Updated 15 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,769exploited flaws on CISA’s list

30added in the last 30 days

456new WordPress flaws this week

394,547entries in the database

19,369 results · page 18 of 388

Oct 4, 2026Five Star Business Profile and Schema: Does not properly restrict the callbacks used to resolve schema field default valuesCVE-2026-86817 · WordPress plugins & themes · reported by WPScanMedium 4.9
The Five Star Business Profile and Schema WordPress plugin before 2.4.0 does not properly restrict the callbacks used to resolve schema field default values, allowing authenticated users with Author-level access and above to store input that discloses sensitive data, including other users' password hashes and arbitrary site option values, in public output readable by unauthenticated visitors.
Product
Five Star Business Profile and Schema
Fixed in
2.4.0
What to do
Update Five Star Business Profile and Schema to 2.4.0 or newer.
Full record and what to do →NVD record wpscan.com
Oct 4, 2026Horizontal scrolling announcements: Does not sanitise and escape one of its announcement settings before outputting it into an attribute context on the front endCVE-2026-17005 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Horizontal scrolling announcements WordPress plugin through 2.6 does not sanitise and escape one of its announcement settings before outputting it into an attribute context on the front end, allowing users granted access to the announcement management page (Contributor and above, once permitted) to perform Stored Cross-Site Scripting attacks that execute in the browser of anyone viewing the announcement.
Product
Horizontal scrolling announcements
Affected
up to 2.6
What to do
Affects up to 2.6. Update Horizontal scrolling announcements to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Oct 4, 2026Simple Shopping Cart: Does not escape some of its settings field values before outputting them on an admin settings pageCVE-2026-104119 · WordPress plugins & themes · reported by WPScanLow 3.5
The Simple Shopping Cart WordPress plugin before 5.2.6 does not escape some of its settings field values before outputting them on an admin settings page, allowing high-privilege users such as administrators to perform Stored Cross-Site Scripting attacks, which is notably impactful on multisite installations where administrators do not have the unfiltered_html capability.
Product
Simple Shopping Cart
Fixed in
5.2.6
What to do
Update Simple Shopping Cart to 5.2.6 or newer.
Full record and what to do →NVD record wpscan.com
Oct 4, 2026Razorpay for WooCommerce: Does not perform ownership or authorization checks on a REST API route used during checkoutCVE-2026-104118 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Razorpay for WooCommerce WordPress plugin before 4.8.8 does not perform ownership or authorization checks on a REST API route used during checkout, allowing unauthenticated attackers to modify the shipping information stored on arbitrary orders.
Product
Razorpay for WooCommerce
Fixed in
4.8.8
What to do
Update Razorpay for WooCommerce to 4.8.8 or newer.
Full record and what to do →NVD record wpscan.com
Oct 3, 2026Pie Register: Does not restrict access to an invitation-code reportCVE-2026-96962 · WordPress plugins & themes · reported by WPScanLow 3.7
The Pie Register WordPress plugin before 3.8.4.14 does not restrict access to an invitation-code report, allowing unauthenticated visitors who know a valid invitation code to obtain the username and email address of every user who registered with that code.
Product
Pie Register
Fixed in
3.8.4.14
What to do
Update Pie Register to 3.8.4.14 or newer.
Full record and what to do →NVD record wpscan.com
Oct 3, 2026Loco Translate: Does not sanitise and escape some bundle configuration values before outputting them back in an admin pageCVE-2026-94239 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Loco Translate WordPress plugin before 2.8.9 does not sanitise and escape some bundle configuration values before outputting them back in an admin page, allowing users with the translator capability and above to perform Stored Cross-Site Scripting attacks against high privilege users such as administrators.
Product
Loco Translate
Fixed in
2.8.9
What to do
Update Loco Translate to 2.8.9 or newer.
