Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
11,394 results · page 22 of 228
Oct 9, 2026Datasolution AcyMailing SMTP Newsletter acymailing: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-105318 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Datasolution AcyMailing SMTP Newsletter acymailing allows Reflected XSS.This issue affects AcyMailing SMTP Newsletter: from n/a through 11.1.0.
- Product
- Datasolution AcyMailing SMTP Newsletter acymailing
- Affected
- up to 11.1.0
- What to do
- Affects up to 11.1.0. Update Datasolution AcyMailing SMTP Newsletter acymailing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 9, 2026ExpressTech Quiz And Survey Master quiz-master-next: Deserialization of Untrusted DataCVE-2026-104392 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows Object Injection.This issue affects Quiz And Survey Master: from n/a through 11.2.7.
- Product
- ExpressTech Quiz And Survey Master quiz-master-next
- Affected
- up to 11.2.7
- What to do
- Affects up to 11.2.7. Update ExpressTech Quiz And Survey Master quiz-master-next to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 9, 2026Testimonials by BestWebSoft: Does not sanitise and escape a parameter before using it in a SQL queryCVE-2026-89235 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Testimonials by BestWebSoft WordPress plugin through 1.0.8 does not sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated attackers to append additional SQL to the query.
- Product
- Testimonials by BestWebSoft
- Affected
- up to 1.0.8
- What to do
- Affects up to 1.0.8. Update Testimonials by BestWebSoft to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 9, 2026Shipping for Nova Poshta: Does not perform any authorisationCVE-2026-87846 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Shipping for Nova Poshta WordPress plugin through 1.19.8 does not perform any authorisation, nonce or ownership checks on one of its AJAX actions available to unauthenticated users, allowing anyone to delete the shipment records of arbitrary orders and to make the store issue the carrier's waybill-deletion request for those orders using the store's own stored API credentials.
- Product
- Shipping for Nova Poshta
- Affected
- up to 1.19.8
- What to do
- Affects up to 1.19.8. Update Shipping for Nova Poshta to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 9, 2026Livees Checkout: Does not perform any capabilityCVE-2026-86851 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Livees Checkout WordPress plugin through 7.0.2 does not perform any capability, nonce or order-key check before acting on request parameters on the order confirmation page, allowing unauthenticated users to change the status of arbitrary orders, store arbitrary data and notes on them, and recover their order keys.
- Product
- Livees Checkout
- Affected
- up to 7.0.2
- What to do
- Affects up to 7.0.2. Update Livees Checkout to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 9, 2026GDPR Data Request Form: Does not have CSRF protectionCVE-2026-85348 · WordPress plugins & themes · reported by WPScanMedium 4.3
The GDPR Data Request Form WordPress plugin through 1.7.1 does not have CSRF protection when updating one of its settings, allowing attackers to change that setting via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- GDPR Data Request Form
- Affected
- up to 1.7.1
- What to do
- Affects up to 1.7.1. Update GDPR Data Request Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 9, 2026unFocus Projects Scripts n Styles scripts-n-styles: Missing AuthorizationCVE-2026-62042 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in unFocus Projects Scripts n Styles scripts-n-styles allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Scripts n Styles: from n/a through 3.5.8.
- Product
- unFocus Projects Scripts n Styles scripts-n-styles
- Affected
- up to 3.5.8
- What to do
- Affects up to 3.5.8. Update unFocus Projects Scripts n Styles scripts-n-styles to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 9, 2026Ashok Dudhat WP Event Manager wp-event-manager: Missing AuthorizationCVE-2026-62041 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Ashok Dudhat WP Event Manager wp-event-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Event Manager: from n/a through 3.4.1.
