Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
11,363 results · page 2 of 228
Oct 22, 2026Infility Global: Does not perform any authorisation or nonce check on an AJAX action available to unauthenticated usersCVE-2026-109931 · WordPress plugins & themes · reported by WPScanLow 3.7
The Infility Global WordPress plugin before 2.16.25 does not perform any authorisation or nonce check on an AJAX action available to unauthenticated users, allowing any visitor to overwrite a machine-translation configuration value belonging to a companion Infility Global WordPress plugin before 2.16.25.
- Product
- Infility Global
- Fixed in
- 2.16.25
- What to do
- Update Infility Global to 2.16.25 or newer.
Oct 22, 2026HIPAA Forms: Does not perform a capability checkCVE-2026-109927 · WordPress plugins & themes · reported by WPScanHigh 7.2
The HIPAA Forms WordPress plugin before 3.3.2 does not perform a capability check when handling a request that rebuilds its own custom user role, allowing a user who already holds that role to grant it administrator-level capabilities and escalate their privileges.
- Product
- HIPAA Forms
- Fixed in
- 3.3.2
- What to do
- Update HIPAA Forms to 3.3.2 or newer.
Oct 22, 2026WP Ultimate Review: Does not neutralise shortcodes in all of the review fields submitted through its public review formCVE-2026-103234 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Ultimate Review WordPress plugin before 2.4.5 does not neutralise shortcodes in all of the review fields submitted through its public review form, which is available to unauthenticated visitors, allowing them to execute arbitrary shortcodes when the affected field is displayed, provided user reviews and that field's display are enabled.
- Product
- WP Ultimate Review
- Fixed in
- 2.4.5
- What to do
- Update WP Ultimate Review to 2.4.5 or newer.
Oct 22, 2026FluentCart A New Era of eCommerce: Does not verify that a stored customer address selected during checkout belongs to the requesterCVE-2026-100142 · WordPress plugins & themes · reported by WPScanMedium 5.3
The FluentCart A New Era of eCommerce WordPress plugin before 2.2.0 does not verify that a stored customer address selected during checkout belongs to the requester, allowing unauthenticated attackers to attach any customer's stored address to an order they place and read it back, disclosing customers' postal addresses, phone numbers and company details.
- Product
- FluentCart A New Era of eCommerce
- Fixed in
- 2.2.0
- What to do
- Update FluentCart A New Era of eCommerce to 2.2.0 or newer.
Oct 21, 2026Tailored Media Tailored Tools tailored-tools: Cross-Site Request Forgery (CSRF)CVE-2026-111401 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Cross-Site Request Forgery (CSRF) vulnerability in Tailored Media Tailored Tools tailored-tools allows Cross Site Request Forgery.This issue affects Tailored Tools: from n/a through 3.0.3.
- Product
- Tailored Media Tailored Tools tailored-tools
- Affected
- up to 3.0.3
- What to do
- Affects up to 3.0.3. Update Tailored Media Tailored Tools tailored-tools to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 21, 2026DigitalME eRoom eroom-zoom-meetings-webinar: Missing AuthorizationCVE-2026-114176 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in DigitalME eRoom eroom-zoom-meetings-webinar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects eRoom: from n/a through 1.7.1.
- Product
- DigitalME eRoom eroom-zoom-meetings-webinar
- Affected
- up to 1.7.1
- What to do
- Affects up to 1.7.1. Update DigitalME eRoom eroom-zoom-meetings-webinar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 21, 2026H5P H5P h5p: Authorization Bypass Through User-Controlled KeyCVE-2026-112868 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Authorization Bypass Through User-Controlled Key vulnerability in H5P H5P h5p allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects H5P: from n/a through 1.17.9.
- Product
- H5P H5P h5p
- Affected
- up to 1.17.9
- What to do
- Affects up to 1.17.9. Update H5P H5P h5p to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 21, 2026Brainstorm Force SureCart surecart: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-112221 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force SureCart surecart allows Stored XSS.This issue affects SureCart: from n/a through 4.9.5.