Full record and what to do →NVD record wpscan.com
Oct 3, 2026Loco Translate: Does not restrictCVE-2026-94238 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Loco Translate WordPress plugin before 2.8.9 does not restrict which file paths its translation file routes will read, allowing users granted the Loco Translate WordPress plugin before 2.8.9's translator capability to retrieve the contents of files of certain types from anywhere on the server, including outside the web root.
Product
Loco Translate
Fixed in
2.8.9
What to do
Update Loco Translate to 2.8.9 or newer.
Full record and what to do →NVD record wpscan.com
Oct 3, 2026Unlimited Elements for Elementor: Does not sanitise and escape a parameter before using it in a SQL statementCVE-2026-92923 · WordPress plugins & themes · reported by WPScanMedium 6.3
The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not sanitise and escape a parameter before using it in a SQL statement, allowing users with a role as low as subscriber to perform blind SQL injection attacks and read arbitrary data from the database. Version 2.0.18 removed the subscriber-level access, so from 2.0.18 onward the issue requires a Contributor role or above.
Product
Unlimited Elements for Elementor
Fixed in
2.0.21
What to do
Update Unlimited Elements for Elementor to 2.0.21 or newer.
Full record and what to do →NVD record wpscan.com
Oct 3, 2026Mailchimp for WooCommerce: Does not require authenticationCVE-2026-92437 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Mailchimp for WooCommerce WordPress plugin before 6.3 does not require authentication, a nonce or an ownership check before it acts on a customer's abandoned-cart record identified from request-supplied data, allowing an unauthenticated attacker to modify or delete another customer's stored cart.
Product
Mailchimp for WooCommerce
Fixed in
6.3
What to do
Update Mailchimp for WooCommerce to 6.3 or newer.
Full record and what to do →NVD record wpscan.com
Oct 3, 2026TillKit: Does not require the hard-codedCVE-2026-91078 · WordPress plugins & themes · reported by WPScanHigh 8.2
The TillKit WordPress plugin before 1.0.5 does not require the hard-coded, publicly known PIN of the privileged POS account it creates on activation to be changed before use, and it authenticates its public POS login endpoint on that PIN alone with no identity or capability check, allowing unauthenticated attackers to obtain a privileged POS session and thereby read customer and site-user personal data and modify store data.
Product
TillKit
Fixed in
1.0.5
What to do
Update TillKit to 1.0.5 or newer.
Full record and what to do →NVD record wpscan.com
Oct 3, 2026SaveTo Wishlist Lite: Does not sanitise and escape parameters before using them in the ORDER BY clause of a SQL queryCVE-2026-89236 · WordPress plugins & themes · reported by WPScanHigh 8.6
The SaveTo Wishlist Lite WordPress plugin before 1.1.5 does not sanitise and escape parameters before using them in the ORDER BY clause of a SQL query, allowing unauthenticated attackers to append additional SQL queries and extract sensitive information from the database.
Product
SaveTo Wishlist Lite
Fixed in
1.1.5
What to do
Update SaveTo Wishlist Lite to 1.1.5 or newer.
Full record and what to do →NVD record wpscan.com
Oct 3, 2026Kubio AI Page Builder: Does not limit its widening of the allowed HTML elements to the editor contextCVE-2026-88783 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Kubio AI Page Builder WordPress plugin before 2.9.3 does not limit its widening of the allowed HTML elements to the editor context, so the wider set is applied when filtering content submitted by unauthenticated users as well, allowing them to store markup which the Kubio AI Page Builder WordPress plugin before 2.9.3's own script later executes in the browser of any visitor, or of an administrator reviewing the still-unapproved submission.
Product
Kubio AI Page Builder
Fixed in
2.9.3
What to do
Update Kubio AI Page Builder to 2.9.3 or newer.
Full record and what to do →NVD record wpscan.com
Oct 3, 2026Kubio AI Page Builder: Does not validate the URI scheme of a user-supplied value before outputting itCVE-2026-88782 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Kubio AI Page Builder WordPress plugin before 2.9.3 does not validate the URI scheme of a user-supplied value before outputting it as a link target, allowing users with the contributor role and above to store a payload which executes in the browser of anyone who follows the link, including an administrator previewing the unpublished submission.
