Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,148 results · page 2 of 23
Oct 10, 2026Accept PayPal Payments using Contact Form 7: Does not perform any authorization checks before exporting stored form submissionsCVE-2026-105990 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Accept PayPal Payments using Contact Form 7 WordPress plugin before 4.0.7 does not perform any authorization checks before exporting stored form submissions, allowing unauthenticated attackers to download the personal data (name, email, telephone, postal address, message) and payment metadata of everyone who submitted a payment form.
- Product
- Accept PayPal Payments using Contact Form 7
- Fixed in
- 4.0.7
- What to do
- Update Accept PayPal Payments using Contact Form 7 to 4.0.7 or newer.
Oct 10, 2026Post Export Import with Media: Directory TraversalCVE-2026-104763 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The Post Export Import with Media plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.17.1 via the 'file_path' parameter parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. This requires the attacker to upload a crafted ZIP archive containing a media_metadata.json file with path traversal sequences in the file_path field while specifying an allowed file extension for the destination filename to bypass the extension guard introduced in version 1.13.2.
- Product
- Post Export Import with Media
- Affected
- up to 1.17.1
- What to do
- Affects up to 1.17.1. Update Post Export Import with Media to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.svn.wordpress.orgplugins.trac.wordpress.org
Oct 10, 2026Download Manager: Sensitive Information ExposureCVE-2026-103964 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Download Manager plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.3.71 via the 'first_name' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract the administrator's full Cookie header, including wordpress_logged_in_* session cookies, from the suspension email sent during the administrator's authenticated request, enabling full session hijack and account takeover. Exploitation requires an administrator to perform the Suspend action against the attacker's account, which causes the plugin to synchronously compile and send the suspension email inside the administrator's authenticated HTTP request — making the administrator's session cookies available to the template engine at send time.
- Product
- Download Manager
- Affected
- up to 3.3.71
- What to do
- Affects up to 3.3.71. Update Download Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 10, 2026Bookly – Online Scheduling and Appointment Booking System: Sensitive Information ExposureCVE-2026-103365 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Bookly – Online Scheduling and Appointment Booking System plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 28.4 via the classic booking form's Details step. The endpoint bookly_render_details is registered for both wp_ajax and wp_ajax_nopriv, the module overrides csrfTokenValid() to always return true, and Bookly\Frontend\Components\Booking\InfoText::getCodes() calls UserBookingData::getCustomer() to load the persisted Customer entity keyed solely by the attacker-supplied phone (or email) with no invocation of the plugin's own customerIdentityConfirmed() predicate. When a site owner has placed the supported {client_name}, {client_email}, {client_phone}, or {client_note} placeholders into the Details step's Appearance information text, the matched customer's stored name, email, phone and internal notes are substituted into the returned HTML. This makes it possible for unauthenticated attackers who know only a registered customer's primary phone (or email) to read that customer's stored personal data.
- Product
- Bookly – Online Scheduling and Appointment Booking System
- Affected
- up to 28.4
- What to do
- Affects up to 28.4. Update Bookly – Online Scheduling and Appointment Booking System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 9, 2026All Bootstrap Blocks: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2026-62036 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in AREOI All Bootstrap Blocks all-bootstrap-blocks allows Retrieve Embedded Sensitive Data.This issue affects All Bootstrap Blocks: from n/a through 1.3.31.
- Product
- All Bootstrap Blocks
- Affected
- up to 1.3.31
- What to do
- Affects up to 1.3.31. Update All Bootstrap Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 7, 2026Optimole: Does not perform a capability check before exposing its stored image-optimization account data in a dashboard widgetCVE-2026-96530 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Optimole WordPress plugin before 4.2.15 does not perform a capability check before exposing its stored image-optimization account data in a dashboard widget, allowing any authenticated user, including Subscribers, to read the site's third-party service credentials.
- Product
- Optimole
- Fixed in
- 4.2.15
- What to do
- Update Optimole to 4.2.15 or newer.
Oct 6, 2026Unauthenticated Sensitive Data Exposure in Snapshotify – All-in-One Backup & Restore & Migrate <= 1.3.2 versions.CVE-2026-42413 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Sensitive Data Exposure in Snapshotify – All-in-One Backup & Restore & Migrate <= 1.3.2 versions.
