Updated 3 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,769exploited flaws on CISA’s list

30added in the last 30 days

456new WordPress flaws this week

394,547entries in the database

19,369 results · page 22 of 388

Sep 24, 2026WPeMatico RSS Feed Fetcher: Does not sanitise and escape one of its campaign configuration fieldsCVE-2026-89005 · WordPress plugins & themes · reported by WPScanMedium 6.8
The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.26 does not sanitise and escape one of its campaign configuration fields when a certain feature is enabled, which allows users with the Contributor role and above to perform Stored Cross-Site Scripting attacks that execute in the session of any higher-privileged user who later views the campaign.
Product
WPeMatico RSS Feed Fetcher
Fixed in
2.8.26
What to do
Update WPeMatico RSS Feed Fetcher to 2.8.26 or newer.
Full record and what to do →NVD record wpscan.com
Sep 24, 2026WPeMatico RSS Feed Fetcher: Does not verify ownership or authorization before returning a campaign's stored configuration and run logCVE-2026-89004 · WordPress plugins & themes · reported by WPScanLow 2.7
The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.26 does not verify ownership or authorization before returning a campaign's stored configuration and run log, allowing users with contributor-level access and above to read the configuration and execution logs of campaigns created by other users, including administrators.
Product
WPeMatico RSS Feed Fetcher
Fixed in
2.8.26
What to do
Update WPeMatico RSS Feed Fetcher to 2.8.26 or newer.
Full record and what to do →NVD record wpscan.com
Sep 24, 2026WPeMatico RSS Feed Fetcher: Does not sanitize and escape content it retrieves from a user-supplied source before rendering itCVE-2026-89002 · WordPress plugins & themes · reported by WPScanMedium 6.8
The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.26 does not sanitize and escape content it retrieves from a user-supplied source before rendering it, which could allow users such as contributors to perform Stored Cross-Site Scripting attacks against higher-privileged users who review the campaign.
Product
WPeMatico RSS Feed Fetcher
Fixed in
2.8.26
What to do
Update WPeMatico RSS Feed Fetcher to 2.8.26 or newer.
Full record and what to do →NVD record wpscan.com
Sep 24, 2026MasterStudy LMS: Does not verify that a user is enrolled in a course before recording lesson completions against itCVE-2026-88847 · WordPress plugins & themes · reported by WPScanMedium 4.3
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not verify that a user is enrolled in a course before recording lesson completions against it, allowing any authenticated user, such as a subscriber, to create course progress records for courses they have no access to.
Product
MasterStudy LMS
Fixed in
3.7.50
What to do
Update MasterStudy LMS to 3.7.50 or newer.
Full record and what to do →NVD record wpscan.com
Sep 24, 2026MasterStudy LMS: Does not check whether user registration is enabled on the site before creating an account through one of its front-end registration flowsCVE-2026-88846 · WordPress plugins & themes · reported by WPScanMedium 5.3
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not check whether user registration is enabled on the site before creating an account through one of its front-end registration flows, allowing unauthenticated users to create accounts, and be logged into them, on sites where registration has been deliberately disabled.
Product
MasterStudy LMS
Fixed in
3.7.50
What to do
Update MasterStudy LMS to 3.7.50 or newer.
Full record and what to do →NVD record wpscan.com
Sep 24, 2026MasterStudy LMS: Does not perform any capability or nonce checks on an administrative maintenance actionCVE-2026-88845 · WordPress plugins & themes · reported by WPScanMedium 4.3
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not perform any capability or nonce checks on an administrative maintenance action, allowing any authenticated user, such as a subscriber, to trigger it and create published content on the site attributed to their own account.
Product
MasterStudy LMS
Fixed in
3.7.50
What to do
Update MasterStudy LMS to 3.7.50 or newer.
Full record and what to do →NVD record wpscan.com
Sep 24, 2026MasterStudy LMS: Does not validate one of its display-style settings before using it to build a template pathCVE-2026-88843 · WordPress plugins & themes · reported by WPScanHigh 7.2
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not validate one of its display-style settings before using it to build a template path, allowing users with the Contributor role and above to include and execute arbitrary local PHP files on the server. An equivalent path was corrected in an earlier release and this one was not, so the issue persists in versions the earlier advisory reports as fixed.