Product
Kubio AI Page Builder
Fixed in
2.9.3
What to do
Update Kubio AI Page Builder to 2.9.3 or newer.
Full record and what to do →NVD record wpscan.com
Oct 3, 2026MetForm: Does not properly restrict access to a debug file it writes to the web root on every form submissionCVE-2026-86834 · WordPress plugins & themes · reported by WPScanLow 3.7
The MetForm WordPress plugin before 4.3.1 does not properly restrict access to a debug file it writes to the web root on every form submission when its HubSpot Forms integration is enabled, allowing unauthenticated attackers to read upstream API response data, including correlation identifiers and cookies.
Product
MetForm
Fixed in
4.3.1
What to do
Update MetForm to 4.3.1 or newer.
Full record and what to do →NVD record wpscan.com
Oct 3, 2026MetForm: Does not properly restrict access to form submission dataCVE-2026-86832 · WordPress plugins & themes · reported by WPScanMedium 5.3
The MetForm WordPress plugin before 4.3.1 does not properly restrict access to form submission data, allowing unauthenticated attackers to view submitter information through the REST API.
Product
MetForm
Fixed in
4.3.1
What to do
Update MetForm to 4.3.1 or newer.
Full record and what to do →NVD record wpscan.com
Oct 3, 2026Unlimited Elements for Elementor: Does not correctly handle a search value before rewriting an already prepared SQL statementCVE-2026-85568 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not correctly handle a search value before rewriting an already prepared SQL statement, allowing unauthenticated users to perform SQL injection attacks and to retrieve non-public content, when a related widget option is set away from its default.
Product
Unlimited Elements for Elementor
Fixed in
2.0.21
What to do
Update Unlimited Elements for Elementor to 2.0.21 or newer.
Full record and what to do →NVD record wpscan.com
Oct 3, 2026Unlimited Elements for Elementor: Does not sanitise file paths inside uploaded archives before extracting themCVE-2026-85015 · WordPress plugins & themes · reported by WPScanMedium 6.6
The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not sanitise file paths inside uploaded archives before extracting them, allowing authenticated users with access to its asset-management feature (Administrators by default, or Editors when a non-default Unlimited Elements for Elementor WordPress plugin before 2.0.21 setting is enabled) to write arbitrary files, including executable PHP, outside the intended upload directory on servers where the PHP zip extension is unavailable, leading to Remote Code Execution.
Product
Unlimited Elements for Elementor
Fixed in
2.0.21
What to do
Update Unlimited Elements for Elementor to 2.0.21 or newer.
Full record and what to do →NVD record wpscan.com
Oct 3, 2026WP Ultimate CSV Importer: Does not use a site-specific secretCVE-2026-80518 · WordPress plugins & themes · reported by WPScanLow 3.7
The WP Ultimate CSV Importer WordPress plugin before 9.2 does not use a site-specific secret when deriving the storage location of the import logs it writes under the uploads directory, nor does it block direct access to them, allowing unauthenticated attackers to retrieve the personal data of users imported from a CSV file.
Product
WP Ultimate CSV Importer
Fixed in
9.2
What to do
Update WP Ultimate CSV Importer to 9.2 or newer.
Full record and what to do →NVD record wpscan.com
Oct 3, 2026WP Ultimate CSV Importer: Does not properly validate the file types contained in an uploaded archive nor sanitise their content before storing them in a publicly served locationCVE-2026-80517 · WordPress plugins & themes · reported by WPScanLow 3.5
The WP Ultimate CSV Importer WordPress plugin before 9.2 does not properly validate the file types contained in an uploaded archive nor sanitise their content before storing them in a publicly served location, allowing high privilege users such as administrators to achieve Stored Cross-Site Scripting. On Multisite installations a site Administrator does not hold the unfiltered_html capability, so this lets them run scripts in the session of users who view the file, including Network Super Admins.