- Product
- Ashok Dudhat WP Event Manager wp-event-manager
- Affected
- up to 3.4.1
- What to do
- Affects up to 3.4.1. Update Ashok Dudhat WP Event Manager wp-event-manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 9, 2026DEV Institute Restrict User Access – Membership Plugin with Force restrict-user-access: Missing AuthorizationCVE-2026-62040 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in DEV Institute Restrict User Access – Membership Plugin with Force restrict-user-access allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Restrict User Access – Membership Plugin with Force: from n/a through 2.8.1.
- Product
- DEV Institute Restrict User Access – Membership Plugin with Force restrict-user-access
- Affected
- up to 2.8.1
- What to do
- Affects up to 2.8.1. Update DEV Institute Restrict User Access – Membership Plugin with Force restrict-user-access to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 9, 2026bPlugins Html5 Audio Player html5-audio-player: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-62039 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Html5 Audio Player html5-audio-player allows Stored XSS.This issue affects Html5 Audio Player: from n/a through 2.8.8.
- Product
- bPlugins Html5 Audio Player html5-audio-player
- Affected
- up to 2.8.8
- What to do
- Affects up to 2.8.8. Update bPlugins Html5 Audio Player html5-audio-player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 9, 2026AREOI All Bootstrap Blocks all-bootstrap-blocks: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2026-62036 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in AREOI All Bootstrap Blocks all-bootstrap-blocks allows Retrieve Embedded Sensitive Data.This issue affects All Bootstrap Blocks: from n/a through 1.3.31.
- Product
- AREOI All Bootstrap Blocks all-bootstrap-blocks
- Affected
- up to 1.3.31
- What to do
- Affects up to 1.3.31. Update AREOI All Bootstrap Blocks all-bootstrap-blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 9, 2026Asgaros Asgaros Forum asgaros-forum: Missing AuthorizationCVE-2026-39779 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Asgaros Asgaros Forum asgaros-forum allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Asgaros Forum: from n/a through 3.4.0.
- Product
- Asgaros Asgaros Forum asgaros-forum
- Affected
- up to 3.4.0
- What to do
- Affects up to 3.4.0. Update Asgaros Asgaros Forum asgaros-forum to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 9, 2026Cool Plugins AI Translation for Polylang automatic-translations-for-polylang: Missing AuthorizationCVE-2026-107419 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Cool Plugins AI Translation for Polylang automatic-translations-for-polylang allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AI Translation for Polylang: from n/a through 1.6.2.
- Product
- Cool Plugins AI Translation for Polylang automatic-translations-for-polylang
- Affected
- up to 1.6.2
- What to do
- Affects up to 1.6.2. Update Cool Plugins AI Translation for Polylang automatic-translations-for-polylang to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 9, 2026Super Payments: Does not properly verify the authenticity of incoming payment webhook notificationsCVE-2026-103329 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Super Payments WordPress plugin before 1.43.1 does not properly verify the authenticity of incoming payment webhook notifications, as the signing key used to validate their signature is empty by default, allowing unauthenticated attackers to forge a valid signature and mark arbitrary WooCommerce orders as paid without payment.
- Product
- Super Payments
- Fixed in
- 1.43.1
- What to do
- Update Super Payments to 1.43.1 or newer.
Oct 9, 2026MultiNet Interactive AB EduAdmin Booking eduadmin-booking: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-96809 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in MultiNet Interactive AB EduAdmin Booking eduadmin-booking allows Blind SQL Injection.This issue affects EduAdmin Booking: from n/a before 6.0.0.
- Product
- MultiNet Interactive AB EduAdmin Booking eduadmin-booking
- Fixed in
- 6.0.0
- What to do
- Update MultiNet Interactive AB EduAdmin Booking eduadmin-booking to 6.0.0 or newer.
Oct 9, 2026Welcart Welcart e-Commerce usc-e-shop: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-96761 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Welcart Welcart e-Commerce usc-e-shop allows Reflected XSS.This issue affects Welcart e-Commerce: from n/a through 2.12.3.
