Updated 9 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

35added in the last 30 days

570new WordPress flaws this week

391,310entries in the database

14,808 results · page 19 of 297

Sep 30, 2026Unauthenticated Cross Site Request Forgery (CSRF) in Photo Gallery by Supsystic <= 1.21.0 versions.CVE-2026-102399 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Unauthenticated Cross Site Request Forgery (CSRF) in Photo Gallery by Supsystic <= 1.21.0 versions.
Affected
up to 1.21.0
What to do
Affects up to 1.21.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 30, 2026Unauthenticated Cross Site Scripting (XSS) in Easy Google Maps <= 1.14.6 versions.CVE-2026-102395 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Easy Google Maps <= 1.14.6 versions.
Affected
up to 1.14.6
What to do
Affects up to 1.14.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 30, 2026Author Cross Site Scripting (XSS) in Supreme Modules Lite <= 2.5.63 versions.CVE-2026-102384 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Author Cross Site Scripting (XSS) in Supreme Modules Lite <= 2.5.63 versions.
Affected
up to 2.5.63
What to do
Affects up to 2.5.63. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 30, 2026Contributor Cross Site Scripting (XSS) in CF7 Views – Complete Entry Management for Contact Form 7 <= 3.2.5 versions.CVE-2026-100513 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Cross Site Scripting (XSS) in CF7 Views – Complete Entry Management for Contact Form 7 <= 3.2.5 versions.
Affected
up to 3.2.5
What to do
Affects up to 3.2.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 30, 2026WPMobile.App: Missing AuthorizationCVE-2026-96342 · WordPress plugins & themes · reported by PatchstackMedium 6.9
Missing Authorization vulnerability in Amauri.IO WPMobile.App wpappninja allows Retrieve Embedded Sensitive Data.This issue affects WPMobile.App: from n/a through 11.83.
Product
WPMobile.App
Affected
up to 11.83
What to do
Affects up to 11.83. Update WPMobile.App to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 30, 2026Viable URL Media Uploader: Stored Cross-Site ScriptingCVE-2025-14564 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Viable URL Media Uploader plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
Product
Viable URL Media Uploader
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Viable URL Media Uploader to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 30, 2026Motors – Car Dealership & Classified Listings: Time-based blind SQL InjectionCVE-2026-6806 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'stm_lat/stm_lng' parameter in all versions up to, and including, 1.4.109 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Motors – Car Dealership & Classified Listings
Affected
up to 1.4.109
What to do
Affects up to 1.4.109. Update Motors – Car Dealership & Classified Listings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 30, 2026HT Mega Addons for Elementor – Elementor Widgets & Template Builder: Stored Cross-Site ScriptingCVE-2026-11895 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The HT Mega Addons for Elementor – Elementor Widgets & Template Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Data Table 'display_options' Setting in all versions up to, and including, 3.1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
HT Mega Addons for Elementor – Elementor Widgets & Template Builder
Affected
up to 3.1.1
What to do
Affects up to 3.1.1. Update HT Mega Addons for Elementor – Elementor Widgets & Template Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 30, 2026GiveWP: Improper Validation of Unsafe Equivalence in InputCVE-2026-97196 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Improper Validation of Unsafe Equivalence in Input vulnerability in Liquid Web / StellarWP GiveWP allows Authentication Bypass. This issue affects GiveWP: from n/a through 4.16.9.
Product
GiveWP
Affected
up to 4.16.9
What to do
Affects up to 4.16.9. Update GiveWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 30, 2026Simply Schedule Appointments: Local File InclusionCVE-2026-89294 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Simply Schedule Appointments plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.6.12.27 via the 'ssa_locale' parameter parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. Notably, exploitation does not require authentication in practice, as the locale filter is installed unconditionally on every request during plugins_loaded and the callback performs no nonce or capability check before returning the raw GET parameter value.
