Vulnerability database

4,270 results · page 2 of 86

• Oct 28, 2026the update_fees AJAX handler that: PiWeb Disable payment method / Partial payment for WooCommerce before 1.1.10.9 contains a missing authorizationCVE-2026-118757 · WordPress plugins & themes · reported by VulnCheckMedium 6.9

  PiWeb Disable payment method / Partial payment for WooCommerce before 1.1.10.9 contains a missing authorization vulnerability in the update_fees AJAX handler that allows unauthenticated attackers to modify and read other customers' orders. Attackers can reuse a nonce from their own order-pay page and supply sequential order_id values to change payment methods, recalculate fees, and disclose order line items and totals.

  Product

  the update_fees AJAX handler that

  Fixed in

  1.1.10.9

  What to do

  Update the update_fees AJAX handler that to 1.1.10.9 or newer.

  Full record and what to do →NVD recordplugins.svn.wordpress.orgplugins.trac.wordpress.org

• Oct 28, 2026Redux Framework: Missing AuthorizationCVE-2026-116404 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Missing Authorization vulnerability in David Anderson Redux Framework redux-framework allows Lifting Sensitive Data Embedded in Cache.This issue affects Redux Framework: from n/a through 4.5.16.

  Product

  Redux Framework

  Affected

  up to 4.5.16

  What to do

  Affects up to 4.5.16. Update Redux Framework to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 28, 2026Optima Express: Missing AuthorizationCVE-2026-116393 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Missing Authorization vulnerability in iHomefinder, Inc. Optima Express optima-express allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Optima Express: from n/a through 9.0.0.

  Product

  Optima Express

  Affected

  up to 9.0.0

  What to do

  Affects up to 9.0.0. Update Optima Express to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 28, 2026My auctions allegro: Missing AuthorizationCVE-2026-116855 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Missing Authorization vulnerability in wphocus My auctions allegro my-auctions-allegro-free-edition allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects My auctions allegro: from n/a through 4.0.3.

  Product

  My auctions allegro

  Affected

  up to 4.0.3

  What to do

  Affects up to 4.0.3. Update My auctions allegro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 28, 2026Clean Login: Missing AuthorizationCVE-2026-116610 · WordPress plugins & themes · reported by WordfenceMedium 4.3

  The Clean Login plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.20.1 due to a missing capability check on the CleanLogin_Shortcode::get_pages_with_shortcodes() function hooked to the save_post action. This makes it possible for authenticated attackers, with Contributor-level access and above, to overwrite the plugin's cl_login_url/cl_login_id/cl_register_url/cl_register_id/cl_restore_url/cl_restore_id/cl_edit_url/cl_edit_id/cl_change_password_url/cl_change_password_id options with the ID and permalink of a post they themselves authored — simply by embedding the plugin's shortcodes in their own post content.

  Product

  Clean Login

  Affected

  up to 1.20.1

  What to do

  Affects up to 1.20.1. Update Clean Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Oct 28, 2026Welcart e-Commerce: Does not properly verify authorization against the targeted product before processing SKU changesCVE-2026-111032 · WordPress plugins & themes · reported by WPScanLow 3.8

  The Welcart e-Commerce WordPress plugin before 2.12.6 does not properly verify authorization against the targeted product before processing SKU changes, because its capability check is not tied to the product being edited, allowing any authenticated user with Author-level access or higher to read, modify, create, delete and re-order the SKU data (including prices, confidential cost prices and stock levels) of any product, including those belonging to other users.

  Product

  Welcart e-Commerce

  Fixed in

  2.12.6

  What to do

  Update Welcart e-Commerce to 2.12.6 or newer.

  Full record and what to do →NVD recordwpscan.com

• Oct 28, 2026Welcart e-Commerce: Does not validate a user-supplied URL before using it in a redirectCVE-2026-111031 · WordPress plugins & themes · reported by WPScanMedium 4.7

  The Welcart e-Commerce WordPress plugin before 2.12.6 does not validate a user-supplied URL before using it in a redirect, allowing unauthenticated attackers to redirect users to arbitrary external websites.

  Product

  Welcart e-Commerce

  Fixed in

  2.12.6

  What to do

  Update Welcart e-Commerce to 2.12.6 or newer.