- Product
- Brainstorm Force SureCart surecart
- Affected
- up to 4.9.5
- What to do
- Affects up to 4.9.5. Update Brainstorm Force SureCart surecart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 21, 2026WPdreams Ajax Search Lite ajax-search-lite: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-111852 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPdreams Ajax Search Lite ajax-search-lite allows Blind SQL Injection.This issue affects Ajax Search Lite: from n/a through 4.14.6.
- Product
- WPdreams Ajax Search Lite ajax-search-lite
- Affected
- up to 4.14.6
- What to do
- Affects up to 4.14.6. Update WPdreams Ajax Search Lite ajax-search-lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 21, 2026Dylan Kuhn Geo Mashup geo-mashup: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-111848 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dylan Kuhn Geo Mashup geo-mashup allows Reflected XSS.This issue affects Geo Mashup: from n/a through 1.13.22.
- Product
- Dylan Kuhn Geo Mashup geo-mashup
- Affected
- up to 1.13.22
- What to do
- Affects up to 1.13.22. Update Dylan Kuhn Geo Mashup geo-mashup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 21, 2026VideoWhisper: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-111840 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VideoWhisper.com Paid Videochat Turnkey Site ppv-live-webcams allows Reflected XSS.This issue affects Paid Videochat Turnkey Site: from n/a through 7.5.14.
- Product
- VideoWhisper
- Affected
- up to 7.5.14
- What to do
- Affects up to 7.5.14. Update VideoWhisper to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 21, 2026ThemeHunk ThemeHunk Customizer themehunk-customizer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-111838 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeHunk ThemeHunk Customizer themehunk-customizer allows Reflected XSS.This issue affects ThemeHunk Customizer: from n/a through 2.8.7.
- Product
- ThemeHunk ThemeHunk Customizer themehunk-customizer
- Affected
- up to 2.8.7
- What to do
- Affects up to 2.8.7. Update ThemeHunk ThemeHunk Customizer themehunk-customizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 21, 2026Wasiliy Strecker Contest Gallery contest-gallery: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-111837 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wasiliy Strecker Contest Gallery contest-gallery allows Stored XSS.This issue affects Contest Gallery: from n/a through 34.0.1.
- Product
- Wasiliy Strecker Contest Gallery contest-gallery
- Affected
- up to 34.0.1
- What to do
- Affects up to 34.0.1. Update Wasiliy Strecker Contest Gallery contest-gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 21, 2026bjorntech BjornTech Swish for WooCommerce woo-swish-e-commerce: Missing AuthorizationCVE-2026-111835 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in bjorntech BjornTech Swish for WooCommerce woo-swish-e-commerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BjornTech Swish for WooCommerce: from n/a through 3.7.8.
- Product
- bjorntech BjornTech Swish for WooCommerce woo-swish-e-commerce
- Affected
- up to 3.7.8
- What to do
- Affects up to 3.7.8. Update bjorntech BjornTech Swish for WooCommerce woo-swish-e-commerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 21, 2026Kitae Park Mang Board WP mangboard: Unrestricted Upload of File with Dangerous TypeCVE-2026-111834 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in Kitae Park Mang Board WP mangboard allows Upload a Web Shell to a Web Server.This issue affects Mang Board WP: from n/a through 2.4.4.
- Product
- Kitae Park Mang Board WP mangboard
- Affected
- up to 2.4.4
- What to do
- Affects up to 2.4.4. Update Kitae Park Mang Board WP mangboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 21, 2026Bold Grid weForms weforms: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2026-111833 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Bold Grid weForms weforms allows Path Traversal.This issue affects weForms: from n/a through 1.6.28.
- Product
- Bold Grid weForms weforms
- Affected
- up to 1.6.28
- What to do
- Affects up to 1.6.28. Update Bold Grid weForms weforms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 21, 2026WP Mailster WP Mailster wp-mailster: Unrestricted Upload of File with Dangerous TypeCVE-2026-111832 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in WP Mailster WP Mailster wp-mailster allows Upload a Web Shell to a Web Server.This issue affects WP Mailster: from n/a through 1.9.1.0.