Product
Simply Schedule Appointments
Affected
up to 1.6.12.27
What to do
Affects up to 1.6.12.27. Update Simply Schedule Appointments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 30, 2026Verge3D Publishing and E-Commerce: Does not validate the contents of files uploaded through its file storage feature and serves them back with an attacker-controlled content typeCVE-2026-92994 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Verge3D Publishing and E-Commerce WordPress plugin before 4.13.1 does not validate the contents of files uploaded through its file storage feature and serves them back with an attacker-controlled content type, allowing unauthenticated attackers to store a file containing malicious JavaScript that executes in the browser of any user who opens it.
Product
Verge3D Publishing and E-Commerce
Fixed in
4.13.1
What to do
Update Verge3D Publishing and E-Commerce to 4.13.1 or newer.
Full record and what to do →NVD record wpscan.com
Sep 30, 2026Content Egg: Does not verify that a user running its bulk content-import feature is authorized for the import preset they selectCVE-2026-92424 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Content Egg WordPress plugin before 11.9.0 does not verify that a user running its bulk content-import feature is authorized for the import preset they select, and switches to the preset author's identity before creating the resulting post, allowing users with contributor-level access and above to store arbitrary web scripts unfiltered under a privileged user's account, executing in the context of anyone who later views that content.
Product
Content Egg
Fixed in
11.9.0
What to do
Update Content Egg to 11.9.0 or newer.
Full record and what to do →NVD record wpscan.com
Sep 30, 2026WP Mobile Menu: Does not correctly verify the nonce on its settings importCVE-2026-91832 · WordPress plugins & themes · reported by WPScanHigh 7.1
The WP Mobile Menu WordPress plugin before 2.9 does not correctly verify the nonce on its settings import, so an attacker can import arbitrary WP Mobile Menu WordPress plugin before 2.9 settings through a cross-site request in an administrator's session, and the imported values are then output unescaped to every visitor, resulting in Stored Cross-Site Scripting.
Product
WP Mobile Menu
Fixed in
2.9
What to do
Update WP Mobile Menu to 2.9 or newer.
Full record and what to do →NVD record wpscan.com
Sep 30, 2026EWWW Image Optimizer: Does not confine a WebP-derivative file migration routine to the current site's own uploads directoryCVE-2026-91072 · WordPress plugins & themes · reported by WPScanMedium 4.4
The EWWW Image Optimizer WordPress plugin before 8.8.0 does not confine a WebP-derivative file migration routine to the current site's own uploads directory, letting an attacker with Administrator-level access rename or delete existing WebP-derivative image files outside that scope, including, on a multisite network, files belonging to a different site they have no access to.
Product
EWWW Image Optimizer
Fixed in
8.8.0
What to do
Update EWWW Image Optimizer to 8.8.0 or newer.
Full record and what to do →NVD record wpscan.com
Sep 30, 2026EWWW Image Optimizer: Does not prevent authenticated users with author-level permissions from storing a serialized value in a post meta field that is deserializedCVE-2026-91051 · WordPress plugins & themes · reported by WPScanMedium 6.6
The EWWW Image Optimizer WordPress plugin before 8.8.0 does not prevent authenticated users with author-level permissions from storing a serialized value in a post meta field that is deserialized when the post is rendered, allowing them to perform PHP Object Injection, which can lead to remote code execution when a suitable gadget chain is present via another installed EWWW Image Optimizer WordPress plugin before 8.8.0 or .
Product
EWWW Image Optimizer
Fixed in
8.8.0
What to do
Update EWWW Image Optimizer to 8.8.0 or newer.
Full record and what to do →NVD record wpscan.com
Sep 30, 2026Robin Image Optimizer: Does not escape values that its bundled HTML parser re-emits into element attributesCVE-2026-89193 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Robin Image Optimizer WordPress plugin before 2.0.8 does not escape values that its bundled HTML parser re-emits into element attributes when a non-default image delivery mode is enabled, allowing unauthenticated users to submit content that is stored and later executed as Cross-Site Scripting in the browser of any user viewing an affected page, including administrators.