- Affected
- up to 1.3.2
- What to do
- Affects up to 1.3.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2026Unauthenticated Sensitive Data Exposure in Norvis Backup <= 1.1.0 versions.CVE-2026-41562 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Sensitive Data Exposure in Norvis Backup <= 1.1.0 versions.
- Affected
- up to 1.1.0
- What to do
- Affects up to 1.1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2026Unauthenticated Sensitive Data Exposure in Museder RestoreOne <= 2.7.276 versions.CVE-2026-41561 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Sensitive Data Exposure in Museder RestoreOne <= 2.7.276 versions.
- Affected
- up to 2.7.276
- What to do
- Affects up to 2.7.276. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2026Unauthenticated Sensitive Data Exposure in SafeSnap – Verified WordPress Backup & Restore <= 2.1.2 versions.CVE-2026-41559 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Sensitive Data Exposure in SafeSnap – Verified WordPress Backup & Restore <= 2.1.2 versions.
- Affected
- up to 2.1.2
- What to do
- Affects up to 2.1.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2026Unauthenticated Sensitive Data Exposure in Mailjet Email Marketing <= 6.2.3 versions.CVE-2026-39791 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Sensitive Data Exposure in Mailjet Email Marketing <= 6.2.3 versions.
- Affected
- up to 6.2.3
- What to do
- Affects up to 6.2.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2026Unauthenticated Sensitive Data Exposure in Edwiser Bridge <= 4.3.4 versions.CVE-2026-39729 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Unauthenticated Sensitive Data Exposure in Edwiser Bridge <= 4.3.4 versions.
- Affected
- up to 4.3.4
- What to do
- Affects up to 4.3.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2026Unauthenticated Sensitive Data Exposure in SiteVault – Backup, Restore, Migration & Cloning <= 1.5.17 versions.CVE-2026-105071 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Sensitive Data Exposure in SiteVault – Backup, Restore, Migration & Cloning <= 1.5.17 versions.
- Affected
- up to 1.5.17
- What to do
- Affects up to 1.5.17. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2026Editor Privilege Escalation in Import and export users and customers <= 2.5.5 versions.CVE-2026-104757 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Editor Privilege Escalation in Import and export users and customers <= 2.5.5 versions.
- Affected
- up to 2.5.5
- What to do
- Affects up to 2.5.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2026Unauthenticated Sensitive Data Exposure in Groundhogg <= 4.8.3 versions.CVE-2026-104385 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Sensitive Data Exposure in Groundhogg <= 4.8.3 versions.
- Affected
- up to 4.8.3
- What to do
- Affects up to 4.8.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2026Unauthenticated Sensitive Data Exposure in Xserver Migrator <= 1.6.6 versions.CVE-2026-102387 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Sensitive Data Exposure in Xserver Migrator <= 1.6.6 versions.
- Affected
- up to 1.6.6
- What to do
- Affects up to 1.6.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2026Unauthenticated Sensitive Data Exposure in Sitemovr <= 1.0.1 versions.CVE-2026-41563 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Sensitive Data Exposure in Sitemovr <= 1.0.1 versions.
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026WP Ultimate Exporter: Deserialization of Untrusted DataCVE-2026-103348 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Deserialization of Untrusted Data vulnerability in Smackcoders Inc. WP Ultimate Exporter wp-ultimate-exporter allows Object Injection.This issue affects WP Ultimate Exporter: from n/a through 3.0.
- Product
- WP Ultimate Exporter
- Affected
- up to 3.0
- What to do
- Affects up to 3.0. Update WP Ultimate Exporter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026WP Event Solution: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2026-105073 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Arraytics WP Event Solution wp-event-solution allows Retrieve Embedded Sensitive Data.This issue affects WP Event Solution: from n/a through 4.1.25.
- Product
- WP Event Solution
- Affected
- up to 4.1.25
- What to do
- Affects up to 4.1.25. Update WP Event Solution to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026Memberful - Membership: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2026-104401 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Memberful Memberful - Membership Plugin memberful-wp allows Retrieve Embedded Sensitive Data.This issue affects Memberful - Membership Plugin: from n/a through 1.81.2.
