Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,327 results · page 2 of 27
Oct 2, 2026Smart One Click Setup – Complete Demo Import & Export: Insertion of Sensitive Information Into Sent DataCVE-2026-32584 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Insertion of Sensitive Information Into Sent Data vulnerability in Chiranjit Hazarika Smart One Click Setup – Complete Demo Import & Export smart-one-click-setup allows Retrieve Embedded Sensitive Data.This issue affects Smart One Click Setup – Complete Demo Import & Export: from n/a through 1.4.3.
- Product
- Smart One Click Setup – Complete Demo Import & Export
- Affected
- up to 1.4.3
- What to do
- Affects up to 1.4.3. Update Smart One Click Setup – Complete Demo Import & Export to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 2, 2026Giveaways and Contests by RafflePress: Does not remove the reCAPTCHA secret key from the giveaway settings it embeds in public giveaway pagesCVE-2026-97317 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Giveaways and Contests by RafflePress WordPress plugin before 1.12.27 does not remove the reCAPTCHA secret key from the giveaway settings it embeds in public giveaway pages, allowing unauthenticated visitors to retrieve the secret key of any active giveaway that has reCAPTCHA configured.
- Product
- Giveaways and Contests by RafflePress
- Fixed in
- 1.12.27
- What to do
- Update Giveaways and Contests by RafflePress to 1.12.27 or newer.
Oct 2, 2026Motors: Does not sanitise and escape a listing badge setting before outputting it inside an HTML attributeCVE-2026-91022 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Motors WordPress plugin before 1.4.124 does not sanitise and escape a listing badge setting before outputting it inside an HTML attribute, allowing users with a custom, administrator-assigned listing-management role to inject arbitrary web scripts that execute when a listing is viewed by any visitor, including an administrator.
- Product
- Motors
- Fixed in
- 1.4.124
- What to do
- Update Motors to 1.4.124 or newer.
Oct 1, 2026WP Fusion Lite: Does not require authentication on a settings handler that runs during admin initializationCVE-2026-90974 · WordPress plugins & themes · reported by WPScanMedium 6.5
The WP Fusion Lite WordPress plugin before 3.48.0 does not require authentication on a settings handler that runs during admin initialization, allowing unauthenticated users to overwrite the site's CRM integration endpoint and credentials, after which synced user data is delivered to an attacker-chosen host.
- Product
- WP Fusion Lite
- Fixed in
- 3.48.0
- What to do
- Update WP Fusion Lite to 3.48.0 or newer.
Oct 1, 2026Download Manager: Does not sufficiently sanitise and escape a package setting before outputting it back in a pageCVE-2026-86610 · WordPress plugins & themes · reported by WPScanMedium 6.4
The Download Manager WordPress plugin before 3.3.71 does not sufficiently sanitise and escape a package setting before outputting it back in a page, which could allow users with the Author role and above to perform Stored Cross-Site Scripting attacks against any visitor who opens the package's download dialogue, including administrators. Only sites running PHP below 8.1 are affected, as the sanitisation applied when the setting is saved does not neutralise single quotes there.
- Product
- Download Manager
- Fixed in
- 3.3.71
- What to do
- Update Download Manager to 3.3.71 or newer.
Sep 30, 2026Contributor PHP Object Injection in DesignSetGo <= 2.8.0 versions.CVE-2026-94683 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Contributor PHP Object Injection in DesignSetGo <= 2.8.0 versions.
- Affected
- up to 2.8.0
- What to do
- Affects up to 2.8.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 30, 2026Content Egg: Does not verify that a user running its bulk content-import feature is authorized for the import preset they selectCVE-2026-92424 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Content Egg WordPress plugin before 11.9.0 does not verify that a user running its bulk content-import feature is authorized for the import preset they select, and switches to the preset author's identity before creating the resulting post, allowing users with contributor-level access and above to store arbitrary web scripts unfiltered under a privileged user's account, executing in the context of anyone who later views that content.