Product
WP Ultimate CSV Importer
Fixed in
9.2
What to do
Update WP Ultimate CSV Importer to 9.2 or newer.
Full record and what to do →NVD record wpscan.com
Oct 3, 2026WP 2FA: Does not invalidate a time-based one-time passcode once it has been usedCVE-2026-103514 · WordPress plugins & themes · reported by WPScanHigh 7.5
The WP 2FA WordPress plugin before 4.1.0 does not invalidate a time-based one-time passcode once it has been used, allowing an attacker who knows an account's password and has observed a valid code within its validity window to replay it and bypass two-factor authentication, including on administrator accounts.
Product
WP 2FA
Fixed in
4.1.0
What to do
Update WP 2FA to 4.1.0 or newer.
Full record and what to do →NVD record wpscan.com
Oct 3, 2026MPG: Does not validate that the dataset source suppliedCVE-2026-103293 · WordPress plugins & themes · reported by WPScanMedium 6.8
The MPG WordPress plugin before 4.2.3 does not validate that the dataset source supplied when importing a project is a remote URL before treating it as a local filesystem path and copying that file into a publicly accessible uploads folder. This makes it possible for users with the Editor role and above to read the contents of arbitrary files on the server, with the copied file then retrievable by unauthenticated visitors.
Product
MPG
Fixed in
4.2.3
What to do
Update MPG to 4.2.3 or newer.
Full record and what to do →NVD record wpscan.com
Oct 3, 2026WP Ultimate Review: Does not escape some of its review overview settings before outputting them in postsCVE-2026-101162 · WordPress plugins & themes · reported by WPScanMedium 6.4
The WP Ultimate Review WordPress plugin before 2.4.4 does not escape some of its review overview settings before outputting them in posts, which could allow users with a role as low as author to perform Stored Cross-Site Scripting attacks, when author reviews are enabled.
Product
WP Ultimate Review
Fixed in
2.4.4
What to do
Update WP Ultimate Review to 2.4.4 or newer.
Full record and what to do →NVD record wpscan.com
Oct 3, 2026WP Ultimate Review: Does not prevent unauthenticated users from storing crafted review content that makes the reviewed page fail with a fatal error on every subsequent visitCVE-2026-101161 · WordPress plugins & themes · reported by WPScanHigh 7.5
The WP Ultimate Review WordPress plugin before 2.4.4 does not prevent unauthenticated users from storing crafted review content that makes the reviewed page fail with a fatal error on every subsequent visit, resulting in a persistent denial of service when the WP Ultimate Review WordPress plugin before 2.4.4's review display settings have never been saved.
Product
WP Ultimate Review
Fixed in
2.4.4
What to do
Update WP Ultimate Review to 2.4.4 or newer.
Full record and what to do →NVD record wpscan.com
Oct 3, 2026WP Ultimate Review: Does not validate that a submitted review rating is numeric before storing it and later using it in numeric operationsCVE-2026-101160 · WordPress plugins & themes · reported by WPScanHigh 7.5
The WP Ultimate Review WordPress plugin before 2.4.4 does not validate that a submitted review rating is numeric before storing it and later using it in numeric operations when rendering reviews, allowing unauthenticated users to make the reviewed content fail with a fatal error for all visitors until the review is removed (a persistent denial of service), when user reviews are enabled.
Product
WP Ultimate Review
Fixed in
2.4.4
What to do
Update WP Ultimate Review to 2.4.4 or newer.
Full record and what to do →NVD record wpscan.com
Oct 3, 2026WP Ultimate Review: Does not properly sanitise and escape reviews submitted through its public review formCVE-2026-101159 · WordPress plugins & themes · reported by WPScanHigh 7.5
The WP Ultimate Review WordPress plugin before 2.4.4 does not properly sanitise and escape reviews submitted through its public review form, which is available to unauthenticated visitors, allowing them to perform Stored Cross-Site Scripting attacks against any user, including administrators, viewing a page displaying the review, when user reviews are enabled.
