Updated 2 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

472new WordPress flaws this week

390,714entries in the database

3,879 results · page 2 of 78

Oct 26, 2026Media LIbrary Assistant: Insertion of Sensitive Information Into Sent DataCVE-2026-115594 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Insertion of Sensitive Information Into Sent Data vulnerability in David Lingren Media LIbrary Assistant media-library-assistant allows Retrieve Embedded Sensitive Data.This issue affects Media LIbrary Assistant: from n/a through 3.42.
Product
Media LIbrary Assistant
Affected
up to 3.42
What to do
Affects up to 3.42. Update Media LIbrary Assistant to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 26, 2026GiveWP: Does not restrict the currency of a donation to the one the site or form acceptsCVE-2026-111974 · WordPress plugins & themes · reported by WPScanMedium 5.3
The GiveWP WordPress plugin before 4.19.0.1 does not restrict the currency of a donation to the one the site or form accepts, while comparing its amount limits as bare numbers, allowing unauthenticated users to make donations below a form's configured minimum or fixed amount.
Product
GiveWP
Fixed in
4.19.0.1
What to do
Update GiveWP to 4.19.0.1 or newer.
Full record and what to do →NVD record wpscan.com
Oct 25, 2026InstaWP Connect: Does not perform a capability check on its InstaWP Connect WordPress plugin before 0CVE-2026-114743 · WordPress plugins & themes · reported by WPScanLow 3.1
The InstaWP Connect WordPress plugin before 0.1.4.2 does not perform a capability check on its InstaWP Connect WordPress plugin before 0.1.4.2-settings update action, verifying only a nonce, allowing an authenticated user holding a low-privileged role that an administrator has granted access to the InstaWP Connect WordPress plugin before 0.1.4.2's sync feature to overwrite the InstaWP Connect WordPress plugin before 0.1.4.2's settings, including the setting controlling which roles may access that feature. The role grant is not enabled by default.
Product
InstaWP Connect
Fixed in
0.1.4.2
What to do
Update InstaWP Connect to 0.1.4.2 or newer.
Full record and what to do →NVD record wpscan.com
Oct 25, 2026WPVR: Does not perform object-level ownership checksCVE-2026-114742 · WordPress plugins & themes · reported by WPScanLow 2.7
The WPVR WordPress plugin before 9.0.3 does not perform object-level ownership checks when updating virtual tours, allowing users with contributor-level access and above to modify, reconfigure and publish tours created by other users.
Product
WPVR
Fixed in
9.0.3
What to do
Update WPVR to 9.0.3 or newer.
Full record and what to do →NVD record wpscan.com
Oct 25, 2026WPVR: Does not perform object-level authorization checksCVE-2026-114741 · WordPress plugins & themes · reported by WPScanLow 3.8
The WPVR WordPress plugin before 9.0.3 does not perform object-level authorization checks when reading and updating virtual tours, allowing users with contributor-level access and above to read and modify tours created by other users.
Product
WPVR
Fixed in
9.0.3
What to do
Update WPVR to 9.0.3 or newer.
Full record and what to do →NVD record wpscan.com
Oct 25, 2026GiveWP: Does not perform a capability checkCVE-2026-111981 · WordPress plugins & themes · reported by WPScanLow 2.7
The GiveWP WordPress plugin before 4.19.0.1 does not perform a capability check when handling donor address changes, allowing users who have been granted donor-report (view) access but not donor-edit access to add, modify, or delete the stored address of any donor on the site.
Product
GiveWP
Fixed in
4.19.0.1
What to do
Update GiveWP to 4.19.0.1 or newer.
Full record and what to do →NVD record wpscan.com
Oct 25, 2026GiveWP: Does not properly sanitise and escape one of its donation form template settings before outputting it inside an HTML attributeCVE-2026-111979 · WordPress plugins & themes · reported by WPScanMedium 6.8
The GiveWP WordPress plugin before 4.19.0.1 does not properly sanitise and escape one of its donation form template settings before outputting it inside an HTML attribute, allowing users with a custom form-editing GiveWP WordPress plugin before 4.19.0.1 role to inject arbitrary web scripts that execute in the browser of any visitor or administrator who opens the affected donation form.
Product
GiveWP
Fixed in
4.19.0.1
What to do
Update GiveWP to 4.19.0.1 or newer.