Product
Robin Image Optimizer
Fixed in
2.0.8
What to do
Update Robin Image Optimizer to 2.0.8 or newer.
Full record and what to do →NVD record wpscan.com
Sep 30, 2026Robin Image Optimizer: Does not check the user's capabilities before dispatching one of its bundled admin framework's request handlersCVE-2026-89190 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Robin Image Optimizer WordPress plugin before 2.0.8 does not check the user's capabilities before dispatching one of its bundled admin framework's request handlers, allowing users with a subscriber-level account to render admin-only Robin Image Optimizer WordPress plugin before 2.0.8 pages and disclose the Robin Image Optimizer WordPress plugin before 2.0.8's stored settings.
Product
Robin Image Optimizer
Fixed in
2.0.8
What to do
Update Robin Image Optimizer to 2.0.8 or newer.
Full record and what to do →NVD record wpscan.com
Sep 30, 2026All in One Files Upload: Does not have any capability checkCVE-2026-85576 · WordPress plugins & themes · reported by WPScanMedium 4.3
The All in One Files Upload WordPress plugin before 2.0.17 does not have any capability check, and does not verify the authenticity of the request, when saving its settings, allowing any authenticated user, such as a subscriber, to change them.
Product
All in One Files Upload
Fixed in
2.0.17
What to do
Update All in One Files Upload to 2.0.17 or newer.
Full record and what to do →NVD record wpscan.com
Sep 30, 2026All in One Files Upload: Adds SVG to the site's allowed upload types and does not sanitise uploaded files or verify the authenticity of its public upload requestsCVE-2026-85573 · WordPress plugins & themes · reported by WPScanHigh 8.8
The All in One Files Upload WordPress plugin before 2.0.17 adds SVG to the site's allowed upload types and does not sanitise uploaded files or verify the authenticity of its public upload requests, allowing unauthenticated users to store files containing active content which run in the site's origin when a victim opens them.
Product
All in One Files Upload
Fixed in
2.0.17
What to do
Update All in One Files Upload to 2.0.17 or newer.
Full record and what to do →NVD record wpscan.com
Sep 30, 2026EmbedPress: Does not sanitise and escape one of its Elementor widget settings before outputting it into an HTML attributeCVE-2026-85001 · WordPress plugins & themes · reported by WPScanMedium 6.8
The EmbedPress WordPress plugin before 4.6.7 does not sanitise and escape one of its Elementor widget settings before outputting it into an HTML attribute, which could allow users with the Contributor role or above to inject arbitrary web scripts that execute when the affected content is viewed.
Product
EmbedPress
Fixed in
4.6.7
What to do
Update EmbedPress to 4.6.7 or newer.
Full record and what to do →NVD record wpscan.com
Sep 30, 2026User Frontend: Does not prevent tampering with the role assigned by its registration formCVE-2026-75823 · WordPress plugins & themes · reported by WPScanHigh 7.4
The User Frontend WordPress plugin before 4.3.12 does not prevent tampering with the role assigned by its registration form, allowing unauthenticated users to register with a higher privileged role, such as Editor. This affects installations running a PHP build where the sodium extension is unavailable, and where a registration page has been configured. The administrator role cannot be obtained this way.
Product
User Frontend
Fixed in
4.3.12
What to do
Update User Frontend to 4.3.12 or newer.
Full record and what to do →NVD record wpscan.com
Sep 27, 2026Optima Express IDX: Does not perform any authorisation check on one of its AJAX actions that is available to logged-out usersCVE-2026-96897 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Optima Express IDX WordPress plugin before 8.7.6 does not perform any authorisation check on one of its AJAX actions that is available to logged-out users, allowing unauthenticated attackers to force the creation of a fixed author-role account and to repeatedly rotate its application password on any connected install.
Product
Optima Express IDX
Fixed in
8.7.6
What to do
Update Optima Express IDX to 8.7.6 or newer.
