Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
702 results · page 2 of 15
Sep 30, 2026Subscriber Insecure Direct Object References (IDOR) in Newsletters, Email Marketing, SMS and Popups by Omnisend <= 1.9.0 versions.CVE-2026-97074 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Subscriber Insecure Direct Object References (IDOR) in Newsletters, Email Marketing, SMS and Popups by Omnisend <= 1.9.0 versions.
- Affected
- up to 1.9.0
- What to do
- Affects up to 1.9.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 30, 2026Unauthenticated Insecure Direct Object References (IDOR) in GiveWP <= 4.16.9 versions.CVE-2026-97066 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Insecure Direct Object References (IDOR) in GiveWP <= 4.16.9 versions.
- Affected
- up to 4.16.9
- What to do
- Affects up to 4.16.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 30, 2026Subscriber Bypass Vulnerability in All In One WP Security & Firewall <= 5.4.8 versions.CVE-2026-96825 · WordPress plugins & themes · reported by PatchstackMedium 4.2
Subscriber Bypass Vulnerability in All In One WP Security & Firewall <= 5.4.8 versions.
- Affected
- up to 5.4.8
- What to do
- Affects up to 5.4.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 30, 2026Subscriber Insecure Direct Object References (IDOR) in Bookly <= 28.2 versions.CVE-2026-96347 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Subscriber Insecure Direct Object References (IDOR) in Bookly <= 28.2 versions.
- Affected
- up to 28.2
- What to do
- Affects up to 28.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 30, 2026Unauthenticated Insecure Direct Object References (IDOR) in Simply Schedule Appointments <= 1.6.12.31 versions.CVE-2026-94673 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Insecure Direct Object References (IDOR) in Simply Schedule Appointments <= 1.6.12.31 versions.
- Affected
- up to 1.6.12.31
- What to do
- Affects up to 1.6.12.31. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 30, 2026Contributor Insecure Direct Object References (IDOR) in Safe SVG <= 2.5.0 versions.CVE-2026-94672 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Contributor Insecure Direct Object References (IDOR) in Safe SVG <= 2.5.0 versions.
- Affected
- up to 2.5.0
- What to do
- Affects up to 2.5.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 30, 2026Contributor Insecure Direct Object References (IDOR) in Business Directory <= 6.4.27 versions.CVE-2026-94173 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Contributor Insecure Direct Object References (IDOR) in Business Directory <= 6.4.27 versions.
- Affected
- up to 6.4.27
- What to do
- Affects up to 6.4.27. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 30, 2026Contributor Insecure Direct Object References (IDOR) in Flexible PDF Coupons <= 1.14.11 versions.CVE-2026-62081 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Contributor Insecure Direct Object References (IDOR) in Flexible PDF Coupons <= 1.14.11 versions.
- Affected
- up to 1.14.11
- What to do
- Affects up to 1.14.11. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 25, 2026Premium Packages – Sell Digital Products Securely: Stored Cross-Site ScriptingCVE-2026-93654 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'cart_items[][product_name]' Parameter in all versions up to, and including, 7.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The checkout REST route uses permission_callback set to __return_true and the invoice loader performs no order ownership check, meaning an unauthenticated attacker can both persist the payload and ensure it is renderable to any logged-in user who accesses the invoice.
- Product
- Premium Packages – Sell Digital Products Securely
- Affected
- up to 7.2.1
- What to do
- Affects up to 7.2.1. Update Premium Packages – Sell Digital Products Securely to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 25, 2026Bookly: Insecure Direct Object ReferenceCVE-2026-93399 · WordPress plugins & themes · reported by WordfenceCritical 9.1
The Bookly plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 28.2 via the 'bookly_get_form_id', 'bookly_render_complete', 'bookly_add_to_calendar' and 'bookly_rollback_order' AJAX actions. This is due to the 'bookly_get_form_id' handler blindly storing the attacker-controlled 'order_id' from the submitted form_data into a new booking session, which the 'bookly_render_complete' handler then trusts to look up and return the corresponding Order's secret token without verifying that the current session created that order. This makes it possible for unauthenticated attackers to enumerate sequential order IDs, disclose other customers' order tokens, retrieve calendar/appointment information via 'bookly_add_to_calendar' and permanently delete arbitrary non-completed bookings via 'bookly_rollback_order', which cascade-deletes the customer_appointment and (when no other customers are attached) the underlying appointment.
