Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
567 results · page 2 of 12
Oct 1, 2026Subscriber Broken Access Control in WP Project Manager <= 4.0.7 versions.CVE-2026-97281 · WordPress plugins & themes · reported by PatchstackMedium 6.3
Subscriber Broken Access Control in WP Project Manager <= 4.0.7 versions.
- Affected
- up to 4.0.7
- What to do
- Affects up to 4.0.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 1, 2026Subscriber Broken Access Control in Social Boost <= 3.6.2 versions.CVE-2026-97277 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Subscriber Broken Access Control in Social Boost <= 3.6.2 versions.
- Affected
- up to 3.6.2
- What to do
- Affects up to 3.6.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 1, 2026Subscriber Broken Access Control in Aruba Migration Tool <= 1.0.4 versions.CVE-2026-97258 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Subscriber Broken Access Control in Aruba Migration Tool <= 1.0.4 versions.
- Affected
- up to 1.0.4
- What to do
- Affects up to 1.0.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 1, 2026Unauthenticated Broken Access Control in WP Full Stripe Free <= 8.5.6 versions.CVE-2026-62073 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in WP Full Stripe Free <= 8.5.6 versions.
- Affected
- up to 8.5.6
- What to do
- Affects up to 8.5.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 1, 2026Paytm Payment Gateway: Does not properly escape data taken from payment callbacks before using it in a SQL statementCVE-2026-81809 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Paytm Payment Gateway WordPress plugin before 2.8.9 does not properly escape data taken from payment callbacks before using it in a SQL statement, and the integrity check on those callbacks can be forged when the gateway is enabled without credentials, allowing unauthenticated users to perform SQL injection attacks.
- Product
- Paytm Payment Gateway
- Fixed in
- 2.8.9
- What to do
- Update Paytm Payment Gateway to 2.8.9 or newer.
Sep 30, 2026Unauthenticated Broken Access Control in Ultimate Maps by Supsystic <= 1.5.5 versions.CVE-2026-102397 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Broken Access Control in Ultimate Maps by Supsystic <= 1.5.5 versions.
- Affected
- up to 1.5.5
- What to do
- Affects up to 1.5.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 30, 2026Contributor Broken Access Control in The Events Calendar <= 6.17.5 versions.CVE-2026-97285 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Contributor Broken Access Control in The Events Calendar <= 6.17.5 versions.
- Affected
- up to 6.17.5
- What to do
- Affects up to 6.17.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 30, 2026Subscriber Broken Access Control in Prevent files / folders access <= 2.6.7 versions.CVE-2026-97267 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Subscriber Broken Access Control in Prevent files / folders access <= 2.6.7 versions.
- Affected
- up to 2.6.7
- What to do
- Affects up to 2.6.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 30, 2026Unauthenticated Broken Access Control in Blocksy Companion <= 2.1.55 versions.CVE-2026-97247 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Broken Access Control in Blocksy Companion <= 2.1.55 versions.
- Affected
- up to 2.1.55
- What to do
- Affects up to 2.1.55. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 30, 2026Subscriber Broken Access Control in AllAble Connector <= 0.13.4 versions.CVE-2026-97243 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Subscriber Broken Access Control in AllAble Connector <= 0.13.4 versions.
- Affected
- up to 0.13.4
- What to do
- Affects up to 0.13.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 30, 2026Subscriber Broken Access Control in MCP Content Manager Lite <= 1.1.0 versions.CVE-2026-97239 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Subscriber Broken Access Control in MCP Content Manager Lite <= 1.1.0 versions.
- Affected
- up to 1.1.0
- What to do
- Affects up to 1.1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 30, 2026Unauthenticated Broken Access Control in WordPress Backup & Migration <= 1.6.0 versions.CVE-2026-97197 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in WordPress Backup & Migration <= 1.6.0 versions.
- Affected
- up to 1.6.0
- What to do
- Affects up to 1.6.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 30, 2026Unauthenticated Broken Access Control in WP Express Checkout (Accept PayPal Payments) <= 2.4.9 versions.CVE-2026-96818 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in WP Express Checkout (Accept PayPal Payments) <= 2.4.9 versions.
- Affected
- up to 2.4.9
- What to do
- Affects up to 2.4.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 30, 2026Subscriber Broken Access Control in MakeCommerce for WooCommerce <= 4.1.0 versions.CVE-2026-96817 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Subscriber Broken Access Control in MakeCommerce for WooCommerce <= 4.1.0 versions.
- Affected
- up to 4.1.0
- What to do
- Affects up to 4.1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 30, 2026Unauthenticated Broken Access Control in Bookly <= 28.2 versions.CVE-2026-96348 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in Bookly <= 28.2 versions.