- Product
- WP Mailster WP Mailster wp-mailster
- Affected
- up to 1.9.1.0
- What to do
- Affects up to 1.9.1.0. Update WP Mailster WP Mailster wp-mailster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 21, 2026Magepeople inc: Missing AuthorizationCVE-2026-111849 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Magepeople inc. WpTravelly tour-booking-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WpTravelly: from n/a through 2.3.5.
- Product
- Magepeople inc
- Affected
- up to 2.3.5
- What to do
- Affects up to 2.3.5. Update Magepeople inc to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 21, 2026geekontheroad Live Summary for Gravity Forms live-summary-for-gravity-forms: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-110884 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in geekontheroad Live Summary for Gravity Forms live-summary-for-gravity-forms allows Reflected XSS.This issue affects Live Summary for Gravity Forms: from n/a through 1.2.10.
- Product
- geekontheroad Live Summary for Gravity Forms live-summary-for-gravity-forms
- Affected
- up to 1.2.10
- What to do
- Affects up to 1.2.10. Update geekontheroad Live Summary for Gravity Forms live-summary-for-gravity-forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 21, 2026GS Plugins GS Pins for Pinterest gs-pinterest-portfolio: Deserialization of Untrusted DataCVE-2026-110370 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in GS Plugins GS Pins for Pinterest gs-pinterest-portfolio allows Object Injection.This issue affects GS Pins for Pinterest: from n/a through 1.9.2.
- Product
- GS Plugins GS Pins for Pinterest gs-pinterest-portfolio
- Affected
- up to 1.9.2
- What to do
- Affects up to 1.9.2. Update GS Plugins GS Pins for Pinterest gs-pinterest-portfolio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 21, 2026GS Plugins WordPress Team Members – GS Plugins gs-team-members: Deserialization of Untrusted DataCVE-2026-110369 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in GS Plugins WordPress Team Members – GS Plugins gs-team-members allows Object Injection.This issue affects WordPress Team Members – GS Plugins: from n/a through 2.8.2.
- Product
- GS Plugins WordPress Team Members – GS Plugins gs-team-members
- Affected
- up to 2.8.2
- What to do
- Affects up to 2.8.2. Update GS Plugins WordPress Team Members – GS Plugins gs-team-members to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 21, 2026Jane Menu: Does not have any capability or nonce checks on one of its form handlersCVE-2026-85683 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Jane Menu WordPress plugin before 1.5.1 does not have any capability or nonce checks on one of its form handlers, which is reachable by unauthenticated users, allowing them to bind any published page to a remote document of their choosing. The plugin then fetches that document and outputs its head and body into the page without escaping, so an unauthenticated attacker can run arbitrary JavaScript in the browser of any visitor to that page, including an administrator.
- Product
- Jane Menu
- Fixed in
- 1.5.1
- What to do
- Update Jane Menu to 1.5.1 or newer.
Oct 21, 2026HappyForms: Does not sanitise or escape a user-controlled referral value before embedding it in the form notification emailCVE-2026-14556 · WordPress plugins & themes · reported by WPScanMedium 5.4
The HappyForms WordPress plugin before 1.26.15 does not sanitise or escape a user-controlled referral value before embedding it in the form notification email, allowing unauthenticated attackers to inject arbitrary HTML into the emails site administrators receive.
- Product
- HappyForms
- Fixed in
- 1.26.15
- What to do
- Update HappyForms to 1.26.15 or newer.
Oct 21, 2026Contest Gallery: Does not reliably validate the visitor identity used to enforce its one-vote-per-entry restrictionCVE-2026-107447 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Contest Gallery WordPress plugin before 34.0.1 does not reliably validate the visitor identity used to enforce its one-vote-per-entry restriction, trusting a client-supplied request header and an unbound client-generated token, which allows unauthenticated users to bypass the restriction and cast multiple votes for the same contest entry, inflating its vote total.