  Full record and what to do →NVD recordwpscan.com

• Oct 28, 2026Welcart e-Commerce: Does not properly sanitise and escape a parameter before using it in a SQL queryCVE-2026-111027 · WordPress plugins & themes · reported by WPScanMedium 6.8

  The Welcart e-Commerce WordPress plugin before 2.12.6 does not properly sanitise and escape a parameter before using it in a SQL query, and strips the escaping it had applied before running the query, allowing users with the Editor role or higher to perform SQL injection attacks.

  Product

  Welcart e-Commerce

  Fixed in

  2.12.6

  What to do

  Update Welcart e-Commerce to 2.12.6 or newer.

  Full record and what to do →NVD recordwpscan.com

• Oct 28, 2026Royal Addons for Elementor: Does not perform any authorization check before using the site owner's stored Mailchimp credential to add subscriber records to an audience chosen by the requestCVE-2026-107097 · WordPress plugins & themes · reported by WPScanMedium 5.3

  The Royal Addons for Elementor WordPress plugin before 1.7.1070 does not perform any authorization check before using the site owner's stored Mailchimp credential to add subscriber records to an audience chosen by the request, allowing unauthenticated attackers to inject arbitrary email addresses and contact details into the site owner's Mailchimp account as confirmed subscribers.

  Product

  Royal Addons for Elementor

  Fixed in

  1.7.1070

  What to do

  Update Royal Addons for Elementor to 1.7.1070 or newer.

  Full record and what to do →NVD recordwpscan.com

• Oct 28, 2026Thrive Automator: Does not properly sanitize and escape a parameter's array key before using it in a SQL queryCVE-2026-104694 · WordPress plugins & themes · reported by WPScanMedium 6.8

  The Thrive Automator WordPress plugin before 11.2 does not properly sanitize and escape a parameter's array key before using it in a SQL query, allowing authenticated attackers with editor-level access to perform blind SQL injection attacks.

  Product

  Thrive Automator

  Fixed in

  11.2

  What to do

  Update Thrive Automator to 11.2 or newer.

  Full record and what to do →NVD recordwpscan.com

• Oct 26, 2026Customer Coupons for WooCommerce: Missing AuthorizationCVE-2026-112839 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in VillaTheme Customer Coupons for WooCommerce woo-customer-coupons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Customer Coupons for WooCommerce: from n/a through 1.3.14.

  Product

  Customer Coupons for WooCommerce

  Affected

  up to 1.3.14

  What to do

  Affects up to 1.3.14. Update Customer Coupons for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 26, 2026Photo Reviews for WooCommerce: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')CVE-2026-111404 · WordPress plugins & themes · reported by PatchstackLow 3.7

  Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in VillaTheme Photo Reviews for WooCommerce woo-photo-reviews allows Leveraging Race Conditions.This issue affects Photo Reviews for WooCommerce: from n/a through 1.2.31.

  Product

  Photo Reviews for WooCommerce

  Affected

  up to 1.2.31

  What to do

  Affects up to 1.2.31. Update Photo Reviews for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 26, 2026Easy Digital Downloads: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')CVE-2026-116403 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Awesomemotive Easy Digital Downloads easy-digital-downloads allows Leveraging Race Conditions.This issue affects Easy Digital Downloads: from n/a through 3.7.1.

  Product

  Easy Digital Downloads

  Affected

  up to 3.7.1

  What to do

  Affects up to 3.7.1. Update Easy Digital Downloads to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 26, 2026Amelia: Missing AuthorizationCVE-2026-116388 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in TMS Amelia ameliabooking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Amelia: from n/a through 2.4.10.

  Product

  Amelia

  Affected

  up to 2.4.10

  What to do

  Affects up to 2.4.10. Update Amelia to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 26, 2026LearnPress: Missing AuthorizationCVE-2026-115598 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LearnPress: from n/a through 4.4.11.

  Product

  LearnPress

  Affected

  up to 4.4.11

  What to do

  Affects up to 4.4.11. Update LearnPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 26, 2026LearnPress: Missing AuthorizationCVE-2026-115597 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LearnPress: from n/a through 4.4.11.

  Product

  LearnPress

  Affected

  up to 4.4.11

  What to do

  Affects up to 4.4.11. Update LearnPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 26, 2026APIExperts Square for WooCommerce: Missing AuthorizationCVE-2026-115960 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in WPExperts APIExperts Square for WooCommerce woosquare allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects APIExperts Square for WooCommerce: from n/a through 4.7.5.

  Product

  APIExperts Square for WooCommerce

  Affected

  up to 4.7.5

  What to do

  Affects up to 4.7.5. Update APIExperts Square for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 26, 2026APIExperts Square for WooCommerce: Missing AuthorizationCVE-2026-115959 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in WPExperts APIExperts Square for WooCommerce woosquare allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects APIExperts Square for WooCommerce: from n/a through 4.7.5.

