Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
5,534 results · page 2 of 111
Nov 5, 2026The Security For WooCommerce WordPress plugin from 1.0.10 to 1.0.16 does not perform capability checks when creating users through an action available to unauthCVE-2026-100109 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Security For WooCommerce WordPress plugin from 1.0.10 to 1.0.16 does not perform capability checks when creating users through an action available to unauthenticated visitors, and lets the caller choose the new account's role, allowing unauthenticated attackers to create administrator accounts and take over the site.
- What to do
- Update the plugin to the newest version.
Nov 5, 2026EWWW Image Optimizer: Does not properly sanitize and restrict a value in post content before using it to dynamically load and execute a script in the pageCVE-2026-91049 · WordPress plugins & themes · reported by WPScanMedium 6.4
The EWWW Image Optimizer WordPress plugin before 8.9.1 does not properly sanitize and restrict a value in post content before using it to dynamically load and execute a script in the page, allowing authenticated attackers with author-level access and above to inject arbitrary web scripts that run in the session of any user who views the affected page, including administrators. This is an incomplete fix of CVE-2026-15446: the origin and path restrictions added from 8.7.4 onward were each bypassable, so versions 8.7.4 through 8.9.0 remain affected.
- Product
- EWWW Image Optimizer
- Affected
- up to 8.9.0
- Fixed in
- 8.9.1
- What to do
- Update EWWW Image Optimizer to 8.9.1 or newer.
Nov 5, 2026Essential Real Estate: Does not verify ownership of an invoice before rendering it in one of its AJAX actionsCVE-2026-90967 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Essential Real Estate WordPress plugin before 5.3.5 does not verify ownership of an invoice before rendering it in one of its AJAX actions, allowing an authenticated low-privileged user to read other users' invoices, including the invoice owner's name, account email address and financial details.
- Product
- Essential Real Estate
- Fixed in
- 5.3.5
- What to do
- Update Essential Real Estate to 5.3.5 or newer.
Nov 5, 2026Essential Real Estate: Does not verifyCVE-2026-90966 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Essential Real Estate WordPress plugin before 5.3.5 does not verify, in one of its AJAX actions, that a listing package selected for free activation is genuinely free or that the requesting user is entitled to it, allowing a self-registered customer to activate a paid package without payment and cause the site to record a paid invoice at the package's full price.
- Product
- Essential Real Estate
- Fixed in
- 5.3.5
- What to do
- Update Essential Real Estate to 5.3.5 or newer.
Nov 5, 2026Essential Real Estate: Does not perform a publication-status or authorization check in two of its AJAX actionsCVE-2026-90965 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Essential Real Estate WordPress plugin before 5.3.5 does not perform a publication-status or authorization check in two of its AJAX actions, allowing unauthenticated users to retrieve the images attached to property listings that have not been published.
- Product
- Essential Real Estate
- Fixed in
- 5.3.5
- What to do
- Update Essential Real Estate to 5.3.5 or newer.
Nov 5, 2026Essential Real Estate: Does not restrict the recipient of one of its contact email actionsCVE-2026-90964 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Essential Real Estate WordPress plugin before 5.3.5 does not restrict the recipient of one of its contact email actions, allowing unauthenticated users to send emails to arbitrary addresses with an attacker-controlled sender header and message body through the site.
- Product
- Essential Real Estate
- Fixed in
- 5.3.5
- What to do
- Update Essential Real Estate to 5.3.5 or newer.
Nov 5, 2026Essential Real Estate: Does not perform any authorization or publication-status check in one of its AJAX actionsCVE-2026-90963 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Essential Real Estate WordPress plugin before 5.3.5 does not perform any authorization or publication-status check in one of its AJAX actions, allowing unauthenticated users to read the full contents of property listings that have not been published, together with the private name, email address, phone number and office address of the listing agent.
- Product
- Essential Real Estate
- Fixed in
- 5.3.5
- What to do
- Update Essential Real Estate to 5.3.5 or newer.
Nov 5, 2026YITH WooCommerce Gift Cards: Does not lock or atomically update a gift card's balanceCVE-2026-88814 · WordPress plugins & themes · reported by WPScanLow 3.7
The YITH WooCommerce Gift Cards WordPress plugin before 4.38.1 does not lock or atomically update a gift card's balance when it is redeemed at checkout, allowing an attacker who holds a gift card code to spend more than its funded value by submitting multiple checkouts for the same code at the same time.