- Product
- Bookly
- Affected
- up to 28.2
- What to do
- Affects up to 28.2. Update Bookly to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 23, 2026Unauthenticated Insecure Direct Object References (IDOR) in Team <= 6.0.0 versions.CVE-2026-95592 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Insecure Direct Object References (IDOR) in Team <= 6.0.0 versions.
- Affected
- up to 6.0.0
- What to do
- Affects up to 6.0.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 23, 2026Contributor Cross Site Scripting (XSS) in Podcast Importer SecondLine <= 1.5.6 versions.CVE-2026-94682 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Cross Site Scripting (XSS) in Podcast Importer SecondLine <= 1.5.6 versions.
- Affected
- up to 1.5.6
- What to do
- Affects up to 1.5.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 23, 2026Unauthenticated Insecure Direct Object References (IDOR) in AI Engine <= 3.7.8 versions.CVE-2026-93623 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Insecure Direct Object References (IDOR) in AI Engine <= 3.7.8 versions.
- Affected
- up to 3.7.8
- What to do
- Affects up to 3.7.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 23, 2026Contributor Insecure Direct Object References (IDOR) in SiteSkite <= 2.1.7 versions.CVE-2026-93513 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Contributor Insecure Direct Object References (IDOR) in SiteSkite <= 2.1.7 versions.
- Affected
- up to 2.1.7
- What to do
- Affects up to 2.1.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2026Tutor LMS – eLearning and online course solution: Insecure Direct Object ReferenceCVE-2026-18439 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 4.0.7 via the tutor_quiz_builder_save AJAX action due to missing validation that nested question_id, answer_id, deleted_question_ids[], and deleted_answer_ids[] values in the submitted payload belong to a quiz/topic/course the requester is authorized to manage. The handler only validates the top-level course_id, topic_id, and (when supplied) payload['ID'], but the nested identifiers are passed straight into $wpdb->update/DELETE statements in QuizBuilder::save_questions(), QuizBuilder::save_question_answers(), and QuizBuilder::handle_delete(). This makes it possible for authenticated attackers, with Instructor-level access and above, to overwrite the content and re-parent arbitrary quiz questions/answers belonging to other instructors or administrators, and to delete arbitrary quiz question and answer rows.
- Product
- Tutor LMS – eLearning and online course solution
- Affected
- up to 4.0.7
- What to do
- Affects up to 4.0.7. Update Tutor LMS – eLearning and online course solution to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 22, 2026Custom Field Template: Insecure Direct Object ReferenceCVE-2026-12995 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Custom Field Template plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.7.8 via the edit_meta_value due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with contributor-level access and above, to delete arbitrary media attachments site-wide by supplying any numeric attachment ID in the file-field parameter alongside the corresponding delete flag, causing content loss and broken pages. Exploitation requires that the attacker's post is governed by a Custom Field Template containing at least one file-type field with the mediaRemove option not enabled, which is the default configuration for file fields.
- Product
- Custom Field Template
- Affected
- up to 2.7.8
- What to do
- Affects up to 2.7.8. Update Custom Field Template to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 19, 2026WP Ghost (Hide My WP Ghost) – Security & Firewall: Open RedirectCVE-2026-7527 · WordPress plugins & themes · reported by WordfenceMedium 4.7
The WP Ghost (Hide My WP Ghost) – Security & Firewall plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 7.0.02. This is due to the plugin not properly validating user input. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if they can successfully trick them into clicking on a specially crafted link. Exploitation requires tricking a logged-in user into clicking a crafted logout URL; the victim is fully logged out via wp_logout() before the malicious redirect is issued, making the logout irreversible as part of the attack chain.
- Product
- WP Ghost (Hide My WP Ghost) – Security & Firewall
- Affected
- up to 7.0.02
- What to do
- Affects up to 7.0.02. Update WP Ghost (Hide My WP Ghost) – Security & Firewall to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 19, 2026Secure Custom Fields: Does not properly verify that a front-end form submission corresponds to the form that was rendered to the visitorCVE-2026-92403 · WordPress plugins & themes · reported by WPScanLow 3.7
The Secure Custom Fields WordPress plugin before 6.9.4 does not properly verify that a front-end form submission corresponds to the form that was rendered to the visitor, allowing unauthenticated users to submit against a different registered form and modify the title and content of the post that form is bound to.