Product
MasterStudy LMS
Fixed in
3.7.50
What to do
Update MasterStudy LMS to 3.7.50 or newer.
Full record and what to do →NVD record wpscan.com
Sep 24, 2026Post Grid: Does not limit an expansion of the WordPress allowed-HTML list to its own markup and applies it site-wideCVE-2026-84151 · WordPress plugins & themes · reported by WPScanLow 3.5
The Post Grid WordPress plugin before 7.9.5 does not limit an expansion of the WordPress allowed-HTML list to its own markup and applies it site-wide, allowing users with the Contributor role and above to store iframe, style and input elements that are normally stripped from their content, leading to HTML injection (phishing frames, CSS defacement and spoofed input forms) that renders to any visitor and to administrators reviewing the content.
Product
Post Grid
Fixed in
7.9.5
What to do
Update Post Grid to 7.9.5 or newer.
Full record and what to do →NVD record wpscan.com
Sep 24, 2026Masteriyo LMS: Does not restrict access to quiz answer keysCVE-2026-82850 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Masteriyo LMS WordPress plugin before 3.4.2 does not restrict access to quiz answer keys, allowing any authenticated user, such as a student, to retrieve the correct answers for any quiz on the site, including quizzes in courses they are not enrolled in. The redaction that hides them is applied only to a fixed list of question types, so the answers to every other type are returned in full to anyone able to view the questions.
Product
Masteriyo LMS
Fixed in
3.4.2
What to do
Update Masteriyo LMS to 3.4.2 or newer.
Full record and what to do →NVD record wpscan.com
Sep 24, 2026Masteriyo LMS: Does not verify that the user making the request owns the course-progress records being returnedCVE-2026-82849 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Masteriyo LMS WordPress plugin before 3.4.2 does not verify that the user making the request owns the course-progress records being returned, allowing any authenticated user, such as a self-registered subscriber, to read another user's learning activity. The ownership check it applies is skipped whenever the requested account is not named with a non-zero value, in which case the records of every learner on the site are returned at once.
Product
Masteriyo LMS
Fixed in
3.4.2
What to do
Update Masteriyo LMS to 3.4.2 or newer.
Full record and what to do →NVD record wpscan.com
Sep 24, 202610Web Booster: Does not restrict access to the routineCVE-2026-82195 · WordPress plugins & themes · reported by WPScanMedium 6.5
The 10Web Booster WordPress plugin before 2.34.0 does not restrict access to the routine which issues the shared secret that authenticates its cloud connection, disclosing that secret to unauthenticated visitors and letting them delete it repeatedly, preventing an administrator from completing a legitimate connection.
Product
10Web Booster
Fixed in
2.34.0
What to do
Update 10Web Booster to 2.34.0 or newer.
Full record and what to do →NVD record wpscan.com
Sep 24, 2026wpForo Forum: Does not restrictCVE-2026-80513 · WordPress plugins & themes · reported by WPScanHigh 7.5
The wpForo Forum WordPress plugin before 3.1.6 does not restrict which classes may be instantiated when it deserializes a user-supplied profile field value, allowing authenticated users with Subscriber-level access and above to inject a PHP Object. No POP chain is present in the wpForo Forum WordPress plugin before 3.1.6 itself; if one is present via another installed wpForo Forum WordPress plugin before 3.1.6 or , this could lead to remote code execution, arbitrary file operations, or SQL injection. This is an incomplete fix of CVE-2026-49769.
Product
wpForo Forum
Fixed in
3.1.6
What to do
Update wpForo Forum to 3.1.6 or newer.