- Product
- Content Egg
- Fixed in
- 11.9.0
- What to do
- Update Content Egg to 11.9.0 or newer.
Sep 30, 2026WP Mobile Menu: Does not correctly verify the nonce on its settings importCVE-2026-91832 · WordPress plugins & themes · reported by WPScanHigh 7.1
The WP Mobile Menu WordPress plugin before 2.9 does not correctly verify the nonce on its settings import, so an attacker can import arbitrary WP Mobile Menu WordPress plugin before 2.9 settings through a cross-site request in an administrator's session, and the imported values are then output unescaped to every visitor, resulting in Stored Cross-Site Scripting.
- Product
- WP Mobile Menu
- Fixed in
- 2.9
- What to do
- Update WP Mobile Menu to 2.9 or newer.
Sep 30, 2026Hostinger Reach: Does not sanitize and escape a widget setting before outputting it in the editor previewCVE-2026-87777 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Hostinger Reach WordPress plugin before 1.8.3 does not sanitize and escape a widget setting before outputting it in the editor preview, allowing users with contributor-level access and above to inject arbitrary web scripts that will execute in the session of a higher-privileged user who opens the affected content in the editor.
- Product
- Hostinger Reach
- Fixed in
- 1.8.3
- What to do
- Update Hostinger Reach to 1.8.3 or newer.
Sep 30, 2026EmbedPress: Does not sanitise and escape one of its Elementor widget settings before outputting it into an HTML attributeCVE-2026-85001 · WordPress plugins & themes · reported by WPScanMedium 6.8
The EmbedPress WordPress plugin before 4.6.7 does not sanitise and escape one of its Elementor widget settings before outputting it into an HTML attribute, which could allow users with the Contributor role or above to inject arbitrary web scripts that execute when the affected content is viewed.
- Product
- EmbedPress
- Fixed in
- 4.6.7
- What to do
- Update EmbedPress to 4.6.7 or newer.
Sep 30, 2026New User Approve: Does not properly verify authentication on a set of integration REST API routesCVE-2026-83560 · WordPress plugins & themes · reported by WPScanMedium 5.3
The New User Approve WordPress plugin before 3.2.10 does not properly verify authentication on a set of integration REST API routes when the integration is unconfigured, allowing unauthenticated attackers to retrieve personal data (id, username, email address and registration date) of registered users.
- Product
- New User Approve
- Fixed in
- 3.2.10
- What to do
- Update New User Approve to 3.2.10 or newer.
Sep 27, 2026UpdraftPlus: WP Backup & Migration Plugin WordPress plugin before 1.26.8, UpdraftPlus: WP Backup & Migration: Does not have any capability check in a routine that outputs its stored remote storage settings into admin pagCVE-2026-82841 · WordPress plugins & themes · reported by WPScanMedium 5.3
The UpdraftPlus: WP Backup & Migration Plugin WordPress plugin before 1.26.8, UpdraftPlus: WP Backup & Migration Plugin WordPress plugin before 2.26.8.26 does not have any capability check in a routine that outputs its stored remote storage settings into admin pages when the site is left in a particular post-migration state, allowing any authenticated user, such as a subscriber, to retrieve the credentials of the configured backup destinations, such as passwords and secret keys.
- Product
- UpdraftPlus: WP Backup & Migration Plugin WordPress plugin before 1.26.8, UpdraftPlus: WP Backup & Migration
- Fixed in
- 1.26.8
- What to do
- Update UpdraftPlus: WP Backup & Migration Plugin WordPress plugin before 1.26.8, UpdraftPlus: WP Backup & Migration to 1.26.8 or newer.
Sep 27, 2026Ad Inserter: Does not correctly restrict access to one of its settings pagesCVE-2026-81655 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Ad Inserter WordPress plugin before 2.8.19 does not correctly restrict access to one of its settings pages, making it reachable by every logged in user under a configuration its own settings allow, and does not filter the content saved there, allowing users with a role as low as subscriber to store code which is then executed as PHP or served unescaped to site visitors.