  Product

  APIExperts Square for WooCommerce

  Affected

  up to 4.7.5

  What to do

  Affects up to 4.7.5. Update APIExperts Square for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 26, 2026Geo Mashup: Missing AuthorizationCVE-2026-115954 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Missing Authorization vulnerability in Dylan Kuhn Geo Mashup geo-mashup allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Geo Mashup: from n/a through 1.13.22.

  Product

  Geo Mashup

  Affected

  up to 1.13.22

  What to do

  Affects up to 1.13.22. Update Geo Mashup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 26, 2026Contact Form by Supsystic: Missing AuthorizationCVE-2026-115595 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in Supsystic Contact Form by Supsystic contact-form-by-supsystic allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Contact Form by Supsystic: from n/a through 1.10.7.

  Product

  Contact Form by Supsystic

  Affected

  up to 1.10.7

  What to do

  Affects up to 1.10.7. Update Contact Form by Supsystic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 26, 2026WP Discussion Board: Missing AuthorizationCVE-2026-115958 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in WP Discussion Board WP Discussion Board wp-discussion-board allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Discussion Board: from n/a through 2.6.0.

  Product

  WP Discussion Board

  Affected

  up to 2.6.0

  What to do

  Affects up to 2.6.0. Update WP Discussion Board to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 26, 2026Better Post & Filter Widgets for Elementor: Missing AuthorizationCVE-2026-115949 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Missing Authorization vulnerability in WP Smart Widgets Better Post & Filter Widgets for Elementor better-post-filter-widgets-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Better Post & Filter Widgets for Elementor: from n/a through 1.9.1.

  Product

  Better Post & Filter Widgets for Elementor

  Affected

  up to 1.9.1

  What to do

  Affects up to 1.9.1. Update Better Post & Filter Widgets for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 26, 2026Booking and Rental Manager: Missing AuthorizationCVE-2026-115614 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in Magepeople inc. Booking and Rental Manager booking-and-rental-manager-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booking and Rental Manager: from n/a through 2.8.2.

  Product

  Booking and Rental Manager

  Affected

  up to 2.8.2

  What to do

  Affects up to 2.8.2. Update Booking and Rental Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 26, 2026Bopo – WooCommerce Product Bundle Builder: Missing AuthorizationCVE-2026-110377 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in VillaTheme Bopo – WooCommerce Product Bundle Builder bopo-woo-product-bundle-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Bopo – WooCommerce Product Bundle Builder: from n/a through 1.2.3.

  Product

  Bopo – WooCommerce Product Bundle Builder

  Affected

  up to 1.2.3

  What to do

  Affects up to 1.2.3. Update Bopo – WooCommerce Product Bundle Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 26, 2026AI Engine: Missing AuthorizationCVE-2026-112828 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in Meow Apps AI Engine ai-engine allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AI Engine: from n/a through 3.8.6.

  Product

  AI Engine

  Affected

  up to 3.8.6

  What to do

  Affects up to 3.8.6. Update AI Engine to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 26, 2026DEPART: Missing AuthorizationCVE-2026-110376 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in VillaTheme DEPART depart-deposit-and-part-payment-for-woo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects DEPART: from n/a through 1.0.10.

  Product

  DEPART

  Affected

  up to 1.0.10

  What to do

  Affects up to 1.0.10. Update DEPART to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 26, 2026Payment Gateway: Does not ensure a shared secret is configured before using it to authenticate the bank's payment-notification callbackCVE-2026-103299 · WordPress plugins & themes · reported by WPScanMedium 5.3

  The Payment Gateway WordPress plugin through 2.2.0 does not ensure a shared secret is configured before using it to authenticate the bank's payment-notification callback, allowing unauthenticated attackers to forge a valid notification and mark any WooCommerce order as paid on installs where the secret has not been set, and the same callback lets them move any pending order to a failed state whether or not the secret is configured.

  Product

  Payment Gateway

  Affected

  up to 2.2.0

  What to do

  Affects up to 2.2.0. Update Payment Gateway to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordwpscan.com

• Oct 24, 2026WpEvently: Missing AuthorizationCVE-2026-114192 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Missing Authorization vulnerability in Magepeople inc. WpEvently mage-eventpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WpEvently: from n/a through 5.7.8.

