Updated 8 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

343new WordPress flaws this week

390,080entries in the database

2,190 results · page 2 of 44

Oct 17, 2026ACF Frontend Admin by DynamiApps: Does not perform a capability check on one of its form-submission actions before writing submitted values into the site's global ACF options storeCVE-2026-81343 · WordPress plugins & themes · reported by WPScanMedium 5.3
The ACF Frontend Admin by DynamiApps WordPress plugin through 3.29.13 does not perform a capability check on one of its form-submission actions before writing submitted values into the site's global ACF options store, allowing unauthenticated visitors to overwrite site-wide option values via a public form.
Product
ACF Frontend Admin by DynamiApps
Affected
up to 3.29.13
What to do
Affects up to 3.29.13. Update ACF Frontend Admin by DynamiApps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Oct 17, 2026WP Data Access: Does not have authorisation and CSRF checks in one of its actionsCVE-2026-106470 · WordPress plugins & themes · reported by WPScanMedium 5
The WP Data Access WordPress plugin before 5.5.88 does not have authorisation and CSRF checks in one of its actions, allowing any authenticated user, such as a subscriber, to make the server open connections to arbitrary hosts and ports, including internal ones, and read back the outcome.
Product
WP Data Access
Fixed in
5.5.88
What to do
Update WP Data Access to 5.5.88 or newer.
Full record and what to do →NVD record wpscan.com
Oct 17, 2026Contact Form 7 Signature Addon: Does not sanitize a signature field value before building an email attachment path from itCVE-2026-104246 · WordPress plugins & themes · reported by WPScanMedium 5.9
The Contact Form 7 Signature Addon WordPress plugin through 4.2.2 does not sanitize a signature field value before building an email attachment path from it, allowing unauthenticated users to attach arbitrary files (bounded to wp-content on current Contact Form 7) to a form's outgoing email via path traversal; when a form is configured to email a copy to a submitter-controlled address, the attacker can read the targeted file.
Product
Contact Form 7 Signature Addon
Affected
up to 4.2.2
What to do
Affects up to 4.2.2. Update Contact Form 7 Signature Addon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Oct 16, 2026Squeeze: Does not perform a capability check on one of its AJAX actionsCVE-2026-110029 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Squeeze WordPress plugin before 1.8.1 does not perform a capability check on one of its AJAX actions, allowing authenticated users with a role as low as Subscriber to revert any attachment to its backup copy and to permanently delete that backup and the plugin's generated WebP derivatives, regardless of ownership.
Product
Squeeze
Fixed in
1.8.1
What to do
Update Squeeze to 1.8.1 or newer.
Full record and what to do →NVD record wpscan.com
Oct 16, 2026Product Delivery Date for WooCommerce: Does not perform a capability check before disclosing order details through its calendar view AJAX actionsCVE-2026-110191 · WordPress plugins & themes · reported by WPScanLow 2.7
The Product Delivery Date for WooCommerce WordPress plugin before 3.3.2 does not perform a capability check before disclosing order details through its calendar view AJAX actions, allowing users with a role as low as Contributor to view other customers' order information.
Product
Product Delivery Date for WooCommerce
Fixed in
3.3.2
What to do
Update Product Delivery Date for WooCommerce to 3.3.2 or newer.
Full record and what to do →NVD record wpscan.com
Oct 16, 2026MB Custom Post Types & Custom Taxonomies: Does not perform a capability check or validate a nonce on its migration actionsCVE-2026-109982 · WordPress plugins & themes · reported by WPScanMedium 4.2
The MB Custom Post Types & Custom Taxonomies WordPress plugin before 2.12.2 does not perform a capability check or validate a nonce on its migration actions, allowing any authenticated user, such as a subscriber, to trigger a one-way migration that creates published records and permanently deletes a companion MB Custom Post Types & Custom Taxonomies WordPress plugin before 2.12.2's entire post-type and taxonomy configuration.
Product
MB Custom Post Types & Custom Taxonomies
Fixed in
2.12.2
What to do
Update MB Custom Post Types & Custom Taxonomies to 2.12.2 or newer.
Full record and what to do →NVD record wpscan.com
Oct 16, 2026Ultra Addons for Contact Form 7: Stored Cross-Site ScriptingCVE-2026-103999 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via File Upload in all versions up to, and including, 3.5.54 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The extension blocklist gatekeeper is bypassed by uploading text-type files (.txt, .csv, .vtt, .srt, .asc) whose contents begin with an HTML payload such as '<BODY onload=…>', as the check classifies these files as text/plain without inspecting their byte content.