Full record and what to do →NVD record wpscan.com
Sep 24, 2026CMB2: Does not perform any capability check on one of its AJAX actionsCVE-2026-80338 · WordPress plugins & themes · reported by WPScanMedium 6.8
The CMB2 WordPress plugin before 2.13.0 does not perform any capability check on one of its AJAX actions, allowing users with a role as low as Subscriber to create arbitrary WordPress options and corrupt existing ones, which can break core site settings and take the site offline. Exploitation requires the site's or another CMB2 WordPress plugin before 2.13.0 to have declared an oEmbed field, as the CMB2 WordPress plugin before 2.13.0 registers none of its own. The stored value is never attacker-controlled, so the issue does not lead to privilege escalation.
Product
CMB2
Fixed in
2.13.0
What to do
Update CMB2 to 2.13.0 or newer.
Full record and what to do →NVD record wpscan.com
Sep 24, 2026WPForms: Does not verify that a Stripe payment object supplied during a public form submission belongs to it before acting on itCVE-2026-74991 · WordPress plugins & themes · reported by WPScanMedium 6.8
The WPForms WordPress plugin before 2.0.2 does not verify that a Stripe payment object supplied during a public form submission belongs to it before acting on it, allowing unauthenticated users to trigger a full refund and an immediate subscription cancellation against payments created by other applications on the site owner's Stripe account.
Product
WPForms
Fixed in
2.0.2
What to do
Update WPForms to 2.0.2 or newer.
Full record and what to do →NVD record wpscan.com
Sep 24, 2026Fabasoft Folio Client before 2026, a locally installed component that communicates with the Fabasoft browser extension via web messaging, does not restrict whicCVE-2026-97155 · Other software · Fabasoft · reported by MITREMedium 6.5
Fabasoft Folio Client before 2026, a locally installed component that communicates with the Fabasoft browser extension via web messaging, does not restrict which web origins may invoke its functions by default. The registry value VALIDDOMAINS, which limits permitted origins, was optional and empty by default, resulting in all domains being trusted. As a consequence, any website visited by a user with the Folio Client and browser extension installed could invoke client functions, e.g., related to downloading documents, opening documents, and synchronizing files. The first fixed builds are Fabasoft Folio Client 2026 (Build 26.0.0.10) and Fabasoft Folio Client 2026 April Release (Build 26.4.0.76). This client is, for example, shipped with Fabasoft eGov-Suite.
Product
Folio Client
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record help.supportservices.fabasoft.com
Sep 23, 2026In OpenStack Swift before 2.38.2, the tempurl middleware does not reject the X-Copy-From header on PUT requests.CVE-2026-97149 · Other software · OpenStack · reported by MITREMedium 5.3
In OpenStack Swift before 2.38.2, the tempurl middleware does not reject the X-Copy-From header on PUT requests. A TempURL signature only covers the method, expiry, and path, and thus the list of disallowed headers is the only defense against a signed PUT request changing what the request does. An attacker holding a PUT TempURL for a single object can add an X-Copy-From header naming any object in the same account; the copy middleware copies that object to the destination, and the attacker then reads the victim's data back with a GET TempURL for the destination object. Copies across account boundaries are rejected. Only deployments using the shipped default proxy pipeline (tempurl and copy middleware) with account-level TempURL keys are affected.
Product
Swift
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record launchpad.net openwall.com
Sep 23, 2026Arc Search for Android before version 1.12.10 does not display a fullscreen notification when a page enters fullscreen mode while the app is running in the backCVE-2026-94183 · Other software · The Browser Company of New York · reported by 59469e6c-7ea7-446f-8e43-06aa32c115e8High 7.4
Arc Search for Android before version 1.12.10 does not display a fullscreen notification when a page enters fullscreen mode while the app is running in the background. A remote attacker can exploit this via a specially crafted website to render fake UI elements, such as a spoofed address bar, misleading the user about the origin of displayed content and increasing the risk of phishing.
Product
Arc Search
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record arc.net hackerone.com
Sep 23, 2026Robur Albatross 1.0.0 through 2.x before 2.7.2 does not limit use of the ring buffer, leading to an albatross-console loop with no recognized termination conditCVE-2026-96609 · Other software · Robur · reported by MITREHigh 7.1
Robur Albatross 1.0.0 through 2.x before 2.7.2 does not limit use of the ring buffer, leading to an albatross-console loop with no recognized termination condition. This is only exploitable by users who can send console subscription commands to unikernels that produce sufficient log output to fill the ring buffer (1024 lines). It is not exploitable by unauthorized clients.
