Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
13,899 results · page 21 of 278
Oct 10, 2026WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN): Stored Cross-Site ScriptingCVE-2026-96765 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id_token' parameter in all versions up to, and including, 44.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload is stored in the wpo365_errors transient for up to three days by submitting a crafted unauthenticated request with a forged id_token whose base64url-decoded unique_name or iss claim contains malicious HTML, requiring no prior authentication or user interaction beyond an administrator later visiting the WPO365 wizard page.
- Product
- WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN)
- Affected
- up to 44.1
- What to do
- Affects up to 44.1. Update WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 10, 2026Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress: Generic SQL InjectionCVE-2026-96662 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to generic SQL Injection via 'booking[service_id]' Parameter in all versions up to, and including, 5.7.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress
- Affected
- up to 5.7.2
- What to do
- Affects up to 5.7.2. Update Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 10, 2026WP Directory Kit: Time-based SQL InjectionCVE-2026-96653 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The WP Directory Kit plugin for WordPress is vulnerable to time-based SQL Injection via 'display_name' Profile Field (Second-Order) in all versions up to, and including, 1.5.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This is a second-order injection: a Subscriber stores a display_name containing a single quote via their own profile, which WordPress preserves verbatim; the payload is then triggered when WdkCachedUserEditor::update_listings_user_editor() re-reads that stored value and passes it unsanitized to the SQL sink.
- Product
- WP Directory Kit
- Affected
- up to 1.5.9
- What to do
- Affects up to 1.5.9. Update WP Directory Kit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 10, 2026Motors – Car Dealership & Classified Listings: Stored Cross-Site ScriptingCVE-2026-96563 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'stm_f_s' parameter in all versions up to, and including, 1.4.124 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The nonce required by the stm_ajax_add_a_car AJAX handler is emitted in wp_footer on every page, making it accessible to any authenticated user and removing any practical barrier to exploitation at the Subscriber level.
- Product
- Motors – Car Dealership & Classified Listings
- Affected
- up to 1.4.124
- What to do
- Affects up to 1.4.124. Update Motors – Car Dealership & Classified Listings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 10, 2026WP Photo Album Plus: Stored Cross-Site ScriptingCVE-2026-96278 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The WP Photo Album Plus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REQUEST_URI Session History in all versions up to, and including, 9.3.03.002 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The bypass works because esc_url_raw() strips literal angle brackets but retains HTML entities, which wppaEntityDecode() silently converts back to live HTML tags before jQuery('#wppa-modal-container').html() renders them.
- Product
- WP Photo Album Plus
- Affected
- up to 9.3.03.002
- What to do
- Affects up to 9.3.03.002. Update WP Photo Album Plus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 10, 2026Bracketweb Zeinet zeinet: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-93951 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bracketweb Zeinet zeinet allows Reflected XSS.This issue affects Zeinet: from n/a through 1.0.0.
- Product
- Bracketweb Zeinet zeinet
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Bracketweb Zeinet zeinet to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026StylemixThemes Motors motors: Missing AuthorizationCVE-2026-93950 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in StylemixThemes Motors motors allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Motors: from n/a through 1.4.108.
- Product
- StylemixThemes Motors motors
- Affected
- up to 1.4.108
- What to do
- Affects up to 1.4.108. Update StylemixThemes Motors motors to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026Omegathemes Grocery Shopping Store grocery-shopping-store: Authentication Bypass Using an Alternate Path or ChannelCVE-2026-93949 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Authentication Bypass Using an Alternate Path or Channel vulnerability in Omegathemes Grocery Shopping Store grocery-shopping-store allows Password Recovery Exploitation.This issue affects Grocery Shopping Store: from n/a through 1.3.3.
- Product
- Omegathemes Grocery Shopping Store grocery-shopping-store
- Affected
- up to 1.3.3
- What to do
- Affects up to 1.3.3. Update Omegathemes Grocery Shopping Store grocery-shopping-store to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026Axiomthemes Balance balance: Deserialization of Untrusted DataCVE-2026-93945 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in Axiomthemes Balance balance allows Object Injection.This issue affects Balance: from n/a through 1.12.0.
- Product
- Axiomthemes Balance balance
- Affected
- up to 1.12.0
- What to do
- Affects up to 1.12.0. Update Axiomthemes Balance balance to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026ThemeREX Group Camelia camelia: Deserialization of Untrusted DataCVE-2026-93944 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeREX Group Camelia camelia allows Object Injection.This issue affects Camelia: from n/a through 1.2.15.
