Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,669 results · page 2 of 34
Oct 17, 2026The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin CVE-2026-96660 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Checkbox Field Value in all versions up to, and including, 5.2.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The nopriv AJAX action user_registration_user_form_submit reaches ur_process_registration() without nonce validation, meaning any unauthenticated request can reach the vulnerable code path.
- Affected
- up to 5.2.8
- What to do
- Affects up to 5.2.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 17, 2026The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin CVE-2026-92978 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.2.8 This is due to missing or incorrect nonce validation on the trigger_bulk_action function. This makes it possible for unauthenticated attackers to force administrators to approve pending user registrations or deny arbitrary user accounts, locking targeted users out of the site via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. An attacker can bypass the earlier nonce check in trigger_query_actions() by supplying an empty new_role parameter, which causes that handler to return early and cede control to the unprotected trigger_bulk_action() handler; the exit() call at the end of that handler additionally prevents WordPress core's own bulk-users nonce validation from executing.
- Affected
- up to 5.2.8
- What to do
- Affects up to 5.2.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 17, 2026User Registration & Membership: Arbitrary Shortcode ExecutionCVE-2026-92798 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The User Registration & Membership plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 5.2.8 This is due to insufficient input sanitization in the 'referrer_url' branch of UR_Smart_Tags::process(), where the attacker-controlled HTTP_REFERER header is only passed through sanitize_text_field() — which does not strip WordPress shortcode delimiters — before being substituted into a Content Restriction message that is subsequently executed via apply_shortcodes()/do_shortcode(). This makes it possible for unauthenticated attackers to execute arbitrary registered shortcodes on any restricted page whose message uses the supported {{referrer_url}} smart tag.
- Product
- User Registration & Membership
- Affected
- up to 5.2.8
- What to do
- Affects up to 5.2.8. Update User Registration & Membership to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 16, 2026Fuint through commit 57ec018 contains an insecure direct object reference vulnerability that allows authenticated members to read other members' booking recordsCVE-2026-111705 · Other software · fushengqian · reported by VulnCheckMedium 5.3
Fuint through commit 57ec018 contains an insecure direct object reference vulnerability that allows authenticated members to read other members' booking records by supplying arbitrary bookId values to /clientApi/book/myBookDetail. Attackers can iterate the auto-increment bookId to retrieve contact names, mobile numbers, in-store verification codes, service dates, stores and remarks.
- Product
- fuint
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2026Shaiwz data-platform-open through commit efeacd3 contains an insecure direct object reference vulnerability that allows authenticated workspace members to accesCVE-2026-111695 · Other software · shaiwz · reported by VulnCheckHigh 7.1
Shaiwz data-platform-open through commit efeacd3 contains an insecure direct object reference vulnerability that allows authenticated workspace members to access other workspaces' datasources by numeric id. Attackers can send foreign sequential ids to /datasource/detail, /listSchemaTable, /tableDetail, /update or /delete to obtain JDBC credentials, enumerate database schemas, and modify or delete datasources.
- Product
- data-platform-open
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2026Magistrala through 1.0.0 contains an authorization bypass vulnerability that allows authenticated workspace members to view, issue, and revoke other tenants' deCVE-2026-111684 · Other software · absmach · reported by VulnCheckHigh 7.2
Magistrala through 1.0.0 contains an authorization bypass vulnerability that allows authenticated workspace members to view, issue, and revoke other tenants' device certificates by supplying foreign serials or entity ids. Attackers can call RevokeBySerial, RevokeAll, ViewCert, ListCerts, or IssueCert under their own workspace path to disconnect other tenants' devices, disclose certificates, and mint CA-signed certificates for their device ids.
- Product
- magistrala
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2026waynboot-mall through 2.0.0 contains a missing authentication vulnerability that allows unauthenticated attackers to cancel any member's pending order via the /CVE-2026-111660 · Other software · wayn111 · reported by VulnCheckMedium 6.9
waynboot-mall through 2.0.0 contains a missing authentication vulnerability that allows unauthenticated attackers to cancel any member's pending order via the /callback/order/unpaid endpoint. Attackers can submit predictable orderSn values, built from epoch seconds and a sequential counter, to auto-cancel unpaid orders and manipulate product stock levels.