- Affected
- up to 28.2
- What to do
- Affects up to 28.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 30, 2026Unauthenticated Broken Access Control in Hostinger Migrator <= 1.0 versions.CVE-2026-95587 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in Hostinger Migrator <= 1.0 versions.
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 30, 2026Subscriber Broken Access Control in FormGent <= 1.12.2 versions.CVE-2026-94499 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Subscriber Broken Access Control in FormGent <= 1.12.2 versions.
- Affected
- up to 1.12.2
- What to do
- Affects up to 1.12.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 30, 2026Unauthenticated Broken Access Control in GravityExport Lite for Gravity Forms <= 2.7.2 versions.CVE-2026-94120 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in GravityExport Lite for Gravity Forms <= 2.7.2 versions.
- Affected
- up to 2.7.2
- What to do
- Affects up to 2.7.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 30, 2026Unauthenticated Broken Access Control in Simply Schedule Appointments <= 1.6.12.29 versions.CVE-2026-94074 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Broken Access Control in Simply Schedule Appointments <= 1.6.12.29 versions.
- Affected
- up to 1.6.12.29
- What to do
- Affects up to 1.6.12.29. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 30, 2026Broken Link Notifier: Does not re-validate the destination of redirectsCVE-2026-97316 · WordPress plugins & themes · reported by WPScanMedium 5.8
The Broken Link Notifier WordPress plugin before 2.0.0.1 does not re-validate the destination of redirects when checking links, allowing unauthenticated attackers to bypass its internal-address filter and make the server send requests to internal services.
- Product
- Broken Link Notifier
- Fixed in
- 2.0.0.1
- What to do
- Update Broken Link Notifier to 2.0.0.1 or newer.
Sep 26, 2026WP Delicious: Does not validate or escape the HTML tag name taken from user-supplied recipe block data before rendering it on the front endCVE-2026-92411 · WordPress plugins & themes · reported by WPScanMedium 6.8
The WP Delicious WordPress plugin before 1.10.8 does not validate or escape the HTML tag name taken from user-supplied recipe block data before rendering it on the front end, allowing users with the Contributor role and above to inject arbitrary HTML tags, including script tags, which execute when the recipe page is viewed.
- Product
- WP Delicious
- Fixed in
- 1.10.8
- What to do
- Update WP Delicious to 1.10.8 or newer.
Sep 23, 2026Unauthenticated Broken Access Control in Loops & Logic <= 4.2.4 versions.CVE-2026-95604 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in Loops & Logic <= 4.2.4 versions.
- Affected
- up to 4.2.4
- What to do
- Affects up to 4.2.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 23, 2026Unauthenticated Broken Access Control in Conekta Payment Gateway <= 6.2.4 versions.CVE-2026-95527 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Broken Access Control in Conekta Payment Gateway <= 6.2.4 versions.
- Affected
- up to 6.2.4
- What to do
- Affects up to 6.2.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 23, 2026Unauthenticated Broken Access Control in Online Booking & Scheduling Calendar for WordPress by vcita <= 4.6.0 versions.CVE-2026-95513 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in Online Booking & Scheduling Calendar for WordPress by vcita <= 4.6.0 versions.
- Affected
- up to 4.6.0
- What to do
- Affects up to 4.6.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 23, 2026Subscriber Broken Access Control in Fluent Support <= 2.3.2 versions.CVE-2026-94679 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Subscriber Broken Access Control in Fluent Support <= 2.3.2 versions.
- Affected
- up to 2.3.2
- What to do
- Affects up to 2.3.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 23, 2026Unauthenticated Broken Access Control in AppMySite <= 3.15.4 versions.CVE-2026-94498 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Broken Access Control in AppMySite <= 3.15.4 versions.
- Affected
- up to 3.15.4
- What to do
- Affects up to 3.15.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 23, 2026Unauthenticated Broken Access Control in MarketKing <= 2.1.70 versions.CVE-2026-94080 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Broken Access Control in MarketKing <= 2.1.70 versions.
- Affected
- up to 2.1.70
- What to do
- Affects up to 2.1.70. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 23, 2026Unauthenticated Broken Access Control in WP User Manager <= 2.9.19 versions.CVE-2026-94079 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Broken Access Control in WP User Manager <= 2.9.19 versions.
- Affected
- up to 2.9.19
- What to do
- Affects up to 2.9.19. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 23, 2026Unauthenticated Broken Access Control in PayPlus Payment Gateway <= 8.2.5 versions.CVE-2026-93620 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Broken Access Control in PayPlus Payment Gateway <= 8.2.5 versions.
