Vulnerability database

19,059 results · page 24 of 382

• Sep 9, 2026My Calendar – Accessible Event Manager: Stored Cross-Site ScriptingCVE-2026-77187 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'before' and 'after' Shortcode Attributes in all versions up to, and including, 3.8.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

  Product

  My Calendar – Accessible Event Manager

  Affected

  up to 3.8.3

  What to do

  Affects up to 3.8.3. Update My Calendar – Accessible Event Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordgithub.complugins.trac.wordpress.org

• Sep 9, 2026My Calendar – Accessible Event Manager: Stored Cross-Site ScriptingCVE-2026-77186 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'fallback' Shortcode Attribute in all versions up to, and including, 3.8.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The bypass relies on hex-encoded shortcode attribute payloads (e.g. \x3cscript\x3e), which wp_kses_post cannot strip on save because they appear as literal backslash sequences rather than real HTML tags; WordPress core's shortcode_parse_atts() then calls stripcslashes() at render time, decoding the escapes into real angle brackets before they reach the unescaped sink.

  Product

  My Calendar – Accessible Event Manager

  Affected

  up to 3.8.3

  What to do

  Affects up to 3.8.3. Update My Calendar – Accessible Event Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordgithub.complugins.trac.wordpress.org

• Sep 9, 2026Podlove Podcast Publisher: Stored Cross-Site ScriptingCVE-2026-75966 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The Podlove Podcast Publisher plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'episode_contributor[..][..][comment]' Parameter in all versions up to, and including, 4.5.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The contributor comment is stored in a plugin-managed custom table, bypassing WordPress core's wp_kses_post filter, and the save_post hook fires without a nonce check, meaning any user who can edit posts can exploit this without further preconditions.

  Product

  Podlove Podcast Publisher

  Affected

  up to 4.5.5

  What to do

  Affects up to 4.5.5. Update Podlove Podcast Publisher to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Sep 9, 2026User Access Manager: Reflected Cross-Site ScriptingCVE-2026-19797 · WordPress plugins & themes · reported by WordfenceMedium 6.1

  The User Access Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab_group_section' parameter in all versions up to, and including, 2.3.18 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

  Product

  User Access Manager

  Affected

  up to 2.3.18

  What to do

  Affects up to 2.3.18. Update User Access Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Sep 8, 2026Graphina – Charts and Graphs For Elementor: Stored Cross-Site ScriptingCVE-2026-13709 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The Graphina – Charts and Graphs For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'iq_tree_tree_chart_template' Widget Setting in all versions up to, and including, 3.1.11 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

  Product

  Graphina – Charts and Graphs For Elementor

  Affected

  up to 3.1.11

  What to do

  Affects up to 3.1.11. Update Graphina – Charts and Graphs For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Sep 8, 2026Contact Form to DB by BestWebSoft – Messages Database Plugin For: Stored Cross-Site ScriptingCVE-2026-13359 · WordPress plugins & themes · reported by WordfenceHigh 7.2

  The Contact Form to DB by BestWebSoft – Messages Database Plugin For WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via cntctfrm_contact_dropdown Parameter in all versions up to, and including, 1.7.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload executes in the context of an administrator's browser session when they visit the plugin's message manager page at /wp-admin/admin.php?page=cntctfrmtdb_manager, making it possible to compromise administrator-level sessions via a simple unauthenticated contact form submission.

  Product

  Contact Form to DB by BestWebSoft – Messages Database Plugin For

  Affected

  up to 1.7.5

  What to do

  Affects up to 1.7.5. Update Contact Form to DB by BestWebSoft – Messages Database Plugin For to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Sep 8, 2026Zephyr Project Manager: Stored Cross-Site ScriptingCVE-2026-76931 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The Zephyr Project Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘message’ parameter in all versions up to, and including, 3.3.205 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Custom-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerability can only be exploited when the 'Directly link to project' plugin setting is disabled.