Product
WP Ultimate Review
Fixed in
2.4.4
What to do
Update WP Ultimate Review to 2.4.4 or newer.
Full record and what to do →NVD record wpscan.com
Oct 2, 2026In ConvertX before 0.19.0, converters/calibre.ts does not block recipe files, and instead passes them to the ebook-convert program from Calibre.CVE-2026-105080 · Other software · C4illin · reported by MITRECritical 9.4
In ConvertX before 0.19.0, converters/calibre.ts does not block recipe files, and instead passes them to the ebook-convert program from Calibre. This affects executable code in a .recipe or .downloaded_recipe file.
Product
ConvertX
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Oct 2, 2026Zilliz Attu before 3.0.0 has a Playground feature that does not require authentication for proxying arbitrary HTTP and HTTPS requests to URLs on the public inteCVE-2026-105049 · Other software · Zilliz · reported by MITREMedium 5.8
Zilliz Attu before 3.0.0 has a Playground feature that does not require authentication for proxying arbitrary HTTP and HTTPS requests to URLs on the public internet.
Product
Attu
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bishopfox.com github.com
Oct 2, 2026All in One SEO: Does not correctly determineCVE-2026-19856 · WordPress plugins & themes · reported by WPScanMedium 6.5
The All in One SEO WordPress plugin before 5.0.2.1 does not correctly determine which shortcodes are present in content derived from user input before deciding which ones to strip, allowing unauthenticated users to execute arbitrary shortcodes registered on the site. On sites upgraded from older versions the protection is disabled outright, making the issue reachable without any crafted input.
Product
All in One SEO
Fixed in
5.0.2.1
What to do
Update All in One SEO to 5.0.2.1 or newer.
Full record and what to do →NVD record wpscan.com
Oct 2, 2026PostCSS Selector Parser is a CSS selector parser that integrates with PostCSS but does not require it.CVE-2026-104844 · Other software · postcss · reported by GitHubMedium 5.9
PostCSS Selector Parser is a CSS selector parser that integrates with PostCSS but does not require it. Prior to 7.1.6, src/parser.js splitWord() can receive a flat selector as one word token carrying many class or ID indexes because period and hash characters are not tokenizer word delimiters. The uniqs() deduplication and per-index class and ID membership checks repeatedly scan the class and ID index arrays, while a separate Sass-interpolation filtering pass also performs repeated linear scanning. Together, these passes make parsing quadratic in the number of indexes and allow a crafted selector to occupy a synchronous parser thread. The maxNestingDepth guard does not mitigate the issue because the hostile selector can have zero nesting depth. Only consumers that synchronously parse untrusted selectors in an exposed request path are affected; ordinary build-time parsing of trusted sources is not affected. This issue is fixed in version 7.1.6.
Product
postcss-selector-parser
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Oct 2, 2026YesWiki before 4.6.7 contains a session fixation vulnerability that allows attackers to hijack authenticated sessions because login does not regenerate the PHP CVE-2026-104469 · Other software · YesWiki · reported by VulnCheckHigh 7.6
YesWiki before 4.6.7 contains a session fixation vulnerability that allows attackers to hijack authenticated sessions because login does not regenerate the PHP session ID. Attackers who set or learn a victim's pre-authentication YesWiki-* session cookie can reuse it after login to access private content and perform actions with the victim's privileges.
Product
yeswiki
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com vulncheck.com
Oct 2, 2026Zebra (zebrad) 5.0.0 before 6.0.0-rc.0 does not apply its per-peer mempool admission cap to transactions received as direct P2P tx messages, because these are qCVE-2026-104429 · Other software · ZcashFoundation · reported by VulnCheckMedium 6.9
Zebra (zebrad) 5.0.0 before 6.0.0-rc.0 does not apply its per-peer mempool admission cap to transactions received as direct P2P tx messages, because these are queued without the sending peer recorded as their source. A remote inbound peer can push many unique transactions to occupy a disproportionate share of mempool admission slots, crowding out honest peers' transaction relay.