Product
Ultra Addons for Contact Form 7
Affected
up to 3.5.54
What to do
Affects up to 3.5.54. Update Ultra Addons for Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record downloads.wordpress.org plugins.trac.wordpress.org
Oct 16, 2026The Forminator Forms – Contact Form, Payment Form & Custom Form Builder: Arbitrary shortcode executionCVE-2026-103911 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.58.1. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. This is exploitable on any block-theme install via a single unauthenticated GET request to the search results page, or by submitting an anonymous comment on any post with comments enabled; no Forminator-specific content or configuration is required to trigger execution.
Product
The Forminator Forms – Contact Form, Payment Form & Custom Form Builder
Affected
up to 1.58.1
What to do
Affects up to 1.58.1. Update The Forminator Forms – Contact Form, Payment Form & Custom Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 16, 2026Forminator Forms – Contact Form, Payment Form & Custom Form Builder: Arbitrary Shortcode ExecutionCVE-2026-101335 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 1.58.1. This is due to the forminator_replace_quiz_form_data() helper invoking do_shortcode() on the fully expanded notification body once the {quiz_result} merge tag has been substituted, while the earlier-substituted {user_agent} and {refer_url} merge tags carry unauthenticated attacker-controlled bytes (the User-Agent header and the referer_url POST parameter) through sanitize_text_field()/esc_html(), neither of which strip the '[' and ']' shortcode delimiters. This makes it possible for unauthenticated attackers to execute arbitrary WordPress shortcodes registered on the site by submitting a quiz whose notification template contains {quiz_result}; the resulting impact depends on the shortcodes exposed by other installed plugins/themes and can range from arbitrary content injection to information disclosure.
Product
Forminator Forms – Contact Form, Payment Form & Custom Form Builder
Affected
up to 1.58.1
What to do
Affects up to 1.58.1. Update Forminator Forms – Contact Form, Payment Form & Custom Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 15, 2026Ninja Forms Signature Contract Add-On: Missing AuthorizationCVE-2026-110378 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WP E-Signature Ninja Forms Signature Contract Add-On ninja-signature-contract-forms-add-on allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ninja Forms Signature Contract Add-On: from n/a through 3.2.5.
Product
Ninja Forms Signature Contract Add-On
Affected
up to 3.2.5
What to do
Affects up to 3.2.5. Update Ninja Forms Signature Contract Add-On to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 15, 2026Document Gallery: Does not properly sanitise and escape user input before reflecting it inside an HTML attribute in the response of an unauthenticated AJAX actionCVE-2026-74920 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Document Gallery WordPress plugin through 5.1.1 does not properly sanitise and escape user input before reflecting it inside an HTML attribute in the response of an unauthenticated AJAX action, leading to a Reflected Cross-Site Scripting vulnerability which can be exploited against any visitor, including a logged-in administrator.
Product
Document Gallery
Affected
up to 5.1.1
What to do
Affects up to 5.1.1. Update Document Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Oct 15, 2026Spin Wheel: Does not verify that a visitor actually performed a legitimate spin before returning and consuming a configured prize couponCVE-2026-106031 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Spin Wheel WordPress plugin before 2.2.1 does not verify that a visitor actually performed a legitimate spin before returning and consuming a configured prize coupon, allowing unauthenticated users to disclose and drain the stored coupon codes of any campaign, including unpublished ones.
Product
Spin Wheel
Fixed in
2.2.1
What to do
Update Spin Wheel to 2.2.1 or newer.
Full record and what to do →NVD record wpscan.com
Oct 15, 2026Easy HTTPS Redirection (SSL): Does not perform capability checks in some of its AJAX actionsCVE-2026-104643 · WordPress plugins & themes · reported by WPScanMedium 4.2
The Easy HTTPS Redirection (SSL) WordPress plugin before 2.0.2 does not perform capability checks in some of its AJAX actions, allowing any authenticated user, such as a Subscriber, to read URLs its content scanner collected from private and draft posts and from site options, and to trigger a site-wide rewrite of those URLs, once an administrator has run a scan.
Product
Easy HTTPS Redirection (SSL)
Fixed in
2.0.2
What to do
Update Easy HTTPS Redirection (SSL) to 2.0.2 or newer.