- Product
- waynboot-mall
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2026DooTask through 1.9.66 contains a missing authorization vulnerability in WebSocketDialog::checkDialog() that skips the membership check for dialogs with group_tCVE-2026-111640 · Other software · kuaifan · reported by VulnCheckMedium 5.3
DooTask through 1.9.66 contains a missing authorization vulnerability in WebSocketDialog::checkDialog() that skips the membership check for dialogs with group_type 'okr'. Authenticated users can supply the dialog_id of OKR comment dialogs to msg__list, msg__one, or msg__send* endpoints to read and inject messages.
- Product
- dootask
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2026SureDash – Community, Courses & Member Dashboard: Stored Cross-Site ScriptingCVE-2026-96870 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The SureDash – Community, Courses & Member Dashboard plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'display_name' parameter in all versions up to, and including, 1.12.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit is triggered when any user hovers over a comment's like counter on a community page, as the plugin's tooltip handler assigns the attacker-controlled data-tooltip-description attribute value directly to innerHTML, re-parsing the browser-decoded entity payload as live HTML.
- Product
- SureDash – Community, Courses & Member Dashboard
- Affected
- up to 1.12.0
- What to do
- Affects up to 1.12.0. Update SureDash – Community, Courses & Member Dashboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 16, 2026The The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder pluCVE-2026-15222 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.2.8. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for authenticated attackers, with subscriber-level access and above, to execute arbitrary shortcodes.
- Affected
- up to 5.2.8
- What to do
- Affects up to 5.2.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Oct 15, 2026Nezha from 1.7.0 before 2.3.15 contains an information disclosure vulnerability that allows authenticated members to enumerate other tenants' server IDs throughCVE-2026-111386 · Other software · nezhahq · reported by VulnCheckMedium 5.3
Nezha from 1.7.0 before 2.3.15 contains an information disclosure vulnerability that allows authenticated members to enumerate other tenants' server IDs through differential responses. Attackers can sweep sequential IDs against getServerConfig and setServerConfig, distinguishing 'permission denied' from success payloads to map other users' servers.
- Product
- nezha
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026ClassroomIO through 1.0.0 contains an incorrect authorization vulnerability in the PUT and DELETE /:lessonId lesson routes that allows any course member, includCVE-2026-111369 · Other software · classroomio · reported by VulnCheckHigh 7.1
ClassroomIO through 1.0.0 contains an incorrect authorization vulnerability in the PUT and DELETE /:lessonId lesson routes that allows any course member, including students, to modify lessons. Authenticated students can supply arbitrary lesson ids to change titles and stored HTML content or delete lessons in their course and in other courses and organizations.
- Product
- ClassroomIO
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026SendPortal sendportal-core through 4.0.1 contains an authorization bypass vulnerability that allows authenticated workspace members to attach subscribers to othCVE-2026-111358 · Other software · mettle · reported by VulnCheckMedium 5.3
SendPortal sendportal-core through 4.0.1 contains an authorization bypass vulnerability that allows authenticated workspace members to attach subscribers to other workspaces' tags by supplying unvalidated tag IDs. Attackers can submit sequential tag IDs via the web subscriber form or CSV import to receive victim campaign content and skew victim reports.
- Product
- sendportal-core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026MacCMS v10 through 2026.1000.4056 does not limit attempts on the six-digit password recovery code, allowing unauthenticated attackers to take over member accounCVE-2026-111356 · Other software · magicblack · reported by VulnCheckCritical 9.1
MacCMS v10 through 2026.1000.4056 does not limit attempts on the six-digit password recovery code, allowing unauthenticated attackers to take over member accounts. Attackers knowing a victim's email or phone can request a code and brute-force findpass_reset to overwrite the member's password.