- Product
- Ad Inserter
- Fixed in
- 2.8.19
- What to do
- Update Ad Inserter to 2.8.19 or newer.
Sep 25, 2026Asset CleanUp: Page Speed Booster: Server-Side Request ForgeryCVE-2026-12037 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The Asset CleanUp: Page Speed Booster plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.4.0.5 via the 'page_url' parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. This vulnerability is only reachable when the plugin's dom_get_type setting has been configured to 'wp_remote_post' by an administrator.
- Product
- Asset CleanUp: Page Speed Booster
- Affected
- up to 1.4.0.5
- What to do
- Affects up to 1.4.0.5. Update Asset CleanUp: Page Speed Booster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 24, 2026MasterStudy LMS: Does not validate one of its display-style settings before using it to build a template pathCVE-2026-88843 · WordPress plugins & themes · reported by WPScanHigh 7.2
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not validate one of its display-style settings before using it to build a template path, allowing users with the Contributor role and above to include and execute arbitrary local PHP files on the server. An equivalent path was corrected in an earlier release and this one was not, so the issue persists in versions the earlier advisory reports as fixed.
- Product
- MasterStudy LMS
- Fixed in
- 3.7.50
- What to do
- Update MasterStudy LMS to 3.7.50 or newer.
Sep 23, 2026Subscribe Forms: Does not sanitise and escape one of its form settings before outputting it in a pageCVE-2026-91073 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Subscribe Forms WordPress plugin before 1.6.3 does not sanitise and escape one of its form settings before outputting it in a page, allowing authenticated users with the Author role and above to perform Stored Cross-Site Scripting attacks that execute in the browser of any visitor who views a page embedding the form, including logged-out visitors and administrators.
- Product
- Subscribe Forms
- Fixed in
- 1.6.3
- What to do
- Update Subscribe Forms to 1.6.3 or newer.
Sep 22, 2026Handily: Unauthorized payment settings modificationCVE-2025-14487 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Handily plugin for WordPress is vulnerable to unauthorized payment settings modification due to missing authorization checks in all versions up to, and including, 1.0.3. This makes it possible for unauthenticated attackers to modify Stripe payment configuration settings, including publishable keys, secret keys, email addresses, success URLs, and cancel URLs via the payment settings parameters. This could allow attackers to redirect payments to their own Stripe accounts.
- Product
- Handily
- Affected
- up to 1.0.3
- What to do
- Affects up to 1.0.3. Update Handily to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodecanyon.networdfence.com
Sep 20, 2026Photo Gallery, Sliders, Proofing and: Does not check that a user holds its options capability before saving image sizing settingsCVE-2026-81654 · WordPress plugins & themes · reported by WPScanLow 3.1
The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not check that a user holds its options capability before saving image sizing settings, allowing users granted only its gallery-management capability by an administrator to change settings that apply across the whole site.
- Product
- Photo Gallery, Sliders, Proofing and
- Fixed in
- 4.5.0
- What to do
- Update Photo Gallery, Sliders, Proofing and to 4.5.0 or newer.
Sep 19, 2026Business Name Generator: Does not sanitise and escape some of its settingsCVE-2025-15698 · WordPress plugins & themes · reported by WPScanLow 3.5
The Business Name Generator WordPress plugin through 1.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Business Name Generator
- Affected
- up to 1.3
- What to do
- Affects up to 1.3. Update Business Name Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 18, 2026Asset CleanUp: Page Speed Booster: Stored Cross-Site ScriptingCVE-2026-13354 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Asset CleanUp: Page Speed Booster plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to, and including, 1.4.0.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is only exploitable on instances where combine_loaded_css has been enabled.
- Product
- Asset CleanUp: Page Speed Booster
- Affected
- up to 1.4.0.5
- What to do
- Affects up to 1.4.0.5. Update Asset CleanUp: Page Speed Booster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 18, 2026Breeze Cache: Does not include a set of tracking-related query parameters in its page-cache key while still caching pages requested with themCVE-2026-79713 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Breeze Cache WordPress plugin before 2.5.15 does not include a set of tracking-related query parameters in its page-cache key while still caching pages requested with them, allowing unauthenticated attackers to have a page rendered under their own request context stored under, and served from, the clean URL's cache entry to every subsequent visitor.