  Product

  Zephyr Project Manager

  Affected

  up to 3.3.205

  What to do

  Affects up to 3.3.205. Update Zephyr Project Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Sep 8, 2026WPML Multilingual CMS: Time-based SQL InjectionCVE-2026-17509 · WordPress plugins & themes · reported by WordfenceMedium 6.5

  The WPML Multilingual CMS plugin for WordPress is vulnerable to time-based SQL Injection via the ‘elementIds’ parameter in all versions up to, and including, 4.9.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This vulnerability is exploitable due to an authorization bypass where the registered authorization callback fails to execute, allowing any authenticated user regardless of role to access administrative translation functionalities.

  Product

  WPML Multilingual CMS

  Affected

  up to 4.9.5

  What to do

  Affects up to 4.9.5. Update WPML Multilingual CMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordwpml.orgwordfence.com

• Sep 8, 2026LearnPress – WordPress LMS Plugin for Create and Sell Online Courses: Stored Cross-Site ScriptingCVE-2026-12230 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'layout_custom_css' parameter in all versions up to, and including, 4.3.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

  Product

  LearnPress – WordPress LMS Plugin for Create and Sell Online Courses

  Affected

  up to 4.3.9.1

  What to do

  Affects up to 4.3.9.1. Update LearnPress – WordPress LMS Plugin for Create and Sell Online Courses to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Sep 8, 2026Hide My WP Ghost: Server-Side Request Forgery (SSRF)CVE-2026-81806 · WordPress plugins & themes · reported by PatchstackHigh 7.2

  Server-Side Request Forgery (SSRF) vulnerability in John Darrel Hide My WP Ghost allows Server Side Request Forgery. This issue affects Hide My WP Ghost: from n/a through 7.0.09.

  Product

  Hide My WP Ghost

  Affected

  up to 7.0.09

  What to do

  Affects up to 7.0.09. Update Hide My WP Ghost to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 8, 2026Easy Appointments: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-81798 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Easy Appointments allows DOM-Based XSS. This issue affects Easy Appointments: from n/a through 4.0.2.1.

  Product

  Easy Appointments

  Affected

  up to 4.0.2.1

  What to do

  Affects up to 4.0.2.1. Update Easy Appointments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 8, 2026Csomagpontok és szállítási címkék WooCommerce-hez: Missing AuthorizationCVE-2026-81790 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Missing Authorization vulnerability in Viszt Péter Csomagpontok és szállítási címkék WooCommerce-hez allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Csomagpontok és szállítási címkék WooCommerce-hez: from n/a before 4.2.8.

  Product

  Csomagpontok és szállítási címkék WooCommerce-hez

  Fixed in

  4.2.8

  What to do

  Update Csomagpontok és szállítási címkék WooCommerce-hez to 4.2.8 or newer.

  Full record and what to do →NVD recordpatchstack.com

• Sep 7, 2026User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor: Stored Cross-Site ScriptingCVE-2026-6431 · WordPress plugins & themes · reported by WordfenceHigh 7.2

  The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Biographical Info' meta field parameter in all versions up to, and including, 3.15.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

  Product

  User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor

  Affected

  up to 3.15.7

  What to do

  Affects up to 3.15.7. Update User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Sep 7, 2026Powerkit: Stored Cross-Site ScriptingCVE-2026-2390 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The Powerkit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Lazy Load module's image processing in all versions up to, and including, 3.0.4. This is due to the 'content_process_images' function using a flawed regex-based HTML attribute parser. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

  Product

  Powerkit

  Affected

  up to 3.0.4

  What to do

  Affects up to 3.0.4. Update Powerkit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Sep 6, 2026The Ninja Forms WordPress plugin from 3.14.10 before 3.15.2 does not prevent shortcodes in request-derived values from being executed when it substitutes them iCVE-2026-80437 · WordPress plugins & themes · reported by WPScanMedium 4.8

  The Ninja Forms WordPress plugin from 3.14.10 before 3.15.2 does not prevent shortcodes in request-derived values from being executed when it substitutes them into content it later processes for shortcodes, allowing unauthenticated users to run any shortcode registered on the site.