- Product
- ThemeREX Group Camelia camelia
- Affected
- up to 1.2.15
- What to do
- Affects up to 1.2.15. Update ThemeREX Group Camelia camelia to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026ThemeREX Group Convex convex: Deserialization of Untrusted DataCVE-2026-93943 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeREX Group Convex convex allows Object Injection.This issue affects Convex: from n/a through 1.16.0.
- Product
- ThemeREX Group Convex convex
- Affected
- up to 1.16.0
- What to do
- Affects up to 1.16.0. Update ThemeREX Group Convex convex to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026ThemeREX Group Dwell dwell: Deserialization of Untrusted DataCVE-2026-93942 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeREX Group Dwell dwell allows Object Injection.This issue affects Dwell: from n/a through 1.16.0.
- Product
- ThemeREX Group Dwell dwell
- Affected
- up to 1.16.0
- What to do
- Affects up to 1.16.0. Update ThemeREX Group Dwell dwell to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026ThemeREX Group Edema edema: Deserialization of Untrusted DataCVE-2026-93941 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeREX Group Edema edema allows Object Injection.This issue affects Edema: from n/a through 1.2.2.2.
- Product
- ThemeREX Group Edema edema
- Affected
- up to 1.2.2.2
- What to do
- Affects up to 1.2.2.2. Update ThemeREX Group Edema edema to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026ThemeREX Group Greeny greeny: Deserialization of Untrusted DataCVE-2026-93940 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeREX Group Greeny greeny allows Object Injection.This issue affects Greeny: from n/a through 2.10.0.
- Product
- ThemeREX Group Greeny greeny
- Affected
- up to 2.10.0
- What to do
- Affects up to 2.10.0. Update ThemeREX Group Greeny greeny to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026ThemeREX Group Hogwords hogwords: Deserialization of Untrusted DataCVE-2026-93938 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeREX Group Hogwords hogwords allows Object Injection.This issue affects Hogwords: from n/a through 1.2.7.
- Product
- ThemeREX Group Hogwords hogwords
- Affected
- up to 1.2.7
- What to do
- Affects up to 1.2.7. Update ThemeREX Group Hogwords hogwords to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026ThemeREX Group Hygia hygia: Deserialization of Untrusted DataCVE-2026-93937 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeREX Group Hygia hygia allows Object Injection.This issue affects Hygia: from n/a through 1.21.0.
- Product
- ThemeREX Group Hygia hygia
- Affected
- up to 1.21.0
- What to do
- Affects up to 1.21.0. Update ThemeREX Group Hygia hygia to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026ThemeREX Group IPharm ipharm: Deserialization of Untrusted DataCVE-2026-93936 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeREX Group IPharm ipharm allows Object Injection.This issue affects IPharm: from n/a through 1.2.4.
- Product
- ThemeREX Group IPharm ipharm
- Affected
- up to 1.2.4
- What to do
- Affects up to 1.2.4. Update ThemeREX Group IPharm ipharm to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026ThemeREX Group Let's Play playhockey: Deserialization of Untrusted DataCVE-2026-93935 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeREX Group Let's Play playhockey allows Object Injection.This issue affects Let's Play: from n/a through 1.1.15.
- Product
- ThemeREX Group Let's Play playhockey
- Affected
- up to 1.1.15
- What to do
- Affects up to 1.1.15. Update ThemeREX Group Let's Play playhockey to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026ThemeREX Group Partiso partiso: Deserialization of Untrusted DataCVE-2026-93934 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeREX Group Partiso partiso allows Object Injection.This issue affects Partiso: from n/a through 1.1.13.
- Product
- ThemeREX Group Partiso partiso
- Affected
- up to 1.1.13
- What to do
- Affects up to 1.1.13. Update ThemeREX Group Partiso partiso to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026ThemeREX Group Rosalinda rosalinda: Deserialization of Untrusted DataCVE-2026-93933 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeREX Group Rosalinda rosalinda allows Object Injection.This issue affects Rosalinda: from n/a through 1.2.4.
