Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
11,394 results · page 24 of 228
Oct 8, 2026ShortPixel ShortPixel Image Optimizer shortpixel-image-optimiser: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-103070 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ShortPixel ShortPixel Image Optimizer shortpixel-image-optimiser allows Stored XSS.This issue affects ShortPixel Image Optimizer: from n/a through 6.5.6.
- Product
- ShortPixel ShortPixel Image Optimizer shortpixel-image-optimiser
- Affected
- up to 6.5.6
- What to do
- Affects up to 6.5.6. Update ShortPixel ShortPixel Image Optimizer shortpixel-image-optimiser to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 8, 2026Wallet System for WooCommerce: Does not validate that a wallet transfer amount is positiveCVE-2026-93509 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not validate that a wallet transfer amount is positive, and computes the sender's new balance from a stale snapshot taken before crediting the recipient, allowing an authenticated attacker with Subscriber-level access to mint wallet funds for themselves or drain a specific victim's balance into their own account.
- Product
- Wallet System for WooCommerce
- Fixed in
- 2.8.0
- What to do
- Update Wallet System for WooCommerce to 2.8.0 or newer.
Oct 8, 2026Easy Digital Downloads: Does not consult the site's user registration setting before creating a WordPress accountCVE-2026-105190 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Easy Digital Downloads WordPress plugin before 3.7.1 does not consult the site's user registration setting before creating a WordPress account, allowing unauthenticated users to create an account and receive a logged-in session even when registration is disabled. The created account receives the site's default role.
- Product
- Easy Digital Downloads
- Fixed in
- 3.7.1
- What to do
- Update Easy Digital Downloads to 3.7.1 or newer.
Oct 8, 2026TutorStarter: Does not respect the site's user registration setting in one of its AJAX registration handlersCVE-2026-104671 · WordPress plugins & themes · reported by WPScanMedium 5.3
The TutorStarter WordPress theme before 4.0.4 does not respect the site's user registration setting in one of its AJAX registration handlers, allowing unauthenticated visitors to create WordPress user accounts even when user registration is disabled.
- Product
- TutorStarter
- Fixed in
- 4.0.4
- What to do
- Update TutorStarter to 4.0.4 or newer.
Oct 8, 2026Airwallex Online Payments Gateway: Does not verify that an incoming payment notification genuinely comes from the payment providerCVE-2026-103517 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Airwallex Online Payments Gateway WordPress plugin before 1.36.0 does not verify that an incoming payment notification genuinely comes from the payment provider when no webhook secret has been configured, allowing unauthenticated attackers to forge one and mark orders as paid without paying.
- Product
- Airwallex Online Payments Gateway
- Fixed in
- 1.36.0
- What to do
- Update Airwallex Online Payments Gateway to 1.36.0 or newer.
Oct 8, 2026Bricksforge: Unauthenticated arbitrary file uploadCVE-2026-85097 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Bricksforge plugin for WordPress is vulnerable to unauthenticated arbitrary file upload in versions up to, and including, 3.1.8.9. This is due to insufficient validation of the attacker-controlled URL field in the 'temporaryFileUploads' parameter during form submission. An unauthenticated attacker can first obtain a valid nonce via the bricksforge_regenerate_nonce AJAX endpoint, then upload a GIF/PHP polyglot file to the temporary upload directory where MIME type validation is correctly performed. Subsequently, the attacker can submit a form with a crafted 'temporaryFileUploads' parameter where the server-side file path points to the validated GIF file, but the attacker-controlled url field ends with a .php extension. This makes it possible for unauthenticated attackers to upload and execute arbitrary PHP code on the server.
- Product
- Bricksforge
- Affected
- up to 3.1.8.9
- What to do
- Affects up to 3.1.8.9. Update Bricksforge to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 8, 2026Track Orders for WooCommerce: Does not verify ownership of an order before returning its billing detailsCVE-2026-94275 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Track Orders for WooCommerce WordPress plugin before 1.2.7 does not verify ownership of an order before returning its billing details, allowing unauthenticated attackers to obtain a customer's name, email address, phone number, postal address and order history by supplying that customer's email address.
- Product
- Track Orders for WooCommerce
- Fixed in
- 1.2.7
- What to do
- Update Track Orders for WooCommerce to 1.2.7 or newer.
Oct 8, 2026SMS Alert: Does not check that the acting administrator is allowed to manage the selected users before returning their stored billing phone numbersCVE-2026-94258 · WordPress plugins & themes · reported by WPScanLow 2.7
The SMS Alert WordPress plugin before 4.0.1 does not check that the acting administrator is allowed to manage the selected users before returning their stored billing phone numbers, allowing an administrator of one site on a multisite network to disclose the phone numbers of users who belong to other sites on that network. This affects multisite only, and requires the SMS Alert WordPress plugin before 4.0.1's gateway credentials to be stored on the acting administrator's own site.
- Product
- SMS Alert
- Fixed in
- 4.0.1
- What to do
- Update SMS Alert to 4.0.1 or newer.
Oct 8, 2026Wallet System for WooCommerce: Does not verify that the wallet account named in a withdrawal submission belongs to the user making itCVE-2026-94246 · WordPress plugins & themes · reported by WPScanMedium 6.3
The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not verify that the wallet account named in a withdrawal submission belongs to the user making it, allowing any authenticated user, such as a subscriber, to file a withdrawal request against another user's wallet for an amount and a payout destination of their choosing, and to indefinitely prevent that user from submitting withdrawals of their own.
- Product
- Wallet System for WooCommerce
- Fixed in
- 2.8.0
- What to do
- Update Wallet System for WooCommerce to 2.8.0 or newer.