- Product
- Secure Custom Fields
- Fixed in
- 6.9.4
- What to do
- Update Secure Custom Fields to 6.9.4 or newer.
Sep 18, 2026Tutor LMS – eLearning and online course solution: Insecure Direct Object ReferenceCVE-2026-89333 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.0.8 via the 'student_id' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with subscriber-level access and above, to disclose the email address and Tutor profile phone number of arbitrary WordPress users, including Administrators, by iterating over user IDs via the student_id parameter.
- Product
- Tutor LMS – eLearning and online course solution
- Affected
- up to 4.0.8
- What to do
- Affects up to 4.0.8. Update Tutor LMS – eLearning and online course solution to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 18, 2026LatePoint – Calendar Booking Plugin for Appointments and Events: Insecure Direct Object ReferenceCVE-2026-13471 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.6.3 via the LatePointAbilityDeleteBooking::execute due to missing validation on a user controlled key. This makes it possible for attackers, with LatePoint Agent-level access and above, to read bookings and customer PII (full name, email, phone, and notes) assigned to other LatePoint agents, and delete arbitrary bookings by supplying any booking ID. This vulnerability is only exploitable when an administrator has enabled the Abilities API toggles (latepoint_abilities_api, latepoint_abilities_api_delete, and/or latepoint_abilities_api_edit) in the plugin settings.
- Product
- LatePoint – Calendar Booking Plugin for Appointments and Events
- Affected
- up to 5.6.3
- What to do
- Affects up to 5.6.3. Update LatePoint – Calendar Booking Plugin for Appointments and Events to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 18, 2026Download Manager: Insecure Direct Object ReferenceCVE-2026-92714 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Download Manager plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 3.3.68 via the duplicate() function hooked on admin_init. This is due to the handler only verifying the generic 'edit_posts' capability and a plugin-wide static nonce (NONCE_KEY) without any object-level authorization check against the targeted wpdmpro package ID. This makes it possible for authenticated attackers, with Author-level access and above, to duplicate arbitrary Download Manager packages owned by other users (including administrators), which copies all package metadata — including protected file references, role-based access restrictions, and password lock settings — into an attacker-owned clone that they can then edit to remove restrictions and download the previously protected files.
- Product
- Download Manager
- Affected
- up to 3.3.68
- What to do
- Affects up to 3.3.68. Update Download Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 18, 2026Hide My WP Ghost: Does not properly validate a loopback security-check request before disabling its login and URL hiding protectionCVE-2026-86800 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Hide My WP Ghost WordPress plugin before 7.0.11 does not properly validate a loopback security-check request before disabling its login and URL hiding protection, dropping that protection precisely when the request's verification value is missing or incorrect, which any visitor can arrange, allowing unauthenticated attackers to re-expose the concealed WordPress login page location.
- Product
- Hide My WP Ghost
- Fixed in
- 7.0.11
- What to do
- Update Hide My WP Ghost to 7.0.11 or newer.
Sep 18, 2026Really Simple Security: Does not validate a client-supplied address value before using itCVE-2026-88798 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Really Simple Security WordPress plugin before 9.8.3 does not validate a client-supplied address value before using it as a storage key in one of its own options, allowing unauthenticated attackers to grow that option without bound and to slow the site's handling of missing pages.
- Product
- Really Simple Security
- Fixed in
- 9.8.3
- What to do
- Update Really Simple Security to 9.8.3 or newer.
Sep 17, 2026Appointment Booking Plugin – LatePoint | Calendar & Scheduling for: Insecure Direct Object ReferenceCVE-2026-18441 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.6.9 via the set_customer_object due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to enumerate arbitrary customer records and disclose personally identifiable information - including first name, last name, email address, and phone number - by iterating the customer[id] parameter. This issue is exploitable only when the site is configured with customer authentication disabled (guest checkout enabled).
- Product
- Appointment Booking Plugin – LatePoint | Calendar & Scheduling for
- Affected
- up to 5.6.9
- What to do
- Affects up to 5.6.9. Update Appointment Booking Plugin – LatePoint | Calendar & Scheduling for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 17, 2026Contributor Insecure Direct Object References (IDOR) in Cooked <= 1.16.0 versions.CVE-2026-73999 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Contributor Insecure Direct Object References (IDOR) in Cooked <= 1.16.0 versions.