- Product
- YITH WooCommerce Gift Cards
- Fixed in
- 4.38.1
- What to do
- Update YITH WooCommerce Gift Cards to 4.38.1 or newer.
Nov 5, 2026Community Events: Does not have authorisation or nonce checks in one of its AJAX actionsCVE-2026-86795 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Community Events WordPress plugin before 1.6.0 does not have authorisation or nonce checks in one of its AJAX actions, allowing unauthenticated users to retrieve details of event submissions awaiting moderation, which are not available anywhere on the public site.
- Product
- Community Events
- Fixed in
- 1.6.0
- What to do
- Update Community Events to 1.6.0 or newer.
Nov 5, 2026WP Event Manager: Does not verify the ownership or the post type of a user supplied post identifier in its front-end event submission flowCVE-2026-86442 · WordPress plugins & themes · reported by WPScanHigh 8.2
The WP Event Manager WordPress plugin before 3.4.2 does not verify the ownership or the post type of a user supplied post identifier in its front-end event submission flow, allowing unauthenticated attackers to read and overwrite the content of arbitrary unpublished posts and pages, and to convert them into events.
- Product
- WP Event Manager
- Fixed in
- 3.4.2
- What to do
- Update WP Event Manager to 3.4.2 or newer.
Nov 5, 2026Tutor LMS: Does not prevent the correct answers to quiz questions from being included in the page it serves to the student taking the quizCVE-2026-85570 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Tutor LMS WordPress plugin before 4.2.0 does not prevent the correct answers to quiz questions from being included in the page it serves to the student taking the quiz, and does so regardless of the setting intended to control whether answers are revealed, allowing any enrolled student to obtain them before submitting their attempt.
- Product
- Tutor LMS
- Fixed in
- 4.2.0
- What to do
- Update Tutor LMS to 4.2.0 or newer.
Nov 5, 2026FV Flowplayer Video Player: Does not validate a user-supplied URL before performing a server-side fetch whose response body is stored and served publiclyCVE-2026-85351 · WordPress plugins & themes · reported by WPScanMedium 5
The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not validate a user-supplied URL before performing a server-side fetch whose response body is stored and served publicly, allowing users with Contributor-level access and above to perform Server-Side Request Forgery (SSRF) attacks and to read the response of an internal resource when it is returned with an image content type.
- Product
- FV Flowplayer Video Player
- Fixed in
- 7.5.56.7212
- What to do
- Update FV Flowplayer Video Player to 7.5.56.7212 or newer.
Nov 5, 2026FV Flowplayer Video Player: Does not sanitize and escape a user-supplied value before outputting it in a pageCVE-2026-85347 · WordPress plugins & themes · reported by WPScanMedium 6.8
The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not sanitize and escape a user-supplied value before outputting it in a page, which could allow users with the Contributor role and above to inject arbitrary web scripts that execute when a higher-privileged user views the affected page.
- Product
- FV Flowplayer Video Player
- Fixed in
- 7.5.56.7212
- What to do
- Update FV Flowplayer Video Player to 7.5.56.7212 or newer.
Nov 5, 2026FV Flowplayer Video Player: Does not perform authorization or CSRF checks on several of its cloud storage media browser handlersCVE-2026-85346 · WordPress plugins & themes · reported by WPScanMedium 4.3
The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not perform authorization or CSRF checks on several of its cloud storage media browser handlers, allowing any authenticated user with minimal permissions (such as Subscriber) to disclose the configuration and stored file listings of the site's connected cloud storage accounts.
- Product
- FV Flowplayer Video Player
- Fixed in
- 7.5.56.7212
- What to do
- Update FV Flowplayer Video Player to 7.5.56.7212 or newer.
Nov 5, 2026All In One Login: Does not adequately restrict the number of attempts that can be made against the short numeric code used by its default-enabled passwordless email loginCVE-2026-19256 · WordPress plugins & themes · reported by WPScanCritical 9.8
The All In One Login WordPress plugin before 2.5.0 does not adequately restrict the number of attempts that can be made against the short numeric code used by its default-enabled passwordless email login, and does not feed those failed attempts into its own brute-force protection, allowing unauthenticated attackers to take over any account including administrators.
- Product
- All In One Login
- Fixed in
- 2.5.0
- What to do
- Update All In One Login to 2.5.0 or newer.