Full record and what to do →NVD record wpscan.com
Oct 25, 2026GiveWP: Does not perform any status or capability checkCVE-2026-111976 · WordPress plugins & themes · reported by WPScanMedium 5.3
The GiveWP WordPress plugin before 4.19.0.1 does not perform any status or capability check when rendering a donation form on a public front-end route, allowing unauthenticated visitors to view the content and settings of unpublished (draft, pending, private and scheduled) donation forms that WordPress core otherwise keeps non-public.
Product
GiveWP
Fixed in
4.19.0.1
What to do
Update GiveWP to 4.19.0.1 or newer.
Full record and what to do →NVD record wpscan.com
Oct 25, 2026Contact Form by Supsystic: Does not sanitise and escape a form nameCVE-2025-15705 · WordPress plugins & themes · reported by WPScanLow 3.5
The Contact Form by Supsystic WordPress plugin before 1.8.0 does not sanitise and escape a form name, allowing users with access to the form editor to inject arbitrary web scripts that execute when another user views the form. On multisite installations, where administrators do not hold the unfiltered_html capability, this crosses a privilege boundary.
Product
Contact Form by Supsystic
Fixed in
1.8.0
What to do
Update Contact Form by Supsystic to 1.8.0 or newer.
Full record and what to do →NVD record wpscan.com
Oct 24, 2026aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder: Privilege EscalationCVE-2026-110018 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.17.0 via the `/ablocks/v1/form-builder/registration` REST endpoint. The vulnerability exists because the endpoint is registered with `permission_callback => __return_true` and the `register()` handler reads `roleSlug` directly from attacker-controlled block attributes in `post_content` without ever verifying that the block's `formType` is `registration` — a condition that `RegistrationFormSanitizer::verify()` imposes only at save-time, meaning a Contributor can preserve an arbitrary `roleSlug` by saving a block with `formType='login'` and then triggering the endpoint via a valid `wp_rest` nonce and post-ownership check. This makes it possible for authenticated attackers, with Contributor-level access and above, to escalate their WordPress role to Editor or any other non-administrator role and receive a fully authenticated session at the elevated privilege level via `WP_User::set_role()` and `wp_set_auth_cookie()`. Escalation is bounded below administrator-tier roles because `is_safe
Product
aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder
Affected
up to 2.17.0
What to do
Affects up to 2.17.0. Update aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 24, 2026LiteSpeed Cache: Insertion of Sensitive Information Into Sent DataCVE-2026-114190 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Insertion of Sensitive Information Into Sent Data vulnerability in Hai Zheng / Lite Speed Cache LiteSpeed Cache litespeed-cache allows Retrieve Embedded Sensitive Data.This issue affects LiteSpeed Cache: from n/a through 7.9.
Product
LiteSpeed Cache
Affected
up to 7.9
What to do
Affects up to 7.9. Update LiteSpeed Cache to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 24, 2026News Kit Addons For Elementor: Does not perform capability or ownership checks before updating post metadata in one of its authenticated AJAX actionsCVE-2026-97353 · WordPress plugins & themes · reported by WPScanMedium 5.4
The News Kit Addons For Elementor WordPress plugin through 1.4.7 does not perform capability or ownership checks before updating post metadata in one of its authenticated AJAX actions, allowing users with subscriber-level access and above to write arbitrary post meta, under attacker-chosen keys, to any post including those owned by other users. This can be used to overwrite protected core metadata and tamper with content created by higher-privileged users.
Product
News Kit Addons For Elementor
Affected
up to 1.4.7
What to do
Affects up to 1.4.7. Update News Kit Addons For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Oct 24, 2026News Kit Addons For Elementor: Does not perform a capability check on one of its AJAX actionsCVE-2026-97352 · WordPress plugins & themes · reported by WPScanMedium 4.3
The News Kit Addons For Elementor WordPress plugin before 1.4.9 does not perform a capability check on one of its AJAX actions, allowing authenticated users with subscriber-level access and above to install and activate a specific News Kit Addons For Elementor WordPress plugin before 1.4.9 from the WordPress.org repository.
Product
News Kit Addons For Elementor
Fixed in
1.4.9
What to do
Update News Kit Addons For Elementor to 1.4.9 or newer.
Full record and what to do →NVD record wpscan.com
Oct 24, 2026GeoDirectory: Does not perform statusCVE-2026-113492 · WordPress plugins & themes · reported by WPScanMedium 5.3
The GeoDirectory WordPress plugin before 2.8.194 does not perform status, ownership or password checks when loading listings for one of its unauthenticated AJAX handlers, allowing unauthenticated users to disclose the content of non-public (draft, pending and private) listings by supplying their IDs.