  Fixed in

  3.15.2

  What to do

  Update the plugin to 3.15.2 or newer.

  Full record and what to do →NVD recordwpscan.com

• Sep 6, 2026JetFormBuilder: Does not validate or strip line breaks from address values it sources from submitted form fields before adding them to the headers of the e-mails it sendsCVE-2026-19862 · WordPress plugins & themes · reported by WPScanMedium 4.8

  The JetFormBuilder WordPress plugin before 3.6.5.2 does not validate or strip line breaks from address values it sources from submitted form fields before adding them to the headers of the e-mails it sends, allowing unauthenticated users to inject arbitrary e-mail headers, add hidden recipients and spoof the sender. Exploitation requires the site to be configured to take one of the message's addresses from a form field.

  Product

  JetFormBuilder

  Fixed in

  3.6.5.2

  What to do

  Update JetFormBuilder to 3.6.5.2 or newer.

  Full record and what to do →NVD recordwpscan.com

• Sep 5, 2026Ninja Forms - Save Progress: Missing AuthorizationCVE-2026-15550 · WordPress plugins & themes · reported by WordfenceMedium 4.3

  The Ninja Forms - Save Progress plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 3.0.30. This is due to the lack of capability checks and nonce verification in the 'bulk_actions' function. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary database records from the 'wp_nf3_objects' table, such as saved submissions.

  Product

  Ninja Forms - Save Progress

  Affected

  up to 3.0.30

  What to do

  Affects up to 3.0.30. Update Ninja Forms - Save Progress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordninjaforms.comwordfence.com

• Sep 5, 2026Pods – Custom Content Types and Fields: Stored Cross-Site ScriptingCVE-2026-76573 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The Pods – Custom Content Types and Fields plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'not_found' Shortcode Attribute in all versions up to, and including, 3.3.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

  Product

  Pods – Custom Content Types and Fields

  Affected

  up to 3.3.9.1

  What to do

  Affects up to 3.3.9.1. Update Pods – Custom Content Types and Fields to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Sep 5, 2026Gallery : FooGallery: Stored Cross-Site ScriptingCVE-2026-85414 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The Gallery : FooGallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'custom_settings' Shortcode Attribute in all versions up to, and including, 3.3.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

  Product

  Gallery : FooGallery

  Affected

  up to 3.3.2

  What to do

  Affects up to 3.3.2. Update Gallery : FooGallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Sep 5, 2026Contact Form by Supsystic: Stored Cross-Site ScriptingCVE-2026-83625 · WordPress plugins & themes · reported by WordfenceHigh 7.2

  The Contact Form by Supsystic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via IP Address Header in all versions up to, and including, 1.10.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. An unauthenticated attacker can first call the 'updateNonce' action — which is accessible without authentication due to its absence from the plugin's permission list — to obtain a valid nonce, then submit a contact form with a malicious payload in a spoofed IP header such as X-Forwarded-For.

  Product

  Contact Form by Supsystic

  Affected

  up to 1.10.2

  What to do

  Affects up to 1.10.2. Update Contact Form by Supsystic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Sep 5, 2026Unlimited Elements For Elementor: Reflected Cross-Site ScriptingCVE-2026-75586 · WordPress plugins & themes · reported by WordfenceMedium 6.1

  The Unlimited Elements For Elementor plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'formData[id]' Parameter in all versions up to, and including, 2.0.17 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. The front-end AJAX handler is registered on the public 'wp' action with no nonce, capability, or referer check, and the raw attacker-controlled id value is interpolated verbatim into an exception message that is echoed back without escaping; when the response is served as text/html rather than application/json, the browser parses the injected markup.