Nov 5, 2026WP Event Manager: Does not properly validate ownership or the type of the user-supplied post identifiers processed by one of its frontend formsCVE-2026-16304 · WordPress plugins & themes · reported by WPScanHigh 8.1
The WP Event Manager WordPress plugin before 3.4.2 does not properly validate ownership or the type of the user-supplied post identifiers processed by one of its frontend forms, allowing any user with a Subscriber account or above to reassign the authorship of arbitrary posts to themselves and to force them to be published. This results in content takeover and in the public disclosure of otherwise private or draft content, and requires the relevant frontend feature to be enabled.
- Product
- WP Event Manager
- Fixed in
- 3.4.2
- What to do
- Update WP Event Manager to 3.4.2 or newer.
Nov 5, 2026WP PageNavi Style: Does not sanitise and escape some of its settingsCVE-2026-109150 · WordPress plugins & themes · reported by WPScanHigh 7.1
The WP PageNavi Style WordPress plugin through 1.4 does not sanitise and escape some of its settings, and has no CSRF check when they are saved, which could allow attackers to make a logged-in administrator store arbitrary JavaScript via a CSRF attack that is then executed in the browser of everyone who visits the site's front end.
- Product
- WP PageNavi Style
- Affected
- up to 1.4
- What to do
- Affects up to 1.4. Update WP PageNavi Style to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 5, 2026CatFolders: Does not have authorisation checks on a folder maintenance actionCVE-2026-107787 · WordPress plugins & themes · reported by WPScanLow 3.1
The CatFolders WordPress plugin before 2.5.7 does not have authorisation checks on a folder maintenance action, allowing users with a role as low as subscriber to reset the per-user ownership of every media folder and disable the CatFolders WordPress plugin before 2.5.7's user restriction setting.
- Product
- CatFolders
- Fixed in
- 2.5.7
- What to do
- Update CatFolders to 2.5.7 or newer.
Nov 5, 2026CatFolders: Does not properly sanitize and escape a user-controlled sort setting before using it in a SQL queryCVE-2026-107786 · WordPress plugins & themes · reported by WPScanMedium 6.8
The CatFolders WordPress plugin before 2.5.7 does not properly sanitize and escape a user-controlled sort setting before using it in a SQL query, allowing authenticated users with upload capability (Author and above) to perform SQL injection attacks.
- Product
- CatFolders
- Fixed in
- 2.5.7
- What to do
- Update CatFolders to 2.5.7 or newer.
Nov 5, 2026Dokan: AI Powered WooCommerce Multivendor Marketplace Solution: Does not verify that the acting administrator is authorized to manage each selected user before enabling that user's marketplace seller statusCVE-2026-107775 · WordPress plugins & themes · reported by WPScanLow 2.7
The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.3.3 does not verify that the acting administrator is authorized to manage each selected user before enabling that user's marketplace seller status, allowing a subsite Administrator on WordPress Multisite to enable selling for users outside their own site, including network-level users they cannot otherwise manage.
- Product
- Dokan: AI Powered WooCommerce Multivendor Marketplace Solution
- Fixed in
- 5.3.3
- What to do
- Update Dokan: AI Powered WooCommerce Multivendor Marketplace Solution to 5.3.3 or newer.
Nov 5, 2026Dokan: AI Powered WooCommerce Multivendor Marketplace Solution: Does not use a trusted site-owned sender addressCVE-2026-107774 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.3.3 does not use a trusted site-owned sender address when relaying its store contact form, instead placing the unauthenticated submitter's supplied address directly in the message's From header rather than a Reply-To, allowing unauthenticated attackers to make the site email its own vendors with the sender spoofed to an address at the site's own domain (such as its administrator), aligned with the domain's own SPF/DKIM.
- Product
- Dokan: AI Powered WooCommerce Multivendor Marketplace Solution
- Fixed in
- 5.3.3
- What to do
- Update Dokan: AI Powered WooCommerce Multivendor Marketplace Solution to 5.3.3 or newer.
Nov 5, 2026Dokan: AI Powered WooCommerce Multivendor Marketplace Solution: Does not correctly verify authorizationCVE-2026-107773 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.3.3 does not correctly verify authorization when serving a single order and its order notes, allowing unauthenticated attackers to read customer and order information and to add or delete order notes for a subset of orders.