Full record and what to do →NVD record wpscan.com
Sep 27, 2026Verge3D Publishing and E-Commerce: Does not restrict access to a file-download handlerCVE-2026-92995 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Verge3D Publishing and E-Commerce WordPress plugin through 4.13.0 does not restrict access to a file-download handler, allowing unauthenticated users to download the digital-goods files attached to any order without authorization.
Product
Verge3D Publishing and E-Commerce
Affected
up to 4.13.0
What to do
Affects up to 4.13.0. Update Verge3D Publishing and E-Commerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Sep 27, 2026Online Scheduling and Appointment Booking System: Does not prevent deserialization of untrusted input and does not correctly restrict a privileged maintenance feature to administratorsCVE-2026-86841 · WordPress plugins & themes · reported by WPScanMedium 4.7
The Online Scheduling and Appointment Booking System WordPress plugin before 28.3 does not prevent deserialization of untrusted input and does not correctly restrict a privileged maintenance feature to administrators, allowing users granted a custom booking-management capability, which an administrator must explicitly assign, to inject arbitrary PHP objects, overwrite privileged site options, and read stored integration secrets.
Product
Online Scheduling and Appointment Booking System
Fixed in
28.3
What to do
Update Online Scheduling and Appointment Booking System to 28.3 or newer.
Full record and what to do →NVD record wpscan.com
Sep 27, 2026Online Scheduling and Appointment Booking System: Does not verify that appointment and payment records requested through its staff-role AJAX actions belong to the requesting staff memberCVE-2026-86839 · WordPress plugins & themes · reported by WPScanLow 3.8
The Online Scheduling and Appointment Booking System WordPress plugin before 28.3 does not verify that appointment and payment records requested through its staff-role AJAX actions belong to the requesting staff member, allowing authenticated attackers with a staff-level account to view, modify and delete other staff members' appointments and payments, including the associated customer's personal information.
Product
Online Scheduling and Appointment Booking System
Fixed in
28.3
What to do
Update Online Scheduling and Appointment Booking System to 28.3 or newer.
Full record and what to do →NVD record wpscan.com
Sep 27, 2026WebFacing™: Does not restrict access to one of its bundled scripts and does not validate a user-supplied path before using it to include a local fileCVE-2026-84069 · WordPress plugins & themes · reported by WPScanMedium 5.3
The WebFacing™ WordPress plugin before 5.4 does not restrict access to one of its bundled scripts and does not validate a user-supplied path before using it to include a local file, allowing unauthenticated users to perform Local File Inclusion.
Product
WebFacing™
Fixed in
5.4
What to do
Update WebFacing™ to 5.4 or newer.
Full record and what to do →NVD record wpscan.com
Sep 26, 2026Ultra Addons for Contact Form 7: Arbitrary File UploadCVE-2026-82901 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Arbitrary File Upload due to insufficient file type validation in the 'uacf7_wpcf7_mail_components' function in all versions up to, and including, 3.5.50. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. Note: This is only exploitable when the plugin's PDF Generator module is enabled, which is disabled by default.
Product
Ultra Addons for Contact Form 7
Affected
up to 3.5.50
What to do
Affects up to 3.5.50. Update Ultra Addons for Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 26, 2026Groups – Memberships and Access Control: Privilege EscalationCVE-2026-77203 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Groups – Memberships and Access Control plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.6.0. This is due to the groups_join() function deriving group-join eligibility from the ambient post's author capabilities via the global $post->post_author rather than from the currently authenticated user's own capabilities, while simultaneously minting and returning a valid groups-join-data hash and WordPress nonce for the caller in the same response — eliminating all authorization barriers to self-enrollment. This makes it possible for authenticated attackers, with Subscriber-level access and above, to enroll themselves into any group including privileged groups carrying the groups_admin_groups capability, and to subsequently create and join a group containing every registered WordPress capability, effectively escalating their privileges to Administrator. Exploitation requires the attacker to supply an Administrator-authored post ID via the post_ID parameter of the authenticated wp_ajax_parse_media_shortcode handler in order to establish the privileged ambient post context used by the flawed authorization check.