- Product
- ThemeREX Group Rosalinda rosalinda
- Affected
- up to 1.2.4
- What to do
- Affects up to 1.2.4. Update ThemeREX Group Rosalinda rosalinda to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026ThemeREX Group Smart Casa smart-casa: Deserialization of Untrusted DataCVE-2026-93932 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeREX Group Smart Casa smart-casa allows Object Injection.This issue affects Smart Casa: from n/a through 1.0.12.
- Product
- ThemeREX Group Smart Casa smart-casa
- Affected
- up to 1.0.12
- What to do
- Affects up to 1.0.12. Update ThemeREX Group Smart Casa smart-casa to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026ThemeREX Group Smash smash: Deserialization of Untrusted DataCVE-2026-93931 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeREX Group Smash smash allows Object Injection.This issue affects Smash: from n/a through 1.12.0.
- Product
- ThemeREX Group Smash smash
- Affected
- up to 1.12.0
- What to do
- Affects up to 1.12.0. Update ThemeREX Group Smash smash to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026ThemeREX Group Tantra tantra: Deserialization of Untrusted DataCVE-2026-93930 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeREX Group Tantra tantra allows Object Injection.This issue affects Tantra: from n/a through 2.9.0.
- Product
- ThemeREX Group Tantra tantra
- Affected
- up to 2.9.0
- What to do
- Affects up to 2.9.0. Update ThemeREX Group Tantra tantra to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026ThemeREX Group Travesia travesia: Deserialization of Untrusted DataCVE-2026-93929 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeREX Group Travesia travesia allows Object Injection.This issue affects Travesia: from n/a through 1.1.16.
- Product
- ThemeREX Group Travesia travesia
- Affected
- up to 1.1.16
- What to do
- Affects up to 1.1.16. Update ThemeREX Group Travesia travesia to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026Axiomthemes Veto veto: Deserialization of Untrusted DataCVE-2026-93927 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in Axiomthemes Veto veto allows Object Injection.This issue affects Veto: from n/a through 1.6.0.
- Product
- Axiomthemes Veto veto
- Affected
- up to 1.6.0
- What to do
- Affects up to 1.6.0. Update Axiomthemes Veto veto to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels: Insecure Direct Object ReferenceCVE-2026-93746 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 5.0.2 via the 'email' parameter of the guest print_document_from_the_mail_link handler dispatched from print_window() on init. This is due to the handler authorizing access to an order's printable documents when the attacker-supplied (base64-encoded) 'email' equals the order's billing email — a non-secret identifier — instead of requiring the WooCommerce order_key. This makes it possible for unauthenticated attackers, when the site is configured to allow guest access to documents ('wt_pklist_print_button_access_for' != 'logged_in'), to retrieve any other customer's invoice, packing slip, delivery note, dispatch label or shipping label — including customer name, billing/shipping address, phone number, purchased products, prices, taxes and invoice metadata — by knowing the target order ID and the associated billing email address.
- Product
- WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels
- Affected
- up to 5.0.2
- What to do
- Affects up to 5.0.2. Update WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 10, 2026ThemeREX Group Gutentype gutentype: Deserialization of Untrusted DataCVE-2026-62046 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeREX Group Gutentype gutentype allows Object Injection.This issue affects Gutentype: from n/a through 2.1.12.
- Product
- ThemeREX Group Gutentype gutentype
- Affected
- up to 2.1.12
- What to do
- Affects up to 2.1.12. Update ThemeREX Group Gutentype gutentype to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026ThemeREX Group Booklovers booklovers: Deserialization of Untrusted DataCVE-2026-62045 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeREX Group Booklovers booklovers allows Object Injection.This issue affects Booklovers: from n/a through 2.13.0.
- Product
- ThemeREX Group Booklovers booklovers
- Affected
- up to 2.13.0
- What to do
- Affects up to 2.13.0. Update ThemeREX Group Booklovers booklovers to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026YITH YITH WooCommerce Affiliates yith-woocommerce-affiliates: Deserialization of Untrusted DataCVE-2026-106606 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Deserialization of Untrusted Data vulnerability in YITH YITH WooCommerce Affiliates yith-woocommerce-affiliates allows Object Injection.This issue affects YITH WooCommerce Affiliates: from n/a through 3.31.0.