Full record and what to do →NVD record wpscan.com
Oct 15, 2026eaSYNC Booking: Does not perform authorization or nonce checks on several of its cancellation-related AJAX actionsCVE-2026-103304 · WordPress plugins & themes · reported by WPScanMedium 5.3
The eaSYNC Booking WordPress plugin before 1.3.31 does not perform authorization or nonce checks on several of its cancellation-related AJAX actions, allowing unauthenticated users to create booking cancellation requests, trigger booking notification emails, and overwrite the content of the emails the site sends.
Product
eaSYNC Booking
Fixed in
1.3.31
What to do
Update eaSYNC Booking to 1.3.31 or newer.
Full record and what to do →NVD record wpscan.com
Oct 14, 2026Sifalo Pay: Does not verify that a payment transaction identifier belongs to the order it is confirmingCVE-2026-94261 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Sifalo Pay WordPress plugin before 2.5.3 does not verify that a payment transaction identifier belongs to the order it is confirming, nor that the requester owns that order, allowing unauthenticated attackers holding one valid transaction identifier from a payment of their own to mark arbitrary pending orders as paid.
Product
Sifalo Pay
Fixed in
2.5.3
What to do
Update Sifalo Pay to 2.5.3 or newer.
Full record and what to do →NVD record wpscan.com
Oct 14, 2026Robokassa payment gateway for Woocommerce: Does not verify the authenticity of an incoming payment-notification request before acting on the order named in itCVE-2026-91076 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Robokassa payment gateway for Woocommerce WordPress plugin before 1.9.0 does not verify the authenticity of an incoming payment-notification request before acting on the order named in it, allowing unauthenticated attackers to force any WooCommerce order into a failed state. Order identifiers are sequential, so every order in the shop can be taken out of the fulfilment queue one request at a time.
Product
Robokassa payment gateway for Woocommerce
Fixed in
1.9.0
What to do
Update Robokassa payment gateway for Woocommerce to 1.9.0 or newer.
Full record and what to do →NVD record wpscan.com
Oct 14, 2026Product Feed for Google Shopping, Microsoft Advertising and 40+ Channels for WooCommerce Merchant: Does not perform a nonce or capability check on the AJAX action that registers the store with its feed service and exposeCVE-2026-87968 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Product Feed for Google Shopping, Microsoft Advertising and 40+ Channels for WooCommerce Merchant WordPress plugin before 5.3.2 does not perform a nonce or capability check on the AJAX action that registers the store with its feed service and exposes it to unauthenticated users, so any visitor can force the store to re-register and overwrite the Product Feed for Google Shopping, Microsoft Advertising and 40+ Channels for WooCommerce Merchant WordPress plugin before 5.3.2's stored shop secret.
Product
Product Feed for Google Shopping, Microsoft Advertising and 40+ Channels for WooCommerce Merchant
Fixed in
5.3.2
What to do
Update Product Feed for Google Shopping, Microsoft Advertising and 40+ Channels for WooCommerce Merchant to 5.3.2 or newer.
Full record and what to do →NVD record wpscan.com
Oct 14, 2026WP 2FA: Does not perform an object-level capability check before removing a user's two-factor authentication configurationCVE-2026-108066 · WordPress plugins & themes · reported by WPScanLow 2.7
The WP 2FA WordPress plugin before 4.2.0 does not perform an object-level capability check before removing a user's two-factor authentication configuration, allowing a site administrator on WordPress Multisite to remove the 2FA configuration of users outside their own site, including accounts they are not permitted to edit. On single-site installs an administrator can already manage all users, so this crosses a trust boundary only on Multisite.
Product
WP 2FA
Fixed in
4.2.0
What to do
Update WP 2FA to 4.2.0 or newer.
Full record and what to do →NVD record wpscan.com
Oct 14, 2026GamiPress: Does not properly authorize access to private activity log entriesCVE-2026-107320 · WordPress plugins & themes · reported by WPScanMedium 5.3
The GamiPress WordPress plugin before 8.0.6 does not properly authorize access to private activity log entries, allowing unauthenticated users to retrieve the private activity logs of all users. This is an incomplete fix of CVE-2026-13450.
Product
GamiPress
Fixed in
8.0.6
What to do
Update GamiPress to 8.0.6 or newer.