- Product
- Welcart Welcart e-Commerce usc-e-shop
- Affected
- up to 2.12.3
- What to do
- Affects up to 2.12.3. Update Welcart Welcart e-Commerce usc-e-shop to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 9, 2026fifu: Cross-Site Request Forgery (CSRF)CVE-2026-96671 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Cross-Site Request Forgery (CSRF) vulnerability in fifu.app Featured Image from URL featured-image-from-url allows Cross Site Request Forgery.This issue affects Featured Image from URL: from n/a through 6.0.7.
- Product
- fifu
- Affected
- up to 6.0.7
- What to do
- Affects up to 6.0.7. Update fifu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 9, 2026Basix NEX-Forms nex-forms-express-wp-form-builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-96607 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Basix NEX-Forms nex-forms-express-wp-form-builder allows Reflected XSS.This issue affects NEX-Forms: from n/a through 9.3.1.
- Product
- Basix NEX-Forms nex-forms-express-wp-form-builder
- Affected
- up to 9.3.1
- What to do
- Affects up to 9.3.1. Update Basix NEX-Forms nex-forms-express-wp-form-builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 9, 2026Damian Góra FiboSearch ajax-search-for-woocommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-96553 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Damian Góra FiboSearch ajax-search-for-woocommerce allows Reflected XSS.This issue affects FiboSearch: from n/a through 1.34.1.
- Product
- Damian Góra FiboSearch ajax-search-for-woocommerce
- Affected
- up to 1.34.1
- What to do
- Affects up to 1.34.1. Update Damian Góra FiboSearch ajax-search-for-woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 9, 2026Ultimate Member Ultimate Member ultimate-member: Incorrect Privilege AssignmentCVE-2026-96539 · WordPress plugins & themes · reported by PatchstackMedium 5.6
Incorrect Privilege Assignment vulnerability in Ultimate Member Ultimate Member ultimate-member allows Privilege Escalation.This issue affects Ultimate Member: from n/a through 2.13.1.
- Product
- Ultimate Member Ultimate Member ultimate-member
- Affected
- up to 2.13.1
- What to do
- Affects up to 2.13.1. Update Ultimate Member Ultimate Member ultimate-member to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 9, 2026properfraction ProfilePress wp-user-avatar: Missing AuthorizationCVE-2026-96518 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Missing Authorization vulnerability in properfraction ProfilePress wp-user-avatar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ProfilePress: from n/a through 4.17.3.
- Product
- properfraction ProfilePress wp-user-avatar
- Affected
- up to 4.17.3
- What to do
- Affects up to 4.17.3. Update properfraction ProfilePress wp-user-avatar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 9, 2026TMS Amelia ameliabooking: Missing AuthorizationCVE-2026-96461 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in TMS Amelia ameliabooking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Amelia: from n/a through 2.4.10.
- Product
- TMS Amelia ameliabooking
- Affected
- up to 2.4.10
- What to do
- Affects up to 2.4.10. Update TMS Amelia ameliabooking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 9, 2026properfraction ProfilePress wp-user-avatar: Missing AuthorizationCVE-2026-96337 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in properfraction ProfilePress wp-user-avatar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ProfilePress: from n/a through 4.17.3.
- Product
- properfraction ProfilePress wp-user-avatar
- Affected
- up to 4.17.3
- What to do
- Affects up to 4.17.3. Update properfraction ProfilePress wp-user-avatar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 9, 2026WPMU DEV Forminator forminator: Authentication Bypass by SpoofingCVE-2026-96336 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Authentication Bypass by Spoofing vulnerability in WPMU DEV Forminator forminator allows Identity Spoofing.This issue affects Forminator: from n/a through 1.57.2.
- Product
- WPMU DEV Forminator forminator
- Affected
- up to 1.57.2
- What to do
- Affects up to 1.57.2. Update WPMU DEV Forminator forminator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 9, 2026ThemeGrill User Registration user-registration: Missing AuthorizationCVE-2026-96334 · WordPress plugins & themes · reported by PatchstackMedium 5.6
Missing Authorization vulnerability in ThemeGrill User Registration user-registration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Registration: from n/a through 5.2.7.