- Product
- YITH YITH WooCommerce Affiliates yith-woocommerce-affiliates
- Affected
- up to 3.31.0
- What to do
- Affects up to 3.31.0. Update YITH YITH WooCommerce Affiliates yith-woocommerce-affiliates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026WPCOM Member: Authentication BypassCVE-2026-104803 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The WPCOM Member plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.7.27 via the `uuid` and `code` parameters of the social-login callback handler registered on the `init` hook. The vulnerability exists because the `login` function's social-login flow performs no nonce validation, no OAuth state verification, and no per-visitor namespace isolation in the session store, allowing an unauthenticated attacker to issue a crafted GET request that writes an attacker-named, attacker-valued entry into the global session namespace (bypassing the per-visitor prefix by prepending an underscore), then issue a second GET request triggering `weapp_new_user()` to read that forged entry and resolve the attacker-supplied `openid` value to a bound WordPress account before `wp_set_auth_cookie()` establishes a fully authenticated session. This makes it possible for unauthenticated attackers to log in as any WordPress user — including administrators — whose bound social provider identifier (openid/unionid) is known or discoverable. Successful exploitation requires that the target site has at least one social provider configured (which activates the vulner
- Product
- WPCOM Member
- Affected
- up to 1.7.27
- What to do
- Affects up to 1.7.27. Update WPCOM Member to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 10, 2026WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN): Authentication BypassCVE-2026-104759 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) plugin for WordPress is vulnerable to Authentication Bypass via OIDC Nonce Replay in all versions up to, and including, 44.1 This is due to `Id_Token_Service_Deprecated::process_openidconnect_token()` using the incompatible WordPress core `wp_verify_nonce()` function to validate a nonce produced by `Nonce_Service::create_nonce()` — a 64-character hex value that `wp_verify_nonce()` can never successfully verify — causing the nonce check to silently fail without terminating authentication, so execution continues into `authenticate_oidc_user()` with the attacker-supplied `id_token`. This makes it possible for unauthenticated attackers who have obtained a previously-issued, valid `id_token` for a target account to replay that token and authenticate as any WordPress user, including administrators, resulting in full site takeover. This vulnerability is only exploitable when the `use_id_token_parser_v2` plugin option is enabled, as this is the configuration that routes token processing through the deprecated parser containing the broken nonce check.
- Product
- WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN)
- Affected
- up to 44.1
- What to do
- Affects up to 44.1. Update WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 10, 2026AutomatorWP – No-Code Workflow Automation, Integration & Webhooks Plugin, now with AI: Authorization bypassCVE-2026-104728 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The AutomatorWP – No-Code Workflow Automation, Integration & Webhooks Plugin, now with AI plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.8.4. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to enumerate all Fluent Forms records, including form IDs and titles, from the fluentform_forms database table.
- Product
- AutomatorWP – No-Code Workflow Automation, Integration & Webhooks Plugin, now with AI
- Affected
- up to 5.8.4
- What to do
- Affects up to 5.8.4. Update AutomatorWP – No-Code Workflow Automation, Integration & Webhooks Plugin, now with AI to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 10, 2026Premium Packages – Sell Digital Products Securely: Stored Cross-Site ScriptingCVE-2026-103478 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'checkout[billing][phone] (and state / taxid / email)' parameter in all versions up to, and including, 7.2.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Premium Packages – Sell Digital Products Securely
- Affected
- up to 7.2.6
- What to do
- Affects up to 7.2.6. Update Premium Packages – Sell Digital Products Securely to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 10, 2026SureDash – Community, Courses & Member Dashboard: Stored DOM-Based Cross-Site ScriptingCVE-2026-102774 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The SureDash – Community, Courses & Member Dashboard plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via Image 'alt' Attribute in Community Post Content in all versions up to, and including, 1.12.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The entity-encoded payload bypasses server-side wp_kses filtering because kses permits the img/alt tag combination and does not normalize entities inside attribute values; the decode occurs client-side when GLightbox reads the .alt DOM property and assigns the result to innerHTML.
- Product
- SureDash – Community, Courses & Member Dashboard
- Affected
- up to 1.12.1
- What to do
- Affects up to 1.12.1. Update SureDash – Community, Courses & Member Dashboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 10, 2026Kirki – Freeform Page Builder, Website Builder & Customizer: Arbitrary shortcode executionCVE-2026-102291 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 6.3.1 This is due to the plugin substituting a user's `display_name` into the composed page markup unfiltered and then running the whole result through `do_shortcode()` in `TheFrontend::replace_content()`. Because `display_name` is writable by any user on their own account through the core profile form, this makes it possible for authenticated attackers with Subscriber-level access and above to execute arbitrary shortcodes. Where the page is a users collection — an ordinary team or member-directory page — the shortcode runs in the request of every visitor, including unauthenticated ones. Requires a published page with a Kirki element whose dynamic content is bound to the `display_name` user field.