Full record and what to do →NVD record wpscan.com
Oct 14, 2026GamiPress: Does not perform a capability check or ownership verification on one of its authenticated AJAX actionsCVE-2026-107319 · WordPress plugins & themes · reported by WPScanMedium 4.3
The GamiPress WordPress plugin before 8.0.6 does not perform a capability check or ownership verification on one of its authenticated AJAX actions, allowing any authenticated user, such as a Subscriber, to read arbitrary entries from its activity log, including other users' points balances and earned achievements and the usernames of the administrators who performed manual point award and revoke actions.
Product
GamiPress
Fixed in
8.0.6
What to do
Update GamiPress to 8.0.6 or newer.
Full record and what to do →NVD record wpscan.com
Oct 14, 2026WP Data Access: Does not restrict its database table export action to authorized usersCVE-2026-106099 · WordPress plugins & themes · reported by WPScanMedium 5.3
The WP Data Access WordPress plugin before 5.5.84 does not restrict its database table export action to authorized users, gating it only with a token that the WP Data Access WordPress plugin before 5.5.84 itself prints into the public pages on which it displays a table, allowing unauthenticated attackers to export the complete contents of any publicly displayed table, including columns and rows withheld from the display shown to visitors.
Product
WP Data Access
Fixed in
5.5.84
What to do
Update WP Data Access to 5.5.84 or newer.
Full record and what to do →NVD record wpscan.com
Oct 14, 2026Smart Forms – when you need more than just a contact form: Stored Cross-Site ScriptingCVE-2026-95816 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Smart Forms – when you need more than just a contact form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'formString' parameter in all versions up to, and including, 2.6.104 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The nonce check protecting the rednao_smart_forms_save_form_values AJAX handler is only enforced when the smart_forms_block_anonymous_submissions option is enabled, meaning default installations require no authentication or nonce verification whatsoever to submit and store malicious payloads.
Product
Smart Forms – when you need more than just a contact form
Affected
up to 2.6.104
What to do
Affects up to 2.6.104. Update Smart Forms – when you need more than just a contact form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 14, 2026Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder: Blind SQL InjectionCVE-2026-95808 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to blind SQL Injection via the 'inputs' parameter in all versions up to, and including, 1.15.48 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The nonce required to reach the vulnerable handler is emitted to every public page that renders a form, making it trivially obtainable by an unauthenticated attacker from page source.
Product
Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder
Affected
up to 1.15.48
What to do
Affects up to 1.15.48. Update Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 14, 2026Contact Form DB for Enfold: Stored Cross-Site ScriptingCVE-2026-83592 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Contact Form DB for Enfold plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Contact Form Field Values in all versions up to, and including, 2.0.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload is echoed unescaped both inside a title HTML attribute and in the table cell body in admin/ecf_index.php; base64 encoding and serialization of the stored values do not neutralize the malicious content.
Product
Contact Form DB for Enfold
Affected
up to 2.0.2
What to do
Affects up to 2.0.2. Update Contact Form DB for Enfold to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 13, 2026Database Addon for Contact Form 7 – CFDB7: Arbitrary File DeletionCVE-2026-107652 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Database Addon for Contact Form 7 – CFDB7 plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 1.4.1. This is due to the plugin storing arbitrary (non-form-tag) submission fields in its db7_forms row and the process_bulk_action() delete handler then matching any stored key whose name contains the substring 'cfdb7_file' and passing the stored value directly to unlink() without validating that the file actually belongs to the submission being deleted or constraining the filename with basename()/realpath(). This makes it possible for unauthenticated attackers to inject a crafted multipart field.
Product
Database Addon for Contact Form 7 – CFDB7
Affected
up to 1.4.1
What to do
Affects up to 1.4.1. Update Database Addon for Contact Form 7 – CFDB7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 13, 2026Active Products Tables for WooCommerce: Insertion of Sensitive Information Into Sent DataCVE-2026-108489 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Insertion of Sensitive Information Into Sent Data vulnerability in PluginUs.Net Active Products Tables for WooCommerce profit-products-tables-for-woocommerce allows Retrieve Embedded Sensitive Data.This issue affects Active Products Tables for WooCommerce: from n/a through 2.1.3.
Product
Active Products Tables for WooCommerce
Affected
up to 2.1.3
What to do
Affects up to 2.1.3. Update Active Products Tables for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 11, 2026MemberHero: Does not perform any capability or nonce check on one of its AJAX actionsCVE-2026-94235 · WordPress plugins & themes · reported by WPScanMedium 4.3
The MemberHero WordPress plugin through 6.9 does not perform any capability or nonce check on one of its AJAX actions, allowing any authenticated user, such as a subscriber, to make the site send arbitrary HTML emails to arbitrary recipients from its own mail system, which can be abused to relay phishing carrying the site's identity and domain reputation.