- Affected
- up to 8.2.5
- What to do
- Affects up to 8.2.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 23, 2026Contributor Broken Access Control in WSP MCP – AI Agents Connector <= 2.7.0 versions.CVE-2026-93529 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Broken Access Control in WSP MCP – AI Agents Connector <= 2.7.0 versions.
- Affected
- up to 2.7.0
- What to do
- Affects up to 2.7.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 23, 2026Booking Manager: Does not sanitize and escape values taken from a fetched external iCalendar feed before using them in a SQL queryCVE-2026-91024 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Booking Manager WordPress plugin before 2.1.21 does not sanitize and escape values taken from a fetched external iCalendar feed before using them in a SQL query, allowing authenticated users with Author-level access and above to perform SQL injection attacks by importing a feed they control.
- Product
- Booking Manager
- Fixed in
- 2.1.21
- What to do
- Update Booking Manager to 2.1.21 or newer.
Sep 23, 2026Paymob for WooCommerce: Does not verify the request signature on the card-token branch of its payment webhookCVE-2026-87979 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Paymob for WooCommerce WordPress plugin before 4.1.14 does not verify the request signature on the card-token branch of its payment webhook, allowing unauthenticated attackers to write a card-token record to any user's account and to enumerate registered accounts.
- Product
- Paymob for WooCommerce
- Fixed in
- 4.1.14
- What to do
- Update Paymob for WooCommerce to 4.1.14 or newer.
Sep 23, 2026Email Subscribers & Newsletters: Does not verify the per-subscriber management token before changing a subscriber's subscription statusCVE-2026-83555 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Email Subscribers & Newsletters WordPress plugin before 5.9.35 does not verify the per-subscriber management token before changing a subscriber's subscription status, allowing unauthenticated users to force-unsubscribe or force-confirm an arbitrary subscriber whose email address they know.
- Product
- Email Subscribers & Newsletters
- Fixed in
- 5.9.35
- What to do
- Update Email Subscribers & Newsletters to 5.9.35 or newer.
Sep 23, 2026jet-form-builder-stripe-gateway: Does not sanitise and escape a payment token before using it in a SQL statementCVE-2022-4997 · WordPress plugins & themes · reported by WPScanHigh 8.6
The jet-form-builder-stripe-gateway WordPress plugin before 1.1.0 does not sanitise and escape a payment token before using it in a SQL statement, allowing unauthenticated users to extract arbitrary data from the database, including password hashes.
- Product
- jet-form-builder-stripe-gateway
- Fixed in
- 1.1.0
- What to do
- Update jet-form-builder-stripe-gateway to 1.1.0 or newer.
Sep 18, 2026Easy Appointments: Does not use an unguessable token to authorize its mail-link appointment cancellation and confirmation actionCVE-2026-87965 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Easy Appointments WordPress plugin before 4.0.2.2 does not use an unguessable token to authorize its mail-link appointment cancellation and confirmation action, deriving the token from a hardcoded source-embedded salt and the appointment's creation timestamp, so unauthenticated attackers who know or guess that timestamp can cancel or confirm arbitrary appointments.
- Product
- Easy Appointments
- Fixed in
- 4.0.2.2
- What to do
- Update Easy Appointments to 4.0.2.2 or newer.
Sep 17, 2026Unauthenticated Broken Access Control in BerqWP <= 4.1.15 versions.CVE-2026-78528 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Broken Access Control in BerqWP <= 4.1.15 versions.
- Affected
- up to 4.1.15
- What to do
- Affects up to 4.1.15. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 17, 2026Unauthenticated Broken Access Control in User Registration <= 5.2.7 versions.CVE-2026-74017 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Broken Access Control in User Registration <= 5.2.7 versions.
- Affected
- up to 5.2.7
- What to do
- Affects up to 5.2.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 17, 2026Unauthenticated Broken Access Control in Booking Calendar <= 11.7 versions.CVE-2026-74002 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Broken Access Control in Booking Calendar <= 11.7 versions.
- Affected
- up to 11.7
- What to do
- Affects up to 11.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 17, 2026Contributor Broken Access Control in Simple Membership <= 4.8.2 versions.CVE-2026-74000 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Contributor Broken Access Control in Simple Membership <= 4.8.2 versions.
- Affected
- up to 4.8.2
- What to do
- Affects up to 4.8.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 17, 2026Unauthenticated Broken Access Control in Easy Invoice <= 2.3.8 versions.CVE-2026-66676 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Broken Access Control in Easy Invoice <= 2.3.8 versions.