- Product
- Breeze Cache
- Fixed in
- 2.5.15
- What to do
- Update Breeze Cache to 2.5.15 or newer.
Sep 18, 2026iGMS Direct Booking: Does not authorise or escape its widget appearance settingsCVE-2026-88825 · WordPress plugins & themes · reported by WPScanHigh 8.8
The iGMS Direct Booking WordPress plugin before 2.0 does not authorise or escape its widget appearance settings, allowing unauthenticated users to store arbitrary web scripts that execute in the context of an administrator viewing the iGMS Direct Booking WordPress plugin before 2.0 settings, and in the browser of any visitor to a page displaying the booking widget.
- Product
- iGMS Direct Booking
- Fixed in
- 2.0
- What to do
- Update iGMS Direct Booking to 2.0 or newer.
Sep 17, 2026Unauthenticated Cross Site Request Forgery (CSRF) in Asset CleanUp: Page Speed Booster <= 1.4.0.5 versions.CVE-2026-66571 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Request Forgery (CSRF) in Asset CleanUp: Page Speed Booster <= 1.4.0.5 versions.
- Affected
- up to 1.4.0.5
- What to do
- Affects up to 1.4.0.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 16, 2026WPBot: Does not perform a capability check on the AJAX action that saves its Claude AI provider settingsCVE-2026-87959 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WPBot WordPress plugin before 8.7.6 does not perform a capability check on the AJAX action that saves its Claude AI provider settings, allowing users with subscriber-level access to overwrite those settings, including the API key used for the WPBot WordPress plugin before 8.7.6's outgoing AI requests.
- Product
- WPBot
- Fixed in
- 8.7.6
- What to do
- Update WPBot to 8.7.6 or newer.
Sep 16, 2026Formidable Forms: Does not restrict who can set the identifier recordingCVE-2026-85641 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Formidable Forms WordPress plugin before 6.35 does not restrict who can set the identifier recording which user last edited a form entry, and relies on that identifier when deciding whether to strip HTML from stored entry values, allowing unauthenticated visitors to have markup rendered in the admin entry view that would otherwise be removed, and to attribute their submission to an administrator who never made it.
- Product
- Formidable Forms
- Fixed in
- 6.35
- What to do
- Update Formidable Forms to 6.35 or newer.
Sep 16, 2026Xpro Addons — 140+ Widgets for Elementor: Does not validate or sanitize a widget link setting before storing and using it in a JavaScript navigation callCVE-2026-84088 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Xpro Addons — 140+ Widgets for Elementor WordPress plugin before 1.7.9 does not validate or sanitize a widget link setting before storing and using it in a JavaScript navigation call, allowing users with the contributor role and above to inject and store JavaScript that executes in the browser of anyone who interacts with the affected widget.
- Product
- Xpro Addons — 140+ Widgets for Elementor
- Fixed in
- 1.7.9
- What to do
- Update Xpro Addons — 140+ Widgets for Elementor to 1.7.9 or newer.
Sep 15, 2026WP Directory Kit: Does not sanitize and escape some widget settings before using them in a SQL statementCVE-2026-16593 · WordPress plugins & themes · reported by WPScanMedium 6.8
The WP Directory Kit WordPress plugin through 1.5.7 does not sanitize and escape some widget settings before using them in a SQL statement, allowing authenticated users with access to the page builder (Editor and above) to perform SQL injection attacks that execute when the affected page is rendered.
- Product
- WP Directory Kit
- Affected
- up to 1.5.7
- What to do
- Affects up to 1.5.7. Update WP Directory Kit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 13, 2026Really Simple Security: Does not prevent an unauthenticated request from resetting an account's completed email two-factor enrolmentCVE-2026-89080 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Really Simple Security WordPress plugin before 9.8.1 does not prevent an unauthenticated request from resetting an account's completed email two-factor enrolment, allowing an attacker who already knows the account's password to bypass the second factor and obtain that user's session, up to administrator.