Product
zebra
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com vulncheck.com
Oct 2, 2026Ghost 0.5.0 before 6.64.0 does not correctly restrict staff role assignment, allowing users with the Editor or Super Editor role to assign their own role to othCVE-2026-104412 · Other software · TryGhost · reported by VulnCheckMedium 5.3
Ghost 0.5.0 before 6.64.0 does not correctly restrict staff role assignment, allowing users with the Editor or Super Editor role to assign their own role to other staff despite lacking permission to do so. An authenticated Editor or Super Editor can promote Author and Contributor users to Editor or Super Editor.
Product
Ghost
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com vulncheck.com
Oct 2, 2026An improper verification of cryptographic signature vulnerability exists in protocol gateways because the device does not properly verify the cryptographic authCVE-2026-86326 · Other software · Moxa · reported by psirt@moxa.comHigh 8.6
An improper verification of cryptographic signature vulnerability exists in protocol gateways because the device does not properly verify the cryptographic authenticity of firmware images before installation. An attacker with high privileges and access to the firmware update interface could provide a specially crafted or modified firmware image, causing it to be installed on the device. Successful exploitation could allow the attacker to execute unauthorized code, compromise the integrity and availability of the device, and persist malicious modifications across subsequent firmware updates.
Product
MGate MB3170 Series
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record moxa.com
Oct 2, 2026MStore API: Does not restrictCVE-2026-97219 · WordPress plugins & themes · reported by WPScanMedium 4.3
The MStore API WordPress plugin before 4.22.1 does not restrict which fields of an order a customer may update, allowing any authenticated user with a self-registerable account to change the status of their own unpaid order to a paid or fulfilled state and receive the goods without paying.
Product
MStore API
Fixed in
4.22.1
What to do
Update MStore API to 4.22.1 or newer.
Full record and what to do →NVD record wpscan.com
Oct 2, 2026Unlimited Elements for Elementor: Does not check that a request to render widget output comes from a user allowed to make itCVE-2026-92924 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not check that a request to render widget output comes from a user allowed to make it, allowing users with a role as low as subscriber to have arbitrary WordPress shortcodes executed on the site. Version 2.0.18 removed the subscriber-level access, so from 2.0.18 onward the issue requires a Contributor role or above.
Product
Unlimited Elements for Elementor
Fixed in
2.0.21
What to do
Update Unlimited Elements for Elementor to 2.0.21 or newer.
Full record and what to do →NVD record wpscan.com
Oct 2, 2026WebToffee Gift Cards for WooCommerce: Does not validate a user-supplied gift card amount server-side before using itCVE-2026-91020 · WordPress plugins & themes · reported by WPScanMedium 5.3
The WebToffee Gift Cards for WooCommerce WordPress plugin before 1.3.1 does not validate a user-supplied gift card amount server-side before using it as the cart-item price and store-credit coupon value, allowing unauthenticated users to submit an arbitrary or negative amount, bypassing the configured denominations and manipulating the order total to obtain products without paying.
Product
WebToffee Gift Cards for WooCommerce
Fixed in
1.3.1
What to do
Update WebToffee Gift Cards for WooCommerce to 1.3.1 or newer.
Full record and what to do →NVD record wpscan.com
Oct 2, 2026Easy PayPal & Stripe Buy Now Button: Does not derive the payment amount on the serverCVE-2026-90987 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Easy PayPal & Stripe Buy Now Button WordPress plugin before 2.0.6 does not derive the payment amount on the server, taking it from a client-supplied field, so an unauthenticated attacker sets an arbitrary lower price for a purchase.
Product
Easy PayPal & Stripe Buy Now Button
Fixed in
2.0.6
What to do
Update Easy PayPal & Stripe Buy Now Button to 2.0.6 or newer.