  Product

  Unlimited Elements For Elementor

  Affected

  up to 2.0.17

  What to do

  Affects up to 2.0.17. Update Unlimited Elements For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Sep 5, 2026Video Player for YouTube: Does not properly sanitise and escape user-supplied input before using it in a SQL statementCVE-2026-84937 · WordPress plugins & themes · reported by WPScanMedium 6.8

  The Video Player for YouTube WordPress plugin before 2.1.0 does not properly sanitise and escape user-supplied input before using it in a SQL statement, allowing users with the Contributor role and above to perform SQL injection attacks and read arbitrary data from the database.

  Product

  Video Player for YouTube

  Fixed in

  2.1.0

  What to do

  Update Video Player for YouTube to 2.1.0 or newer.

  Full record and what to do →NVD recordwpscan.com

• Sep 5, 2026EmbedPress: Does not have proper authorization on a public review-loading actionCVE-2026-84936 · WordPress plugins & themes · reported by WPScanMedium 5.3

  The EmbedPress WordPress plugin before 4.6.4 does not have proper authorization on a public review-loading action, allowing unauthenticated users to force the site to make repeated billable third-party API requests using the site's own configured API key, and to create an unbounded number of attacker-controlled rows in the database.

  Product

  EmbedPress

  Fixed in

  4.6.4

  What to do

  Update EmbedPress to 4.6.4 or newer.

  Full record and what to do →NVD recordwpscan.com

• Sep 5, 2026HT Menu: Does not perform any capability or object-ownership checkCVE-2026-84935 · WordPress plugins & themes · reported by WPScanHigh 8

  The HT Menu WordPress plugin before 1.2.7 does not perform any capability or object-ownership check when saving navigation menu-item settings, and does not escape those stored settings when the menu is rendered, allowing users with minimal permissions such as Subscribers to store JavaScript that executes in the browser of any visitor, administrators included, who views the affected menu.

  Product

  HT Menu

  Fixed in

  1.2.7

  What to do

  Update HT Menu to 1.2.7 or newer.

  Full record and what to do →NVD recordwpscan.com

• Sep 5, 2026Eventin: Does not properly check authorization on several of its event-management REST routesCVE-2026-84901 · WordPress plugins & themes · reported by WPScanMedium 4.9

  The Eventin WordPress plugin before 4.1.22 does not properly check authorization on several of its event-management REST routes, allowing users with contributor-level access and above to change the site's front-page setting to an event they do not own and to create, edit and delete global event and speaker taxonomy terms they should not be able to manage.

  Product

  Eventin

  Fixed in

  4.1.22

  What to do

  Update Eventin to 4.1.22 or newer.

  Full record and what to do →NVD recordwpscan.com

• Sep 5, 2026King Addons for Elementor: Does not escape a widget display-style setting before outputting it in an HTML attributeCVE-2026-84896 · WordPress plugins & themes · reported by WPScanMedium 6.8

  The King Addons for Elementor WordPress plugin before 51.1.77 does not escape a widget display-style setting before outputting it in an HTML attribute, allowing users with Contributor-level access and above to store JavaScript that executes in the browser of any visitor to the affected page, including logged-in administrators.

  Product

  King Addons for Elementor

  Fixed in

  51.1.77

  What to do

  Update King Addons for Elementor to 51.1.77 or newer.

  Full record and what to do →NVD recordwpscan.com

• Sep 5, 2026Events Calendar: Does not restrict non-public content to the users entitled to read it on its public REST archivesCVE-2026-84745 · WordPress plugins & themes · reported by WPScanLow 2.7

  The Events Calendar WordPress plugin before 6.17.3.1 does not restrict non-public content to the users entitled to read it on its public REST archives, allowing users with a low-privilege role such as contributor to read the full contents of every unpublished record on the site, including other users'.

  Product

  Events Calendar

  Fixed in

  6.17.3.1

  What to do

  Update Events Calendar to 6.17.3.1 or newer.