- Product
- Dokan: AI Powered WooCommerce Multivendor Marketplace Solution
- Fixed in
- 5.3.3
- What to do
- Update Dokan: AI Powered WooCommerce Multivendor Marketplace Solution to 5.3.3 or newer.
Nov 5, 2026Car Dealer (Dealership) and Vehicle sales: Does not restrict its unauthenticated single-listing AJAX action to published contentCVE-2026-105971 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Car Dealer (Dealership) and Vehicle sales WordPress plugin through 4.73 does not restrict its unauthenticated single-listing AJAX action to published content, allowing an unauthenticated attacker to read the title, content and metadata of any private, draft, pending, future or trashed post by supplying its numeric id.
- Product
- Car Dealer (Dealership) and Vehicle sales
- Affected
- up to 4.73
- What to do
- Affects up to 4.73. Update Car Dealer (Dealership) and Vehicle sales to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 5, 2026Easy Social Icons: Does not sanitise SVG filesCVE-2026-105259 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Easy Social Icons WordPress plugin before 4.0.3 does not sanitise SVG files, which it adds to the list of file types that may be uploaded site-wide, allowing users with the Author role and above to upload a malicious SVG containing XSS payloads. Where another installed Easy Social Icons WordPress plugin before 4.0.3 exposes an upload route to unauthenticated visitors, the same issue can be triggered without an account.
- Product
- Easy Social Icons
- Fixed in
- 4.0.3
- What to do
- Update Easy Social Icons to 4.0.3 or newer.
Nov 5, 2026IVPAY payments: Does not sanitise a value from its payment callback before using it in a SQL statementCVE-2026-100144 · WordPress plugins & themes · reported by WPScanCritical 9.3
The IVPAY payments WordPress plugin through 1.0.8 does not sanitise a value from its payment callback before using it in a SQL statement, and treats an empty API key, which is its own default, as valid authentication, allowing unauthenticated attackers to read arbitrary data from the database.
- Product
- IVPAY payments
- Affected
- up to 1.0.8
- What to do
- Affects up to 1.0.8. Update IVPAY payments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 5, 2026Cloud Blocks: Does not perform any authorisation or sanitisationCVE-2025-15702 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Cloud Blocks WordPress plugin through 1.1.8 does not perform any authorisation or sanitisation when storing block asset URLs, allowing unauthenticated users to store malicious scripts that are executed in the browser of any privileged user, such as an administrator, who opens the block editor.
- Product
- Cloud Blocks
- Affected
- up to 1.1.8
- What to do
- Affects up to 1.1.8. Update Cloud Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 5, 2026Easy Social Icons: Does not sanitise and escape some of its settings before outputting them on front-end pagesCVE-2025-15701 · WordPress plugins & themes · reported by WPScanLow 3.5
The Easy Social Icons WordPress plugin before 4.0.3 does not sanitise and escape some of its settings before outputting them on front-end pages, which could allow high-privilege users such as Administrators to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed, for example on a multisite network.
- Product
- Easy Social Icons
- Fixed in
- 4.0.3
- What to do
- Update Easy Social Icons to 4.0.3 or newer.
Nov 4, 2026VikWidgetsLoader: Does not sanitise or escape several block attributes before outputting them inside HTML attributesCVE-2026-118983 · WordPress plugins & themes · reported by WPScanMedium 6.8
The VikWidgetsLoader WordPress plugin before 1.12.3 does not sanitise or escape several block attributes before outputting them inside HTML attributes, allowing users with the Contributor role to store arbitrary JavaScript that executes in the browser of any user viewing the affected post, including the administrator or editor who reviews the pending submission.
- Product
- VikWidgetsLoader
- Fixed in
- 1.12.3
- What to do
- Update VikWidgetsLoader to 1.12.3 or newer.
Nov 4, 2026All-in-One Video Gallery: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embeddedCVE-2026-118783 · WordPress plugins & themes · reported by WPScanMedium 6.8
The All-in-One Video Gallery WordPress plugin before 5.0.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedded, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- All-in-One Video Gallery
- Fixed in
- 5.0.0
- What to do
- Update All-in-One Video Gallery to 5.0.0 or newer.
Nov 4, 2026Simple Download Monitor: Does not properly check the visibility of the content referenced by one of its shortcodesCVE-2026-118637 · WordPress plugins & themes · reported by WPScanLow 2.7
The Simple Download Monitor WordPress plugin before 4.1.3 does not properly check the visibility of the content referenced by one of its shortcodes, allowing users with a role as low as Contributor to disclose the title and description of private, draft and other non-public posts.
