Updated 11 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

35added in the last 30 days

570new WordPress flaws this week

391,310entries in the database

35,100 results · page 23 of 702

Sep 30, 2026A stored cross-site scripting (XSS) weakness in Kiteworks Core could allow an administrator holding only a single, narrowly scoped delegated permission to storeCVE-2026-102126 · Other software · Kiteworks · reported by 9119a7d8-5eab-497f-8521-727c672e3725High 8.1
A stored cross-site scripting (XSS) weakness in Kiteworks Core could allow an administrator holding only a single, narrowly scoped delegated permission to store crafted content that later executes arbitrary JavaScript in the authenticated session of a System Administrator who views the affected page. This could have permitted the lower-privileged administrator to escalate to full administrative control of the tenant, including the creation of a new administrative account.
Product
Core
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com raw.githubusercontent.com
Sep 30, 2026Kiteworks Core before version 9.5.0 is vulnerable to Stored Cross-Site Scripting.CVE-2026-102100 · Other software · Kiteworks · reported by 9119a7d8-5eab-497f-8521-727c672e3725High 8.7
Kiteworks Core before version 9.5.0 is vulnerable to Stored Cross-Site Scripting. A stored cross-site scripting (XSS) weakness in Kiteworks Core could allow an authenticated user to submit content that, when later viewed by another user, executes arbitrary JavaScript in that user's authenticated session. This could be used to perform actions on the victim's behalf and may have permitted account takeover, including of higher-privileged users. Exploitation requires the victim to view the attacker-supplied content.
Product
Core
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com raw.githubusercontent.com
Sep 30, 2026Kiteworks Core before version 9.5.0 is vulnerable to Stored Cross-site Scripting (XSS) that could allow an authenticated user to store crafted content that execCVE-2026-102092 · Other software · Kiteworks · reported by 9119a7d8-5eab-497f-8521-727c672e3725High 8.7
Kiteworks Core before version 9.5.0 is vulnerable to Stored Cross-site Scripting (XSS) that could allow an authenticated user to store crafted content that executes arbitrary JavaScript in another user's authenticated session when they preview shared content. This could potentially lead to session compromise and account takeover.
Product
Core
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com raw.githubusercontent.com
Sep 30, 2026Unauthenticated Cross Site Scripting (XSS) in Photonic Gallery & Lightbox for Flickr, SmugMug & Others <= 3.36 versions.CVE-2026-97290 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Photonic Gallery & Lightbox for Flickr, SmugMug & Others <= 3.36 versions.
Affected
up to 3.36
What to do
Affects up to 3.36. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 30, 2026JetEngine: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-97265 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock. Jetimpex Inc. JetEngine allows Stored XSS. This issue affects JetEngine: from n/a through 3.8.15.3.
Product
JetEngine
Affected
up to 3.8.15.3
What to do
Affects up to 3.8.15.3. Update JetEngine to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 30, 2026VillaTheme CURCY woo-multi-currency: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-94171 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VillaTheme CURCY woo-multi-currency allows DOM-Based XSS.This issue affects CURCY: 2.2.18.
Product
VillaTheme CURCY woo-multi-currency
What to do
Update VillaTheme CURCY woo-multi-currency to the newest version.
Full record and what to do →NVD record patchstack.com
Sep 30, 2026Unauthenticated Cross Site Scripting (XSS) in JetFormBuilder <= 3.6.5.4 versions.CVE-2026-102391 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in JetFormBuilder <= 3.6.5.4 versions.
Affected
up to 3.6.5.4
What to do
Affects up to 3.6.5.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 30, 2026Subscriber Cross Site Scripting (XSS) in Branda <= 3.4.32 versions.CVE-2026-102376 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Subscriber Cross Site Scripting (XSS) in Branda <= 3.4.32 versions.
Affected
up to 3.4.32
What to do
Affects up to 3.4.32. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 30, 2026Unauthenticated Cross Site Scripting (XSS) in Post and Page Builder by BoldGrid <= 1.27.14 versions.CVE-2026-100510 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Post and Page Builder by BoldGrid <= 1.27.14 versions.
Affected
up to 1.27.14
What to do
Affects up to 1.27.14. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 30, 2026User Submitted Posts: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-62084 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jeff Starr User Submitted Posts allows Stored XSS. This issue affects User Submitted Posts: from n/a through 20260810.