Product
Groups – Memberships and Access Control
Affected
up to 4.6.0
What to do
Affects up to 4.6.0. Update Groups – Memberships and Access Control to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 26, 2026Optimole: Does not escape unrecognized attributes of its video-player block before rendering them onto the block's wrapper elementCVE-2026-96531 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Optimole WordPress plugin before 4.2.13 does not escape unrecognized attributes of its video-player block before rendering them onto the block's wrapper element, allowing users with the Author role and above to store an event-handler attribute that executes scripts in the browser of any user, such as an administrator, who views the post.
Product
Optimole
Fixed in
4.2.13
What to do
Update Optimole to 4.2.13 or newer.
Full record and what to do →NVD record wpscan.com
Sep 26, 2026MCP Server for WordPress: Does not perform an object-level authorization check on one of its workflow REST routesCVE-2026-96526 · WordPress plugins & themes · reported by WPScanLow 2.7
The MCP Server for WordPress WordPress plugin before 1.8.2 does not perform an object-level authorization check on one of its workflow REST routes, allowing users with the Contributor role to disclose the title and publication status of any post, page or custom post type, including other users' private, draft, pending and scheduled content.
Product
MCP Server for WordPress
Fixed in
1.8.2
What to do
Update MCP Server for WordPress to 1.8.2 or newer.
Full record and what to do →NVD record wpscan.com
Sep 26, 2026File Manager WordPress plugin before 8.0.5, FileOrganizer WordPress plugin before 1.2.1, File Manager Pro: Do not correctly validate the origin of window messages received by the file browser they load on their admin scrCVE-2026-85081 · WordPress plugins & themes · reported by WPScanHigh 7.5
The File Manager WordPress plugin before 8.0.5, FileOrganizer WordPress plugin before 1.2.1, File Manager Pro WordPress plugin before 2.1.3 do not correctly validate the origin of window messages received by the file browser they load on their admin screens, accepting any origin that is a leading string prefix of the site's own address, which allows an unauthenticated attacker to run arbitrary JavaScript in the session of a logged-in administrator who visits a page under their control. The defect is in the file-manager library all three bundle, and every version below 2.1.70 carries it. Updating the bundled library closes it.
Product
File Manager WordPress plugin before 8.0.5, FileOrganizer WordPress plugin before 1.2.1, File Manager Pro
Fixed in
8.0.5
What to do
Update File Manager WordPress plugin before 8.0.5, FileOrganizer WordPress plugin before 1.2.1, File Manager Pro to 8.0.5 or newer.
Full record and what to do →NVD record wpscan.com
Sep 26, 2026wp-review-slider-pro: Does not sanitize a value stored through one of its AJAX handlersCVE-2026-84097 · WordPress plugins & themes · reported by WPScanMedium 6.5
The wp-review-slider-pro WordPress plugin before 12.7.12 does not sanitize a value stored through one of its AJAX handlers, which lacks a capability check, before using it in a SQL statement, allowing any authenticated user, such as a subscriber, to perform SQL injection attacks whose results are then returned to unauthenticated visitors.
Product
wp-review-slider-pro
Fixed in
12.7.12
What to do
Update wp-review-slider-pro to 12.7.12 or newer.
Full record and what to do →NVD record wpscan.com
Sep 26, 2026wp-review-slider-pro: Does not perform a capability check on the AJAX handler that saves its review submission formsCVE-2026-84096 · WordPress plugins & themes · reported by WPScanHigh 8
The wp-review-slider-pro WordPress plugin before 12.7.12 does not perform a capability check on the AJAX handler that saves its review submission forms, and the nonce protecting it is generated for every visitor, allowing any authenticated user, such as a subscriber, to overwrite a live form with field values that are output without escaping on public pages, leading to Stored Cross-Site Scripting.