- Product
- ThemeGrill User Registration user-registration
- Affected
- up to 5.2.7
- What to do
- Affects up to 5.2.7. Update ThemeGrill User Registration user-registration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 9, 2026Liquid Web / StellarWP GiveWP give: Authentication Bypass by SpoofingCVE-2026-96333 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Authentication Bypass by Spoofing vulnerability in Liquid Web / StellarWP GiveWP give allows Identity Spoofing.This issue affects GiveWP: from n/a through 4.16.8.1.
- Product
- Liquid Web / StellarWP GiveWP give
- Affected
- up to 4.16.8.1
- What to do
- Affects up to 4.16.8.1. Update Liquid Web / StellarWP GiveWP give to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 9, 2026yalla ya! Simple Payment simple-payment: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-96332 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in yalla ya! Simple Payment simple-payment allows Reflected XSS.This issue affects Simple Payment: from n/a through 2.5.4.
- Product
- yalla ya! Simple Payment simple-payment
- Affected
- up to 2.5.4
- What to do
- Affects up to 2.5.4. Update yalla ya! Simple Payment simple-payment to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 9, 2026wpdreams Ajax Search Pro ajax-search-pro: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-96331 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in wpdreams Ajax Search Pro ajax-search-pro allows Blind SQL Injection.This issue affects Ajax Search Pro: from n/a through 4.29.1.
- Product
- wpdreams Ajax Search Pro ajax-search-pro
- Affected
- up to 4.29.1
- What to do
- Affects up to 4.29.1. Update wpdreams Ajax Search Pro ajax-search-pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 9, 2026tagDiv tagDiv Opt-In Builder td-subscription: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-96330 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in tagDiv tagDiv Opt-In Builder td-subscription allows Blind SQL Injection.This issue affects tagDiv Opt-In Builder: from n/a through 1.7.6.
- Product
- tagDiv tagDiv Opt-In Builder td-subscription
- Affected
- up to 1.7.6
- What to do
- Affects up to 1.7.6. Update tagDiv tagDiv Opt-In Builder td-subscription to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 9, 2026tagDiv tagDiv Opt-In Builder td-subscription: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-96329 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in tagDiv tagDiv Opt-In Builder td-subscription allows Blind SQL Injection.This issue affects tagDiv Opt-In Builder: from n/a through 1.7.6.
- Product
- tagDiv tagDiv Opt-In Builder td-subscription
- Affected
- up to 1.7.6
- What to do
- Affects up to 1.7.6. Update tagDiv tagDiv Opt-In Builder td-subscription to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 9, 2026jegtheme JNews - Pay Writer jnews-pay-writer: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-96328 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in jegtheme JNews - Pay Writer jnews-pay-writer allows Blind SQL Injection.This issue affects JNews - Pay Writer: from n/a through 12.0.1.
- Product
- jegtheme JNews - Pay Writer jnews-pay-writer
- Affected
- up to 12.0.1
- What to do
- Affects up to 12.0.1. Update jegtheme JNews - Pay Writer jnews-pay-writer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 9, 2026VibeThemes WPLMS wplms_plugin: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-96327 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VibeThemes WPLMS wplms_plugin allows Blind SQL Injection.This issue affects WPLMS: from n/a before 1.9.9.8.2.
- Product
- VibeThemes WPLMS wplms_plugin
- Fixed in
- 1.9.9.8.2
- What to do
- Update VibeThemes WPLMS wplms_plugin to 1.9.9.8.2 or newer.
Oct 9, 2026UpSolution UpSolution Core us-core: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-95610 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in UpSolution UpSolution Core us-core allows Blind SQL Injection.This issue affects UpSolution Core: from n/a through 9.3.