Product
Albatross
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com osv.dev
Sep 23, 2026SUMIT Payment Gateway for WooCommerce: Does not verify with the payment provider that a payment notification is genuine before marking the corresponding orderCVE-2026-84091 · WordPress plugins & themes · reported by WPScanMedium 5.3
The SUMIT Payment Gateway for WooCommerce WordPress plugin before 4.0.0 does not verify with the payment provider that a payment notification is genuine before marking the corresponding order as paid, allowing unauthenticated users to mark a pending order paid without completing payment.
Product
SUMIT Payment Gateway for WooCommerce
Fixed in
4.0.0
What to do
Update SUMIT Payment Gateway for WooCommerce to 4.0.0 or newer.
Full record and what to do →NVD record wpscan.com
Sep 23, 2026CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in Apache Tomcat.CVE-2026-86248 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.8
CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M14 through 11.0.25, from 10.1.22 through 10.1.59, from 9.0.92 through 9.0.121. Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.
Product
Apache Tomcat
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apache.org
Sep 23, 2026Paid Membership Subscriptions: Does not verify the reCAPTCHA on its registration handlerCVE-2026-90950 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Paid Membership Subscriptions WordPress plugin before 3.1.0 does not verify the reCAPTCHA on its registration handler when a form field is absent from the request, allowing unauthenticated users to create accounts without solving the reCAPTCHA the site has enabled.
Product
Paid Membership Subscriptions
Fixed in
3.1.0
What to do
Update Paid Membership Subscriptions to 3.1.0 or newer.
Full record and what to do →NVD record wpscan.com
Sep 23, 2026Paymob for WooCommerce: Does not verify the request signature on one branch of its payment webhookCVE-2026-87978 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Paymob for WooCommerce WordPress plugin before 4.1.14 does not verify the request signature on one branch of its payment webhook, allowing unauthenticated attackers to mark arbitrary WooCommerce orders as paid without any payment.
Product
Paymob for WooCommerce
Fixed in
4.1.14
What to do
Update Paymob for WooCommerce to 4.1.14 or newer.
Full record and what to do →NVD record wpscan.com
Sep 23, 2026The MPCX Lightbox WordPress plugin 1.2.2 through 1.2.5 does not have any authorisation or authentication on one of its AJAX actions available to unauthenticatedCVE-2026-87848 · WordPress plugins & themes · reported by WPScanLow 3.7
The MPCX Lightbox WordPress plugin 1.2.2 through 1.2.5 does not have any authorisation or authentication on one of its AJAX actions available to unauthenticated users, nor does it check the status of the requested post, allowing unauthenticated visitors to retrieve the title, content or excerpt of arbitrary posts, including private, draft, pending, trashed and password-protected ones.
Affected
up to 1.2.5
What to do
Affects up to 1.2.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Sep 23, 2026Forminator Forms: Does not restrictCVE-2026-87071 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Forminator Forms WordPress plugin before 1.57.2.1 does not restrict which metadata keys a form submission may supply, and does not exclude the keys WordPress reserves for its own use, so unauthenticated visitors submitting a public form that collects post content can attach metadata of their choosing to the post their submission creates.
Product
Forminator Forms
Fixed in
1.57.2.1
What to do
Update Forminator Forms to 1.57.2.1 or newer.
Full record and what to do →NVD record wpscan.com
Sep 23, 2026Forminator Forms: Does not verify that a request came from a trusted proxy before preferring client-supplied forwarding headers over the connecting addressCVE-2026-87070 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Forminator Forms WordPress plugin before 1.57.2.1 does not verify that a request came from a trusted proxy before preferring client-supplied forwarding headers over the connecting address, and it uses that value both to enforce its per-visitor voting limit and to record who submitted an entry. Unauthenticated visitors can therefore vote without limit on any poll and can choose the address stored against every submission they make.