Product
GeoDirectory
Fixed in
2.8.194
What to do
Update GeoDirectory to 2.8.194 or newer.
Full record and what to do →NVD record wpscan.com
Oct 24, 2026GeoDirectory: Does not perform any status or ownership checkCVE-2026-113490 · WordPress plugins & themes · reported by WPScanMedium 5.3
The GeoDirectory WordPress plugin before 2.8.194 does not perform any status or ownership check when rendering a listing's map-popup through one of its single-item REST routes, allowing unauthenticated users to read the title, permalink and card fields of non-public (draft, pending, private and trashed) listings by supplying the listing ID.
Product
GeoDirectory
Fixed in
2.8.194
What to do
Update GeoDirectory to 2.8.194 or newer.
Full record and what to do →NVD record wpscan.com
Oct 24, 2026MAS Videos: Does not perform any capability or ownership checkCVE-2026-107907 · WordPress plugins & themes · reported by WPScanMedium 6.5
The MAS Videos WordPress plugin through 1.3.4 does not perform any capability or ownership check when handling its front-end video and playlist deletion requests, and the nonce it verifies is tied only to a static action rather than to the targeted object, allowing any authenticated user with a minimal role to permanently delete arbitrary posts, pages, attachments and other content belonging to other users.
Product
MAS Videos
Affected
up to 1.3.4
What to do
Affects up to 1.3.4. Update MAS Videos to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Oct 24, 2026Advanced Twenty Seventeen: Does not perform any capability or nonce check on the action that creates and activates its bundled childCVE-2026-107887 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Advanced Twenty Seventeen WordPress plugin through 1.3.1 does not perform any capability or nonce check on the action that creates and activates its bundled child , allowing any authenticated user such as a subscriber to switch the site's active site-wide, and allowing the same action to be triggered against any logged-in user including an administrator via CSRF.
Product
Advanced Twenty Seventeen
Affected
up to 1.3.1
What to do
Affects up to 1.3.1. Update Advanced Twenty Seventeen to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Oct 24, 2026Pixel Tag Manager for WooCommerce: Does not perform a capability check in one of its AJAX actionsCVE-2026-105199 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Pixel Tag Manager for WooCommerce WordPress plugin before 2.2.3 does not perform a capability check in one of its AJAX actions, and exposes the nonce protecting it to any user able to access the admin dashboard, allowing users with a role as low as Contributor to overwrite the Pixel Tag Manager for WooCommerce WordPress plugin before 2.2.3's tracking configuration and have arbitrary JavaScript executed in the browsers of all visitors, including administrators.
Product
Pixel Tag Manager for WooCommerce
Fixed in
2.2.3
What to do
Update Pixel Tag Manager for WooCommerce to 2.2.3 or newer.
Full record and what to do →NVD record wpscan.com
Oct 24, 2026User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor: Limited Privilege EscalationCVE-2026-115807 · WordPress plugins & themes · reported by WordfenceHigh 7.1
The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Limited Privilege Escalation in all versions up to, and including, 4.0.3. This is due to the Gutenberg Register block passing the attacker-controlled Assigned Role attribute directly into the `[wppb-register]` shortcode without server-side authorization. The role guard in the form builder only downgrades roles that carry the manage_options or remove_users capability, leaving the Editor role and other privileged non-Administrator roles completely unrestricted. This makes it possible for authenticated attackers with Author-level access and above to create new WordPress accounts bearing the Editor role (or any other role that lacks the two guarded capabilities).
Product
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
Affected
up to 4.0.3
What to do
Affects up to 4.0.3. Update User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 23, 2026Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO: Does not resolve the target of the update-user action in its front-end Forms module consistently between the stage tCVE-2026-94268 · WordPress plugins & themes · reported by WPScanHigh 8.1
The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not resolve the target of the update-user action in its front-end Forms module consistently between the stage that authorises the request and the stage that carries it out, which allows unauthenticated visitors to bypass the guard protecting administrator accounts, take over the site administrator's account and be issued a valid session for it. Exploitation requires the site to publish two separate front-end form configurations whose targets are mapped to visitor-submitted values.
Product
Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO
Fixed in
0.9.2.8
What to do
Update Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO to 0.9.2.8 or newer.