  Full record and what to do →NVD recordwpscan.com

• Sep 5, 2026Kirki: Does not escape a user-supplied identifier before using it in a SQL queryCVE-2026-84221 · WordPress plugins & themes · reported by WPScanMedium 6.8

  The Kirki WordPress plugin before 6.3.0 does not escape a user-supplied identifier before using it in a SQL query, allowing users with editor-level access and above to append arbitrary SQL and read the contents of the database, including user credentials.

  Product

  Kirki

  Fixed in

  6.3.0

  What to do

  Update Kirki to 6.3.0 or newer.

  Full record and what to do →NVD recordwpscan.com

• Sep 5, 2026Greenshift: Does not validate a user-supplied URL before fetching it server-sideCVE-2026-83543 · WordPress plugins & themes · reported by WPScanMedium 4.1

  The Greenshift WordPress plugin before 13.2.0 does not validate a user-supplied URL before fetching it server-side, allowing users with contributor-level access and above to make the server issue requests to arbitrary hosts and read the response.

  Product

  Greenshift

  Fixed in

  13.2.0

  What to do

  Update Greenshift to 13.2.0 or newer.

  Full record and what to do →NVD recordwpscan.com

• Sep 5, 2026Accept Stripe Payments: Does not validate a user-supplied URL before using it in a redirectCVE-2026-81423 · WordPress plugins & themes · reported by WPScanMedium 4.3

  The Accept Stripe Payments WordPress plugin before 2.1.4 does not validate a user-supplied URL before using it in a redirect, allowing unauthenticated attackers to redirect visitors to an arbitrary external website, which can be leveraged for phishing.

  Product

  Accept Stripe Payments

  Fixed in

  2.1.4

  What to do

  Update Accept Stripe Payments to 2.1.4 or newer.

  Full record and what to do →NVD recordwpscan.com

• Sep 5, 2026My Private Site: Does not apply its site-privacy access control to certain unauthenticated front-end read surfacesCVE-2026-81348 · WordPress plugins & themes · reported by WPScanLow 3.7

  The My Private Site WordPress plugin before 4.2.3 does not apply its site-privacy access control to certain unauthenticated front-end read surfaces, allowing unauthenticated users to view post content, comments and post URLs from a site the administrator placed behind mandatory login.

  Product

  My Private Site

  Fixed in

  4.2.3

  What to do

  Update My Private Site to 4.2.3 or newer.

  Full record and what to do →NVD recordwpscan.com

• Sep 5, 2026W3 Total Cache: Stored Cross-Site ScriptingCVE-2026-78438 · WordPress plugins & themes · reported by WordfenceHigh 7.2

  The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via LazyLoad Background Mutator in all versions up to, and including, 2.10.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the "Lazy Load Images" feature with "Process background images" to be enabled, and the malicious comment to be approved by a moderator before execution is triggered.

  Product

  W3 Total Cache

  Affected

  up to 2.10.5

  What to do

  Affects up to 2.10.5. Update W3 Total Cache to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Sep 5, 2026Spam protection, Honeypot, Anti-Spam by CleanTalk: Stored Cross-Site ScriptingCVE-2026-77830 · WordPress plugins & themes · reported by WordfenceHigh 7.2

  The Spam protection, Honeypot, Anti-Spam by CleanTalk plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content aria-label Placeholder in all versions up to, and including, 6.86 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with custom-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload is deliverable via unauthenticated comment submission and executes exclusively for non-logged-in visitors; if comment moderation is enabled, an approving moderator must first publish the comment before the script reaches other users.