Product
Forminator Forms
Fixed in
1.57.2.1
What to do
Update Forminator Forms to 1.57.2.1 or newer.
Full record and what to do →NVD record wpscan.com
Sep 23, 2026Ninja Tables: Does not restrict shortcode expansion to administrator-authored table rows whichCVE-2026-86612 · WordPress plugins & themes · reported by WPScanMedium 5.6
The Ninja Tables WordPress plugin before 5.2.17 does not restrict shortcode expansion to administrator-authored table rows which, in a non-default configuration, allows unauthenticated users to have arbitrary shortcodes executed on a public page, and to permanently break that page, by submitting an ordinary form entry.
Product
Ninja Tables
Fixed in
5.2.17
What to do
Update Ninja Tables to 5.2.17 or newer.
Full record and what to do →NVD record wpscan.com
Sep 23, 2026GTranslate: Does not remove shortcodes from the content of outgoing emails before expanding them whichCVE-2026-86604 · WordPress plugins & themes · reported by WPScanMedium 4.8
The GTranslate WordPress plugin before 5.0.1 does not remove shortcodes from the content of outgoing emails before expanding them which, in a non-default configuration, allows unauthenticated users to have arbitrary shortcodes registered on the site executed server side.
Product
GTranslate
Fixed in
5.0.1
What to do
Update GTranslate to 5.0.1 or newer.
Full record and what to do →NVD record wpscan.com
Sep 23, 2026WP Recipe Maker: Does not remove shortcodes from comment content before expanding it while building a page's structured metadataCVE-2026-86601 · WordPress plugins & themes · reported by WPScanMedium 6.5
The WP Recipe Maker WordPress plugin before 10.8.2 does not remove shortcodes from comment content before expanding it while building a page's structured metadata, allowing unauthenticated users to have arbitrary shortcodes executed server side and to read the content of unpublished recipes.
Product
WP Recipe Maker
Fixed in
10.8.2
What to do
Update WP Recipe Maker to 10.8.2 or newer.
Full record and what to do →NVD record wpscan.com
Sep 23, 2026Foxit PDF Editor/Reader does not perform sufficient verification of the JPEG2000 image metadata in the PDF file, which leads to out-of-bounds write in the heap CVE-2026-91815 · Other software · Foxit Software Inc. · reported by 14984358-7092-470d-8f34-ade47a7658a2High 7.8
Foxit PDF Editor/Reader does not perform sufficient verification of the JPEG2000 image metadata in the PDF file, which leads to out-of-bounds write in the heap buffer during decoding, potentially causing the program to crash and introducing the risk of arbitrary code execution.
Product
Foxit PDF Editor
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record foxit.com
Sep 23, 2026NP Quote Request for WooCommerce: Does not verify order ownership before rendering an order's detailsCVE-2026-93528 · WordPress plugins & themes · reported by WPScanLow 3.7
The NP Quote Request for WooCommerce WordPress plugin before 2.4.16 does not verify order ownership before rendering an order's details, allowing unauthenticated attackers to view another customer's order using the order's key.
Product
NP Quote Request for WooCommerce
Fixed in
2.4.16
What to do
Update NP Quote Request for WooCommerce to 2.4.16 or newer.
Full record and what to do →NVD record wpscan.com
Sep 23, 2026Premium Packages: Does not verify PayPal's webhook signature before processing payment and subscription notificationsCVE-2026-93511 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Premium Packages WordPress plugin before 7.2.1 does not verify PayPal's webhook signature before processing payment and subscription notifications, allowing unauthenticated attackers to forge payment confirmations and subscription-cancellation events against any order whose transaction id they know.
Product
Premium Packages
Fixed in
7.2.1
What to do
Update Premium Packages to 7.2.1 or newer.