- Product
- Kirki – Freeform Page Builder, Website Builder & Customizer
- Affected
- up to 6.3.1
- What to do
- Affects up to 6.3.1. Update Kirki – Freeform Page Builder, Website Builder & Customizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 10, 2026WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More: Reflected Cross-Site ScriptingCVE-2026-101921 · WordPress plugins & themes · reported by WordfenceMedium 4.7
The WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'attacker-chosen key referenced by the smart tag (e.g. "x")' parameter in all versions up to, and including, 2.0.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Exploitation requires that a site administrator has previously saved a form whose description embeds a {query_var} Smart Tag inside an iframe srcdoc attribute and has enabled Show Description on a public-facing page.
- Product
- WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More
- Affected
- up to 2.0.2.1
- What to do
- Affects up to 2.0.2.1. Update WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 10, 2026Molongui Authorship – Author Boxes, Guest Authors & Co-Authors for WordPress: Stored DOM-Based Cross-Site ScriptingCVE-2026-101920 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Molongui Authorship – Author Boxes, Guest Authors & Co-Authors for WordPress plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'comment (href attribute inside comment content)' parameter in all versions up to, and including, 5.2.12 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable in the free build because the plugin's author-filter rewriter never appends the ?m_bm=true marker to its own anchors (Plugin::has_pro() returns false), meaning every href the byline script selects and rewrites is fully attacker-controlled.
- Product
- Molongui Authorship – Author Boxes, Guest Authors & Co-Authors for WordPress
- Affected
- up to 5.2.12
- What to do
- Affects up to 5.2.12. Update Molongui Authorship – Author Boxes, Guest Authors & Co-Authors for WordPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 10, 2026WPAdverts – Classifieds: Stored Cross-Site ScriptingCVE-2026-100178 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The WPAdverts – Classifieds Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'adverts_location' parameter in all versions up to, and including, 2.3.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- WPAdverts – Classifieds
- Affected
- up to 2.3.4
- What to do
- Affects up to 2.3.4. Update WPAdverts – Classifieds to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 10, 2026FunnelKit – Funnel Builder for WooCommerce Checkout: Stored Cross-Site ScriptingCVE-2026-100147 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The FunnelKit – Funnel Builder for WooCommerce Checkout plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'shipping_first_name' parameter in all versions up to, and including, 3.16.0.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- FunnelKit – Funnel Builder for WooCommerce Checkout
- Affected
- up to 3.16.0.5
- What to do
- Affects up to 3.16.0.5. Update FunnelKit – Funnel Builder for WooCommerce Checkout to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 10, 2026SiteOrigin Widgets Bundle: Directory TraversalCVE-2026-97348 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.74.3 via the get_instance_css function. This makes it possible for authenticated attackers, with contributor-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. The widget's normal update()/sanitize_field_input() pipeline — which would reject non-hex color values — is bypassed entirely because the [siteorigin_widget] shortcode handler calls $the_widget->widget() directly on the attacker-supplied decoded JSON instance.
- Product
- SiteOrigin Widgets Bundle
- Affected
- up to 1.74.3
- What to do
- Affects up to 1.74.3. Update SiteOrigin Widgets Bundle to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026Post Grid Gutenberg Blocks – PostX: Stored Cross-Site ScriptingCVE-2026-96840 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Post Grid Gutenberg Blocks – PostX plugin for WordPress is vulnerable to Stored Cross-Site Scripting via display_name User Field in all versions up to, and including, 5.1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. WordPress core's pre_user_display_name filter encodes &, <, and > but leaves double-quotes intact (ENT_NOQUOTES), allowing a Subscriber-level user to store a double-quote in their display_name via /wp-admin/profile.php that subsequently breaks out of the alt="" attribute at Archive_Title.php:144.
- Product
- Post Grid Gutenberg Blocks – PostX
- Affected
- up to 5.1.0
- What to do
- Affects up to 5.1.0. Update Post Grid Gutenberg Blocks – PostX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 10, 2026User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission: Stored Cross-Site ScriptingCVE-2026-96574 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpuf_payment_method' parameter in all versions up to, and including, 4.3.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The bypass technique involves appending a valid gateway keyword such as 'bank' to the HTML payload, causing sanitize_text_field() to yield only the keyword for routing purposes while the full malicious raw value is stored and later rendered unescaped.