- Product
- Contest Gallery
- Fixed in
- 34.0.1
- What to do
- Update Contest Gallery to 34.0.1 or newer.
Oct 21, 2026LatePoint: Does not validate the client-supplied value that determines how much is charged for a booking against the amounts the service and site actually allowCVE-2026-105256 · WordPress plugins & themes · reported by WPScanMedium 5.3
The LatePoint WordPress plugin before 5.7.5 does not validate the client-supplied value that determines how much is charged for a booking against the amounts the service and site actually allow, allowing an unauthenticated visitor to make the amount due resolve to zero and obtain a confirmed appointment and a recorded order without completing any payment.
- Product
- LatePoint
- Fixed in
- 5.7.5
- What to do
- Update LatePoint to 5.7.5 or newer.
Oct 21, 2026Simple Shopping Cart: Does not verify submitted product prices against a value only the site owner can setCVE-2026-104642 · WordPress plugins & themes · reported by WPScanLow 2.7
The Simple Shopping Cart WordPress plugin before 5.3.3 does not verify submitted product prices against a value only the site owner can set, allowing users with the Contributor role and above to register attacker-chosen prices for existing products, which any visitor can then use to add those products to the cart at that price.
- Product
- Simple Shopping Cart
- Fixed in
- 5.3.3
- What to do
- Update Simple Shopping Cart to 5.3.3 or newer.
Oct 21, 2026Simple Shopping Cart: Does not verify that a PayPal payment notification is for a payment received by the site owner's PayPal account in its default configurationCVE-2026-104641 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Simple Shopping Cart WordPress plugin before 5.3.3 does not verify that a PayPal payment notification is for a payment received by the site owner's PayPal account in its default configuration, allowing unauthenticated attackers to have their orders marked as paid using a payment made to an account they control.
- Product
- Simple Shopping Cart
- Fixed in
- 5.3.3
- What to do
- Update Simple Shopping Cart to 5.3.3 or newer.
Oct 21, 2026Payment Gateway for Telcell: Does not verify the authenticity of incoming payment notificationsCVE-2026-103301 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Payment Gateway for Telcell WordPress plugin before 2.0.5 does not verify the authenticity of incoming payment notifications, because the secret used to sign them is empty by default, allowing unauthenticated attackers to forge a valid notification and mark arbitrary WooCommerce orders as paid. The same handler also marks an attacker-chosen order as failed when given an invalid signature.
- Product
- Payment Gateway for Telcell
- Fixed in
- 2.0.5
- What to do
- Update Payment Gateway for Telcell to 2.0.5 or newer.
Oct 21, 2026CMP – Coming Soon & Maintenance: Does not correctly apply maintenance mode to pages added to its page whitelist by manually entered URL patternCVE-2026-101138 · WordPress plugins & themes · reported by WPScanMedium 5.3
The CMP – Coming Soon & Maintenance WordPress plugin before 4.1.21 does not correctly apply maintenance mode to pages added to its page whitelist by manually entered URL pattern, allowing unauthenticated visitors to view the content of those pages while maintenance mode is active.
- Product
- CMP – Coming Soon & Maintenance
- Fixed in
- 4.1.21
- What to do
- Update CMP – Coming Soon & Maintenance to 4.1.21 or newer.
Oct 21, 2026Kevin Stover Ninja Forms ninja-forms: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-110899 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kevin Stover Ninja Forms ninja-forms allows Stored XSS.This issue affects Ninja Forms: from n/a through 3.15.5.
- Product
- Kevin Stover Ninja Forms ninja-forms
- Affected
- up to 3.15.5
- What to do
- Affects up to 3.15.5. Update Kevin Stover Ninja Forms ninja-forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 21, 2026WP Chill Strong Testimonials strong-testimonials: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-107435 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Strong Testimonials strong-testimonials allows Stored XSS.This issue affects Strong Testimonials: from n/a through 3.3.12.