Product
User Submitted Posts
Affected
up to 20260810
What to do
Affects up to 20260810. Update User Submitted Posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 30, 2026MISP contains a stored cross-site scripting (XSS) vulnerability in the galaxy icon handling path.CVE-2026-103389 · Other software · MISP · reported by 5a6e4751-2f3f-4070-9419-94fb35b644e8Medium 6.2
MISP contains a stored cross-site scripting (XSS) vulnerability in the galaxy icon handling path. The icon field of a galaxy object was persisted without any server-side validation through the galaxy add, edit, and sync/import capture endpoints. The stored value was subsequently concatenated directly into HTML markup by the D3-based correlation graph rendering scripts (both the default and Overmind themes) using the .html() method. A user holding the perm_galaxy_editor permission, which is granted to the stock User role, could store arbitrary HTML or JavaScript in the icon field. Any other user who opened the correlation graph of an event containing a cluster belonging to that galaxy would have the injected script executed in their browser session. Impact: - Arbitrary script execution in the context of the victim's MISP session - Potential theft of session credentials, manipulation of displayed data, or initiation of actions on behalf of the victim - Affects both the default and Overmind UI themes Affected versions: <2.5.48
Product
MISP
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com
Sep 30, 2026Contributor Cross Site Scripting (XSS) in Cool Formkit Lite <= 2.7.8 versions.CVE-2026-97301 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Cross Site Scripting (XSS) in Cool Formkit Lite <= 2.7.8 versions.
Affected
up to 2.7.8
What to do
Affects up to 2.7.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 30, 2026Contributor Cross Site Scripting (XSS) in King Addons for Elementor <= 51.1.86 versions.CVE-2026-97298 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Cross Site Scripting (XSS) in King Addons for Elementor <= 51.1.86 versions.
Affected
up to 51.1.86
What to do
Affects up to 51.1.86. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 30, 2026Author Cross Site Scripting (XSS) in YITH WooCommerce Tab Manager <= 2.15.0 versions.CVE-2026-97292 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Author Cross Site Scripting (XSS) in YITH WooCommerce Tab Manager <= 2.15.0 versions.
Affected
up to 2.15.0
What to do
Affects up to 2.15.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 30, 2026Quiz And Survey Master: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-97289 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows DOM-Based XSS.This issue affects Quiz And Survey Master: from n/a through 11.2.6.
Product
Quiz And Survey Master
Affected
up to 11.2.6
What to do
Affects up to 11.2.6. Update Quiz And Survey Master to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 30, 2026Contributor Cross Site Scripting (XSS) in OAuth Server <= 4.5.1 versions.CVE-2026-97288 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Cross Site Scripting (XSS) in OAuth Server <= 4.5.1 versions.
Affected
up to 4.5.1
What to do
Affects up to 4.5.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 30, 2026Strong Testimonials: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-97286 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Strong Testimonials strong-testimonials allows Stored XSS.This issue affects Strong Testimonials: from n/a through 3.3.11.
Product
Strong Testimonials
Affected
up to 3.3.11
What to do
Affects up to 3.3.11. Update Strong Testimonials to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 30, 2026Contributor Cross Site Scripting (XSS) in Polylang <= 3.8.9 versions.CVE-2026-97279 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Cross Site Scripting (XSS) in Polylang <= 3.8.9 versions.
Affected
up to 3.8.9
What to do
Affects up to 3.8.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 30, 2026Unauthenticated Cross Site Scripting (XSS) in Premmerce Permalink Manager for WooCommerce <= 2.3.13 versions.CVE-2026-97272 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Premmerce Permalink Manager for WooCommerce <= 2.3.13 versions.
Affected
up to 2.3.13
What to do
Affects up to 2.3.13. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 30, 2026Unauthenticated Cross Site Scripting (XSS) in WPFunnels <= 3.13.1 versions.CVE-2026-97271 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in WPFunnels <= 3.13.1 versions.
Affected
up to 3.13.1
What to do
Affects up to 3.13.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 30, 2026Subscriber Cross Site Scripting (XSS) in CMB2 <= 2.13.0 versions.CVE-2026-97270 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Subscriber Cross Site Scripting (XSS) in CMB2 <= 2.13.0 versions.