Full record and what to do →NVD record wpscan.com
Oct 23, 2026Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO: Does not perform any capability checkCVE-2026-94267 · WordPress plugins & themes · reported by WPScanCritical 9
The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not perform any capability check when updating a post through one of its front-end form actions, allowing unauthenticated visitors to overwrite arbitrary posts, including the ones in which the site stores its own field definitions, which in turn leads to arbitrary code execution on the server. Exploitation requires the site to publish a form whose post-update action maps both its target and its content to visitor-submitted values.
Product
Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO
Fixed in
0.9.2.8
What to do
Update Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO to 0.9.2.8 or newer.
Full record and what to do →NVD record wpscan.com
Oct 23, 2026Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO: Does not validate or escape some of its form shortcode attributesCVE-2026-94264 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not validate or escape some of its form shortcode attributes, which can be pointed at values taken from the visitor's own request and are then output without escaping, allowing users with a role as low as contributor to have arbitrary script run in the browser of anyone led to open a crafted link or page, including a logged-in administrator. This is an incomplete fix for CVE-2023-5292, whose deny-list covers only the three HTML wrapper attributes.
Product
Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO
Fixed in
0.9.2.8
What to do
Update Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO to 0.9.2.8 or newer.
Full record and what to do →NVD record wpscan.com
Oct 23, 2026LiteSpeed Cache: Does not perform a capability check on its admin-notice dismissal handlerCVE-2026-113501 · WordPress plugins & themes · reported by WPScanLow 3.1
The LiteSpeed Cache WordPress plugin before 7.9.2 does not perform a capability check on its admin-notice dismissal handler, and the nonce it relies on is not bound to the specific notice being dismissed, so on sites in certain configurations a low-privileged authenticated user (Subscriber) can dismiss administrative notices the LiteSpeed Cache WordPress plugin before 7.9.2 marks as non-dismissible, including a warning that sensitive files may be publicly accessible.
Product
LiteSpeed Cache
Fixed in
7.9.2
What to do
Update LiteSpeed Cache to 7.9.2 or newer.
Full record and what to do →NVD record wpscan.com
Oct 23, 2026Popup Builder: Does not perform authorization checks before trashing popup content in a maintenance routine that runs on unauthenticated requestsCVE-2026-112230 · WordPress plugins & themes · reported by WPScanLow 3.7
The Popup Builder WordPress plugin before 4.4.6 does not perform authorization checks before trashing popup content in a maintenance routine that runs on unauthenticated requests, allowing unauthenticated attackers to move affected popups into the Trash and overwrite their stored preview data.
Product
Popup Builder
Fixed in
4.4.6
What to do
Update Popup Builder to 4.4.6 or newer.
Full record and what to do →NVD record wpscan.com
Oct 23, 2026User Profile Builder: Does not verify that a user is authorized to edit the specific account selected on its front-end Edit Profile formCVE-2026-111982 · WordPress plugins & themes · reported by WPScanHigh 7.2
The User Profile Builder WordPress plugin before 4.0.5 does not verify that a user is authorized to edit the specific account selected on its front-end Edit Profile form, allowing an Administrator of a Multisite subsite to change any other user's account email, including a Network Super Admin's, and take over that account through the password-reset flow.
Product
User Profile Builder
Fixed in
4.0.5
What to do
Update User Profile Builder to 4.0.5 or newer.
Full record and what to do →NVD record wpscan.com
Oct 22, 2026ShopMagic: Insertion of Sensitive Information into Externally-Accessible File or DirectoryCVE-2026-114195 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Insertion of Sensitive Information into Externally-Accessible File or Directory vulnerability in WP Desk ShopMagic shopmagic-for-woocommerce allows Retrieve Embedded Sensitive Data.This issue affects ShopMagic: from n/a through 4.9.1.
Product
ShopMagic
Affected
up to 4.9.1
What to do
Affects up to 4.9.1. Update ShopMagic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 22, 2026Contact Form Email: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-112379 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Codepeople Contact Form Email contact-form-to-email allows Stored XSS.This issue affects Contact Form Email: from n/a through 1.3.68.
Product
Contact Form Email
Affected
up to 1.3.68
What to do
Affects up to 1.3.68. Update Contact Form Email to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 22, 2026Metform: Missing AuthorizationCVE-2026-114180 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Wpmet Metform metform allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Metform: from n/a through 4.3.2.