- Product
- WP Chill Strong Testimonials strong-testimonials
- Affected
- up to 3.3.12
- What to do
- Affects up to 3.3.12. Update WP Chill Strong Testimonials strong-testimonials to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 21, 2026Cart Abandonment Recovery for WooCommerce: Does not verify the integrity of its cart-recovery token before acting on it and still accepts an unsigned legacy token formatCVE-2026-96901 · WordPress plugins & themes · reported by WPScanLow 3.7
The Cart Abandonment Recovery for WooCommerce WordPress plugin before 2.2.0 does not verify the integrity of its cart-recovery token before acting on it and still accepts an unsigned legacy token format, allowing unauthenticated attackers who know a victim's cart session identifier to modify that victim's abandoned-cart record, for example unsubscribing them from recovery emails or applying an arbitrary coupon to their restored cart.
- Product
- Cart Abandonment Recovery for WooCommerce
- Fixed in
- 2.2.0
- What to do
- Update Cart Abandonment Recovery for WooCommerce to 2.2.0 or newer.
Oct 21, 2026Click n Chat (Chat Widget Integration): Does not perform any authorization check on a lead-export handlerCVE-2026-92999 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Click n Chat (Chat Widget Integration) WordPress plugin before 1.1.3 does not perform any authorization check on a lead-export handler, allowing unauthenticated users to download every captured contact record (names, email addresses and phone numbers).
- Product
- Click n Chat (Chat Widget Integration)
- Fixed in
- 1.1.3
- What to do
- Update Click n Chat (Chat Widget Integration) to 1.1.3 or newer.
Oct 21, 2026Click n Chat (Chat Widget Integration): Does not sanitise sort parameters before using them in a SQL ORDER BY clauseCVE-2026-92998 · WordPress plugins & themes · reported by WPScanHigh 8.6
The Click n Chat (Chat Widget Integration) WordPress plugin before 1.1.3 does not sanitise sort parameters before using them in a SQL ORDER BY clause, allowing unauthenticated attackers to perform SQL injection attacks.
- Product
- Click n Chat (Chat Widget Integration)
- Fixed in
- 1.1.3
- What to do
- Update Click n Chat (Chat Widget Integration) to 1.1.3 or newer.
Oct 21, 2026Click n Chat (Chat Widget Integration): Does not properly validate a parameter before using itCVE-2026-92997 · WordPress plugins & themes · reported by WPScanHigh 8.6
The Click n Chat (Chat Widget Integration) WordPress plugin before 1.1.3 does not properly validate a parameter before using it as a column identifier in a SQL query, allowing unauthenticated attackers to perform SQL injection attacks.
- Product
- Click n Chat (Chat Widget Integration)
- Fixed in
- 1.1.3
- What to do
- Update Click n Chat (Chat Widget Integration) to 1.1.3 or newer.
Oct 21, 2026Translate WordPress with Weglot 2.0: Does not escape the URLs it re-inserts into a pageCVE-2026-88784 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Translate WordPress with Weglot 2.0 WordPress plugin before 6.4.3 does not escape the URLs it re-inserts into a page when rewriting links for a translated language, and reverses the encoding that was applied to them beforehand, allowing unauthenticated users to store a payload which executes in the browser of anyone viewing the page in a translated language.
- Product
- Translate WordPress with Weglot 2.0
- Fixed in
- 6.4.3
- What to do
- Update Translate WordPress with Weglot 2.0 to 6.4.3 or newer.
Oct 21, 2026Wava Payment: Does not perform any authorisationCVE-2026-87838 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Wava Payment Plugin WordPress plugin before 0.3.10 does not perform any authorisation, nonce or origin verification on one of its public REST endpoints, allowing unauthenticated attackers to overwrite the stored credential that identifies the merchant account the store's payments are created against, to force the integration into a verified state the site owner never completed, and to remove the payment method from the store's checkout.
- Product
- Wava Payment
- Fixed in
- 0.3.10
- What to do
- Update Wava Payment to 0.3.10 or newer.