- Product
- MacCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026crmeb_java through 3.1 contains an authorization bypass vulnerability that allows authenticated members to read other members' orders by supplying their order nCVE-2026-111354 · Other software · crmeb · reported by VulnCheckLow 2.3
crmeb_java through 3.1 contains an authorization bypass vulnerability that allows authenticated members to read other members' orders by supplying their order numbers. Attackers can request /api/front/order/express/{orderId} or /api/front/order/apply/refund/{orderId} to view victims' tracking numbers, logistics traces, payment amounts and product lines.
- Product
- crmeb_java
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026n8n before 1.123.83 contains an authorization bypass vulnerability that allows authenticated members to spoof workflow identity by supplying a trusted identifieCVE-2026-110853 · Other software · n8n-io · reported by VulnCheckHigh 7.1
n8n before 1.123.83 contains an authorization bypass vulnerability that allows authenticated members to spoof workflow identity by supplying a trusted identifier in Execute Sub-workflow inline JSON mode. Attackers can set this identifier to resolve credentials from projects they do not belong to and modify another workflow's static data and error-workflow dispatch.
- Product
- n8n
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 14, 2026Sure 0.7.0 through 0.7.6-alpha.6 contains a missing authorization vulnerability in Transactions::BulkUpdatesController#create that allows family members to bypaCVE-2026-110772 · Other software · we-promise · reported by VulnCheckMedium 5.3
Sure 0.7.0 through 0.7.6-alpha.6 contains a missing authorization vulnerability in Transactions::BulkUpdatesController#create that allows family members to bypass account sharing permissions. Authenticated members with read_only or no share can submit arbitrary entry_ids to modify other members' transaction dates, names, notes, categories, merchants and tags, corrupting budgets and reports.
- Product
- sure
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026youlai-mall through commit 9f62de8 contains a missing authorization vulnerability that allows authenticated members to view every customer's orders via the app CVE-2026-110613 · Other software · youlaitech · reported by VulnCheckHigh 7.1
youlai-mall through commit 9f62de8 contains a missing authorization vulnerability that allows authenticated members to view every customer's orders via the app order list endpoint. Attackers can page through the oms_order table using a self-registered account to read order ids, order_sn values, member ids, payment amounts, and order status.
- Product
- youlai-mall
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026BottleCRM 0.30 through 1.14.5 contains an HTML injection vulnerability in render_invoice_template() that allows authenticated organization members to inject marCVE-2026-110592 · Other software · MicroPyramid · reported by VulnCheckMedium 5.1
BottleCRM 0.30 through 1.14.5 contains an HTML injection vulnerability in render_invoice_template() that allows authenticated organization members to inject markup into custom-template invoice PDFs. Attackers can place HTML and CSS in notes, terms, client name or address fields to overlay totals, payee and payment instructions in PDFs served via download, public links and emails.
- Product
- BottleCRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Membership & User Roles for WooCommerce (Automatic Role Changer): Privilege EscalationCVE-2026-104767 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Membership & User Roles for WooCommerce (Automatic Role Changer) plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 20260828. This is due to the `maybe_add_role_to_user()` function unconditionally re-assigning every role stored in the `dfxwcrc_foreign_roles` user meta cache without verifying that each cached role is still actively assigned by the external provider — a condition made permanent by `remember_foreign_roles()`, which merges new foreign roles into the cache but never evicts roles that have since been revoked. This makes it possible for authenticated attackers with subscriber-level access and above to restore a previously revoked Administrator role to their own account, gaining full administrative control of the site, by triggering any role-assignment event such as completing a purchase for a role-mapped product. Exploitation requires Replace Roles mode to be enabled and the attacker's account to have previously received Administrator legitimately through a separate role-management mechanism while the plugin was active, so that `administrator` was written into the `dfxwcrc_foreign_roles` user meta cache before the external pro
- Product
- Membership & User Roles for WooCommerce (Automatic Role Changer)
- Affected
- up to 20260828
- What to do
- Affects up to 20260828. Update Membership & User Roles for WooCommerce (Automatic Role Changer) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 13, 2026Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability that allows a regular, non-administrative member to create user accounts bCVE-2026-63172 · Other software · Omnispace · reported by VulnCheckHigh 7.1
Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability that allows a regular, non-administrative member to create user accounts by invoking the user-edit action without a function-level authorization check. Attackers can exploit the missing editRight() enforcement in actionVueEditUser to create unauthorized user accounts, leading to privilege escalation.