  Product

  Spam protection, Honeypot, Anti-Spam by CleanTalk

  Affected

  up to 6.86

  What to do

  Affects up to 6.86. Update Spam protection, Honeypot, Anti-Spam by CleanTalk to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Sep 5, 2026Divi: Server-Side Request ForgeryCVE-2026-4361 · WordPress plugins & themes · reported by WordfenceMedium 5

  The Divi theme for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.27.6. This is due to the `et_pb_set_video_oembed_thumbnail_resolution()` function using `wp_remote_get()` instead of `wp_safe_remote_get()` to fetch a remote image URL, which does not restrict requests to private or reserved IP ranges. This makes it possible for authenticated attackers, with Contributor-level access and above, to make web requests to arbitrary locations originating from the web application server. The response body is not returned to the attacker (blind SSRF), but two oracles exist: a status oracle (the returned URL string differs depending on whether the target responded with HTTP 200) and a timing oracle (response time varies by target reachability).

  Product

  Divi

  Affected

  up to 4.27.6

  What to do

  Affects up to 4.27.6. Update Divi to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recorddivichangelog.comelegantthemes.com

• Sep 5, 2026Divi: DOM-Based Stored Cross-Site ScriptingCVE-2026-3853 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The Divi theme for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via the `image_src` attribute of the `et_pb_video_slider_item` shortcode in all versions up to, and including, 4.27.6. This is due to the `image_src` field not being included in the `$url_options` whitelist (which only contains `url`, `button_link`, `button_url`), so it never receives `esc_url_raw()` at save time. On the server side, the value is rendered into a `data-image` HTML attribute using `esc_attr()`, which encodes double quotes as `"`. However, the client-side JavaScript carousel code in `custom.unified.js` reads this attribute using jQuery's `.data('image')`, which returns the browser-decoded value (with `"` decoded back to `"`). The decoded value is then concatenated directly into an HTML string and injected into the DOM via `jQuery.after()` without re-escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user hovers over the carousel thumbnail.

  Product

  Divi

  Affected

  up to 4.27.6

  What to do

  Affects up to 4.27.6. Update Divi to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recorddivichangelog.comwordfence.com

• Sep 5, 2026Welcart e-Commerce: PHP Object InjectionCVE-2026-19887 · WordPress plugins & themes · reported by WordfenceHigh 8.8

  The Welcart e-Commerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.12.1 via deserialization of untrusted input in the Telecom EDY payment callback (usces_action_acting_transaction). Unauthenticated attackers can store arbitrary 'reserve' key/value pairs as order metadata during a public checkout, then invoke the callback with an attacker-chosen 'option' parameter to select and unserialize that metadata without any provider signature, source-address, transaction-identity or ownership check. A POP chain is present in the TCPDF library bundled with the plugin itself, so no additional plugin or theme is required. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, including wp-config.php, which can lead to remote code execution when an attacker re-runs the WordPress installer against a database they control. Successful exploitation is contingent on an admin printing an invoice to trigger file deletion.

  Product

  Welcart e-Commerce

  Affected

  up to 2.12.1

  What to do

  Affects up to 2.12.1. Update Welcart e-Commerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Sep 5, 2026Ninja Forms – The Contact Form Builder That Grows With You: Stored Cross-Site ScriptingCVE-2026-19769 · WordPress plugins & themes · reported by WordfenceHigh 7.2

  The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Repeater Child 'type' Confusion via Unmatched Array Key in all versions up to, and including, 3.15.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the Ninja Forms File Uploads add-on to be active, as the attack routes the unwhitelisted child entry through the File Uploads handler to write an attacker-supplied HTML file containing arbitrary JavaScript into any web-server-writable directory, including the site root, where it is served from the site's own origin.

  Product

  Ninja Forms – The Contact Form Builder That Grows With You

  Affected

  up to 3.15.1

  What to do

  Affects up to 3.15.1. Update Ninja Forms – The Contact Form Builder That Grows With You to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Sep 5, 2026Beaver Builder Plugin (Starter Version): Reflected Cross-Site ScriptingCVE-2026-18843 · WordPress plugins & themes · reported by WordfenceMedium 6.1

  The Beaver Builder Plugin (Starter Version) plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'no_results_message' node_preview Parameter in all versions up to, and including, 2.11.0.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

  Product

  Beaver Builder Plugin (Starter Version)