Product
Metform
Affected
up to 4.3.2
What to do
Affects up to 4.3.2. Update Metform to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 22, 2026MB Custom Post Types & Custom Taxonomies: Does not perform a capability check in its export featureCVE-2026-110011 · WordPress plugins & themes · reported by WPScanLow 2.7
The MB Custom Post Types & Custom Taxonomies WordPress plugin before 2.12.3 does not perform a capability check in its export feature, allowing users with a role as low as Contributor to read the configuration of admin-only custom post types and taxonomies, as well as the titles, dates, statuses and some stored content of other users' non-public posts and pages.
Product
MB Custom Post Types & Custom Taxonomies
Fixed in
2.12.3
What to do
Update MB Custom Post Types & Custom Taxonomies to 2.12.3 or newer.
Full record and what to do →NVD record wpscan.com
Oct 22, 2026MB Custom Post Types & Custom Taxonomies: Does not perform any capability or authentication check before allowing an unauthenticated request to re-run a legacy data migrationCVE-2026-110010 · WordPress plugins & themes · reported by WPScanMedium 4.8
The MB Custom Post Types & Custom Taxonomies WordPress plugin before 2.12.3 does not perform any capability or authentication check before allowing an unauthenticated request to re-run a legacy data migration, letting anyone revert a custom post type or taxonomy definition on sites upgraded from a pre-2.0 release back to its pre-upgrade state. This discards configuration changes an administrator made after upgrading and, where those changes had restricted a definition's visibility, silently re-exposes the definition and its content to anonymous visitors.
Product
MB Custom Post Types & Custom Taxonomies
Fixed in
2.12.3
What to do
Update MB Custom Post Types & Custom Taxonomies to 2.12.3 or newer.
Full record and what to do →NVD record wpscan.com
Oct 22, 2026Infility Global: Does not perform any authorisation or nonce check on an AJAX action available to unauthenticated usersCVE-2026-109931 · WordPress plugins & themes · reported by WPScanLow 3.7
The Infility Global WordPress plugin before 2.16.25 does not perform any authorisation or nonce check on an AJAX action available to unauthenticated users, allowing any visitor to overwrite a machine-translation configuration value belonging to a companion Infility Global WordPress plugin before 2.16.25.
Product
Infility Global
Fixed in
2.16.25
What to do
Update Infility Global to 2.16.25 or newer.
Full record and what to do →NVD record wpscan.com
Oct 22, 2026HIPAA Forms: Does not perform a capability checkCVE-2026-109927 · WordPress plugins & themes · reported by WPScanHigh 7.2
The HIPAA Forms WordPress plugin before 3.3.2 does not perform a capability check when handling a request that rebuilds its own custom user role, allowing a user who already holds that role to grant it administrator-level capabilities and escalate their privileges.
Product
HIPAA Forms
Fixed in
3.3.2
What to do
Update HIPAA Forms to 3.3.2 or newer.
Full record and what to do →NVD record wpscan.com
Oct 22, 2026WP Ultimate Review: Does not neutralise shortcodes in all of the review fields submitted through its public review formCVE-2026-103234 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Ultimate Review WordPress plugin before 2.4.5 does not neutralise shortcodes in all of the review fields submitted through its public review form, which is available to unauthenticated visitors, allowing them to execute arbitrary shortcodes when the affected field is displayed, provided user reviews and that field's display are enabled.
Product
WP Ultimate Review
Fixed in
2.4.5
What to do
Update WP Ultimate Review to 2.4.5 or newer.
Full record and what to do →NVD record wpscan.com
Oct 21, 2026weForms: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2026-111833 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Bold Grid weForms weforms allows Path Traversal.This issue affects weForms: from n/a through 1.6.28.
Product
weForms
Affected
up to 1.6.28
What to do
Affects up to 1.6.28. Update weForms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 21, 2026Live Summary for Gravity Forms: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-110884 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in geekontheroad Live Summary for Gravity Forms live-summary-for-gravity-forms allows Reflected XSS.This issue affects Live Summary for Gravity Forms: from n/a through 1.2.10.
Product
Live Summary for Gravity Forms
Affected
up to 1.2.10
What to do
Affects up to 1.2.10. Update Live Summary for Gravity Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 21, 2026Jane Menu: Does not have any capability or nonce checks on one of its form handlersCVE-2026-85683 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Jane Menu WordPress plugin before 1.5.1 does not have any capability or nonce checks on one of its form handlers, which is reachable by unauthenticated users, allowing them to bind any published page to a remote document of their choosing. The plugin then fetches that document and outputs its head and body into the page without escaping, so an unauthenticated attacker can run arbitrary JavaScript in the browser of any visitor to that page, including an administrator.