- Product
- Agora Project
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comagora-project.net
Oct 13, 2026Omnispace Agora Project before 26.10.0 contains a vulnerability where the persistent remember-me token is stored verbatim server-side, making the stored value iCVE-2026-63160 · Other software · Omnispace · reported by VulnCheckCritical 9.1
Omnispace Agora Project before 26.10.0 contains a vulnerability where the persistent remember-me token is stored verbatim server-side, making the stored value identical to the bearer credential held in the user's cookie. Attackers who gain access to the stored token, such as through database or backup disclosure, can replay the plaintext value to authenticate as the victim user without needing their password.
- Product
- Agora Project
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comagora-project.net
Oct 13, 2026Rapyd Admin from 9.0.0 before 9.20.0 contains an authorization bypass vulnerability that allows authenticated company members with the default customer role to CVE-2026-110238 · Other software · zofe · reported by VulnCheckHigh 8.7
Rapyd Admin from 9.0.0 before 9.20.0 contains an authorization bypass vulnerability that allows authenticated company members with the default customer role to modify or delete arbitrary user accounts through the UsersModalEditEmbed Livewire component. Attackers can dispatch editUser or deleteUser with predictable sequential user ids to reset owner or super admin passwords, promote themselves to owner, and delete users.
- Product
- rapyd-admin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Phase Console through 2.77.3 contains a missing authorization vulnerability that allows organisation members without Secrets read permission to read secret histCVE-2026-110210 · Other software · Phase · reported by VulnCheckMedium 6
Phase Console through 2.77.3 contains a missing authorization vulnerability that allows organisation members without Secrets read permission to read secret history via the secretHistory GraphQL query. Attackers holding an environment key can supply a known secret identifier to retrieve encrypted secret events and decrypt values using their wrapped environment key.
- Product
- Phase Console
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026fuint through commit 4c4bc8a contains a missing authentication vulnerability that allows unauthenticated attackers to retrieve any member's order details via thCVE-2026-110128 · Other software · fushengqian · reported by VulnCheckHigh 8.7
fuint through commit 4c4bc8a contains a missing authentication vulnerability that allows unauthenticated attackers to retrieve any member's order details via the /clientApi/order/detail endpoint. Attackers can enumerate sequential orderId values without an Access-Token to expose buyer names, national ID numbers, phone numbers, addresses, WeChat openIds and verification codes.
- Product
- fuint
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026waynboot-mall through 2.0.0 contains an insecure direct object reference vulnerability in the mobile CartController that allows authenticated members to modify CVE-2026-110127 · Other software · wayn111 · reported by VulnCheckMedium 5.3
waynboot-mall through 2.0.0 contains an insecure direct object reference vulnerability in the mobile CartController that allows authenticated members to modify or delete other members' cart items. Attackers can enumerate sequential cart ids via PUT /cart, POST /cart/changeNum, and DELETE /cart/{cartId} to change quantities, selection state, or remove items.
- Product
- waynboot-mall
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026waynboot-mall through 2.0.0 contains an insecure direct object reference vulnerability in AddressController that allows authenticated members to modify or deletCVE-2026-110126 · Other software · wayn111 · reported by VulnCheckMedium 5.3
waynboot-mall through 2.0.0 contains an insecure direct object reference vulnerability in AddressController that allows authenticated members to modify or delete other members' shipping addresses. Attackers can enumerate auto-increment address ids and send POST /address or DELETE /address/{addressId} requests to overwrite or remove victims' saved addresses.
- Product
- waynboot-mall
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Waynboot-mall through 2.0.0 contains an insecure direct object reference vulnerability that allows authenticated members to access and modify other members' ordCVE-2026-110125 · Other software · wayn111 · reported by VulnCheckMedium 5.3
Waynboot-mall through 2.0.0 contains an insecure direct object reference vulnerability that allows authenticated members to access and modify other members' orders by supplying their order identifiers. Attackers can enumerate sequential order ids or serial numbers via detail, cancel, confirm, delete and refund endpoints to read recipient addresses and phone numbers or disrupt orders.