Product
MemberHero
Affected
up to 6.9
What to do
Affects up to 6.9. Update MemberHero to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Oct 11, 2026Veeqo for WooCommerce: Does not restrict who can trigger its remote bridge-installation process or validate the URL it is given before downloading and extracting itCVE-2026-93550 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Veeqo for WooCommerce WordPress plugin through 2.2.8 does not restrict who can trigger its remote bridge-installation process or validate the URL it is given before downloading and extracting it, allowing users with Subscriber-level access and above to make the Veeqo for WooCommerce WordPress plugin through 2.2.8 download and extract an attacker-controlled archive containing arbitrary PHP files into the WordPress root.
Product
Veeqo for WooCommerce
Affected
up to 2.2.8
What to do
Affects up to 2.2.8. Update Veeqo for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Oct 11, 2026WP Posts Password Batch Manager: Does not perform any capability or nonce check on a bulk post-password action that runs on an always-loaded admin handlerCVE-2026-89283 · WordPress plugins & themes · reported by WPScanHigh 8.6
The WP Posts Password Batch Manager WordPress plugin through 1.1 does not perform any capability or nonce check on a bulk post-password action that runs on an always-loaded admin handler, allowing unauthenticated attackers to reset or overwrite the password of every published post, disclosing password-protected content or locking all posts behind an attacker-chosen password.
Product
WP Posts Password Batch Manager
Affected
up to 1.1
What to do
Affects up to 1.1. Update WP Posts Password Batch Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Oct 11, 2026SmugMug Embed: Does not have authorisation or CSRF checks on an AJAX action that stores gallery dataCVE-2026-88826 · WordPress plugins & themes · reported by WPScanHigh 8.8
The SmugMug Embed WordPress plugin through 3.13 does not have authorisation or CSRF checks on an AJAX action that stores gallery data, and does not sanitise or escape that data before outputting it, allowing unauthenticated users to store arbitrary web scripts that execute when an administrator views the SmugMug Embed WordPress plugin through 3.13's settings screen.
Product
SmugMug Embed
Affected
up to 3.13
What to do
Affects up to 3.13. Update SmugMug Embed to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Oct 11, 2026Insurify: Does not have authorisation and nonce checks on one of its AJAX actionsCVE-2026-86717 · WordPress plugins & themes · reported by WPScanCritical 9.1
The Insurify WordPress plugin through 1.0 does not have authorisation and nonce checks on one of its AJAX actions, allowing unauthenticated users to delete arbitrary WordPress options, which can take the site offline and strip every user of their role.
Product
Insurify
Affected
up to 1.0
What to do
Affects up to 1.0. Update Insurify to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Oct 11, 2026Quick quotes: Does not perform any capability or nonce check on one of its AJAX actions and lets the caller chooseCVE-2026-86706 · WordPress plugins & themes · reported by WPScanCritical 9.1
The Quick quotes WordPress plugin through 1.0.0 does not perform any capability or nonce check on one of its AJAX actions and lets the caller choose which option is written, allowing unauthenticated users to alter arbitrary site settings and to make the site unavailable.
Product
Quick quotes
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Quick quotes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Oct 11, 2026Crowdfundly: Does not have capability checks on some of its AJAX actionsCVE-2026-85126 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Crowdfundly WordPress plugin through 2.2.2 does not have capability checks on some of its AJAX actions, allowing users holding one of its own low privileged roles to grant themselves the administrator role or arbitrary capabilities, leading to a full site takeover.
Product
Crowdfundly
Affected
up to 2.2.2
What to do
Affects up to 2.2.2. Update Crowdfundly to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Oct 11, 2026Insurify: Does not have authorisation and nonce checks on one of its AJAX actionsCVE-2026-85121 · WordPress plugins & themes · reported by WPScanCritical 9.1
The Insurify WordPress plugin through 1.0 does not have authorisation and nonce checks on one of its AJAX actions, allowing unauthenticated users to create and overwrite arbitrary WordPress options with request data, which can take the site offline and deactivate all of its Insurify WordPress plugin through 1.0.