- Product
- Simple Download Monitor
- Fixed in
- 4.1.3
- What to do
- Update Simple Download Monitor to 4.1.3 or newer.
Nov 4, 2026EventPrime: Does not keep the built-in Pending Review post status non-publicCVE-2026-118523 · WordPress plugins & themes · reported by WPScanMedium 5.3
The EventPrime WordPress plugin before 4.3.6.1 does not keep the built-in Pending Review post status non-public, allowing unauthenticated users to view posts, pages and other content that are awaiting review.
- Product
- EventPrime
- Fixed in
- 4.3.6.1
- What to do
- Update EventPrime to 4.3.6.1 or newer.
Nov 4, 2026Stape Conversion Tracking: Does not validate the sub-path appended to its same-origin proxy's upstream endpointCVE-2026-118422 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Stape Conversion Tracking WordPress plugin before 2.3.11 does not validate the sub-path appended to its same-origin proxy's upstream endpoint, allowing unauthenticated visitors to redirect the server-side request to an arbitrary host and have the response body and its content type returned from the site's own origin with security response headers stripped, leading to Server-Side Request Forgery, including loopback and internal hosts, and Cross-Site Scripting.
- Product
- Stape Conversion Tracking
- Fixed in
- 2.3.11
- What to do
- Update Stape Conversion Tracking to 2.3.11 or newer.
Nov 4, 2026Premium Packages: Does not verify that a user claiming a guest order is the original buyerCVE-2026-118407 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Premium Packages WordPress plugin before 7.3.1 does not verify that a user claiming a guest order is the original buyer, allowing any authenticated user to take ownership of any unclaimed guest order, and thereby read the buyer's billing details and download their purchased files, by supplying only the order identifier.
- Product
- Premium Packages
- Fixed in
- 7.3.1
- What to do
- Update Premium Packages to 7.3.1 or newer.
Nov 4, 2026Premium Packages: Does not verify ownership or session bindingCVE-2026-118404 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Premium Packages WordPress plugin before 7.3.1 does not verify ownership or session binding when loading a previously saved shopping cart, allowing any unauthenticated user who obtains another shopper's saved-cart identifier to load that shopper's cart contents, including selected products, quantities and buyer-entered custom field data, into their own session.
- Product
- Premium Packages
- Fixed in
- 7.3.1
- What to do
- Update Premium Packages to 7.3.1 or newer.
Nov 4, 2026Premium Packages: Does not verify that the requester owns a guest order before returning its detailsCVE-2026-118403 · WordPress plugins & themes · reported by WPScanLow 3.7
The Premium Packages WordPress plugin before 7.3.1 does not verify that the requester owns a guest order before returning its details, allowing unauthenticated visitors who know a guest order's identifier to view its order status, payment status and total.
- Product
- Premium Packages
- Fixed in
- 7.3.1
- What to do
- Update Premium Packages to 7.3.1 or newer.
Nov 4, 2026WPvivid — Backup, Migration & Staging: Does not properly validate a backup storage directory path before using it to create directories and write filesCVE-2026-115426 · WordPress plugins & themes · reported by WPScanMedium 5.5
The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.138 does not properly validate a backup storage directory path before using it to create directories and write files, allowing administrators to cause those directories and files to be created outside the intended backup location via path traversal.
- Product
- WPvivid — Backup, Migration & Staging
- Fixed in
- 0.9.138
- What to do
- Update WPvivid — Backup, Migration & Staging to 0.9.138 or newer.
Nov 4, 2026Duplicator WordPress plugin before 5.1.0, duplicator-pro: Does not restrict its database charset and collation rewrite to schema statements during a restoreCVE-2026-115262 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Duplicator WordPress plugin before 5.1.0, duplicator-pro WordPress plugin before 5.1.0 does not restrict its database charset and collation rewrite to schema statements during a restore, so a value a Subscriber stores in their own profile can break out of its string literal and inject SQL into the restore's INSERT statement when an administrator restores the backup onto a server lacking one of the source's charsets or collations.
- Product
- Duplicator WordPress plugin before 5.1.0, duplicator-pro
- Fixed in
- 5.1.0
- What to do
- Update Duplicator WordPress plugin before 5.1.0, duplicator-pro to 5.1.0 or newer.