- Product
- Really Simple Security
- Fixed in
- 9.8.1
- What to do
- Update Really Simple Security to 9.8.1 or newer.
Sep 11, 2026WPCafe: Does not correctly restrict access to a set of order-management REST endpoints because their permission callbacks return an incorrect type on failureCVE-2026-86812 · WordPress plugins & themes · reported by WPScanMedium 6.5
The WPCafe WordPress plugin before 3.0.18 does not correctly restrict access to a set of order-management REST endpoints because their permission callbacks return an incorrect type on failure, allowing unauthenticated users to disclose guest order information and to change the status of, or trash, any order.
- Product
- WPCafe
- Fixed in
- 3.0.18
- What to do
- Update WPCafe to 3.0.18 or newer.
Sep 11, 2026CoolClock: Does not properly escape a skin setting before outputting it within an HTML attributeCVE-2026-83546 · WordPress plugins & themes · reported by WPScanMedium 6.8
The CoolClock WordPress plugin before 4.3.8 does not properly escape a skin setting before outputting it within an HTML attribute, allowing users with contributor-level access and above to inject arbitrary web scripts that execute when the content is viewed.
- Product
- CoolClock
- Fixed in
- 4.3.8
- What to do
- Update CoolClock to 4.3.8 or newer.
Sep 11, 2026CoolClock: Does not properly escape a custom skin setting before outputting it inside an inline scriptCVE-2026-83545 · WordPress plugins & themes · reported by WPScanMedium 6.8
The CoolClock WordPress plugin before 4.3.8 does not properly escape a custom skin setting before outputting it inside an inline script, allowing users with contributor-level access and above to inject arbitrary JavaScript that executes when the content is viewed.
- Product
- CoolClock
- Fixed in
- 4.3.8
- What to do
- Update CoolClock to 4.3.8 or newer.
Sep 11, 2026MultiVendorX: Does not restrict who can update its role and capability settingsCVE-2026-74925 · WordPress plugins & themes · reported by WPScanHigh 7.2
The MultiVendorX WordPress plugin before 5.0.16 does not restrict who can update its role and capability settings, allowing users holding its vendor role to grant that role administrator-level capabilities and take over the site.
- Product
- MultiVendorX
- Fixed in
- 5.0.16
- What to do
- Update MultiVendorX to 5.0.16 or newer.
Sep 11, 2026Translate WordPress with GTranslate: Does not validate one of its settings before the bundled front-end scripts build markup from itCVE-2025-15695 · WordPress plugins & themes · reported by WPScanLow 3.5
The Translate WordPress with GTranslate WordPress plugin before 3.0.10 does not validate one of its settings before the bundled front-end scripts build markup from it, allowing users with a role as high as administrator to store JavaScript that runs in the session of any visitor to the site.
- Product
- Translate WordPress with GTranslate
- Fixed in
- 3.0.10
- What to do
- Update Translate WordPress with GTranslate to 3.0.10 or newer.
Sep 10, 2026Subscriber Settings Change in WP-Stateless <= 4.4.1 versions.CVE-2026-81801 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Subscriber Settings Change in WP-Stateless <= 4.4.1 versions.
- Affected
- up to 4.4.1
- What to do
- Affects up to 4.4.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 10, 2026Bulk Password Reset: Privilege escalationCVE-2026-14873 · WordPress plugins & themes · reported by WordfenceHigh 8
The Bulk Password Reset plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.3.3. This is due to the plugin not properly validating a user's identity prior to updating their details like arbitrary user passwords, including administrator passwords, to a known plugin-configured custom value, enabling full account takeover of the site. This makes it possible for authenticated attackers, with subscriber-level access and above, to change arbitrary user's email addresses, including administrators, and leverage that to reset the user's password and gain access to their account.