Product
wp-review-slider-pro
Fixed in
12.7.12
What to do
Update wp-review-slider-pro to 12.7.12 or newer.
Full record and what to do →NVD record wpscan.com
Sep 26, 2026wp-review-slider-pro: Does not perform a capability check on one of its AJAX handlersCVE-2026-84095 · WordPress plugins & themes · reported by WPScanHigh 8
The wp-review-slider-pro WordPress plugin before 12.7.12 does not perform a capability check on one of its AJAX handlers, and the nonce protecting it is generated for every visitor, allowing any authenticated user, such as a subscriber, to store arbitrary review content which is later output without escaping on public pages, leading to Stored Cross-Site Scripting.
Product
wp-review-slider-pro
Fixed in
12.7.12
What to do
Update wp-review-slider-pro to 12.7.12 or newer.
Full record and what to do →NVD record wpscan.com
Sep 26, 2026File Manager: Does not prevent unauthenticated users from downloading its database backup archivesCVE-2026-19708 · WordPress plugins & themes · reported by WPScanMedium 5.9
The File Manager WordPress plugin before 8.0.5 does not prevent unauthenticated users from downloading its database backup archives, and in some cases writes them under a fixed filename, allowing unauthenticated attackers to retrieve a full database dump including every user's email address and password hash on servers that do not apply the directory's .htaccess file.
Product
File Manager
Fixed in
8.0.5
What to do
Update File Manager to 8.0.5 or newer.
Full record and what to do →NVD record wpscan.com
Sep 26, 2026Request a Quote for WooCommerce: Arbitrary File UploadCVE-2026-18143 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Request a Quote for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.9.2 via the `afrfq_submit_quote_via_popup()` function. This is due to missing file extension and MIME type validation in the popup upload handler, which uses the raw attacker-supplied filename directly as the destination for `move_uploaded_file()`. This makes it possible for unauthenticated attackers to upload executable files, such as PHP files, to a web-accessible temporary RFQ upload directory when a public quote rule with the multi-page popup flow is enabled.
Product
Request a Quote for WooCommerce
Affected
up to 2.9.2
What to do
Affects up to 2.9.2. Update Request a Quote for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record woocommerce.com wordfence.com
Sep 25, 2026User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor: Stored Cross-Site ScriptingCVE-2026-95866 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Avatar Field in all versions up to, and including, 4.0.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The zero-length multipart file branch in wppb_save_avatar_value() writes the raw request value directly to user meta, bypassing the wppb_save_attachment_id()/wppb_verify_attachment_id() validation path; the stored payload is later adopted as a WordPress attachment URL and rendered unescaped by wppb_default_fields_make_upload_button() when an administrator views the affected account.
Product
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
Affected
up to 4.0.2
What to do
Affects up to 4.0.2. Update User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 25, 2026Repeater Fields for Elementor Forms: Stored Cross-Site ScriptingCVE-2026-94573 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Repeater Fields for Elementor Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Repeater Field Value in all versions up to, and including, 2.2.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Repeater Fields for Elementor Forms
Affected
up to 2.2.7
What to do
Affects up to 2.2.7. Update Repeater Fields for Elementor Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 25, 2026Optima Express IDX: Privilege EscalationCVE-2026-93901 · WordPress plugins & themes · reported by WordfenceHigh 7.3
The Optima Express IDX plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 8.7.5. This is due to the `provisionBlogCredentials()` function in `iHomefinderAdmin.php` being reachable via the `wp_ajax_nopriv_ihf_clear_cache` AJAX action — through the call chain `iHomefinderAjaxHandler::clearCache()` → `activateAuthenticationToken()` → `getAuthenticationInfo()` → `provisionBlogCredentials()` — with no capability check, nonce verification, or ownership validation, and the function unconditionally calling `$user->set_role('author')` on whichever WordPress account matches the hard-coded login `optima-express` via `get_user_by('login', 'optima-express')`. This makes it possible for unauthenticated attackers to escalate a pre-registered `optima-express` account to the Author role, gaining `publish_posts`, `upload_files`, and `edit_published_posts` capabilities, including access to the plugin's own `/wp-json/optima-express/v1/blog-post` REST endpoint. Exploitation requires open user registration to be enabled on the target site, and the attacker must register the `optima-express` username before the plugin has had the opportunity to provision that
Product
Optima Express IDX
Affected
up to 8.7.5
What to do
Affects up to 8.7.5. Update Optima Express IDX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 25, 2026User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor: Stored Cross-Site ScriptingCVE-2026-93656 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Avatar Field in all versions up to, and including, 4.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable via a nonce-free GET request to /wp-admin/profile.php, requiring no profile-form submission; a Subscriber can plant the malicious attachment URL, which then executes when an administrator opens that user's Edit User screen.