Oct 21, 2026Wava Payment: Does not verify the authenticity of incoming payment-provider notificationsCVE-2026-87837 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Wava Payment Plugin WordPress plugin before 0.3.10 does not verify the authenticity of incoming payment-provider notifications, nor restrict who may send them, allowing unauthenticated attackers to change the status of any WooCommerce order in the store, including marking an unpaid order as paid and completed, and cancelling other customers' orders. In versions up to 0.3.7 the response additionally returns the affected order's billing details, disclosing customer names, addresses, email addresses and phone numbers to the same unauthenticated caller.
- Product
- Wava Payment
- Fixed in
- 0.3.10
- What to do
- Update Wava Payment to 0.3.10 or newer.
Oct 21, 2026Download Manager WordPress plugin before 3.3.71, Download Manager: Does not have CSRF checks in some placesCVE-2026-86611 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Download Manager WordPress plugin before 3.3.71, Download Manager WordPress plugin before 7.5.9 does not have CSRF checks in some places, allowing attackers to make a logged in admin update its privacy and storage settings via a crafted link, including the credential that gates its unauthenticated maintenance endpoint.
- Product
- Download Manager WordPress plugin before 3.3.71, Download Manager
- Fixed in
- 3.3.71
- What to do
- Update Download Manager WordPress plugin before 3.3.71, Download Manager to 3.3.71 or newer.
Oct 21, 2026Formidable Forms: Does not verify the identity of the caller before recording the timestamp it uses to rate limit payment gateway verification requestsCVE-2026-85642 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Formidable Forms WordPress plugin before 7.0 does not verify the identity of the caller before recording the timestamp it uses to rate limit payment gateway verification requests, allowing unauthenticated attackers to consume the daily allowance and cause legitimate verification attempts to be refused for the next 24 hours.
- Product
- Formidable Forms
- Fixed in
- 7.0
- What to do
- Update Formidable Forms to 7.0 or newer.
Oct 21, 2026Elementor Website Builder: Does not sanitize the text content of SVG filesCVE-2026-81813 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Elementor Website Builder WordPress plugin before 4.3.5 does not sanitize the text content of SVG files, checking only their elements and attributes, allowing users with the Contributor role and above to store a payload which breaks out when the SVG is rendered inline in a page and executes in the browser of any user viewing it. Execution is specific to Chromium-based browsers; Firefox is not affected.
- Product
- Elementor Website Builder
- Fixed in
- 4.3.5
- What to do
- Update Elementor Website Builder to 4.3.5 or newer.
Oct 21, 2026Elementor Website Builder: Does not sanitize uploaded SVG files on every upload routeCVE-2026-81812 · WordPress plugins & themes · reported by WPScanMedium 6.4
The Elementor Website Builder WordPress plugin before 4.3.5 does not sanitize uploaded SVG files on every upload route, allowing users with the Author role and above to upload a file containing JavaScript, which will run in the browser of any user who opens it. Exploitation requires unfiltered file uploads to be enabled in the Elementor Website Builder WordPress plugin before 4.3.5 settings, which is not the default.
- Product
- Elementor Website Builder
- Fixed in
- 4.3.5
- What to do
- Update Elementor Website Builder to 4.3.5 or newer.
Oct 21, 2026Advanced File Manager: Does not correctly determine whether a stored file is an SVG before sanitising itCVE-2026-79627 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Advanced File Manager WordPress plugin before 6.0.0 does not correctly determine whether a stored file is an SVG before sanitising it, allowing users granted file-manager access by an administrator to store a file containing script that is not stripped and that runs in the browser of anyone who opens it, including an administrator.
- Product
- Advanced File Manager
- Fixed in
- 6.0.0
- What to do
- Update Advanced File Manager to 6.0.0 or newer.
Oct 21, 2026TI WooCommerce Wishlist: Does not enforce the same owner-only access control on its REST API that it applies on the front-endCVE-2026-15261 · WordPress plugins & themes · reported by WPScanMedium 5.3
The TI WooCommerce Wishlist WordPress plugin before 2.13.0 does not enforce the same owner-only access control on its REST API that it applies on the front-end, allowing unauthenticated users to read the metadata and item contents of private wishlists.