Affected
up to 2.13.0
What to do
Affects up to 2.13.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 30, 2026Contributor Cross Site Scripting (XSS) in Virtue/Ascend/Pinnacle Toolkit <= 4.9.12.1 versions.CVE-2026-97266 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Cross Site Scripting (XSS) in Virtue/Ascend/Pinnacle Toolkit <= 4.9.12.1 versions.
Affected
up to 4.9.12.1
What to do
Affects up to 4.9.12.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 30, 2026Contributor Cross Site Scripting (XSS) in Visual Composer Website Builder <= 45.16.2 versions.CVE-2026-97262 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Cross Site Scripting (XSS) in Visual Composer Website Builder <= 45.16.2 versions.
Affected
up to 45.16.2
What to do
Affects up to 45.16.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 30, 2026LayerSlider: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-97253 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kreatura LayerSlider allows Reflected XSS. This issue affects LayerSlider: from n/a through 8.4.0.
Product
LayerSlider
Affected
up to 8.4.0
What to do
Affects up to 8.4.0. Update LayerSlider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 30, 2026Unauthenticated Cross Site Scripting (XSS) in Geo Mashup <= 1.13.21 versions.CVE-2026-97250 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Geo Mashup <= 1.13.21 versions.
Affected
up to 1.13.21
What to do
Affects up to 1.13.21. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 30, 2026Unauthenticated Bypass Vulnerability in Paid Member Subscriptions <= 3.0.9 versions.CVE-2026-97249 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Bypass Vulnerability in Paid Member Subscriptions <= 3.0.9 versions.
Affected
up to 3.0.9
What to do
Affects up to 3.0.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 30, 2026Subscriber Cross Site Scripting (XSS) in JetEngine <= 3.8.14.3 versions.CVE-2026-97238 · WordPress plugins & themes · reported by PatchstackMedium 5.5
Subscriber Cross Site Scripting (XSS) in JetEngine <= 3.8.14.3 versions.
Affected
up to 3.8.14.3
What to do
Affects up to 3.8.14.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 30, 2026JetEngine: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-97237 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetEngine jet-engine allows DOM-Based XSS.This issue affects JetEngine: from n/a through 3.8.14.3.
Product
JetEngine
Affected
up to 3.8.14.3
What to do
Affects up to 3.8.14.3. Update JetEngine to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 30, 2026Subscriber Cross Site Scripting (XSS) in ThemeREX Addons < 2.45.0 versions.CVE-2026-97236 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Subscriber Cross Site Scripting (XSS) in ThemeREX Addons < 2.45.0 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Sep 30, 2026Unauthenticated Cross Site Scripting (XSS) in ThemeREX Addons < 2.45.0 versions.CVE-2026-97235 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in ThemeREX Addons < 2.45.0 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Sep 30, 2026Unauthenticated Cross Site Scripting (XSS) in Ad Inserter <= 2.8.18 versions.CVE-2026-97077 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Ad Inserter <= 2.8.18 versions.
Affected
up to 2.8.18
What to do
Affects up to 2.8.18. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 30, 2026Contributor Cross Site Scripting (XSS) in EWWW Image Optimizer <= 8.7.7 versions.CVE-2026-97067 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Cross Site Scripting (XSS) in EWWW Image Optimizer <= 8.7.7 versions.
Affected
up to 8.7.7
What to do
Affects up to 8.7.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 30, 2026Unauthenticated Cross Site Scripting (XSS) in Happyforms <= 1.26.15 versions.CVE-2026-97065 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Happyforms <= 1.26.15 versions.
Affected
up to 1.26.15
What to do
Affects up to 1.26.15. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 30, 2026Unauthenticated Cross Site Scripting (XSS) in Parsi Date <= 6.3 versions.CVE-2026-96836 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Parsi Date <= 6.3 versions.
Affected
up to 6.3
What to do
Affects up to 6.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 30, 2026Contributor Cross Site Scripting (XSS) in King Addons for Elementor <= 51.1.85 versions.CVE-2026-96835 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Cross Site Scripting (XSS) in King Addons for Elementor <= 51.1.85 versions.
Affected
up to 51.1.85
What to do
Affects up to 51.1.85. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 30, 2026Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.16.9 versions.CVE-2026-96830 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.16.9 versions.