Product
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
Affected
up to 4.0.2
What to do
Affects up to 4.0.2. Update User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 25, 2026Modula Image Gallery – Photo Grid & Video Gallery: Arbitrary file deletionCVE-2026-92713 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Modula Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the upload_image function in all versions up to, and including, 3.0.2. This makes it possible for authenticated attackers, with author-level access and above, to delete arbitrary files on the server. The path restriction to wp-content/uploads is not an effective ownership boundary, as all user attachment files reside within that tree, and Authors trivially satisfy the edit_post check on their own galleries.
Product
Modula Image Gallery – Photo Grid & Video Gallery
Affected
up to 3.0.2
What to do
Affects up to 3.0.2. Update Modula Image Gallery – Photo Grid & Video Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 25, 2026Knit Pay – Cashfree, Instamojo, Razorpay, PayPal and more: Privilege EscalationCVE-2026-89426 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Knit Pay – Cashfree, Instamojo, Razorpay, PayPal and more plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 9.6.1.0. This is due to the `maybe_update_user_role()` function reading the target role directly from an attacker-controlled Gravity Forms entry field — configured via the feed's `user_role_field_id` — and passing it to `WP_User::set_role()` without validating the supplied value against an allowlist of permitted roles. This makes it possible for authenticated attackers, with Subscriber-level access and above, to elevate their privileges to administrator by tampering with the hidden role field value at form submission time. Exploitation is further enabled by the fact that $0 orders are synchronously marked as SUCCESS during form submission without requiring a real payment, and when no GF User Registration user can be resolved, the role assignment target falls back to `$lead['created_by']` — the currently authenticated submitter's own user ID — making any authenticated form submitter an eligible exploitation target.
Product
Knit Pay – Cashfree, Instamojo, Razorpay, PayPal and more
Affected
up to 9.6.1.0
What to do
Affects up to 9.6.1.0. Update Knit Pay – Cashfree, Instamojo, Razorpay, PayPal and more to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 25, 2026Modula Image Gallery – Photo Grid & Video Gallery: Unauthorized disclosure of private gallery contentsCVE-2026-89406 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Modula Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to unauthorized disclosure of private gallery contents in versions up to, and including, 3.0.1. This is due to the Modula_Meta::add_metas() function being hooked to wp_head on every frontend request and looking up any post via get_post( $_GET['modula_gallery_id'] ) without verifying the gallery's post_status or the requester's capability to read it — the gallery-side input guard is bugged (empty('modula_gallery_id') tests a nonempty string literal instead of the GET parameter, so it is always false), the only object validation is a post_type === 'modula-gallery' check, and no is_user_logged_in()/current_user_can('read_post', $gallery_id) check is performed. This makes it possible for unauthenticated attackers to enumerate private modula-gallery posts and their member attachments and recover the image's title, description, dimensions, and original upload URL via Open Graph/Twitter meta tags emitted in the response, which then allows direct unauthenticated download of the original private image bytes.