- Product
- waynboot-mall
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Yshopmall through 2.0.0 contains an insecure direct object reference vulnerability in the after-sales API that allows authenticated members to access other membCVE-2026-110120 · Other software · guchengwuyue · reported by VulnCheckMedium 5.3
Yshopmall through 2.0.0 contains an insecure direct object reference vulnerability in the after-sales API that allows authenticated members to access other members' data by supplying their after-sales id and orderCode. Attackers can call deleteAfterSalesOrder, addLogisticsInformation, or GET /applyForAfterSales/{key} to view other members' order items and tamper with or delete their after-sales records.
- Product
- yshopmall
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Yshopmall through 2.0.0 contains an insecure direct object reference vulnerability in the member address API that allows authenticated members to read, overwritCVE-2026-110119 · Other software · guchengwuyue · reported by VulnCheckHigh 7.1
Yshopmall through 2.0.0 contains an insecure direct object reference vulnerability in the member address API that allows authenticated members to read, overwrite and delete other members' shipping addresses. Attackers can enumerate sequential address ids via /address/detail/{id}, /address/del and /address/edit to expose recipient names, phone numbers and addresses, reassign them, or delete them.
- Product
- yshopmall
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026WP-Members: Missing AuthorizationCVE-2026-61994 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in RocketGeek WP-Members wp-members allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP-Members: from n/a through 3.5.7.
- Product
- WP-Members
- Affected
- up to 3.5.7
- What to do
- Affects up to 3.5.7. Update WP-Members to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 11, 2026pH7Builder (pH7 Social Dating CMS) before 18.5.0 contains an information disclosure vulnerability that allows API clients to obtain sensitive member data becausCVE-2026-108904 · Other software · ph7software · reported by VulnCheckHigh 7.1
pH7Builder (pH7 Social Dating CMS) before 18.5.0 contains an information disclosure vulnerability that allows API clients to obtain sensitive member data because UserController::users() and user() return unfiltered database rows. Attackers holding a valid private API key can retrieve bcrypt password hashes, non-expiring hashValidation reset tokens, and TOTP secrets to take over accounts and bypass two-factor authentication.
- Product
- ph7builder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2026Lightdash through 2.556.0 contains an authorization bypass vulnerability that allows authenticated organization members to delete other users' personal access tCVE-2026-108747 · Other software · Lightdash · reported by VulnCheckLow 2.3
Lightdash through 2.556.0 contains an authorization bypass vulnerability that allows authenticated organization members to delete other users' personal access tokens by supplying their UUID. Attackers can send DELETE requests to the personal-access-tokens route with a victim's token UUID, even across organizations, to revoke it and break API integrations.
- Product
- lightdash
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2026CloudBeaver through 25.3.5 contains a missing authorization vulnerability in the initConnection GraphQL mutation that lets view-only shared-project members persCVE-2026-108742 · Other software · DBeaver · reported by VulnCheckMedium 5.3
CloudBeaver through 25.3.5 contains a missing authorization vulnerability in the initConnection GraphQL mutation that lets view-only shared-project members persist credentials without datasource-edit permission. Attackers can set saveCredentials and sharedCredentials flags with chosen authProperties so other users connect to the shared connection under the attacker's database identity.
- Product
- CloudBeaver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2026Raven 2.0.0 through 3.0.0 contains a missing authorization vulnerability in legacy methods in raven/api/raven_message.py that skip the workspace membership checCVE-2026-108730 · Other software · The-Commit-Company · reported by VulnCheckMedium 5.3
Raven 2.0.0 through 3.0.0 contains a missing authorization vulnerability in legacy methods in raven/api/raven_message.py that skip the workspace membership check. Authenticated non-members can call get_messages_with_dates or get_all_files_shared_in_channel with predictable channel IDs to read Public channel history and Open/Public channel file metadata across workspaces.