Affected
up to 4.16.9
What to do
Affects up to 4.16.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 30, 2026Contributor Cross Site Scripting (XSS) in The Plus Addons for Elementor Page Builder Lite <= 6.5.1 versions.CVE-2026-96829 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Cross Site Scripting (XSS) in The Plus Addons for Elementor Page Builder Lite <= 6.5.1 versions.
Affected
up to 6.5.1
What to do
Affects up to 6.5.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 30, 2026Subscriber Cross Site Scripting (XSS) in Awesome Support <= 6.3.9 versions.CVE-2026-96820 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Subscriber Cross Site Scripting (XSS) in Awesome Support <= 6.3.9 versions.
Affected
up to 6.3.9
What to do
Affects up to 6.3.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 30, 2026Subscriber Cross Site Scripting (XSS) in oik <= 4.15.4 versions.CVE-2026-96819 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Subscriber Cross Site Scripting (XSS) in oik <= 4.15.4 versions.
Affected
up to 4.15.4
What to do
Affects up to 4.15.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 30, 2026Unauthenticated Cross Site Scripting (XSS) in Trusted Shops Easy Integration for WooCommerce <= 2.0.6 versions.CVE-2026-96816 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Trusted Shops Easy Integration for WooCommerce <= 2.0.6 versions.
Affected
up to 2.0.6
What to do
Affects up to 2.0.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 30, 2026Unauthenticated Cross Site Scripting (XSS) in WooCommerce Product Table Lite <= 5.6.7 versions.CVE-2026-96814 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in WooCommerce Product Table Lite <= 5.6.7 versions.
Affected
up to 5.6.7
What to do
Affects up to 5.6.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 30, 2026Contributor Cross Site Scripting (XSS) in pixfort Core < 4.3.3 versions.CVE-2026-96450 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Contributor Cross Site Scripting (XSS) in pixfort Core < 4.3.3 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Sep 30, 2026Unauthenticated Cross Site Scripting (XSS) in YITH WooCommerce Ajax Search <= 2.28.0 versions.CVE-2026-96352 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in YITH WooCommerce Ajax Search <= 2.28.0 versions.
Affected
up to 2.28.0
What to do
Affects up to 2.28.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 30, 2026Unauthenticated Cross Site Scripting (XSS) in Classified Listing <= 6.1.3 versions.CVE-2026-96351 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Classified Listing <= 6.1.3 versions.
Affected
up to 6.1.3
What to do
Affects up to 6.1.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 30, 2026Subscriber Cross Site Scripting (XSS) in Profile Builder <= 4.0.2 versions.CVE-2026-96338 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Subscriber Cross Site Scripting (XSS) in Profile Builder <= 4.0.2 versions.
Affected
up to 4.0.2
What to do
Affects up to 4.0.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 30, 2026Contributor Cross Site Scripting (XSS) in Pixel Manager for WooCommerce <= 1.69.0 versions.CVE-2026-94674 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Cross Site Scripting (XSS) in Pixel Manager for WooCommerce <= 1.69.0 versions.
Affected
up to 1.69.0
What to do
Affects up to 1.69.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 30, 2026Unauthenticated Cross Site Scripting (XSS) in WordPress Persistent Login <= 3.1.3 versions.CVE-2026-94081 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in WordPress Persistent Login <= 3.1.3 versions.
Affected
up to 3.1.3
What to do
Affects up to 3.1.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 30, 2026Unauthenticated Cross Site Scripting (XSS) in Site Reviews <= 8.3.1 versions.CVE-2026-94078 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Site Reviews <= 8.3.1 versions.
Affected
up to 8.3.1
What to do
Affects up to 8.3.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 30, 2026Contributor Cross Site Scripting (XSS) in Safe SVG <= 2.5.0 versions.CVE-2026-94077 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Cross Site Scripting (XSS) in Safe SVG <= 2.5.0 versions.
Affected
up to 2.5.0
What to do
Affects up to 2.5.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 30, 2026Unauthenticated Cross Site Scripting (XSS) in WP Statistics <= 14.16.13 versions.CVE-2026-93770 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in WP Statistics <= 14.16.13 versions.
Affected
up to 14.16.13
What to do
Affects up to 14.16.13. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.