Full record and what to do →NVD record wpscan.com
Sep 23, 2026Points and Rewards for WooCommerce: Does not validate the claimed reward amount or restrict who can call its Win Wheel claim handlerCVE-2026-93510 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Points and Rewards for WooCommerce WordPress plugin before 2.10.4 does not validate the claimed reward amount or restrict who can call its Win Wheel claim handler, allowing authenticated users, Subscriber and above, to credit their own account with an arbitrary and unlimited amount of loyalty points and, where a companion wallet Points and Rewards for WooCommerce WordPress plugin before 2.10.4 is active, wallet balance.
Product
Points and Rewards for WooCommerce
Fixed in
2.10.4
What to do
Update Points and Rewards for WooCommerce to 2.10.4 or newer.
Full record and what to do →NVD record wpscan.com
Sep 23, 2026WC Fields Factory: Does not properly restrict access to its field-management AJAX actionCVE-2026-93508 · WordPress plugins & themes · reported by WPScanHigh 8.1
The WC Fields Factory WordPress plugin before 4.1.11 does not properly restrict access to its field-management AJAX action, allowing authenticated users with Subscriber-level access and above to create, modify and delete arbitrary post meta on any post, including WooCommerce products, regardless of ownership, and to manipulate stored pricing rules on a product to reduce its checkout price.
Product
WC Fields Factory
Fixed in
4.1.11
What to do
Update WC Fields Factory to 4.1.11 or newer.
Full record and what to do →NVD record wpscan.com
Sep 23, 2026WC Fields Factory: Does not properly restrict access toCVE-2026-93507 · WordPress plugins & themes · reported by WPScanLow 3.3
The WC Fields Factory WordPress plugin before 4.1.11 does not properly restrict access to, or verify a nonce for, a post-cloning action, allowing Contributor-level users and above to duplicate arbitrary posts of any type or status, including other users' private or draft content, and gain read access to the resulting copy.
Product
WC Fields Factory
Fixed in
4.1.11
What to do
Update WC Fields Factory to 4.1.11 or newer.
Full record and what to do →NVD record wpscan.com
Sep 23, 2026Event Booking Manager for WooCommerce: Does not restrict its event listing query to events the requesting user is permitted to readCVE-2026-91077 · WordPress plugins & themes · reported by WPScanLow 2.7
The Event Booking Manager for WooCommerce WordPress plugin before 5.7.3 does not restrict its event listing query to events the requesting user is permitted to read, so users with contributor-level access and above can retrieve other authors' private, draft and trashed events, together with event detail the standard listing does not show them. This discloses private events and their content that WordPress withholds from users lacking the read_private_posts capability.
Product
Event Booking Manager for WooCommerce
Fixed in
5.7.3
What to do
Update Event Booking Manager for WooCommerce to 5.7.3 or newer.
Full record and what to do →NVD record wpscan.com
Sep 23, 2026Subscribe Forms: Does not sanitise and escape one of its form settings before outputting it in a pageCVE-2026-91073 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Subscribe Forms WordPress plugin before 1.6.3 does not sanitise and escape one of its form settings before outputting it in a page, allowing authenticated users with the Author role and above to perform Stored Cross-Site Scripting attacks that execute in the browser of any visitor who views a page embedding the form, including logged-out visitors and administrators.
Product
Subscribe Forms
Fixed in
1.6.3
What to do
Update Subscribe Forms to 1.6.3 or newer.
Full record and what to do →NVD record wpscan.com
Sep 23, 2026Booking Manager: Does not verify that a request to modify a user's Booking Manager WordPress plugin before 2CVE-2026-91025 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Booking Manager WordPress plugin before 2.1.21 does not verify that a request to modify a user's Booking Manager WordPress plugin before 2.1.21-specific settings targets the requesting user's own account, allowing any authenticated user with subscriber-level access and above to create or overwrite the Booking Manager WordPress plugin before 2.1.21's per-user settings on arbitrary users, including administrators.
Product
Booking Manager
Fixed in
2.1.21
What to do
Update Booking Manager to 2.1.21 or newer.
Full record and what to do →NVD record wpscan.com
Sep 23, 2026Booking Manager: Does not sanitize and escape values taken from a fetched external iCalendar feed before using them in a SQL queryCVE-2026-91024 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Booking Manager WordPress plugin before 2.1.21 does not sanitize and escape values taken from a fetched external iCalendar feed before using them in a SQL query, allowing authenticated users with Author-level access and above to perform SQL injection attacks by importing a feed they control.