Full record and what to do →NVD record wpscan.com
Oct 2, 2026WP Edit Password Protected: Does not enforce its site-wide access restriction on the WordPress REST APICVE-2026-90952 · WordPress plugins & themes · reported by WPScanMedium 5.3
The WP Edit Password Protected WordPress plugin before 2.0.7 does not enforce its site-wide access restriction on the WordPress REST API, allowing unauthenticated users to read the content of published posts and pages that the site's access mode was configured to hide.
Product
WP Edit Password Protected
Fixed in
2.0.7
What to do
Update WP Edit Password Protected to 2.0.7 or newer.
Full record and what to do →NVD record wpscan.com
Oct 2, 2026Popup Maker WP: Does not perform authorization checks on several of its actions and exposes its management page to any logged-in userCVE-2026-85005 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Popup Maker WP WordPress plugin through 1.4.5 does not perform authorization checks on several of its actions and exposes its management page to any logged-in user, allowing users with a low-privileged role such as Subscriber to store display-targeting values that are later invoked as zero-argument PHP callables on public page loads, leading to sensitive information disclosure and denial of service.
Product
Popup Maker WP
Affected
up to 1.4.5
What to do
Affects up to 1.4.5. Update Popup Maker WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Oct 2, 2026Events Calendar: Does not validate or sanitise data submitted to an unauthenticated AJAX action before merging it into its rendering contextCVE-2026-84740 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Events Calendar WordPress plugin before 6.17.5.1 does not validate or sanitise data submitted to an unauthenticated AJAX action before merging it into its rendering context, allowing unauthenticated users to execute arbitrary shortcodes registered on the site.
Product
Events Calendar
Fixed in
6.17.5.1
What to do
Update Events Calendar to 6.17.5.1 or newer.
Full record and what to do →NVD record wpscan.com
Oct 2, 2026WP User Frontend: Does not enforce its subscription-purchase requirement in one of its post-creation handlersCVE-2026-79618 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WP User Frontend WordPress plugin before 4.3.12 does not enforce its subscription-purchase requirement in one of its post-creation handlers, allowing authenticated users with subscriber-level access and above to create and, depending on the form's configuration, immediately publish posts through forms restricted to paying subscribers.
Product
WP User Frontend
Fixed in
4.3.12
What to do
Update WP User Frontend to 4.3.12 or newer.
Full record and what to do →NVD record wpscan.com
Oct 2, 2026WP Mail Logging: Does not properly restrict the HTML and CSS of logged emails before rendering them in its admin log screensCVE-2026-1661 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WP Mail Logging WordPress plugin before 1.17.0 does not properly restrict the HTML and CSS of logged emails before rendering them in its admin log screens, allowing unauthenticated users to inject styled content and links, for example through a public contact form, that can deceive an administrator viewing the log and send their browser to an attacker-controlled page.
Product
WP Mail Logging
Fixed in
1.17.0
What to do
Update WP Mail Logging to 1.17.0 or newer.
Full record and what to do →NVD record wpscan.com
Oct 2, 2026CMP – Coming Soon & Maintenance: Does not correctly restrict access to the site while maintenance/coming-soon mode is enabledCVE-2026-13413 · WordPress plugins & themes · reported by WPScanMedium 5.3
The CMP – Coming Soon & Maintenance WordPress plugin before 4.1.20 does not correctly restrict access to the site while maintenance/coming-soon mode is enabled, allowing unauthenticated visitors to bypass the coming-soon page and reach the otherwise hidden site, including hidden published pages, by shaping the request so it is mistaken for a login request.
Product
CMP – Coming Soon & Maintenance
Fixed in
4.1.20
What to do
Update CMP – Coming Soon & Maintenance to 4.1.20 or newer.
Full record and what to do →NVD record wpscan.com
Oct 2, 2026Giveaways and Contests by RafflePress: Does not properly validate a giveaway's parent page URL before saving it and later redirecting visitors to itCVE-2026-97318 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Giveaways and Contests by RafflePress WordPress plugin before 1.12.27 does not properly validate a giveaway's parent page URL before saving it and later redirecting visitors to it, allowing unauthenticated attackers to make the site's own giveaway confirmation and referral links redirect visitors to an arbitrary external site.