- Product
- User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission
- Affected
- up to 4.3.12
- What to do
- Affects up to 4.3.12. Update User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 10, 2026WP Meteor Website Speed Optimization Addon: Stored Cross-Site ScriptingCVE-2026-96572 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The WP Meteor Website Speed Optimization Addon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Author Name in all versions up to, and including, 3.4.18 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload is delivered via the comment author name field, which must clear WordPress's comment moderation workflow before being displayed, though this represents a display prerequisite rather than any sanitization control.
- Product
- WP Meteor Website Speed Optimization Addon
- Affected
- up to 3.4.18
- What to do
- Affects up to 3.4.18. Update WP Meteor Website Speed Optimization Addon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 10, 2026Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker: Stored DOM-Based Cross-Site ScriptingCVE-2026-96558 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'qsm_hidden_questions' parameter in all versions up to, and including, 11.2.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the attacker to force the mlw_results INSERT to fail by submitting an over-length or duplicate qsm_unique_key value, which triggers the audit trail code branch that writes the unescaped payload to wp_mlw_qm_audit_trail.form_data.
- Product
- Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker
- Affected
- up to 11.2.6
- What to do
- Affects up to 11.2.6. Update Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 10, 2026VikBooking Hotel Booking Engine & PMS: Stored Cross-Site ScriptingCVE-2026-95684 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'attachments[name]' Parameter in all versions up to, and including, 1.8.15 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- VikBooking Hotel Booking Engine & PMS
- Affected
- up to 1.8.15
- What to do
- Affects up to 1.8.15. Update VikBooking Hotel Booking Engine & PMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 10, 2026WP File Download: Authorization bypassCVE-2026-94538 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The WP File Download plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.3.9. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to permanently delete any file managed by WP File Download, empty the entire trash, move files between categories, and publish or unpublish arbitrary files.
- Product
- WP File Download
- Affected
- up to 6.3.9
- What to do
- Affects up to 6.3.9. Update WP File Download to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026Payment Plugins for Stripe WooCommerce: Reflected Cross-Site ScriptingCVE-2026-89100 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Payment Plugins for Stripe WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via '#response' URL Fragment in all versions up to, and including, 4.0.17 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that the 'Generic Errors' setting is unchecked, causing getErrorMessage() to return the raw Stripe error string unchanged rather than substituting a mapped safe message.
- Product
- Payment Plugins for Stripe WooCommerce
- Affected
- up to 4.0.17
- What to do
- Affects up to 4.0.17. Update Payment Plugins for Stripe WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 10, 2026Frontend Admin by DynamiApps: Stored Cross-Site ScriptingCVE-2026-6243 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via kses bypass / mutation XSS in all versions up to, and including, 3.28.36. This is due to the 'get_dynamic_values' function performing text-level find-and-replace operations on post content without HTML-aware parsing. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Frontend Admin by DynamiApps
- Affected
- up to 3.28.36
- What to do
- Affects up to 3.28.36. Update Frontend Admin by DynamiApps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026Favicon Rotator: Reflected Cross-Site ScriptingCVE-2026-5725 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Favicon Rotator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'fvrt_' prefixed request parameters in all versions up to, and including, 1.2.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- Favicon Rotator
- Affected
- up to 1.2.11
- What to do
- Affects up to 1.2.11. Update Favicon Rotator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026CV Builder – Professional Resume Builder SaaS: Unauthorized arbitrary file uploadCVE-2026-3717 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The CV Builder – Professional Resume Builder SaaS plugin for WordPress is vulnerable to unauthorized arbitrary file upload due to a missing capability check on the 'wp_save_signature_image' function in all versions up to, and including, 1.3.1. This makes it possible for unauthenticated attackers to upload arbitrary content to the WordPress uploads directory as png files.
- Product
- CV Builder – Professional Resume Builder SaaS
- Affected
- up to 1.3.1
- What to do
- Affects up to 1.3.1. Update CV Builder – Professional Resume Builder SaaS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. The WordPress, CMS and hosting-panel entries come from the National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan and others); we show who. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, a booking system, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.