Product
Booking Manager
Fixed in
2.1.21
What to do
Update Booking Manager to 2.1.21 or newer.
Full record and what to do →NVD record wpscan.com
Sep 23, 2026WPC Smart Compare for WooCommerce: Does not apply WordPress's post-password protectionCVE-2026-90985 · WordPress plugins & themes · reported by WPScanMedium 5.3
The WPC Smart Compare for WooCommerce WordPress plugin before 6.6.1 does not apply WordPress's post-password protection when returning product content through its comparison handler, allowing unauthenticated users to read the description of password-protected products.
Product
WPC Smart Compare for WooCommerce
Fixed in
6.6.1
What to do
Update WPC Smart Compare for WooCommerce to 6.6.1 or newer.
Full record and what to do →NVD record wpscan.com
Sep 23, 2026Paid Membership Subscriptions: Does not bind one of its unauthenticated payment actions to the requesting userCVE-2026-90951 · WordPress plugins & themes · reported by WPScanLow 3.7
The Paid Membership Subscriptions WordPress plugin before 3.1.0 does not bind one of its unauthenticated payment actions to the requesting user, allowing someone who holds another member's in-flight payment identifier to delete that member's checkout state.
Product
Paid Membership Subscriptions
Fixed in
3.1.0
What to do
Update Paid Membership Subscriptions to 3.1.0 or newer.
Full record and what to do →NVD record wpscan.com
Sep 23, 2026FluentBoards: Does not properly restrict the member data returned by its publicCVE-2026-89331 · WordPress plugins & themes · reported by WPScanMedium 5.3
The FluentBoards WordPress plugin before 2.1.0 does not properly restrict the member data returned by its public, token-shared board feature, allowing unauthenticated users to disclose the email addresses of a shared board's members, typically including administrators.
Product
FluentBoards
Fixed in
2.1.0
What to do
Update FluentBoards to 2.1.0 or newer.
Full record and what to do →NVD record wpscan.com
Sep 23, 2026JSM Show Post Metadata: Does not properly escape a post meta key before outputting it into an inline event-handler attribute in an admin-facing meta boxCVE-2026-88997 · WordPress plugins & themes · reported by WPScanMedium 6.8
The JSM Show Post Metadata WordPress plugin before 4.9.1 does not properly escape a post meta key before outputting it into an inline event-handler attribute in an admin-facing meta box, allowing users with contributor-level access and above to inject arbitrary JavaScript that executes in the session of a higher-privileged user who reviews the affected post.
Product
JSM Show Post Metadata
Fixed in
4.9.1
What to do
Update JSM Show Post Metadata to 4.9.1 or newer.
Full record and what to do →NVD record wpscan.com
Sep 23, 2026Product Badge, Label, Countdown Timer for WooCommerce: Does not check whether a product is published before returning its details to unauthenticated usersCVE-2026-88929 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Product Badge, Label, Countdown Timer for WooCommerce WordPress plugin before 7.5.2 does not check whether a product is published before returning its details to unauthenticated users, allowing them to read the title, description and price of draft, pending and private products.
Product
Product Badge, Label, Countdown Timer for WooCommerce
Fixed in
7.5.2
What to do
Update Product Badge, Label, Countdown Timer for WooCommerce to 7.5.2 or newer.
Full record and what to do →NVD record wpscan.com
Sep 23, 2026Paymob for WooCommerce: Does not perform a capability check on several admin AJAX actions that manage its payment-gateway configurationCVE-2026-87981 · WordPress plugins & themes · reported by WPScanMedium 4.7
The Paymob for WooCommerce WordPress plugin before 4.1.14 does not perform a capability check on several admin AJAX actions that manage its payment-gateway configuration, allowing users with contributor-level access to delete, wipe, or modify that configuration, including the stored payment credentials.
Product
Paymob for WooCommerce
Fixed in
4.1.14
What to do
Update Paymob for WooCommerce to 4.1.14 or newer.