- Product
- Memberful - Membership
- Affected
- up to 1.81.2
- What to do
- Affects up to 1.81.2. Update Memberful - Membership to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 3, 2026WPZOOM Connect: AI Chat, Click to Chat, Social Icons & Share Buttons: Sensitive Information ExposureCVE-2026-100149 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WPZOOM Connect: AI Chat, Click to Chat, Social Icons & Share Buttons plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.7.3 via the 'x-yamidoo-signature (attacker-obtained via inline_js identify payload)' parameter. This makes it possible for unauthenticated attackers to extract the full customer card — including name, WordPress user ID, order history, order totals, purchased products, payment method labels, and EDD Software Licensing license keys with status and activation counts — for any arbitrary victim email address on the site. Exploitation requires the attacker to register a WooCommerce customer or subscriber-level account with a crafted email address whose local part encodes the target timestamp and victim email, allowing the signature printed into the page HTML by inline_js() to pass verify_request() for an arbitrary victim; both the share_customer_data and identify_logged_in settings are enabled by default, so no non-default configuration is required.
- Product
- WPZOOM Connect: AI Chat, Click to Chat, Social Icons & Share Buttons
- Affected
- up to 4.7.3
- What to do
- Affects up to 4.7.3. Update WPZOOM Connect: AI Chat, Click to Chat, Social Icons & Share Buttons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.complugins.trac.wordpress.org
Oct 3, 2026Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress: Sensitive Information ExposureCVE-2026-92536 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.17.4 via the get_user_profile_structure. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract other users' email addresses, login names, and registration dates via the Member Directory's per-row user rebinding when attacker-controlled base64 payloads in the [pp-custom-html] shortcode invoke [profile-email], [profile-username], and [profile-date-registered]. When the WordPress users_can_register option is enabled, unauthenticated attackers can also exploit this vulnerability by supplying the split shortcode fragments through the plugin's own registration handler, which processes the reg_nickname and reg_bio fields without a nonce requirement.
- Product
- Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress
- Affected
- up to 4.17.4
- What to do
- Affects up to 4.17.4. Update Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 2, 2026Smart One Click Setup – Complete Demo Import & Export: Insertion of Sensitive Information Into Sent DataCVE-2026-32584 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Insertion of Sensitive Information Into Sent Data vulnerability in Chiranjit Hazarika Smart One Click Setup – Complete Demo Import & Export smart-one-click-setup allows Retrieve Embedded Sensitive Data.This issue affects Smart One Click Setup – Complete Demo Import & Export: from n/a through 1.4.3.
- Product
- Smart One Click Setup – Complete Demo Import & Export
- Affected
- up to 1.4.3
- What to do
- Affects up to 1.4.3. Update Smart One Click Setup – Complete Demo Import & Export to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 2, 2026Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE: Sensitive Information ExposureCVE-2026-102002 · WordPress plugins & themes · reported by WordfenceLow 3.1
The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.2.6 via the 'otter_form_widget_filter' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract the email addresses of the five most recent form submitters, their submission dates, and the site's total form submission count. The widget is registered whenever the themeisle_blocks_form_emails option is non-empty — the normal state after any Form block has been saved — meaning the exposure is active on any standard site using the plugin's form feature.
- Product
- Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE
- Affected
- up to 3.2.6
- What to do
- Affects up to 3.2.6. Update Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 2, 2026Popup Maker WP: Does not perform authorization checks on several of its actions and exposes its management page to any logged-in userCVE-2026-85005 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Popup Maker WP WordPress plugin through 1.4.5 does not perform authorization checks on several of its actions and exposes its management page to any logged-in user, allowing users with a low-privileged role such as Subscriber to store display-targeting values that are later invoked as zero-argument PHP callables on public page loads, leading to sensitive information disclosure and denial of service.
- Product
- Popup Maker WP
- Affected
- up to 1.4.5
- What to do
- Affects up to 1.4.5. Update Popup Maker WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 1, 2026WP Popular Posts: Sensitive Information ExposureCVE-2026-92548 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WP Popular Posts plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.4.2 via the 'context' parameter. This makes it possible for unauthenticated attackers to extract sensitive edit-context fields — including raw title, raw content body, password, meta, status, and guid — from non-public post objects such as wp_block synced patterns that WordPress core itself refuses to expose to unauthenticated callers. This is possible because the plugin's REST route is registered with a permission_callback of __return_true and passes the caller-supplied context parameter (e.g., context=edit) directly to WP_REST_Posts_Controller::prepare_item_for_response() without invoking get_item_permissions_check() or check_read_permission(), while the underlying query accepts an arbitrary post_type value without enforcing public or show_in_rest visibility flags.