- Product
- raven
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2026MemberHero: Does not perform any capability or nonce check on one of its AJAX actionsCVE-2026-94235 · WordPress plugins & themes · reported by WPScanMedium 4.3
The MemberHero WordPress plugin through 6.9 does not perform any capability or nonce check on one of its AJAX actions, allowing any authenticated user, such as a subscriber, to make the site send arbitrary HTML emails to arbitrary recipients from its own mail system, which can be abused to relay phishing carrying the site's identity and domain reputation.
- Product
- MemberHero
- Affected
- up to 6.9
- What to do
- Affects up to 6.9. Update MemberHero to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 11, 2026Simple Membership: Does not avoid transmitting a newly registered member's plaintext password in a URL query stringCVE-2026-88785 · WordPress plugins & themes · reported by WPScanMedium 4.7
The Simple Membership WordPress plugin before 4.8.3 does not avoid transmitting a newly registered member's plaintext password in a URL query string when an optional auto-login-after-registration feature is enabled, exposing the credential in browser history and in web server, proxy, and CDN access logs to anyone able to read them.
- Product
- Simple Membership
- Fixed in
- 4.8.3
- What to do
- Update Simple Membership to 4.8.3 or newer.
Oct 10, 2026JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to remove group memberships via the deleteCVE-2026-108638 · Other software · jeecgboot · reported by VulnCheckMedium 5.3
JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to remove group memberships via the deleteGroupUser handler in SysUserController. Attackers can send DELETE requests with arbitrary groupId and userId values to remove any user from any administrator-maintained user group without ownership or tenant checks.
- Product
- JeecgBoot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2026JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to remove user group members by calling DECVE-2026-108637 · Other software · jeecgboot · reported by VulnCheckMedium 5.3
JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to remove user group members by calling DELETE /sys/user/deleteUserGroupBatch. Attackers can supply any groupId and comma-separated userIds to delete sys_ugroup_user rows without permission or tenant checks, tampering with administrator-maintained groups.
- Product
- JeecgBoot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2026Unauthenticated Privilege Escalation in Tonda Membership <= 1.0.1 versions.CVE-2026-62022 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated Privilege Escalation in Tonda Membership <= 1.0.1 versions.
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026WPCOM Member: Authentication BypassCVE-2026-104803 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The WPCOM Member plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.7.27 via the `uuid` and `code` parameters of the social-login callback handler registered on the `init` hook. The vulnerability exists because the `login` function's social-login flow performs no nonce validation, no OAuth state verification, and no per-visitor namespace isolation in the session store, allowing an unauthenticated attacker to issue a crafted GET request that writes an attacker-named, attacker-valued entry into the global session namespace (bypassing the per-visitor prefix by prepending an underscore), then issue a second GET request triggering `weapp_new_user()` to read that forged entry and resolve the attacker-supplied `openid` value to a bound WordPress account before `wp_set_auth_cookie()` establishes a fully authenticated session. This makes it possible for unauthenticated attackers to log in as any WordPress user — including administrators — whose bound social provider identifier (openid/unionid) is known or discoverable. Successful exploitation requires that the target site has at least one social provider configured (which activates the vulner
- Product
- WPCOM Member
- Affected
- up to 1.7.27
- What to do
- Affects up to 1.7.27. Update WPCOM Member to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 10, 2026SureDash – Community, Courses & Member Dashboard: Stored DOM-Based Cross-Site ScriptingCVE-2026-102774 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The SureDash – Community, Courses & Member Dashboard plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via Image 'alt' Attribute in Community Post Content in all versions up to, and including, 1.12.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The entity-encoded payload bypasses server-side wp_kses filtering because kses permits the img/alt tag combination and does not normalize entities inside attribute values; the decode occurs client-side when GLightbox reads the .alt DOM property and assigns the result to innerHTML.
- Product
- SureDash – Community, Courses & Member Dashboard
- Affected
- up to 1.12.1
- What to do
- Affects up to 1.12.1. Update SureDash – Community, Courses & Member Dashboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 10, 2026The User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission plugin for WordPress is vulnCVE-2026-96574 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpuf_payment_method' parameter in all versions up to, and including, 4.3.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The bypass technique involves appending a valid gateway keyword such as 'bank' to the HTML payload, causing sanitize_text_field() to yield only the keyword for routing purposes while the full malicious raw value is stored and later rendered unescaped.