Full record and what to do →NVD record wpscan.com
Sep 23, 2026Paymob for WooCommerce: Does not verify the request signature on the card-token branch of its payment webhookCVE-2026-87979 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Paymob for WooCommerce WordPress plugin before 4.1.14 does not verify the request signature on the card-token branch of its payment webhook, allowing unauthenticated attackers to write a card-token record to any user's account and to enumerate registered accounts.
Product
Paymob for WooCommerce
Fixed in
4.1.14
What to do
Update Paymob for WooCommerce to 4.1.14 or newer.
Full record and what to do →NVD record wpscan.com
Sep 23, 2026Forminator Forms: Does not bind its saved-draft notification to the visitor who created the draftCVE-2026-87074 · WordPress plugins & themes · reported by WPScanLow 3.7
The Forminator Forms WordPress plugin before 1.57.2.1 does not bind its saved-draft notification to the visitor who created the draft, and takes both the recipient address and the link written into the message from the request, so unauthenticated visitors can make the site send a message from its own mail configuration to any address, carrying a link of their choosing inside the site's own template. The token that authorises the send is handed to the anonymous caller by the Forminator Forms WordPress plugin before 1.57.2.1 itself and can be replayed without limit.
Product
Forminator Forms
Fixed in
1.57.2.1
What to do
Update Forminator Forms to 1.57.2.1 or newer.
Full record and what to do →NVD record wpscan.com
Sep 23, 2026Forminator Forms: Does not perform a nonceCVE-2026-87069 · WordPress plugins & themes · reported by WPScanLow 3.1
The Forminator Forms WordPress plugin before 1.57.2.1 does not perform a nonce, capability or ownership check before running a one-time payment-field migration during the construction of one of its admin screens, and that construction happens on every wp-admin request for any logged-in user. Any authenticated user, including a Subscriber with no permissions in the Forminator Forms WordPress plugin before 1.57.2.1, can therefore rewrite the saved field configuration of any form on the site, including a live payment form.
Product
Forminator Forms
Fixed in
1.57.2.1
What to do
Update Forminator Forms to 1.57.2.1 or newer.
Full record and what to do →NVD record wpscan.com
Sep 23, 2026Real3D Flipbook: Does not perform capability checks on several of its authenticated flipbook management actionsCVE-2026-86842 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Real3D Flipbook WordPress plugin before 5.4 does not perform capability checks on several of its authenticated flipbook management actions, allowing users with Author-level access and above to delete other users' flipbook content and overwrite administrator-only global settings, which can be leveraged to store JavaScript that executes in the context of any visitor or administrator viewing the site.
Product
Real3D Flipbook
Fixed in
5.4
What to do
Update Real3D Flipbook to 5.4 or newer.
Full record and what to do →NVD record wpscan.com
Sep 23, 2026Social Commerce for WooCommerce: Does not have authorisation checks on some of its REST API endpointsCVE-2026-86785 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Social Commerce for WooCommerce WordPress plugin through 2.5.4 does not have authorisation checks on some of its REST API endpoints, allowing unauthenticated users to update Social Commerce for WooCommerce WordPress plugin through 2.5.4 configuration and product synchronisation state.
Product
Social Commerce for WooCommerce
Affected
up to 2.5.4
What to do
Affects up to 2.5.4. Update Social Commerce for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Sep 23, 2026Post Grid Gutenberg Blocks: Does not perform an authorization or post-visibility check on a REST API route that returns the custom field keys of a given postCVE-2026-86783 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Post Grid Gutenberg Blocks WordPress plugin before 5.0.41 does not perform an authorization or post-visibility check on a REST API route that returns the custom field keys of a given post, allowing unauthenticated users to disclose the custom field key names of arbitrary posts, including private, draft, pending, scheduled and password-protected posts.
Product
Post Grid Gutenberg Blocks
Fixed in
5.0.41
What to do
Update Post Grid Gutenberg Blocks to 5.0.41 or newer.
Full record and what to do →NVD record wpscan.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.