- Product
- TI WooCommerce Wishlist
- Fixed in
- 2.13.0
- What to do
- Update TI WooCommerce Wishlist to 2.13.0 or newer.
Oct 21, 2026SUMIT Payment Gateway for WooCommerce: Does not bind the payment it confirms with the provider to the order being completedCVE-2026-111957 · WordPress plugins & themes · reported by WPScanMedium 5.3
The SUMIT Payment Gateway for WooCommerce WordPress plugin before 4.0.0 does not bind the payment it confirms with the provider to the order being completed, nor check the payment amount against the order total, allowing unauthenticated users to mark a pending order as paid by replaying a payment identifier obtained from any single genuine payment.
- Product
- SUMIT Payment Gateway for WooCommerce
- Fixed in
- 4.0.0
- What to do
- Update SUMIT Payment Gateway for WooCommerce to 4.0.0 or newer.
Oct 21, 2026WholesaleX: Does not protect or remove the user-import file it keeps in a publicly accessible location under a predictable nameCVE-2026-111956 · WordPress plugins & themes · reported by WPScanMedium 5.9
The WholesaleX WordPress plugin before 3.0.9 does not protect or remove the user-import file it keeps in a publicly accessible location under a predictable name, allowing unauthenticated users to download the most recently imported user data, including any account passwords and customer contact and address details it contains.
- Product
- WholesaleX
- Fixed in
- 3.0.9
- What to do
- Update WholesaleX to 3.0.9 or newer.
Oct 21, 2026WholesaleX: Does not check that a stored account confirmation code is set before comparing it with the one supplied in a requestCVE-2026-111955 · WordPress plugins & themes · reported by WPScanMedium 6.5
The WholesaleX WordPress plugin before 3.0.9 does not check that a stored account confirmation code is set before comparing it with the one supplied in a request, allowing unauthenticated users to activate pending accounts and bypass the administrator approval required before login.
- Product
- WholesaleX
- Fixed in
- 3.0.9
- What to do
- Update WholesaleX to 3.0.9 or newer.
Oct 21, 2026miniOrange 2FA: Does not prevent a pending passkey login from registering an additional passkey on an account that already has one configuredCVE-2026-111949 · WordPress plugins & themes · reported by WPScanHigh 7.5
The miniOrange 2FA WordPress plugin before 6.3.1 does not prevent a pending passkey login from registering an additional passkey on an account that already has one configured, allowing an attacker who knows a user's password to add their own authenticator and bypass the second factor.
- Product
- miniOrange 2FA
- Fixed in
- 6.3.1
- What to do
- Update miniOrange 2FA to 6.3.1 or newer.
Oct 21, 2026User Profile Builder: Does not escape the current page URL before outputting it in a JavaScript context on one of its admin pagesCVE-2026-111948 · WordPress plugins & themes · reported by WPScanHigh 7.1
The User Profile Builder WordPress plugin before 4.0.1 does not escape the current page URL before outputting it in a JavaScript context on one of its admin pages, leading to Reflected Cross-Site Scripting against high-privilege users.
- Product
- User Profile Builder
- Fixed in
- 4.0.1
- What to do
- Update User Profile Builder to 4.0.1 or newer.
Oct 21, 2026Pricing Table: Does not perform authorisation checksCVE-2026-111947 · WordPress plugins & themes · reported by WPScanMedium 5.5
The Pricing Table WordPress Plugin WordPress plugin before 4.1.3 does not perform authorisation checks when duplicating a legacy pricing table, allowing users with the contributor role and above to clone and publish any post or page on the site, including private and draft content belonging to other users.
- Product
- Pricing Table
- Fixed in
- 4.1.3
- What to do
- Update Pricing Table to 4.1.3 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. The WordPress, CMS and hosting-panel entries come from the National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan and others); we show who. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, a booking system, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.