Nov 4, 2026WP Roster: Does not perform any capability or nonce checks before writing its stored roster dataCVE-2026-115257 · WordPress plugins & themes · reported by WPScanMedium 5.3
The WP Roster WordPress plugin before 2.36 does not perform any capability or nonce checks before writing its stored roster data, allowing unauthenticated attackers to overwrite, wipe or restore the content of any roster.
- Product
- WP Roster
- Fixed in
- 2.36
- What to do
- Update WP Roster to 2.36 or newer.
Nov 4, 2026Text Typing: Does not properly sanitize and escape a block attribute before storing it and later outputting it into a page element that is read and rendered by client-side scriptCVE-2026-115250 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Text Typing WordPress plugin before 2.2.2 does not properly sanitize and escape a block attribute before storing it and later outputting it into a page element that is read and rendered by client-side script, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks that execute in the browser of anyone viewing the affected page.
- Product
- Text Typing
- Fixed in
- 2.2.2
- What to do
- Update Text Typing to 2.2.2 or newer.
Nov 4, 2026WPvivid — Backup, Migration & Staging: Does not validate the extension of the file it actually storesCVE-2026-115243 · WordPress plugins & themes · reported by WPScanMedium 6.7
The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.137 does not validate the extension of the file it actually stores when handling an import upload: it checks the extension of a separate request field while saving the uploaded file itself with WordPress's upload type-checking disabled, so an authenticated administrator can store a file with an arbitrary extension, including a PHP file, in the WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.137's import directory. This is an incomplete fix of CVE-2025-5961, whose extension check was applied to the wrong value.
- Product
- WPvivid — Backup, Migration & Staging
- Fixed in
- 0.9.137
- What to do
- Update WPvivid — Backup, Migration & Staging to 0.9.137 or newer.
Nov 4, 2026WPvivid — Backup, Migration & Staging: Does not sanitize the staging destination folder supplied to its staging-start handlerCVE-2026-115242 · WordPress plugins & themes · reported by WPScanMedium 5.5
The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.137 does not sanitize the staging destination folder supplied to its staging-start handler, applying only a generic text filter while the sibling writability-check handler applies the correct filename sanitizer, so an authenticated administrator can supply a path containing traversal sequences and make the WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.137 write the copied site files outside the WordPress installation directory.
- Product
- WPvivid — Backup, Migration & Staging
- Fixed in
- 0.9.137
- What to do
- Update WPvivid — Backup, Migration & Staging to 0.9.137 or newer.
Nov 4, 2026WPvivid — Backup, Migration & Staging: Does not verify that a submitted snapshot identifier names a snapshot it actually created before using itCVE-2026-115241 · WordPress plugins & themes · reported by WPScanMedium 6.5
The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.137 does not verify that a submitted snapshot identifier names a snapshot it actually created before using it as a database table-name prefix, so an authenticated administrator can supply the site's table prefix, or any other string, and cause the WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.137 to drop every matching table, including the core WordPress tables, destroying the site's database.
- Product
- WPvivid — Backup, Migration & Staging
- Fixed in
- 0.9.137
- What to do
- Update WPvivid — Backup, Migration & Staging to 0.9.137 or newer.
Nov 4, 2026Enable Media Replace: Does not pass a replaced media file through the WordPress upload pipelineCVE-2026-114431 · WordPress plugins & themes · reported by WPScanMedium 6.4
The Enable Media Replace WordPress plugin before 4.2.3 does not pass a replaced media file through the WordPress upload pipeline, so the upload prefilter that SVG-sanitizer Enable Media Replace WordPress plugin before 4.2.3 rely on never runs, allowing an authenticated user with upload access to store an SVG file containing script that executes when the file is opened directly. It requires an SVG-enabling Enable Media Replace WordPress plugin before 4.2.3 to be active, as the replace path otherwise rejects SVG uploads.
- Product
- Enable Media Replace
- Fixed in
- 4.2.3
- What to do
- Update Enable Media Replace to 4.2.3 or newer.
Nov 4, 2026Duplicator WordPress plugin before 5.1.0, duplicator-pro: Does not prevent direct access to some of its bundled PHP filesCVE-2026-112244 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Duplicator WordPress plugin before 5.1.0, duplicator-pro WordPress plugin before 5.1.0 does not prevent direct access to some of its bundled PHP files, which initialise without their expected context, trigger a fatal error, and return a stack trace that discloses the server's absolute filesystem paths to unauthenticated users.