- Product
- UpSolution UpSolution Core us-core
- Affected
- up to 9.3
- What to do
- Affects up to 9.3. Update UpSolution UpSolution Core us-core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 9, 2026David Lingren Media LIbrary Assistant media-library-assistant: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-95609 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Lingren Media LIbrary Assistant media-library-assistant allows Stored XSS.This issue affects Media LIbrary Assistant: from n/a through 3.41.
- Product
- David Lingren Media LIbrary Assistant media-library-assistant
- Affected
- up to 3.41
- What to do
- Affects up to 3.41. Update David Lingren Media LIbrary Assistant media-library-assistant to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 9, 2026PluginUs: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-95608 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PluginUs.Net HUSKY woocommerce-products-filter allows Reflected XSS.This issue affects HUSKY: from n/a through 1.4.3.2.
- Product
- PluginUs
- Affected
- up to 1.4.3.2
- What to do
- Affects up to 1.4.3.2. Update PluginUs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 9, 2026VibeThemes WPLMS wplms: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-95607 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VibeThemes WPLMS wplms allows Blind SQL Injection.This issue affects WPLMS : from n/a through 4.973.
- Product
- VibeThemes WPLMS wplms
- Affected
- up to 4.973
- What to do
- Affects up to 4.973. Update VibeThemes WPLMS wplms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 9, 2026Taskbuilder Taskbuilder taskbuilder: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-95599 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Taskbuilder Taskbuilder taskbuilder allows Blind SQL Injection.This issue affects Taskbuilder: from n/a through 6.0.5.
- Product
- Taskbuilder Taskbuilder taskbuilder
- Affected
- up to 6.0.5
- What to do
- Affects up to 6.0.5. Update Taskbuilder Taskbuilder taskbuilder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 9, 2026codepeople Search in Place search-in-place: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-95598 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in codepeople Search in Place search-in-place allows Reflected XSS.This issue affects Search in Place: from n/a through 1.5.5.
- Product
- codepeople Search in Place search-in-place
- Affected
- up to 1.5.5
- What to do
- Affects up to 1.5.5. Update codepeople Search in Place search-in-place to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 9, 2026codemstory 워드프레스 결제 심플페이 pgall-for-woocommerce: Missing AuthorizationCVE-2026-95597 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in codemstory 워드프레스 결제 심플페이 pgall-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects 워드프레스 결제 심플페이: from n/a through 5.5.17.
- Product
- codemstory 워드프레스 결제 심플페이 pgall-for-woocommerce
- Affected
- up to 5.5.17
- What to do
- Affects up to 5.5.17. Update codemstory 워드프레스 결제 심플페이 pgall-for-woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 9, 2026Mamunur Rashid ShopBuilder – Elementor WooCommerce Builder Addons shopbuilder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-95596 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mamunur Rashid ShopBuilder – Elementor WooCommerce Builder Addons shopbuilder allows Reflected XSS.This issue affects ShopBuilder – Elementor WooCommerce Builder Addons: from n/a through 3.4.1.
- Product
- Mamunur Rashid ShopBuilder – Elementor WooCommerce Builder Addons shopbuilder
- Affected
- up to 3.4.1
- What to do
- Affects up to 3.4.1. Update Mamunur Rashid ShopBuilder – Elementor WooCommerce Builder Addons shopbuilder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 9, 2026e4jvikwp VikBooking Hotel Booking Engine & PMS vikbooking: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-95591 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e4jvikwp VikBooking Hotel Booking Engine & PMS vikbooking allows Reflected XSS.This issue affects VikBooking Hotel Booking Engine & PMS: from n/a through 1.8.14.
- Product
- e4jvikwp VikBooking Hotel Booking Engine & PMS vikbooking
- Affected
- up to 1.8.14
- What to do
- Affects up to 1.8.14. Update e4jvikwp VikBooking Hotel Booking Engine & PMS vikbooking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 9, 2026Magepeople inc: Missing AuthorizationCVE-2026-95589 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Magepeople inc. Deposits and Partial Payments for WooCommerce advanced-partial-payment-or-deposit-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Deposits and Partial Payments for WooCommerce: from n/a through 4.0.1.