Product
Jane Menu
Fixed in
1.5.1
What to do
Update Jane Menu to 1.5.1 or newer.
Full record and what to do →NVD record wpscan.com
Oct 21, 2026HappyForms: Does not sanitise or escape a user-controlled referral value before embedding it in the form notification emailCVE-2026-14556 · WordPress plugins & themes · reported by WPScanMedium 5.4
The HappyForms WordPress plugin before 1.26.15 does not sanitise or escape a user-controlled referral value before embedding it in the form notification email, allowing unauthenticated attackers to inject arbitrary HTML into the emails site administrators receive.
Product
HappyForms
Fixed in
1.26.15
What to do
Update HappyForms to 1.26.15 or newer.
Full record and what to do →NVD record wpscan.com
Oct 21, 2026Ninja Forms: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-110899 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kevin Stover Ninja Forms ninja-forms allows Stored XSS.This issue affects Ninja Forms: from n/a through 3.15.5.
Product
Ninja Forms
Affected
up to 3.15.5
What to do
Affects up to 3.15.5. Update Ninja Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 21, 2026Cart Abandonment Recovery for WooCommerce: Does not verify the integrity of its cart-recovery token before acting on it and still accepts an unsigned legacy token formatCVE-2026-96901 · WordPress plugins & themes · reported by WPScanLow 3.7
The Cart Abandonment Recovery for WooCommerce WordPress plugin before 2.2.0 does not verify the integrity of its cart-recovery token before acting on it and still accepts an unsigned legacy token format, allowing unauthenticated attackers who know a victim's cart session identifier to modify that victim's abandoned-cart record, for example unsubscribing them from recovery emails or applying an arbitrary coupon to their restored cart.
Product
Cart Abandonment Recovery for WooCommerce
Fixed in
2.2.0
What to do
Update Cart Abandonment Recovery for WooCommerce to 2.2.0 or newer.
Full record and what to do →NVD record wpscan.com
Oct 21, 2026Click n Chat (Chat Widget Integration): Does not perform any authorization check on a lead-export handlerCVE-2026-92999 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Click n Chat (Chat Widget Integration) WordPress plugin before 1.1.3 does not perform any authorization check on a lead-export handler, allowing unauthenticated users to download every captured contact record (names, email addresses and phone numbers).
Product
Click n Chat (Chat Widget Integration)
Fixed in
1.1.3
What to do
Update Click n Chat (Chat Widget Integration) to 1.1.3 or newer.
Full record and what to do →NVD record wpscan.com
Oct 21, 2026Wava Payment: Does not perform any authorisationCVE-2026-87838 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Wava Payment Plugin WordPress plugin before 0.3.10 does not perform any authorisation, nonce or origin verification on one of its public REST endpoints, allowing unauthenticated attackers to overwrite the stored credential that identifies the merchant account the store's payments are created against, to force the integration into a verified state the site owner never completed, and to remove the payment method from the store's checkout.
Product
Wava Payment
Fixed in
0.3.10
What to do
Update Wava Payment to 0.3.10 or newer.
Full record and what to do →NVD record wpscan.com
Oct 21, 2026Formidable Forms: Does not verify the identity of the caller before recording the timestamp it uses to rate limit payment gateway verification requestsCVE-2026-85642 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Formidable Forms WordPress plugin before 7.0 does not verify the identity of the caller before recording the timestamp it uses to rate limit payment gateway verification requests, allowing unauthenticated attackers to consume the daily allowance and cause legitimate verification attempts to be refused for the next 24 hours.
Product
Formidable Forms
Fixed in
7.0
What to do
Update Formidable Forms to 7.0 or newer.
Full record and what to do →NVD record wpscan.com
Oct 21, 2026Pricing Table: Does not perform authorisation checksCVE-2026-111947 · WordPress plugins & themes · reported by WPScanMedium 5.5
The Pricing Table WordPress Plugin WordPress plugin before 4.1.3 does not perform authorisation checks when duplicating a legacy pricing table, allowing users with the contributor role and above to clone and publish any post or page on the site, including private and draft content belonging to other users.