- Product
- Bulk Password Reset
- Affected
- up to 1.3.3
- What to do
- Affects up to 1.3.3. Update Bulk Password Reset to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 9, 2026WPLP Cookie Consent: Does not perform nonce or capability checks on several of its settings AJAX actionsCVE-2026-85133 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WPLP Cookie Consent WordPress plugin before 4.4.2 does not perform nonce or capability checks on several of its settings AJAX actions, allowing any authenticated user, such as a subscriber, to read and destroy scan data belonging to the administrator and to overwrite the WPLP Cookie Consent WordPress plugin before 4.4.2's stored configuration.
- Product
- WPLP Cookie Consent
- Fixed in
- 4.4.2
- What to do
- Update WPLP Cookie Consent to 4.4.2 or newer.
Sep 9, 2026Sina Extension for Elementor: Does not properly escape a Table widget setting before outputting it within an HTML attributeCVE-2026-83541 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Sina Extension for Elementor WordPress plugin before 3.10.4 does not properly escape a Table widget setting before outputting it within an HTML attribute, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Sina Extension for Elementor
- Fixed in
- 3.10.4
- What to do
- Update Sina Extension for Elementor to 3.10.4 or newer.
Sep 6, 2026SureCart: Does not consult the site's user registration setting before creating WordPress accountsCVE-2026-75793 · WordPress plugins & themes · reported by WPScanMedium 6.5
The SureCart WordPress plugin before 4.7.0 does not consult the site's user registration setting before creating WordPress accounts, allowing unauthenticated users to create an account and receive a logged-in session even when registration is disabled.
- Product
- SureCart
- Fixed in
- 4.7.0
- What to do
- Update SureCart to 4.7.0 or newer.
Sep 5, 2026King Addons for Elementor: Does not escape a widget display-style setting before outputting it in an HTML attributeCVE-2026-84896 · WordPress plugins & themes · reported by WPScanMedium 6.8
The King Addons for Elementor WordPress plugin before 51.1.77 does not escape a widget display-style setting before outputting it in an HTML attribute, allowing users with Contributor-level access and above to store JavaScript that executes in the browser of any visitor to the affected page, including logged-in administrators.
- Product
- King Addons for Elementor
- Fixed in
- 51.1.77
- What to do
- Update King Addons for Elementor to 51.1.77 or newer.
Sep 5, 2026Masteriyo LMS: Does not sanitise and escape some course settings before outputting them in a page available to all visitorsCVE-2026-82846 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Masteriyo LMS WordPress plugin before 3.4.0 does not sanitise and escape some course settings before outputting them in a page available to all visitors, allowing users with a course-author role to perform Stored Cross-Site Scripting attacks that run in the session of anyone viewing the course, including a logged-in administrator.
- Product
- Masteriyo LMS
- Fixed in
- 3.4.0
- What to do
- Update Masteriyo LMS to 3.4.0 or newer.
Sep 5, 2026Search Atlas SEO: Does not perform a nonce or capability check before processing a settings update in one of its early-priority handlersCVE-2026-15247 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Search Atlas SEO WordPress plugin before 2.6.24 does not perform a nonce or capability check before processing a settings update in one of its early-priority handlers, allowing any authenticated user such as a Subscriber to overwrite or delete the site's stored Google service-account credentials.
- Product
- Search Atlas SEO
- Fixed in
- 2.6.24
- What to do
- Update Search Atlas SEO to 2.6.24 or newer.
Sep 5, 2026Joli Table Of Contents: Does not sanitise and escape some of its settings before outputting them in an admin pageCVE-2025-15694 · WordPress plugins & themes · reported by WPScanLow 3.5
The Joli Table Of Contents WordPress plugin before 2.8.1 does not sanitise and escape some of its settings before outputting them in an admin page, which could allow high-privilege users such as administrators to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed, for example in a multisite setup.
- Product
- Joli Table Of Contents
- Fixed in
- 2.8.1
- What to do
- Update Joli Table Of Contents to 2.8.1 or newer.