- Affected
- up to 1.16.0
- What to do
- Affects up to 1.16.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 17, 2026Unauthenticated Insecure Direct Object References (IDOR) in King Addons for Elementor <= 51.1.81 versions.CVE-2026-66575 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Insecure Direct Object References (IDOR) in King Addons for Elementor <= 51.1.81 versions.
- Affected
- up to 51.1.81
- What to do
- Affects up to 51.1.81. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 17, 2026wpShopGermany IT-RECHT KANZLEI: Does not generate its API authentication token securelyCVE-2026-88795 · WordPress plugins & themes · reported by WPScanCritical 9
The wpShopGermany IT-RECHT KANZLEI WordPress plugin before 2.4 does not generate its API authentication token securely, deriving it from data the requester controls and creating it as a side effect of the check that is supposed to validate it, allowing unauthenticated attackers to predict the token and use the access it grants to write arbitrary files, leading to remote code execution.
- Product
- wpShopGermany IT-RECHT KANZLEI
- Fixed in
- 2.4
- What to do
- Update wpShopGermany IT-RECHT KANZLEI to 2.4 or newer.
Sep 17, 2026HT Mega Addons for Elementor: Does not restrict the HTML tag name used to render the section headline in several of its widgets and blocks to a safe allowlistCVE-2026-86788 · WordPress plugins & themes · reported by WPScanMedium 6.8
The HT Mega Addons for Elementor WordPress plugin before 3.2.6 does not restrict the HTML tag name used to render the section headline in several of its widgets and blocks to a safe allowlist, allowing users with contributor-level access and above to store a crafted tag name that executes arbitrary JavaScript when the content is viewed, including by higher-privileged users who review or publish it.
- Product
- HT Mega Addons for Elementor
- Fixed in
- 3.2.6
- What to do
- Update HT Mega Addons for Elementor to 3.2.6 or newer.
Sep 16, 2026Subscriptions for WooCommerce: Does not verify the security token on the request that cancels a subscriptionCVE-2026-87860 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Subscriptions for WooCommerce WordPress plugin before 2.0.3 does not verify the security token on the request that cancels a subscription, allowing attackers to make a logged-in customer cancel their own active subscription through a crafted request they are tricked into making.
- Product
- Subscriptions for WooCommerce
- Fixed in
- 2.0.3
- What to do
- Update Subscriptions for WooCommerce to 2.0.3 or newer.
Sep 16, 2026Subscriptions for WooCommerce: Does not correctly validate the shared secret protecting one of its REST endpointsCVE-2026-87854 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Subscriptions for WooCommerce WordPress plugin before 2.0.3 does not correctly validate the shared secret protecting one of its REST endpoints, allowing unauthenticated users to retrieve the store's full list of subscriptions, including customer usernames, product names, recurring amounts and payment dates.
- Product
- Subscriptions for WooCommerce
- Fixed in
- 2.0.3
- What to do
- Update Subscriptions for WooCommerce to 2.0.3 or newer.
Sep 16, 2026Online Scheduling and Appointment Booking System – Bookly: Insecure Direct Object ReferenceCVE-2026-89063 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 28.1 via the 'conversation_id' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to read the full AI booking conversation transcript of any customer — leaking names, email addresses, phone numbers, and appointment details echoed by the assistant — and inject arbitrary messages into any victim conversation that are subsequently replayed to the Cloud AI worker along with the full private history. Because AI conversations are stored with no owner, user, or session identifier and conversation IDs are sequential integers, an unauthenticated attacker can enumerate all customer conversations simply by incrementing the conversation_id parameter.
- Product
- Online Scheduling and Appointment Booking System – Bookly
- Affected
- up to 28.1
- What to do
- Affects up to 28.1. Update Online Scheduling and Appointment Booking System – Bookly to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 15, 2026AI Engine – The Chatbot, AI Framework & MCP for: Insecure Direct Object ReferenceCVE-2026-89141 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.7.7 via the 'mediaId' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with subscriber-level access and above, to access and retrieve the transcribed contents of private audio attachments belonging to other users, including Administrators, via a supplied attachment ID. This vulnerability requires the Public API module to be enabled in the plugin settings; when disabled, the REST route is absent and the endpoint returns HTTP 404.