  Product

  WpEvently

  Affected

  up to 5.7.8

  What to do

  Affects up to 5.7.8. Update WpEvently to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 24, 2026UPI QR Code Payment Gateway for WooCommerce: Missing AuthorizationCVE-2026-114191 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Missing Authorization vulnerability in Knit Pay UPI QR Code Payment Gateway for WooCommerce upi-qr-code-payment-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects UPI QR Code Payment Gateway for WooCommerce: from n/a through 1.6.3.

  Product

  UPI QR Code Payment Gateway for WooCommerce

  Affected

  up to 1.6.3

  What to do

  Affects up to 1.6.3. Update UPI QR Code Payment Gateway for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 24, 2026WP Social Feed Gallery: Missing AuthorizationCVE-2026-114705 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Missing Authorization vulnerability in quadlayers WP Social Feed Gallery insta-gallery allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Social Feed Gallery: from n/a through 5.0.13.

  Product

  WP Social Feed Gallery

  Affected

  up to 5.0.13

  What to do

  Affects up to 5.0.13. Update WP Social Feed Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 24, 2026SureDash: Missing AuthorizationCVE-2026-110892 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Missing Authorization vulnerability in Brainstorm Force SureDash suredash allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SureDash: from n/a through 1.12.2.

  Product

  SureDash

  Affected

  up to 1.12.2

  What to do

  Affects up to 1.12.2. Update SureDash to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 24, 2026GeoDirectory: Does not validate a user-supplied image URL before using itCVE-2026-113491 · WordPress plugins & themes · reported by WPScanMedium 6.4

  The GeoDirectory WordPress plugin before 2.8.194 does not validate a user-supplied image URL before using it as a local file path when saving a front-end listing, allowing users with Subscriber-level access and above to read files from outside the web root and to delete files on the server, limited to file names that carry an allowed media extension. A disclosed file is re-published at a public URL and its original is deleted as a side effect.

  Product

  GeoDirectory

  Fixed in

  2.8.194

  What to do

  Update GeoDirectory to 2.8.194 or newer.

  Full record and what to do →NVD recordwpscan.com

• Oct 23, 2026Car Rental Manager: Missing AuthorizationCVE-2026-112825 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Missing Authorization vulnerability in Magepeople inc. Car Rental Manager car-rental-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Car Rental Manager: from n/a through 1.5.3.

  Product

  Car Rental Manager

  Affected

  up to 1.5.3

  What to do

  Affects up to 1.5.3. Update Car Rental Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 23, 2026Knit Pay: Missing AuthorizationCVE-2026-112821 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Missing Authorization vulnerability in Knit Pay Knit Pay knit-pay allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Knit Pay: from n/a through 9.6.3.0.

  Product

  Knit Pay

  Affected

  up to 9.6.3.0

  What to do

  Affects up to 9.6.3.0. Update Knit Pay to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 23, 2026WPMobile.App: Missing AuthorizationCVE-2026-112359 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Missing Authorization vulnerability in Amauri.IO WPMobile.App wpappninja allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPMobile.App: from n/a through 11.86.

  Product

  WPMobile.App

  Affected

  up to 11.86

  What to do

  Affects up to 11.86. Update WPMobile.App to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 23, 2026Essential Addons for Elementor: Does not validate the HTML tag setting of some of its widgets before using it to build markupCVE-2026-110510 · WordPress plugins & themes · reported by WPScanLow 3.5

  The Essential Addons for Elementor WordPress plugin before 6.8.7 does not validate the HTML tag setting of some of its widgets before using it to build markup, which could allow users with the author role and above to inject iframe and form elements into published pages.

  Product

  Essential Addons for Elementor

  Fixed in

  6.8.7

  What to do

  Update Essential Addons for Elementor to 6.8.7 or newer.

  Full record and what to do →NVD recordwpscan.com

• Oct 22, 2026Paid Member Subscriptions: Missing AuthorizationCVE-2026-112842 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Missing Authorization vulnerability in Cozmoslabs Paid Member Subscriptions paid-member-subscriptions allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Paid Member Subscriptions: from n/a through 3.1.2.

  Product

  Paid Member Subscriptions

  Affected

  up to 3.1.2

  What to do

  Affects up to 3.1.2. Update Paid Member Subscriptions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 22, 2026ЮKassa для WooCommerce: Missing AuthorizationCVE-2026-114699 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in yoomoney ЮKassa для WooCommerce yookassa allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ЮKassa для WooCommerce: from n/a through 2.17.3.