Sep 4, 2026Hummingbird Performance: Does not restrict a network-wide setting to network administratorsCVE-2026-19224 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Hummingbird Performance WordPress plugin before 3.21.2 does not restrict a network-wide setting to network administrators, allowing an administrator of any single site on a multisite network to execute arbitrary code across the entire network.
- Product
- Hummingbird Performance
- Fixed in
- 3.21.2
- What to do
- Update Hummingbird Performance to 3.21.2 or newer.
Sep 3, 2026Unauthenticated Settings Change in WP Compress <= 7.21.28 versions.CVE-2026-84757 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Unauthenticated Settings Change in WP Compress <= 7.21.28 versions.
- Affected
- up to 7.21.28
- What to do
- Affects up to 7.21.28. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 2, 2026Simple Membership MailChimp Integration: Does not have CSRF checks in its settings pageCVE-2026-8151 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Simple Membership MailChimp Integration WordPress plugin before 1.9.8 does not have CSRF checks in its settings page, allowing attackers to trick a logged-in administrator into changing the configured third-party API key. Once replaced, all subsequent member registration data (name, email, membership level) is sent to the attacker-controlled account.
- Product
- Simple Membership MailChimp Integration
- Fixed in
- 1.9.8
- What to do
- Update Simple Membership MailChimp Integration to 1.9.8 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Sep 2, 2026Xpro Addons: Does not properly escape some of its widgets' settings before outputting them within HTML attributesCVE-2026-83547 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Xpro Addons WordPress plugin before 1.7.4 does not properly escape some of its widgets' settings before outputting them within HTML attributes, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Xpro Addons
- Fixed in
- 1.7.4
- What to do
- Update Xpro Addons to 1.7.4 or newer.
Sep 2, 2026GutenKit: Does not validate or escape style settings saved against a post before using them to build the CSS it outputs on the front endCVE-2026-19698 · WordPress plugins & themes · reported by WPScanLow 3.5
The GutenKit WordPress plugin before 2.5.1 does not validate or escape style settings saved against a post before using them to build the CSS it outputs on the front end, allowing users with the Contributor role and above to inject arbitrary CSS into pages served to other users and to anonymous visitors. JavaScript execution is not possible at that role, so the impact is limited to defacement, interface redressing and forcing external resources to load.
- Product
- GutenKit
- Fixed in
- 2.5.1
- What to do
- Update GutenKit to 2.5.1 or newer.
Sep 2, 2026Icegram Express: Does not properly escape a list description setting before outputting it within an HTML attributeCVE-2025-15692 · WordPress plugins & themes · reported by WPScanLow 3.5
The Icegram Express WordPress plugin before 5.8.6 does not properly escape a list description setting before outputting it within an HTML attribute, which could allow users with the Administrator role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Icegram Express
- Fixed in
- 5.8.6
- What to do
- Update Icegram Express to 5.8.6 or newer.
Sep 2, 2026My Login: Does not enforce the network's registration settingCVE-2026-81583 · WordPress plugins & themes · reported by WPScanMedium 5.4
The My Login WordPress plugin before 7.2.0 does not enforce the network's registration setting when processing site signups on multisite installations, allowing users with a subscriber account, and unauthenticated users on some networks, to create new sites and be granted administrator over them.
- Product
- My Login
- Fixed in
- 7.2.0
- What to do
- Update My Login to 7.2.0 or newer.
Sep 1, 2026WP Fastest Cache: Does not include a set of tracking-related query parameters in its page-cache key while still caching pages requested with themCVE-2026-74916 · WordPress plugins & themes · reported by WPScanMedium 6.5
The WP Fastest Cache WordPress plugin before 1.5.1 does not include a set of tracking-related query parameters in its page-cache key while still caching pages requested with them, allowing unauthenticated attackers to have a page rendered under their own request context stored under, and served from, the clean URL's cache entry to every subsequent visitor.
- Product
- WP Fastest Cache
- Fixed in
- 1.5.1
- What to do
- Update WP Fastest Cache to 1.5.1 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.