Product
Giveaways and Contests by RafflePress
Fixed in
1.12.27
What to do
Update Giveaways and Contests by RafflePress to 1.12.27 or newer.
Full record and what to do →NVD record wpscan.com
Oct 2, 2026Giveaways and Contests by RafflePress: Does not remove the reCAPTCHA secret key from the giveaway settings it embeds in public giveaway pagesCVE-2026-97317 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Giveaways and Contests by RafflePress WordPress plugin before 1.12.27 does not remove the reCAPTCHA secret key from the giveaway settings it embeds in public giveaway pages, allowing unauthenticated visitors to retrieve the secret key of any active giveaway that has reCAPTCHA configured.
Product
Giveaways and Contests by RafflePress
Fixed in
1.12.27
What to do
Update Giveaways and Contests by RafflePress to 1.12.27 or newer.
Full record and what to do →NVD record wpscan.com
Oct 2, 2026BuildKit: Does not properly sanitise and escape data submitted by contributor-level users before storing it and later using it in a SQL queryCVE-2026-94298 · WordPress plugins & themes · reported by WPScanMedium 6.2
The BuildKit WordPress plugin before 1.0.29 does not properly sanitise and escape data submitted by contributor-level users before storing it and later using it in a SQL query, allowing a Contributor to inject SQL that runs against the database once the resulting content is published and viewed by any unauthenticated visitor.
Product
BuildKit
Fixed in
1.0.29
What to do
Update BuildKit to 1.0.29 or newer.
Full record and what to do →NVD record wpscan.com
Oct 2, 2026OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy.: Does not require authentication or a valid nonce on an action that issues a slow server-side loopback requestCVE-2026-91828 · WordPress plugins & themes · reported by WPScanHigh 7.5
The OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. WordPress plugin before 6.3.11 does not require authentication or a valid nonce on an action that issues a slow server-side loopback request, allowing unauthenticated attackers to exhaust the site's PHP worker pool and make the entire site unavailable.
Product
OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy.
Fixed in
6.3.11
What to do
Update OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. to 6.3.11 or newer.
Full record and what to do →NVD record wpscan.com
Oct 2, 2026Motors: Does not properly verify that a user is authorised to modify a listing before processing one of its listing management actionsCVE-2026-91023 · WordPress plugins & themes · reported by WPScanLow 3.1
The Motors WordPress plugin before 1.4.124 does not properly verify that a user is authorised to modify a listing before processing one of its listing management actions, allowing authenticated attackers with subscriber-level access and above to set metadata on posts they do not own, including overwriting product prices. Exploitation is possible only when WooCommerce is active and the Motors WordPress plugin before 1.4.124's paid featured-listing option is enabled, neither of which is a default configuration.
Product
Motors
Fixed in
1.4.124
What to do
Update Motors to 1.4.124 or newer.
Full record and what to do →NVD record wpscan.com
Oct 2, 2026Motors: Does not sanitise and escape a listing badge setting before outputting it inside an HTML attributeCVE-2026-91022 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Motors WordPress plugin before 1.4.124 does not sanitise and escape a listing badge setting before outputting it inside an HTML attribute, allowing users with a custom, administrator-assigned listing-management role to inject arbitrary web scripts that execute when a listing is viewed by any visitor, including an administrator.
Product
Motors
Fixed in
1.4.124
What to do
Update Motors to 1.4.124 or newer.
Full record and what to do →NVD record wpscan.com
Oct 2, 2026Request a Quote: Does not perform an authorization check on one of its unauthenticated AJAX handlersCVE-2026-90988 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Request a Quote WordPress plugin through 2.5.6 does not perform an authorization check on one of its unauthenticated AJAX handlers, allowing unauthenticated users to read the contact records of quote-request submissions, including records the site has not published.
Product
Request a Quote
Affected
up to 2.5.6
What to do
Affects up to 2.5.6. Update Request a Quote to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.