- Product
- Magepeople inc
- Affected
- up to 4.0.1
- What to do
- Affects up to 4.0.1. Update Magepeople inc to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 9, 2026Dimitri Grassi Salon booking system salon-booking-system: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-94668 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dimitri Grassi Salon booking system salon-booking-system allows Reflected XSS.This issue affects Salon booking system: from n/a through 10.31.5.
- Product
- Dimitri Grassi Salon booking system salon-booking-system
- Affected
- up to 10.31.5
- What to do
- Affects up to 10.31.5. Update Dimitri Grassi Salon booking system salon-booking-system to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 9, 2026Crocoblock JetReviews jet-reviews: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-94667 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetReviews jet-reviews allows Stored XSS.This issue affects JetReviews: from n/a through 3.1.2.
- Product
- Crocoblock JetReviews jet-reviews
- Affected
- up to 3.1.2
- What to do
- Affects up to 3.1.2. Update Crocoblock JetReviews jet-reviews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 9, 2026ZealousWeb Generate PDF using Contact Form 7 generate-pdf-using-contact-form-7: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2026-94666 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ZealousWeb Generate PDF using Contact Form 7 generate-pdf-using-contact-form-7 allows Path Traversal.This issue affects Generate PDF using Contact Form 7: from n/a through 4.2.1.
- Product
- ZealousWeb Generate PDF using Contact Form 7 generate-pdf-using-contact-form-7
- Affected
- up to 4.2.1
- What to do
- Affects up to 4.2.1. Update ZealousWeb Generate PDF using Contact Form 7 generate-pdf-using-contact-form-7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 9, 2026Mamunur Rashid Classified Listing classified-listing: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-94665 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mamunur Rashid Classified Listing classified-listing allows Stored XSS.This issue affects Classified Listing: from n/a through 6.1.2.
- Product
- Mamunur Rashid Classified Listing classified-listing
- Affected
- up to 6.1.2
- What to do
- Affects up to 6.1.2. Update Mamunur Rashid Classified Listing classified-listing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 9, 2026add-ons: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2026-94664 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in add-ons.org PDF for Contact Form 7 pdf-for-contact-form-7 allows Path Traversal.This issue affects PDF for Contact Form 7: from n/a through 7.1.0.
- Product
- add-ons
- Affected
- up to 7.1.0
- What to do
- Affects up to 7.1.0. Update add-ons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 9, 2026Metagauss ProfileGrid profilegrid-user-profiles-groups-and-communities: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-94663 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Metagauss ProfileGrid profilegrid-user-profiles-groups-and-communities allows Blind SQL Injection.This issue affects ProfileGrid: from n/a through 6.0.0.2.
- Product
- Metagauss ProfileGrid profilegrid-user-profiles-groups-and-communities
- Affected
- up to 6.0.0.2
- What to do
- Affects up to 6.0.0.2. Update Metagauss ProfileGrid profilegrid-user-profiles-groups-and-communities to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 9, 2026Crocoblock JetBlog jet-blog: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-94661 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetBlog jet-blog allows Reflected XSS.This issue affects JetBlog: from n/a through 2.4.10.
- Product
- Crocoblock JetBlog jet-blog
- Affected
- up to 2.4.10
- What to do
- Affects up to 2.4.10. Update Crocoblock JetBlog jet-blog to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 9, 2026Stiofan UsersWP userswp: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-94641 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Stiofan UsersWP userswp allows Reflected XSS.This issue affects UsersWP: from n/a through 1.2.73.
- Product
- Stiofan UsersWP userswp
- Affected
- up to 1.2.73
- What to do
- Affects up to 1.2.73. Update Stiofan UsersWP userswp to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. The WordPress, CMS and hosting-panel entries come from the National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan and others); we show who. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, a booking system, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.