- Affected
- up to 2.3.8
- What to do
- Affects up to 2.3.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 17, 2026Unauthenticated Broken Authentication in Headless Single Sign On <= 1.7.0 versions.CVE-2026-62108 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated Broken Authentication in Headless Single Sign On <= 1.7.0 versions.
- Affected
- up to 1.7.0
- What to do
- Affects up to 1.7.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 17, 2026Unauthenticated Broken Authentication in EduAdmin Booking <= 5.4.2 versions.CVE-2026-62101 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated Broken Authentication in EduAdmin Booking <= 5.4.2 versions.
- Affected
- up to 5.4.2
- What to do
- Affects up to 5.4.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 17, 2026wpShopGermany IT-RECHT KANZLEI: Does not generate its API authentication token securelyCVE-2026-88795 · WordPress plugins & themes · reported by WPScanCritical 9
The wpShopGermany IT-RECHT KANZLEI WordPress plugin before 2.4 does not generate its API authentication token securely, deriving it from data the requester controls and creating it as a side effect of the check that is supposed to validate it, allowing unauthenticated attackers to predict the token and use the access it grants to write arbitrary files, leading to remote code execution.
- Product
- wpShopGermany IT-RECHT KANZLEI
- Fixed in
- 2.4
- What to do
- Update wpShopGermany IT-RECHT KANZLEI to 2.4 or newer.
Sep 16, 2026Subscriptions for WooCommerce: Does not verify the security token on the request that cancels a subscriptionCVE-2026-87860 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Subscriptions for WooCommerce WordPress plugin before 2.0.3 does not verify the security token on the request that cancels a subscription, allowing attackers to make a logged-in customer cancel their own active subscription through a crafted request they are tricked into making.
- Product
- Subscriptions for WooCommerce
- Fixed in
- 2.0.3
- What to do
- Update Subscriptions for WooCommerce to 2.0.3 or newer.
Sep 16, 2026Eventin: Does not prevent the token issued to a guest at checkout from being used to change that order's tickets afterwardsCVE-2026-77702 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Eventin WordPress plugin before 4.1.24 does not prevent the token issued to a guest at checkout from being used to change that order's tickets afterwards, allowing unauthenticated users to replace a paid ticket with a free one and complete the order at no charge.
- Product
- Eventin
- Fixed in
- 4.1.24
- What to do
- Update Eventin to 4.1.24 or newer.
Sep 16, 2026WP Import Export Lite: Does not validate a path taken from storedCVE-2026-76553 · WordPress plugins & themes · reported by WPScanMedium 6.5
The WP Import Export Lite WordPress plugin before 3.9.33 does not validate a path taken from stored, user-supplied data before recursively deleting the directory it resolves to, allowing users to whom an administrator has delegated a WP Import Export Lite WordPress plugin before 3.9.33 capability to delete arbitrary directories, and every file within them, including outside the web root.
- Product
- WP Import Export Lite
- Fixed in
- 3.9.33
- What to do
- Update WP Import Export Lite to 3.9.33 or newer.
Sep 12, 2026Zonify: Does not perform any capability or authentication check before returning the site's stored account login tokenCVE-2026-87842 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Zonify WordPress plugin before 1.0.5 does not perform any capability or authentication check before returning the site's stored account login token, allowing unauthenticated attackers to retrieve it and authenticate to the site owner's linked service account.
- Product
- Zonify
- Fixed in
- 1.0.5
- What to do
- Update Zonify to 1.0.5 or newer.
Sep 12, 2026Booking for Appointments and Events Calendar: Does not verify that a payment was actually taken before recording a bookingCVE-2026-77689 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Booking for Appointments and Events Calendar WordPress plugin before 9.8.1 does not verify that a payment was actually taken before recording a booking as paid, trusting the payment gateway named in a public, unauthenticated booking request even when the site has never configured that gateway. This lets an unauthenticated attacker obtain confirmed, fully paid appointments and events without any payment being collected.
- Product
- Booking for Appointments and Events Calendar
- Fixed in
- 9.8.1
- What to do
- Update Booking for Appointments and Events Calendar to 9.8.1 or newer.
Sep 11, 2026Unauthenticated Broken Access Control in Flexible Quantity – Measurement Price Calculator for WooCommerce <= 2.3.21 versions.CVE-2026-62136 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Broken Access Control in Flexible Quantity – Measurement Price Calculator for WooCommerce <= 2.3.21 versions.
- Affected
- up to 2.3.21
- What to do
- Affects up to 2.3.21. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 11, 2026Unauthenticated Broken Access Control in Booktics <= 1.0.24 versions.CVE-2026-62135 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Broken Access Control in Booktics <= 1.0.24 versions.
- Affected
- up to 1.0.24
- What to do
- Affects up to 1.0.24. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.