026Hotel Booking: Does not implement CSRF protection on its administrative booking order managementCVE-2026-84166 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Hotel Booking WordPress plugin through 3.8 does not implement CSRF protection on its administrative booking order management, allowing attackers to trick a logged-in administrator into creating, deleting, or modifying arbitrary booking order records via a forged request.
- Product
- Hotel Booking
- Affected
- up to 3.8
- What to do
- Affects up to 3.8. Update Hotel Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 12, 2026WP Comment Cleaner: Does not perform a capability check or validate a nonce on one of its bulk comment-deletion routinesCVE-2026-107791 · WordPress plugins & themes · reported by WPScanMedium 6.5
The WP Comment Cleaner WordPress plugin before 7.2 does not perform a capability check or validate a nonce on one of its bulk comment-deletion routines, allowing authenticated users with minimal permissions, such as subscribers, to permanently delete all comments on the site.
- Product
- WP Comment Cleaner
- Fixed in
- 7.2
- What to do
- Update WP Comment Cleaner to 7.2 or newer.
Oct 12, 2026HireZoot: Does not sanitise and escape one of its job specification settings before it is reflected back into an admin-area settings pageCVE-2025-15703 · WordPress plugins & themes · reported by WPScanLow 3.5
The HireZoot WordPress plugin before 4.0.0 does not sanitise and escape one of its job specification settings before it is reflected back into an admin-area settings page, allowing users with the HireZoot WordPress plugin before 4.0.0's management capability (Administrator by default) to store a payload that is executed in the browser of any administrator who later opens that page. As the unfiltered_html capability is not available to administrators on multisite (or where DISALLOW_UNFILTERED_HTML is set), this leads to Stored Cross-Site Scripting.
- Product
- HireZoot
- Fixed in
- 4.0.0
- What to do
- Update HireZoot to 4.0.0 or newer.
Oct 11, 2026ngx_cache_purge before 3.0.4 can allow file deletion via a symlink attack in certain situations where nginx and a served application (e.g., WordPress) run underCVE-2026-108981 · WordPress plugins & themes · reported by MITRELow 3.6
ngx_cache_purge before 3.0.4 can allow file deletion via a symlink attack in certain situations where nginx and a served application (e.g., WordPress) run under the same user account. The attacker must be able to create a symlink inside the cache path. Version 3.0.4 fixes this for the case of a symlink created at an arbitrary earlier time, but does not resolve an applicable TOCTOU race condition. (The ngx_cache_purge module follows symlinks while walking the cache directory tree during purge operations. The module relies on nginx's ngx_walk_tree(), which relies on stat() and therefore follows symlinks.)
- Fixed in
- 3.0.4
- What to do
- Update the plugin to 3.0.4 or newer.
Oct 11, 2026WP-Invoice: Does not perform capability checks in several of its AJAX handlersCVE-2026-97183 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WP-Invoice WordPress plugin through 4.3.1 does not perform capability checks in several of its AJAX handlers, allowing any authenticated user, such as a Subscriber, to retrieve the email addresses, display names and profile details of all registered users.
- Product
- WP-Invoice
- Affected
- up to 4.3.1
- What to do
- Affects up to 4.3.1. Update WP-Invoice to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 11, 2026Piotnet Forms: Does not authenticate or validate a form-submission file-upload request and permits browser-renderable file types to be storedCVE-2026-96227 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Piotnet Forms WordPress plugin through 1.0.30 does not authenticate or validate a form-submission file-upload request and permits browser-renderable file types to be stored, allowing unauthenticated attackers to store a file that executes arbitrary JavaScript in the site's origin when it is opened (Stored XSS).
- Product
- Piotnet Forms
- Affected
- up to 1.0.30
- What to do
- Affects up to 1.0.30. Update Piotnet Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 11, 2026MemberHero: Does not perform any capability or nonce check on one of its AJAX actionsCVE-2026-94235 · WordPress plugins & themes · reported by WPScanMedium 4.3
The MemberHero WordPress plugin through 6.9 does not perform any capability or nonce check on one of its AJAX actions, allowing any authenticated user, such as a subscriber, to make the site send arbitrary HTML emails to arbitrary recipients from its own mail system, which can be abused to relay phishing carrying the site's identity and domain reputation.
- Product
- MemberHero
- Affected
- up to 6.9
- What to do
- Affects up to 6.9. Update MemberHero to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 11, 2026Veeqo for WooCommerce: Does not restrict who can trigger its remote bridge-installation process or validate the URL it is given before downloading and extracting itCVE-2026-93550 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Veeqo for WooCommerce WordPress plugin through 2.2.8 does not restrict who can trigger its remote bridge-installation process or validate the URL it is given before downloading and extracting it, allowing users with Subscriber-level access and above to make the Veeqo for WooCommerce WordPress plugin through 2.2.8 download and extract an attacker-controlled archive containing arbitrary PHP files into the WordPress root.
- Product
- Veeqo for WooCommerce
- Affected
- up to 2.2.8
- What to do
- Affects up to 2.2.8. Update Veeqo for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 11, 2026Subscribe to Comments: Does not properly validate a parameter before reflecting it into a link targetCVE-2026-91829 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Subscribe to Comments WordPress plugin before 2.3.3 does not properly validate a parameter before reflecting it into a link target, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting via a crafted URL against anyone who clicks it, including administrators.
- Product
- Subscribe to Comments
- Fixed in
- 2.3.3
- What to do
- Update Subscribe to Comments to 2.3.3 or newer.
Oct 11, 2026paymendo: Does not properly sanitize and escape a parameter before using it in a SQL queryCVE-2026-89305 · WordPress plugins & themes · reported by WPScanMedium 6.5
The paymendo WordPress plugin through 1.1 does not properly sanitize and escape a parameter before using it in a SQL query, allowing any authenticated user to perform SQL injection attacks.
- Product
- paymendo
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update paymendo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 11, 2026paymendo: Does not properly sanitize and escape a parameter before using it in a SQL queryCVE-2026-89304 · WordPress plugins & themes · reported by WPScanMedium 6.5
The paymendo WordPress plugin through 1.1 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform blind SQL injection attacks.
- Product
- paymendo
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update paymendo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. The WordPress, CMS and hosting-panel entries come from the National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan and others); we show who. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, a booking system, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.