  Affected

  up to 2.11.0.1

  What to do

  Affects up to 2.11.0.1. Update Beaver Builder Plugin (Starter Version) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordwordfence.comwpbeaverbuilder.com

• Sep 5, 2026SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz: Stored Cross-Site ScriptingCVE-2026-18406 · WordPress plugins & themes · reported by WordfenceHigh 7.2

  The SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Text Field Entity-Encoded Payload in all versions up to, and including, 2.12.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

  Product

  SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz

  Affected

  up to 2.12.2

  What to do

  Affects up to 2.12.2. Update SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Sep 5, 2026Gravity Forms: Stored Cross-Site ScriptingCVE-2026-16649 · WordPress plugins & themes · reported by WordfenceHigh 7.2

  The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Post Body Field Value in all versions up to, and including, 2.10.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit survives save-time sanitization because wp_kses_post allows the required HTML tags and attributes, and the client-side tooltip script re-parses the browser-decoded aria-label value as innerHTML while only stripping script elements, leaving onerror and other event-handler attributes fully intact and executable.

  Product

  Gravity Forms

  Affected

  up to 2.10.5

  What to do

  Affects up to 2.10.5. Update Gravity Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recorddocs.gravityforms.comwordfence.com

• Sep 5, 2026QuickCal: Stored Cross-Site ScriptingCVE-2026-15984 · WordPress plugins & themes · reported by WordfenceHigh 7.2

  The QuickCal plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Custom Field Parameters in all versions up to, and including, 1.0.20 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The nonce guarding the unauthenticated booked_add_appt AJAX action is publicly embedded on any page rendering the booking calendar shortcode, making it trivially obtainable by unauthenticated attackers without any prior account or privilege.

  Product

  QuickCal

  Affected

  up to 1.0.20

  What to do

  Affects up to 1.0.20. Update QuickCal to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordcodecanyon.networdfence.com

• Sep 5, 2026Search Atlas SEO: Does not perform a nonce or capability check before processing a settings update in one of its early-priority handlersCVE-2026-15247 · WordPress plugins & themes · reported by WPScanMedium 5.4

  The Search Atlas SEO WordPress plugin before 2.6.24 does not perform a nonce or capability check before processing a settings update in one of its early-priority handlers, allowing any authenticated user such as a Subscriber to overwrite or delete the site's stored Google service-account credentials.

  Product

  Search Atlas SEO

  Fixed in

  2.6.24

  What to do

  Update Search Atlas SEO to 2.6.24 or newer.

  Full record and what to do →NVD recordwpscan.com

• Sep 5, 2026JCH Optimize: Does not properly restrict a directory path provided to one of its administrative image-browsing features to within the siteCVE-2025-15693 · WordPress plugins & themes · reported by WPScanLow 2.7

  The JCH Optimize WordPress plugin before 5.0.1 does not properly restrict a directory path provided to one of its administrative image-browsing features to within the site, allowing high-privilege users, administrators on single-site and sub-site administrators on multisite, to enumerate directories and file names outside the web root.

  Product

  JCH Optimize

  Fixed in

  5.0.1

  What to do

  Update JCH Optimize to 5.0.1 or newer.

  Full record and what to do →NVD recordwpscan.com

• Sep 5, 2026Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer: Stored Cross-Site ScriptingCVE-2026-8625 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post_content (Custom HTML block inner HTML)' parameter in all versions up to, and including, 2.4.30 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. A Contributor-level attacker can insert a crafted .df-element div with data-df-lightbox='thumb' via a Custom HTML block, whose inner HTML is passed as the title argument to parseThumbs() at render time, enabling both innerHTML injection into a span element and attribute breakout via an onerror handler on a constructed img element.