- Product
- WP Popular Posts
- Affected
- up to 7.4.2
- What to do
- Affects up to 7.4.2. Update WP Popular Posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 1, 2026Simply Schedule Appointments: Sensitive Information ExposureCVE-2026-92245 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Simply Schedule Appointments plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.6.12.32 via the 'recursive' parameter. This makes it possible for unauthenticated attackers to extract customer PII — including names, email addresses, phone numbers, and custom form field data — stored in appointment records, as well as per-appointment public_token values. The leaked per-appointment public_token values also enable unauthenticated attackers to delete arbitrary appointments via the DELETE /wp-json/ssa/v1/appointments/{id} endpoint, which accepts the token as sole authorization.
- Product
- Simply Schedule Appointments
- Affected
- up to 1.6.12.32
- What to do
- Affects up to 1.6.12.32. Update Simply Schedule Appointments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 30, 2026Unauthenticated Sensitive Data Exposure in MPG <= 4.2.3 versions.CVE-2026-97302 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Sensitive Data Exposure in MPG <= 4.2.3 versions.
- Affected
- up to 4.2.3
- What to do
- Affects up to 4.2.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 30, 2026Unauthenticated Sensitive Data Exposure in Notivo <= 1.4.2 versions.CVE-2026-97261 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Sensitive Data Exposure in Notivo <= 1.4.2 versions.
- Affected
- up to 1.4.2
- What to do
- Affects up to 1.4.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 30, 2026Unauthenticated Sensitive Data Exposure in BackupEase <= 2.2.2 versions.CVE-2026-97241 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Sensitive Data Exposure in BackupEase <= 2.2.2 versions.
- Affected
- up to 2.2.2
- What to do
- Affects up to 2.2.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 30, 2026Unauthenticated Sensitive Data Exposure in StifLi Backup Tools <= 2.2.7 versions.CVE-2026-97240 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Sensitive Data Exposure in StifLi Backup Tools <= 2.2.7 versions.
- Affected
- up to 2.2.7
- What to do
- Affects up to 2.2.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 30, 2026Subscriber Sensitive Data Exposure in GiveWP <= 4.16.9 versions.CVE-2026-96834 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Subscriber Sensitive Data Exposure in GiveWP <= 4.16.9 versions.
- Affected
- up to 4.16.9
- What to do
- Affects up to 4.16.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 30, 2026Subscriber Privilege Escalation in Import and export users and customers <= 2.5.2 versions.CVE-2026-94178 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Subscriber Privilege Escalation in Import and export users and customers <= 2.5.2 versions.
- Affected
- up to 2.5.2
- What to do
- Affects up to 2.5.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 30, 2026Unauthenticated Broken Access Control in GravityExport Lite for Gravity Forms <= 2.7.2 versions.CVE-2026-94120 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in GravityExport Lite for Gravity Forms <= 2.7.2 versions.
- Affected
- up to 2.7.2
- What to do
- Affects up to 2.7.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 30, 2026Course Booking System: Does not restrict access to its booking exportCVE-2026-96886 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Course Booking System WordPress plugin before 7.0.9 does not restrict access to its booking export, allowing unauthenticated users to download the name, email address and billing address of every customer who has booked a course.
- Product
- Course Booking System
- Fixed in
- 7.0.9
- What to do
- Update Course Booking System to 7.0.9 or newer.
Sep 30, 2026Vayu X: Does not perform any capability check on one of its AJAX actions and exposes the nonce guarding it to every logged-in userCVE-2026-88797 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Vayu X WordPress theme before 1.0.6 does not perform any capability check on one of its AJAX actions and exposes the nonce guarding it to every logged-in user, allowing any authenticated user, such as a subscriber, to install and activate any hosted on the WordPress.org repository.