- Affected
- up to 4.3.12
- What to do
- Affects up to 4.3.12. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 10, 2026Simple Membership: Stored Cross-Site ScriptingCVE-2026-103427 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Simple Membership plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'country' parameter in all versions up to, and including, 4.8.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Unauthenticated attackers may also exploit this vulnerability when the plugin's Enable Free Membership feature is turned on, as it permits anonymous front-end registration and profile submission.
- Product
- Simple Membership
- Affected
- up to 4.8.4
- What to do
- Affects up to 4.8.4. Update Simple Membership to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recorddownloads.wordpress.orgplugins.trac.wordpress.org
Oct 10, 2026Team – Team Members Showcase: Stored Cross-Site ScriptingCVE-2026-102402 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Team – Team Members Showcase Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ttp_filter_taxonomy (meta of the attacker-chosen post)' parameter in all versions up to, and including, 6.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Team – Team Members Showcase
- Affected
- up to 6.0.2
- What to do
- Affects up to 6.0.2. Update Team – Team Members Showcase to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 9, 2026Restrict User Access – Membership Plugin with Force: Missing AuthorizationCVE-2026-62040 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in DEV Institute Restrict User Access – Membership Plugin with Force restrict-user-access allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Restrict User Access – Membership Plugin with Force: from n/a through 2.8.1.
- Product
- Restrict User Access – Membership Plugin with Force
- Affected
- up to 2.8.1
- What to do
- Affects up to 2.8.1. Update Restrict User Access – Membership Plugin with Force to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 9, 2026Ultimate Member: Incorrect Privilege AssignmentCVE-2026-96539 · WordPress plugins & themes · reported by PatchstackMedium 5.6
Incorrect Privilege Assignment vulnerability in Ultimate Member Ultimate Member ultimate-member allows Privilege Escalation.This issue affects Ultimate Member: from n/a through 2.13.1.
- Product
- Ultimate Member
- Affected
- up to 2.13.1
- What to do
- Affects up to 2.13.1. Update Ultimate Member to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 9, 2026An authenticated Ops Manager organization member can retrieve another member's pending authenticator enrollment seed through user-listing endpoints while that mCVE-2026-87109 · Other software · MongoDB · reported by cna@mongodb.comMedium 6
An authenticated Ops Manager organization member can retrieve another member's pending authenticator enrollment seed through user-listing endpoints while that member's enrollment is unconfirmed. This results in disclosure of secret authentication material to another member of the same organization or project.
- Product
- Ops Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2026In OpenStack Mistral through 23.0.0, the workflow membership API lets a project that has accepted a share of another project's private workflow create a furtherCVE-2026-93861 · Other software · OpenStack · reported by MITREMedium 6
In OpenStack Mistral through 23.0.0, the workflow membership API lets a project that has accepted a share of another project's private workflow create a further membership naming a third project. The new membership row is created with its project_id defaulted to the accepting project rather than the original workflow owner, and thus the owner can neither see nor delete it. The third project can accept this membership (that it had not actually been granted by the owner), and then read and execute the owner's private workflow; only the accepting (not the owning) project can later revoke that access.
- Product
- Mistral
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlaunchpad.netsecurity.openstack.org
Oct 8, 2026pH7Builder (pH7 Social Dating CMS) before 18.5.1 contains a payment validation vulnerability that allows registered low-privileged members to obtain any membersCVE-2026-107636 · Other software · ph7software · reported by VulnCheckHigh 7.1
pH7Builder (pH7 Social Dating CMS) before 18.5.1 contains a payment validation vulnerability that allows registered low-privileged members to obtain any membership tier by supplying client-controlled plan and amount fields. Attackers can set item_number, cart_order_id, or the PayPal custom field while paying a token amount, or submit uncompleted PayPal IPN payments, to gain the most expensive membership and its paid features.
- Product
- ph7builder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.