  Product

  Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer

  Affected

  up to 2.4.30

  What to do

  Affects up to 2.4.30. Update Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Sep 5, 2026Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer: Stored Cross-Site ScriptingCVE-2026-8623 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post_content (class attribute of .dvcss element)' parameter in all versions up to, and including, 2.4.30 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload is embedded as a Base64-encoded JSON object in a CSS class name on a Custom HTML block; the frontend parseCSSElements() function decodes it client-side with atob() and JSON.parse() and renders the logo property as raw HTML, meaning no server-side or client-side sanitization intercepts the malicious script before DOM insertion.

  Product

  Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer

  Affected

  up to 2.4.30

  What to do

  Affects up to 2.4.30. Update Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Sep 5, 2026iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more: Stored Cross-Site ScriptingCVE-2026-77263 · WordPress plugins & themes · reported by WordfenceHigh 7.2

  The iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to, and including, 3.13.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit works by embedding KSES-allowed markup such as abbr title attributes and HTML comments in a submitted comment so that the global strtr() substitution strips substrings from an inert tag, mutating it into an executable element such as an img onerror handler that runs in the WordPress origin for any visitor, including logged-in administrators.

  Product

  iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more

  Affected

  up to 3.13.4

  What to do

  Affects up to 3.13.4. Update iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Sep 5, 2026iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more: Stored Cross-Site ScriptingCVE-2026-77233 · WordPress plugins & themes · reported by WordfenceHigh 7.2

  The iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via AdSense Regex Rewrite in all versions up to, and including, 3.13.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability only manifests when the 'Secondary' parser engine is active (parser_engine=default); it does not exist under the default 'new' DOM-based parser engine.

  Product

  iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more

  Affected

  up to 3.13.4

  What to do

  Affects up to 3.13.4. Update iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Sep 5, 2026Social Chat – Click To Chat App Button: Stored Cross-Site ScriptingCVE-2026-18404 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The Social Chat – Click To Chat App Button plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'consent_message' JSON Attribute in .qlwapp data-box in all versions up to, and including, 8.6.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit requires no user interaction beyond page load, as setting auto_open and consent_enabled to 'yes' in the injected data-box JSON causes the consent box — and the embedded script — to execute immediately on page load.

  Product

  Social Chat – Click To Chat App Button

  Affected

  up to 8.6.2

  What to do

  Affects up to 8.6.2. Update Social Chat – Click To Chat App Button to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Sep 5, 2026Events Manager - Calendar, Bookings, Tickets, and more!: Stored Cross-Site ScriptingCVE-2025-14945 · WordPress plugins & themes · reported by WordfenceMedium 5.4

  The Events Manager - Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Stored Cross-Site Scripting via event attribute values in all versions up to, and including, 7.3.3. This is due to insufficient input sanitization when storing attribute values (using only `wp_unslash()` without sanitization) and lack of output escaping when rendering the '#_ATT{key}' placeholder. This makes it possible for authenticated attackers, with Author-level access and above, or unauthenticated attackers when anonymous event submissions are enabled, to inject arbitrary web scripts that execute when any user views the affected event page.

  Product

  Events Manager - Calendar, Bookings, Tickets, and more!

  Affected

  up to 7.3.3

  What to do

  Affects up to 7.3.3. Update Events Manager - Calendar, Bookings, Tickets, and more! to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Sep 4, 2026E-cab Taxi Booking Manager for Woocommerce: Does not validate a client-supplied trip distance and base-price value on the server before pricing a bookingCVE-2026-84045 · WordPress plugins & themes · reported by WPScanMedium 5.3

  The E-cab Taxi Booking Manager for Woocommerce WordPress plugin before 2.0.5 does not validate a client-supplied trip distance and base-price value on the server before pricing a booking, allowing unauthenticated attackers to manipulate the order total down to zero and place real taxi-booking orders at an arbitrary price.

  Product

  E-cab Taxi Booking Manager for Woocommerce

  Fixed in

  2.0.5

  What to do

  Update E-cab Taxi Booking Manager for Woocommerce to 2.0.5 or newer.

  Full record and what to do →NVD recordwpscan.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.