- Product
- AI Engine – The Chatbot, AI Framework & MCP for
- Affected
- up to 3.7.7
- What to do
- Affects up to 3.7.7. Update AI Engine – The Chatbot, AI Framework & MCP for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 14, 2026Really Simple Security: Missing authorization checkCVE-2026-82519 · WordPress plugins & themes · reported by VulnCheckLow 2.3
Really Simple Security plugin for WordPress before 9.8.2 contains a missing authorization check vulnerability that allows authenticated low-privileged attackers to bypass enforced two-factor authentication indefinitely by exploiting an unguarded code path in the profile-page update handler. Attackers can submit a crafted POST request without the two-factor-authentication field to skip nonce verification and trigger delete_two_fa_meta(), which resets the grace period anchor timestamp on every login cycle, causing mandatory 2FA enforcement to be deferred indefinitely.
- Product
- Really Simple Security
- Fixed in
- 9.8.2
- What to do
- Update Really Simple Security to 9.8.2 or newer.
Full record and what to do →NVD recordwordpress.orgvulncheck.com
Sep 13, 2026Really Simple Security: Does not prevent an unauthenticated request from resetting an account's completed email two-factor enrolmentCVE-2026-89080 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Really Simple Security WordPress plugin before 9.8.1 does not prevent an unauthenticated request from resetting an account's completed email two-factor enrolment, allowing an attacker who already knows the account's password to bypass the second factor and obtain that user's session, up to administrator.
- Product
- Really Simple Security
- Fixed in
- 9.8.1
- What to do
- Update Really Simple Security to 9.8.1 or newer.
Sep 11, 2026Unauthenticated Insecure Direct Object References (IDOR) in Quiz And Survey Master <= 11.2.5 versions.CVE-2026-62140 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Insecure Direct Object References (IDOR) in Quiz And Survey Master <= 11.2.5 versions.
- Affected
- up to 11.2.5
- What to do
- Affects up to 11.2.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 11, 2026Contributor Insecure Direct Object References (IDOR) in Starter Templates <= 4.7.5 versions.CVE-2026-62134 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Contributor Insecure Direct Object References (IDOR) in Starter Templates <= 4.7.5 versions.
- Affected
- up to 4.7.5
- What to do
- Affects up to 4.7.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 11, 2026Contributor Insecure Direct Object References (IDOR) in Slim SEO <= 4.10.0 versions.CVE-2026-62113 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Contributor Insecure Direct Object References (IDOR) in Slim SEO <= 4.10.0 versions.
- Affected
- up to 4.10.0
- What to do
- Affects up to 4.10.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 11, 2026BuddyPress: Insecure Direct Object ReferenceCVE-2024-12145 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The BuddyPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 14.3.3 via the bp_notifications_action_bulk_manage due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete/mark as read/mark as unread notifications of other users.
- Product
- BuddyPress
- Affected
- up to 14.3.3
- What to do
- Affects up to 14.3.3. Update BuddyPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Sep 11, 2026Simple Ajax Chat – Add a Fast, Secure Chat Box: Stored Cross-Site ScriptingCVE-2026-81825 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Simple Ajax Chat – Add a Fast, Secure Chat Box plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Chat Message in all versions up to, and including, <= 20260811 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The nonce protecting chat message submission is publicly visible on the chat page, rendering it ineffective as an authentication barrier and allowing fully unauthenticated attackers to submit malicious messages that are stored persistently and rendered to all visitors on every page load.
- Product
- Simple Ajax Chat – Add a Fast, Secure Chat Box
- Affected
- up to 20260811
- What to do
- Affects up to 20260811. Update Simple Ajax Chat – Add a Fast, Secure Chat Box to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 11, 2026Vigilant – 100% Free Security Suite: Firewall, 2FA, Login, Headers, Scanner…: Stored Cross-Site ScriptingCVE-2026-81754 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Vigilant – 100% Free Security Suite: Firewall, 2FA, Login, Headers, Scanner… plugin for WordPress is vulnerable to Stored Cross-Site Scripting via User-Agent Header in all versions up to, and including, 2.10.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The malicious payload is delivered passively by any unauthenticated visitor who triggers a failed login attempt with a crafted User-Agent header, requiring no further interaction from the attacker once stored.