Product
Insurify
Affected
up to 1.0
What to do
Affects up to 1.0. Update Insurify to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Oct 11, 2026AI Content Generator Marketing: Does not enforce a nonce or capability check on some of its AJAX actionsCVE-2026-85118 · WordPress plugins & themes · reported by WPScanCritical 9.8
The AI Content Generator Marketing WordPress plugin through 1.0.0 does not enforce a nonce or capability check on some of its AJAX actions, allowing unauthenticated users to update and delete arbitrary WordPress options, which can be used to gain administrator access to the site.
Product
AI Content Generator Marketing
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update AI Content Generator Marketing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Oct 11, 2026Freeton WP: Does not correctly validate the activation codeCVE-2026-84737 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Freeton WP WordPress plugin through 1.0.0 does not correctly validate the activation code when authenticating a user, allowing unauthenticated attackers to log in as any user whose email address they know, including administrators.
Product
Freeton WP
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Freeton WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Oct 11, 2026click5 CRM add-on to Contact Form 7: Does not sanitise and escape content submitted through an unauthenticated endpoint before outputting it back in an admin pageCVE-2026-84261 · WordPress plugins & themes · reported by WPScanHigh 8.8
The click5 CRM add-on to Contact Form 7 WordPress plugin through 1.0.4 does not sanitise and escape content submitted through an unauthenticated endpoint before outputting it back in an admin page, leading to Stored XSS which could be used against high privilege users such as admin.
Product
click5 CRM add-on to Contact Form 7
Affected
up to 1.0.4
What to do
Affects up to 1.0.4. Update click5 CRM add-on to Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Oct 11, 2026click5 CRM add-on to Contact Form 7: Does not have authorisation and CSRF checksCVE-2026-84254 · WordPress plugins & themes · reported by WPScanCritical 9.8
The click5 CRM add-on to Contact Form 7 WordPress plugin through 1.0.4 does not have authorisation and CSRF checks when updating options via a REST endpoint, and does not ensure that the option to be updated belongs to the click5 CRM add-on to Contact Form 7 WordPress plugin through 1.0.4. As a result, unauthenticated attackers could change arbitrary blog options, allowing them to create a new administrator account and take over the site.
Product
click5 CRM add-on to Contact Form 7
Affected
up to 1.0.4
What to do
Affects up to 1.0.4. Update click5 CRM add-on to Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Oct 11, 2026Tcard WP: Does not sanitise and escape a parameter before using it in a SQL statement in one of its unauthenticated AJAX actionsCVE-2026-81420 · WordPress plugins & themes · reported by WPScanHigh 8.6
The Tcard WP WordPress plugin through 1.8.0 does not sanitise and escape a parameter before using it in a SQL statement in one of its unauthenticated AJAX actions, allowing unauthenticated users to perform SQL injection attacks.
Product
Tcard WP
Affected
up to 1.8.0
What to do
Affects up to 1.8.0. Update Tcard WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Oct 11, 2026WooCommerce Bookings: Does not limit a user-supplied value before using it to allocate memory in one of its unauthenticated AJAX actionsCVE-2026-14854 · WordPress plugins & themes · reported by WPScanHigh 7.5
The WooCommerce Bookings WordPress plugin before 3.11.0 does not limit a user-supplied value before using it to allocate memory in one of its unauthenticated AJAX actions, allowing unauthenticated attackers to exhaust server memory and cause a Denial of Service with a single request.
Product
WooCommerce Bookings
Fixed in
3.11.0
What to do
Update WooCommerce Bookings to 3.11.0 or newer.
Full record and what to do →NVD record wpscan.com
Oct 10, 2026Unauthenticated Sensitive Data Exposure in Contact Form 7 – Dynamic Text Extension <= 5.0.7 versions.CVE-2026-62043 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Sensitive Data Exposure in Contact Form 7 – Dynamic Text Extension <= 5.0.7 versions.
Affected
up to 5.0.7
What to do
Affects up to 5.0.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 10, 2026WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More: Reflected Cross-Site ScriptingCVE-2026-101921 · WordPress plugins & themes · reported by WordfenceMedium 4.7
The WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'attacker-chosen key referenced by the smart tag (e.g. "x")' parameter in all versions up to, and including, 2.0.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Exploitation requires that a site administrator has previously saved a form whose description embeds a {query_var} Smart Tag inside an iframe srcdoc attribute and has enabled Show Description on a public-facing page.