- Product
- Vayu X
- Fixed in
- 1.0.6
- What to do
- Update Vayu X to 1.0.6 or newer.
Sep 24, 2026Spectra Legacy – Gutenberg Blocks: Sensitive Information ExposureCVE-2026-16302 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Spectra Legacy – Gutenberg Blocks plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.20.0 via the editor_assets function, which exposes the uag_insta_linked_accounts option through the uagb_blocks_info object without a capability check. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive data including raw Instagram Graph API access tokens configured by an administrator. Exploitation requires the Spectra Pro plugin to be active with a linked Instagram account.
- Product
- Spectra Legacy – Gutenberg Blocks
- Affected
- up to 2.20.0
- What to do
- Affects up to 2.20.0. Update Spectra Legacy – Gutenberg Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Sep 23, 2026Import and export users and customers: Privilege EscalationCVE-2026-86583 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Import and export users and customers plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.4.17 via the plugin's own export and re-import workflow. The vulnerability exists because the exporter writes CSV cells using fputcsv() with a NUL byte (\0) as the escape character, while the importer parses the same file using SplFileObject::fgetcsv() with only a single delimiter argument, causing PHP's default backslash escape character to be applied instead; because the export column layout places display_name immediately before the role column and nickname immediately after, an attacker can store crafted values in those two profile fields — saved by WordPress core via the standard profile page — such that the escape mismatch causes the parser to merge the display_name cell into the role field and rebalance the column count via nickname, yielding administrator as the parsed role for their own row when it reaches the import_user function's add_role function. This makes it possible for authenticated attackers with Subscriber-level access or above to escalate their privileges to Administrator. Exploitation requires a site administrator to trig
- Product
- Import and export users and customers
- Affected
- up to 2.4.17
- What to do
- Affects up to 2.4.17. Update Import and export users and customers to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 23, 2026Shop manager PHP Object Injection in Reycob Product Import Export <= 2.3.0 versions.CVE-2026-95603 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Shop manager PHP Object Injection in Reycob Product Import Export <= 2.3.0 versions.
- Affected
- up to 2.3.0
- What to do
- Affects up to 2.3.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 23, 2026Unauthenticated Sensitive Data Exposure in TrustedLogin Connector <= 2.0.3 versions.CVE-2026-95600 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Sensitive Data Exposure in TrustedLogin Connector <= 2.0.3 versions.
- Affected
- up to 2.0.3
- What to do
- Affects up to 2.0.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2026WP-CRM System – Manage Clients and Projects: Sensitive Information ExposureCVE-2026-9004 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP-CRM System – Manage Clients and Projects plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.4.6 via the 'contact_id' parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to extract full names, email addresses, phone numbers, mobile numbers, fax numbers, and physical address information of arbitrary CRM contact records by enumerating the contact_id parameter.
- Product
- WP-CRM System – Manage Clients and Projects
- Affected
- up to 3.4.6
- What to do
- Affects up to 3.4.6. Update WP-CRM System – Manage Clients and Projects to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 22, 2026The Ninja Forms WordPress plugin 3.15.3 does not prevent user-submitted form field values from being deserialised when an administrator later exports form submiCVE-2026-91827 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Ninja Forms WordPress plugin 3.15.3 does not prevent user-submitted form field values from being deserialised when an administrator later exports form submissions to CSV, allowing unauthenticated attackers to perform PHP Object Injection; if a suitable POP chain is present via another installed plugin or theme, this can lead to actions such as arbitrary file operations or remote code execution.
- What to do
- Update the plugin to the newest version.
Sep 20, 2026Import and export users and customers: Does not enforce the promote_users capability in its front-end import functionalityCVE-2026-92541 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Import and export users and customers WordPress plugin before 2.5.2 does not enforce the promote_users capability in its front-end import functionality, allowing users with only the create_users capability to change the role of existing users, including promoting them to administrator.
- Product
- Import and export users and customers
- Fixed in
- 2.5.2
- What to do
- Update Import and export users and customers to 2.5.2 or newer.
Sep 20, 2026Import and export users and customers: Does not correctly enforce the promote_users capabilityCVE-2026-92540 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Import and export users and customers WordPress plugin before 2.5.2 does not correctly enforce the promote_users capability when assigning roles during a CSV import, allowing users with only the create_users capability to create new administrator accounts or promote existing users to administrator.