Product
Pricing Table
Fixed in
4.1.3
What to do
Update Pricing Table to 4.1.3 or newer.
Full record and what to do →NVD record wpscan.com
Oct 21, 2026Redirection for Contact Form 7: Does not sanitise or escape submitted form data storedCVE-2026-111574 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Redirection for Contact Form 7 WordPress plugin before 3.2.12 does not sanitise or escape submitted form data stored as lead entries before outputting it in the lead debug metabox, allowing unauthenticated attackers to store a malicious script that executes when a logged-in user views the entry with the Redirection for Contact Form 7 WordPress plugin before 3.2.12's debug mode enabled.
Product
Redirection for Contact Form 7
Fixed in
3.2.12
What to do
Update Redirection for Contact Form 7 to 3.2.12 or newer.
Full record and what to do →NVD record wpscan.com
Oct 21, 2026Swift Performance Lite: Does not properly sanitize and escape a value before using it in a SQL statementCVE-2026-110651 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Swift Performance Lite WordPress plugin before 2.3.7.4 does not properly sanitize and escape a value before using it in a SQL statement, which could allow users with the author role and above to perform SQL injection attacks.
Product
Swift Performance Lite
Fixed in
2.3.7.4
What to do
Update Swift Performance Lite to 2.3.7.4 or newer.
Full record and what to do →NVD record wpscan.com
Oct 21, 2026Productive Commerce: Does not perform a capability check in one of its AJAX actions and exposes the nonce that guards it on every admin-area pageCVE-2026-109926 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Productive Commerce WordPress plugin before 1.1.49 does not perform a capability check in one of its AJAX actions and exposes the nonce that guards it on every admin-area page, allowing any authenticated user such as a subscriber to activate arbitrary Productive Commerce WordPress plugin before 1.1.49 already installed on the site.
Product
Productive Commerce
Fixed in
1.1.49
What to do
Update Productive Commerce to 1.1.49 or newer.
Full record and what to do →NVD record wpscan.com
Oct 21, 2026SmartyParcel: Does not perform authorisation checksCVE-2026-107789 · WordPress plugins & themes · reported by WPScanMedium 5.3
The SmartyParcel WordPress plugin before 1.23.4 does not perform authorisation checks when serving shipping label downloads, allowing unauthenticated users to obtain the shipping labels of arbitrary orders, which contain customer names, addresses and phone numbers.
Product
SmartyParcel
Fixed in
1.23.4
What to do
Update SmartyParcel to 1.23.4 or newer.
Full record and what to do →NVD record wpscan.com
Oct 21, 2026SmartyParcel: Does not perform authorisation checksCVE-2026-107788 · WordPress plugins & themes · reported by WPScanMedium 4.3
The SmartyParcel WordPress plugin before 1.23.4 does not perform authorisation checks when deleting shipping label records, allowing any authenticated user such as a subscriber to delete the shipping label and tracking records of arbitrary orders store-wide.
Product
SmartyParcel
Fixed in
1.23.4
What to do
Update SmartyParcel to 1.23.4 or newer.
Full record and what to do →NVD record wpscan.com
Oct 21, 2026Backup and Staging by WP Time Capsule: Does not perform capability or nonce checks on the handler that deploys a staging site to the live siteCVE-2026-107237 · WordPress plugins & themes · reported by WPScanHigh 8.2
The Backup and Staging by WP Time Capsule WordPress plugin before 1.22.28 does not perform capability or nonce checks on the handler that deploys a staging site to the live site, allowing any authenticated user with a Subscriber account on a WP Time Capsule staging site to overwrite the separate live site's database and configuration and take it offline.
Product
Backup and Staging by WP Time Capsule
Fixed in
1.22.28
What to do
Update Backup and Staging by WP Time Capsule to 1.22.28 or newer.
Full record and what to do →NVD record wpscan.com
Oct 21, 2026Moloni: Does not perform capability or nonce checks on several of its authenticated AJAX actionsCVE-2026-106932 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Moloni WordPress plugin before 5.0.14 does not perform capability or nonce checks on several of its authenticated AJAX actions, relying only on whether the site holds a stored connection to its external invoicing provider, allowing any authenticated user such as a Subscriber to generate fiscal invoices for arbitrary orders, discard arbitrary orders, and create or modify products and stock.
Product
Moloni
Fixed in
5.0.14
What to do
Update Moloni to 5.0.14 or newer.
Full record and what to do →NVD record wpscan.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.