Product
WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More
Affected
up to 2.0.2.1
What to do
Affects up to 2.0.2.1. Update WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 10, 2026SMS Alert: Does not bind the account whose password is being changed to the phone number that was actually verified during its OTP password resetCVE-2026-94257 · WordPress plugins & themes · reported by WPScanHigh 8.1
The SMS Alert WordPress plugin before 4.0.1 does not bind the account whose password is being changed to the phone number that was actually verified during its OTP password reset, allowing unauthenticated attackers to set a new password on an arbitrary account, including an administrator, by verifying a one-time code sent to a phone number they control.
Product
SMS Alert
Fixed in
4.0.1
What to do
Update SMS Alert to 4.0.1 or newer.
Full record and what to do →NVD record wpscan.com
Oct 10, 2026Accept PayPal Payments using Contact Form 7: Does not perform any authorization checks before exporting stored form submissionsCVE-2026-105990 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Accept PayPal Payments using Contact Form 7 WordPress plugin before 4.0.7 does not perform any authorization checks before exporting stored form submissions, allowing unauthenticated attackers to download the personal data (name, email, telephone, postal address, message) and payment metadata of everyone who submitted a payment form.
Product
Accept PayPal Payments using Contact Form 7
Fixed in
4.0.7
What to do
Update Accept PayPal Payments using Contact Form 7 to 4.0.7 or newer.
Full record and what to do →NVD record wpscan.com
Oct 10, 2026Accept PayPal Payments using Contact Form 7: Does not perform any authorization or request-validation checks on one of its AJAX actionsCVE-2026-105989 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Accept PayPal Payments using Contact Form 7 WordPress plugin before 4.0.7 does not perform any authorization or request-validation checks on one of its AJAX actions, allowing unauthenticated attackers to forge the stored transaction status of records and to write the Accept PayPal Payments using Contact Form 7 WordPress plugin before 4.0.7's status metadata onto arbitrary posts.
Product
Accept PayPal Payments using Contact Form 7
Fixed in
4.0.7
What to do
Update Accept PayPal Payments using Contact Form 7 to 4.0.7 or newer.
Full record and what to do →NVD record wpscan.com
Oct 10, 2026Portfolio Filter Gallery: Does not perform proper authorization checks in a set of AJAX actionsCVE-2026-105976 · WordPress plugins & themes · reported by WPScanMedium 4.7
The Portfolio Filter Gallery WordPress plugin before 2.2.1 does not perform proper authorization checks in a set of AJAX actions, allowing users with at least the Contributor role to read, modify and delete other users' galleries as well as site-wide gallery filters.
Product
Portfolio Filter Gallery
Fixed in
2.2.1
What to do
Update Portfolio Filter Gallery to 2.2.1 or newer.
Full record and what to do →NVD record wpscan.com
Oct 10, 2026Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder: Reflected Cross-Site ScriptingCVE-2026-103998 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'inputs (array key)' parameter in all versions up to, and including, 1.15.48 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder
Affected
up to 1.15.48
What to do
Affects up to 1.15.48. Update Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 10, 2026Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder: Reflected Cross-Site ScriptingCVE-2026-101324 · WordPress plugins & themes · reported by WordfenceMedium 4.7
The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'any attacker-chosen name matching the {get.NAME} placeholder (PoC uses 'proof')' parameter in all versions up to, and including, 6.2.14 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Exploitation requires a site administrator to have configured a Custom HTML field on a published form containing a {get.*} SmartCode inside a URL-accepting attribute such as iframe src or a href — a documented Fluent Forms feature.
Product
Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder
Affected
up to 6.2.14
What to do
Affects up to 6.2.14. Update Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 10, 2026Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection): Arbitrary File UploadCVE-2026-94589 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection) plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.4.5 via the extcf7_submit function. This is due to missing file extension, MIME type, and size validation in the signature field's validation_filter(), combined with the absence of PHP-execution guards in the upload directory and a sanitize_file_name() bypass that converts shell.php- into shell.php. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible.
Product
Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection)
Affected
up to 3.4.5
What to do
Affects up to 3.4.5. Update Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 9, 2026Generate PDF using Contact Form 7: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2026-94666 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ZealousWeb Generate PDF using Contact Form 7 generate-pdf-using-contact-form-7 allows Path Traversal.This issue affects Generate PDF using Contact Form 7: from n/a through 4.2.1.
Product
Generate PDF using Contact Form 7
Affected
up to 4.2.1
What to do
Affects up to 4.2.1. Update Generate PDF using Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.