- Product
- Import and export users and customers
- Fixed in
- 2.5.2
- What to do
- Update Import and export users and customers to 2.5.2 or newer.
Sep 20, 2026Import and export users and customers: Does not validate a user-supplied URL before requesting it server-side during a CSV importCVE-2026-16542 · WordPress plugins & themes · reported by WPScanMedium 4.1
The Import and export users and customers WordPress plugin before 2.4.5 does not validate a user-supplied URL before requesting it server-side during a CSV import, allowing high-privileged users to perform Server-Side Request Forgery attacks.
- Product
- Import and export users and customers
- Fixed in
- 2.4.5
- What to do
- Update Import and export users and customers to 2.4.5 or newer.
Sep 19, 2026WordLift – AI powered SEO – Schema: Sensitive Information ExposureCVE-2026-9289 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WordLift – AI powered SEO – Schema plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.54.10 via the JSON-LD REST API endpoints. This is due to the plugin registering the /wordlift/v1/jsonld/ routes (jsonld/{id}, jsonld/http/{item_id}, jsonld/post-meta/{meta_key}, jsonld/meta/{meta_key}, and jsonld/{post_type}/{post_name}) with a permission_callback of '__return_true' and the downstream converter retrieving the post via get_post() without verifying the post status or the requesting user's capabilities. This makes it possible for unauthenticated attackers to read the title, content/description, author, publication and modification dates, word count, comment count, and other metadata of private, draft, and pending posts by enumerating post IDs, bypassing WordPress core access controls.
- Product
- WordLift – AI powered SEO – Schema
- Affected
- up to 3.54.10
- What to do
- Affects up to 3.54.10. Update WordLift – AI powered SEO – Schema to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 19, 2026YS LeadGen: Sensitive Information ExposureCVE-2026-1255 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The YS LeadGen plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.1.4 due to the 'ysleadgen_get_captured_data' AJAX action being accessible to unauthenticated users. This makes it possible for unauthenticated attackers to retrieve all captured form submission data, including personally identifiable information (PII) such as names, email addresses, and message content submitted through YS LeadGen forms.
- Product
- YS LeadGen
- Affected
- up to 2.1.4
- What to do
- Affects up to 2.1.4. Update YS LeadGen to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 19, 2026Easy Appointments: Sensitive Information ExposureCVE-2026-9232 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Easy Appointments plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.12.27 via the handle_customers_ajax. This makes it possible for authenticated attackers, with contributor-level access and above, to extract the full customer dataset from the ea_customers table, including personally identifiable information such as names, email addresses, mobile numbers, dates of birth, and physical addresses.
- Product
- Easy Appointments
- Affected
- up to 3.12.27
- What to do
- Affects up to 3.12.27. Update Easy Appointments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 19, 2026Bread: Information exposureCVE-2026-4792 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Bread plugin for WordPress is vulnerable to information exposure in versions up to and including 2.9.12. This is due to the lack of authentication and authorization checks on the settings export functionality (download_settings function) which is registered on the plugins_loaded hook and explicitly allows execution on non-admin (public) pages. The function exports all plugin configuration settings including the protection_password field, which is stored in plaintext. This makes it possible for unauthenticated attackers to retrieve the PDF protection password by accessing the /?export-meeting-list=1 endpoint.
- Product
- Bread
- Affected
- up to 2.9.12
- What to do
- Affects up to 2.9.12. Update Bread to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 19, 2026WP Import Export Lite: Does not verify that the user running an import is permitted to create or modify user accounts and assign rolesCVE-2026-76554 · WordPress plugins & themes · reported by WPScanHigh 7.2
The WP Import Export Lite WordPress plugin before 3.9.35 does not verify that the user running an import is permitted to create or modify user accounts and assign roles, allowing users granted a delegated WP Import Export Lite WordPress plugin before 3.9.35 permission, who cannot otherwise manage users, to create administrator accounts and to overwrite the credentials and role of existing accounts, including administrators.
- Product
- WP Import Export Lite
- Fixed in
- 3.9.35
- What to do
- Update WP Import Export Lite to 3.9.35 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.