  Product

  ЮKassa для WooCommerce

  Affected

  up to 2.17.3

  What to do

  Affects up to 2.17.3. Update ЮKassa для WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 22, 2026Page Restriction WordPress (WP): Missing AuthorizationCVE-2026-114696 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in miniOrange Page Restriction WordPress (WP) page-and-post-restriction allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Page Restriction WordPress (WP): from n/a through 1.6.0.

  Product

  Page Restriction WordPress (WP)

  Affected

  up to 1.6.0

  What to do

  Affects up to 1.6.0. Update Page Restriction WordPress (WP) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 22, 2026ACF Extended: Missing AuthorizationCVE-2026-112312 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Missing Authorization vulnerability in ACF Extended ACF Extended acf-extended allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ACF Extended: from n/a through 0.9.2.7.

  Product

  ACF Extended

  Affected

  up to 0.9.2.7

  What to do

  Affects up to 0.9.2.7. Update ACF Extended to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 22, 2026Majestic Support: Missing AuthorizationCVE-2026-112218 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in Ahmad Majestic Support majestic-support allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Majestic Support: from n/a through 1.2.1.

  Product

  Majestic Support

  Affected

  up to 1.2.1

  What to do

  Affects up to 1.2.1. Update Majestic Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 22, 2026Sunshine Photo Cart: Missing AuthorizationCVE-2026-111842 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in WP Sunshine Sunshine Photo Cart sunshine-photo-cart allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sunshine Photo Cart: from n/a through 3.7.5.

  Product

  Sunshine Photo Cart

  Affected

  up to 3.7.5

  What to do

  Affects up to 3.7.5. Update Sunshine Photo Cart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 22, 2026SureDash: Missing AuthorizationCVE-2026-110894 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in Brainstorm Force SureDash suredash allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SureDash: from n/a through 1.12.2.

  Product

  SureDash

  Affected

  up to 1.12.2

  What to do

  Affects up to 1.12.2. Update SureDash to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 22, 2026SureDash: Missing AuthorizationCVE-2026-110893 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in Brainstorm Force SureDash suredash allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SureDash: from n/a through 1.12.2.

  Product

  SureDash

  Affected

  up to 1.12.2

  What to do

  Affects up to 1.12.2. Update SureDash to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 22, 2026PowerPack Addons for Elementor: Missing AuthorizationCVE-2026-114182 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in IdeaBox Creations PowerPack Addons for Elementor powerpack-lite-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PowerPack Addons for Elementor: from n/a through 3.1.0.

  Product

  PowerPack Addons for Elementor

  Affected

  up to 3.1.0

  What to do

  Affects up to 3.1.0. Update PowerPack Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 22, 2026Metform: Missing AuthorizationCVE-2026-114180 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in Wpmet Metform metform allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Metform: from n/a through 4.3.2.

  Product

  Metform

  Affected

  up to 4.3.2

  What to do

  Affects up to 4.3.2. Update Metform to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 22, 2026eRoom: Missing AuthorizationCVE-2026-114175 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Missing Authorization vulnerability in DigitalME eRoom eroom-zoom-meetings-webinar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects eRoom: from n/a through 1.7.1.

  Product

  eRoom

  Affected

  up to 1.7.1

  What to do

  Affects up to 1.7.1. Update eRoom to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 22, 2026Strong Testimonials: Missing AuthorizationCVE-2026-112843 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in WP Chill Strong Testimonials strong-testimonials allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Strong Testimonials: from n/a through 3.3.14.

  Product

  Strong Testimonials

  Affected

  up to 3.3.14

  What to do

  Affects up to 3.3.14. Update Strong Testimonials to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 22, 2026Falcon – WordPress Optimizations & Tweaks: Missing AuthorizationCVE-2026-112826 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in eLightUp Falcon – WordPress Optimizations & Tweaks falcon allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Falcon – WordPress Optimizations & Tweaks: from n/a through 2.12.0.

  Product

  Falcon – WordPress Optimizations & Tweaks

  Affected

  up to 2.12.0

  What to do

  Affects up to 2.12.0. Update Falcon – WordPress Optimizations & Tweaks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 22, 2026MarketKing: Missing AuthorizationCVE-2026-111847 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Missing Authorization vulnerability in Kings Plugins MarketKing marketking-multivendor-marketplace-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MarketKing: from n/a through 2.1.72.

  Product

  MarketKing

  Affected

  up to 2.1.72

  What to do

  Affects up to 2.1.72. Update MarketKing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.