- Product
- Vigilant – 100% Free Security Suite: Firewall, 2FA, Login, Headers, Scanner…
- Affected
- up to 2.10.2
- What to do
- Affects up to 2.10.2. Update Vigilant – 100% Free Security Suite: Firewall, 2FA, Login, Headers, Scanner… to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 11, 2026Woo PDF Invoice Builder plugin (also distributed as "PDF Builder for WooCommerce"): Insecure Direct Object ReferenceCVE-2026-11496 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Woo PDF Invoice Builder plugin (also distributed as "PDF Builder for WooCommerce") for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.0.8. This is due to the InspectOrder() AJAX handler (woocommerce-pdf-invoice-ajax.php:513), registered on wp_ajax_rednao_wcpdfinv_inspect_order, performing no capability check and no nonce verification before loading an arbitrary order by the attacker-supplied 'OrderNumber' POST field and serializing its full WC_Order::get_data() and meta to the response. This makes it possible for authenticated attackers with Subscriber-level access and above to read every WooCommerce order on the site — including billing/shipping address, email, phone number, payment method, gateway transaction ID, and order totals — by iterating order IDs.
- Product
- Woo PDF Invoice Builder plugin (also distributed as "PDF Builder for WooCommerce")
- Affected
- up to 2.0.8
- What to do
- Affects up to 2.0.8. Update Woo PDF Invoice Builder plugin (also distributed as "PDF Builder for WooCommerce") to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 10, 2026miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA: Does not scope its second-factor attempt limit to the account being attackedCVE-2026-77771 · WordPress plugins & themes · reported by WPScanHigh 7.5
The miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA WordPress plugin before 19.3 does not scope its second-factor attempt limit to the account being attacked, keying it instead to an identifier the client supplies and can change at will, allowing an attacker who already knows a victim's password to make unlimited one-time-passcode guesses and defeat the second factor. A second validation endpoint applies no attempt limit at all.
- Product
- miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA
- Fixed in
- 6.3.1
- What to do
- Update miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA to 6.3.1 or newer.
Sep 8, 2026Unauthenticated Insecure Direct Object References (IDOR) in WpEvently <= 5.6.0 versions.CVE-2026-81802 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Insecure Direct Object References (IDOR) in WpEvently <= 5.6.0 versions.
- Affected
- up to 5.6.0
- What to do
- Affects up to 5.6.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 7, 2026Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE: Insecure Direct Object ReferenceCVE-2026-4945 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.1.7 via the 'watch_checkout' function due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to pay for a lower-cost product while obtaining entitlement for a premium product by manipulating the product_id parameter independently of the price_id parameter in the Stripe checkout URL.
- Product
- Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE
- Affected
- up to 3.1.7
- What to do
- Affects up to 3.1.7. Update Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 5, 2026MemberDash: Insecure Direct Object ReferenceCVE-2026-16310 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The MemberDash plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.8.5 via the 'id' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to change the password of any WordPress user, including administrators, by supplying an arbitrary user ID during registration, and take over their account without any notification sent to the victim.
- Product
- MemberDash
- Affected
- up to 1.8.5
- What to do
- Affects up to 1.8.5. Update MemberDash to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordmemberdashwp.comwordfence.com
Sep 3, 2026Subscriber Insecure Direct Object References (IDOR) in WC Ukraine Shipping <= 1.22.3 versions.CVE-2026-84836 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Subscriber Insecure Direct Object References (IDOR) in WC Ukraine Shipping <= 1.22.3 versions.
- Affected
- up to 1.22.3
- What to do
- Affects up to 1.22.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 3, 2026Unauthenticated Denial of Service Attack in MalCare Security <= 6.69 versions.CVE-2026-84776 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Denial of Service Attack in MalCare Security <= 6.69 versions.
- Affected
- up to 6.69
- What to do
- Affects up to 6.69. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 3, 2026Unauthenticated Insecure Direct Object References (IDOR) in Business Directory <= 6.4.26 versions.CVE-2026-84769 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Insecure Direct Object References (IDOR) in Business Directory <= 6.4.26 versions.
- Affected
- up to 6.4.26
- What to do
- Affects up to 6.4.26. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 2, 2026Unauthenticated Insecure Direct Object References (IDOR) in PublishPress Permissions <= 4.8.3 versions.CVE-2026-84771 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Insecure Direct Object References (IDOR) in PublishPress Permissions <= 4.8.3 versions.
- Affected
- up to 4.8.3
- What to do
- Affects up to 4.8.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 31, 2026Unauthenticated Bypass Vulnerability in SiteGround Security <= 1.6.6 versions.CVE-2026-82228 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Bypass Vulnerability in SiteGround Security <= 1.6.6 versions.
- Affected
- up to 1.6.6
- What to do
- Affects up to 1.6.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.