Product
Modula Image Gallery – Photo Grid & Video Gallery
Affected
up to 3.0.1
What to do
Affects up to 3.0.1. Update Modula Image Gallery – Photo Grid & Video Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 25, 2026WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More: Reflected Cross-Site ScriptingCVE-2026-88996 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'page_title' POST Parameter via {page_title} Smart Tag in all versions up to, and including, 2.0.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. This is only exploitable on forms whose admin-authored confirmation message places the {page_title} Smart Tag inside an HTML attribute context.
Product
WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More
Affected
up to 2.0.2
What to do
Affects up to 2.0.2. Update WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 25, 2026s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions: Remote Code ExecutionCVE-2026-19804 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 260814 via the 'first_name' parameter parameter. This is due to insufficient sanitization of the first_name parameter via esc_refs(), which strips only regex backreferences and not PHP tags, before substitution into the eval'd Signup Tracking Codes template, combined with disclosure of the site-global proxy verification key that allows PayPal postback verification to be bypassed. This makes it possible for unauthenticated attackers to execute code on the server. Successful exploitation requires that the site administrator has configured a Signup Tracking Codes template containing the %%first_name%% placeholder (a documented, GUI-supported feature) and that the attacker has obtained the site-global proxy verification key, which is exposed in plaintext in the JSON response of any PayPal Checkout AJAX request on the target site.
Product
s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions
Affected
up to 260814
What to do
Affects up to 260814. Update s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 25, 2026SSL Zen — SSL Certificate Installer & HTTPS Redirects: Directory TraversalCVE-2026-17602 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The SSL Zen — SSL Certificate Installer & HTTPS Redirects plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.7.42 via the 'file_name' parameter parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.
Product
SSL Zen — SSL Certificate Installer & HTTPS Redirects
Affected
up to 4.7.42
What to do
Affects up to 4.7.42. Update SSL Zen — SSL Certificate Installer & HTTPS Redirects to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 25, 2026SSL Zen: Reflected Cross-Site ScriptingCVE-2026-17577 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The SSL Zen plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'uri' (and 'host') parameters in versions up to, and including, 4.7.42. The ssl_zen_messages::getMessages() function builds the 'token_missmatch' message using base64_decode(sanitize_text_field($_REQUEST['uri'])) and (optionally) base64_decode(sanitize_text_field($_REQUEST['host'])). sanitize_text_field() cannot strip HTML/JavaScript that is hidden inside a base64-encoded blob, and the resulting decoded raw HTML is echoed unescaped by showMessage() . This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a specially crafted link.
Product
SSL Zen
Affected
up to 4.7.42
What to do
Affects up to 4.7.42. Update SSL Zen to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 25, 2026WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters: Local File InclusionCVE-2026-13456 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.9.8 via the 'page' parameter parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.
Product
WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters
Affected
up to 4.9.8
What to do
Affects up to 4.9.8. Update WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 25, 2026WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters: Stored Cross-Site ScriptingCVE-2026-13179 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shapes_values Parameter in all versions up to, and including, 4.9.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The fc-call-nonce nonce required by the endpoint is exposed to all frontend visitors who view a map page via window.wpgmp_local.nonce, enabling any authenticated subscriber to read the nonce and craft a valid request; additionally, the secondary _wpnonce check in the drawing handler can be bypassed by simply omitting the _wpnonce parameter from the request.
Product
WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters
Affected
up to 4.9.8
What to do
Affects up to 4.9.8. Update WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 25, 2026Asset CleanUp: Page Speed Booster: Server-Side Request ForgeryCVE-2026-12037 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The Asset CleanUp: Page Speed Booster plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.4.0.5 via the 'page_url' parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. This vulnerability is only reachable when the plugin's dom_get_type setting has been configured to 'wp_remote_post' by an administrator.
Product
Asset CleanUp: Page Speed Booster
Affected
up to 1.4.0.5
What to do
Affects up to 1.4.0.5. Update Asset CleanUp: Page Speed Booster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.