- Product
- Duplicator WordPress plugin before 5.1.0, duplicator-pro
- Fixed in
- 5.1.0
- What to do
- Update Duplicator WordPress plugin before 5.1.0, duplicator-pro to 5.1.0 or newer.
Nov 4, 2026Duplicator WordPress plugin before 5.1.0, duplicator-pro: Does not sanitise and escape a parameter before reflecting it on one of its administrative pages in certain configurationsCVE-2026-112243 · WordPress plugins & themes · reported by WPScanMedium 5.8
The Duplicator WordPress plugin before 5.1.0, duplicator-pro WordPress plugin before 5.1.0 does not sanitise and escape a parameter before reflecting it on one of its administrative pages in certain configurations, leading to Reflected Cross-Site Scripting that executes in the session of a logged-in administrator who is tricked into opening a crafted link.
- Product
- Duplicator WordPress plugin before 5.1.0, duplicator-pro
- Fixed in
- 5.1.0
- What to do
- Update Duplicator WordPress plugin before 5.1.0, duplicator-pro to 5.1.0 or newer.
Nov 4, 2026WP Remote Users Sync: Does not adequately restrict access to the user export files it writes beneath the public web rootCVE-2026-111962 · WordPress plugins & themes · reported by WPScanLow 3.7
The WP Remote Users Sync WordPress plugin before 2.2.0 does not adequately restrict access to the user export files it writes beneath the public web root, relying on an Apache access-control file that other web servers such as Nginx ignore, which allows an unauthenticated attacker who requests the export's predictable file name while it is present to retrieve the exported users' personal data.
- Product
- WP Remote Users Sync
- Fixed in
- 2.2.0
- What to do
- Update WP Remote Users Sync to 2.2.0 or newer.
Nov 4, 2026Post Duplicator: Does not check whether the requesting user may view each post before returning a list of posts for a post typeCVE-2026-111740 · WordPress plugins & themes · reported by WPScanLow 2.7
The Post Duplicator WordPress plugin before 3.0.17 does not check whether the requesting user may view each post before returning a list of posts for a post type, allowing users with a role as low as Contributor to read the titles and hierarchy of other users' draft and private posts.
- Product
- Post Duplicator
- Fixed in
- 3.0.17
- What to do
- Update Post Duplicator to 3.0.17 or newer.
Nov 4, 2026Essential Real Estate: Does not verify that a media attachment belongs to the requesting user before deleting itCVE-2026-110964 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Essential Real Estate WordPress plugin before 5.3.5 does not verify that a media attachment belongs to the requesting user before deleting it, allowing a self-registered customer-level user to delete other users' media library attachments, including those owned by administrators.
- Product
- Essential Real Estate
- Fixed in
- 5.3.5
- What to do
- Update Essential Real Estate to 5.3.5 or newer.
Nov 4, 2026PowerPack Addons for Elementor: Widgets, Form Styler and Templates: Does not validate a user-supplied URL before using it in a server-side HTTP requestCVE-2026-110692 · WordPress plugins & themes · reported by WPScanMedium 4.1
The PowerPack Addons for Elementor: Widgets, Form Styler and Templates WordPress plugin before 3.1.3 does not validate a user-supplied URL before using it in a server-side HTTP request, which could allow users with the contributor role and above to perform Server-Side Request Forgery attacks against internal and loopback resources and read the response back.
- Product
- PowerPack Addons for Elementor: Widgets, Form Styler and Templates
- Fixed in
- 3.1.3
- What to do
- Update PowerPack Addons for Elementor: Widgets, Form Styler and Templates to 3.1.3 or newer.
Nov 4, 2026FV Flowplayer Video Player: Does not perform proper authorization checks on one of its video-migration functionsCVE-2026-108068 · WordPress plugins & themes · reported by WPScanLow 3.8
The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not perform proper authorization checks on one of its video-migration functions, which is protected by a nonce only, allowing users with Contributor-level permissions and above to disclose and bulk-modify the FV Flowplayer Video Player WordPress plugin before 7.5.56.7212's stored video records across the whole site.
- Product
- FV Flowplayer Video Player
- Fixed in
- 7.5.56.7212
- What to do
- Update FV Flowplayer Video Player to 7.5.56.7212 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.