Oct 8, 2026Wallet System for WooCommerce: Does not verify that the user submitting a wallet transfer owns the wallet being debitedCVE-2026-94245 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not verify that the user submitting a wallet transfer owns the wallet being debited, allowing any authenticated user, including one with only the Subscriber role, to move an arbitrary user's wallet balance, including an administrator's, into an account they control.
- Product
- Wallet System for WooCommerce
- Fixed in
- 2.8.0
- What to do
- Update Wallet System for WooCommerce to 2.8.0 or newer.
Oct 8, 2026Wallet System for WooCommerce: Does not perform any capability checkCVE-2026-94244 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not perform any capability check, and relies on a token any authenticated user can obtain from a front-end page, before generating a report containing every customer's wallet transaction history, allowing any authenticated user, such as a subscriber, to disclose all users' names, email addresses, roles, transaction amounts, payment methods and dates.
- Product
- Wallet System for WooCommerce
- Fixed in
- 2.8.0
- What to do
- Update Wallet System for WooCommerce to 2.8.0 or newer.
Oct 8, 2026BackWPup: Does not properly restrict the destination path of files extracted during a backup restoreCVE-2026-86828 · WordPress plugins & themes · reported by WPScanMedium 6.6
The BackWPup WordPress plugin before 5.7.7 does not properly restrict the destination path of files extracted during a backup restore when its fallback archive library is used, allowing high-privileged users to write files outside the intended restore directory, potentially leading to remote code execution.
- Product
- BackWPup
- Fixed in
- 5.7.7
- What to do
- Update BackWPup to 5.7.7 or newer.
Oct 8, 2026BackWPup: Does not verify that a request to its cron-triggered backup execution handler actually originates from WordPress's internal scheduled-event dispatchCVE-2026-86827 · WordPress plugins & themes · reported by WPScanMedium 5.3
The BackWPup WordPress plugin before 5.7.7 does not verify that a request to its cron-triggered backup execution handler actually originates from WordPress's internal scheduled-event dispatch, allowing unauthenticated attackers to force any existing backup job to run immediately, independent of its configured trigger type or schedule.
- Product
- BackWPup
- Fixed in
- 5.7.7
- What to do
- Update BackWPup to 5.7.7 or newer.
Oct 8, 2026BackWPup: Does not properly restrict web access to the working directory it uses during backup restoresCVE-2026-86826 · WordPress plugins & themes · reported by WPScanMedium 5.9
The BackWPup WordPress plugin before 5.7.7 does not properly restrict web access to the working directory it uses during backup restores, allowing unauthenticated attackers, on webservers that do not honour .htaccess rules such as NGINX, to download the full backup archive (database dump and site files, including credentials and secret keys) left behind by an interrupted restore.
- Product
- BackWPup
- Fixed in
- 5.7.7
- What to do
- Update BackWPup to 5.7.7 or newer.
Oct 8, 2026Database Addon For WPForms ( wpforms entries ): Does not verify the CSRF nonceCVE-2026-105260 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Database Addon For WPForms ( wpforms entries ) WordPress plugin before 1.1.1 does not verify the CSRF nonce when the field is omitted and performs no capability check of its own, allowing attackers to delete arbitrary stored form entries by tricking a logged-in administrator into loading a crafted page.
- Product
- Database Addon For WPForms ( wpforms entries )
- Fixed in
- 1.1.1
- What to do
- Update Database Addon For WPForms ( wpforms entries ) to 1.1.1 or newer.
Oct 8, 2026Appointment Booking: Does not verify that the caller owns the order referenced by an order-item identifier before rendering that order's confirmation summaryCVE-2026-105198 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Appointment Booking Plugin WordPress plugin before 5.7.3 does not verify that the caller owns the order referenced by an order-item identifier before rendering that order's confirmation summary, letting an unauthenticated visitor retrieve any customer's name, contact details and order confirmation code by supplying a sequential order-item id.
- Product
- Appointment Booking
- Fixed in
- 5.7.3
- What to do
- Update Appointment Booking to 5.7.3 or newer.
Oct 8, 2026Appointment Booking: Does not verify that a backend staff user is authorized to act on the specific record targeted for deletionCVE-2026-105197 · WordPress plugins & themes · reported by WPScanLow 2.7
The Appointment Booking Plugin WordPress plugin before 5.6.5 does not verify that a backend staff user is authorized to act on the specific record targeted for deletion, allowing an authenticated user with a record-scoped staff role to irreversibly delete any order, customer, or transaction on the site, including records belonging to other staff and outside their assigned scope.
- Product
- Appointment Booking
- Fixed in
- 5.6.5
- What to do
- Update Appointment Booking to 5.6.5 or newer.
Oct 8, 2026Appointment Booking: Does not enforce per-record authorization on several of its AI Abilities API actionsCVE-2026-105196 · WordPress plugins & themes · reported by WPScanLow 3.3
The Appointment Booking Plugin WordPress plugin before 5.6.9 does not enforce per-record authorization on several of its AI Abilities API actions, allowing an authenticated user holding the LatePoint Agent role, normally restricted to their own records, to read and modify other agents' profile data and read other agents' bookings and associated customer details when the Abilities API feature is enabled.
- Product
- Appointment Booking
- Fixed in
- 5.6.9
- What to do
- Update Appointment Booking to 5.6.9 or newer.
Oct 8, 2026Booking Calendar: Does not adequately restrictCVE-2026-105195 · WordPress plugins & themes · reported by WPScanLow 2.7
The Booking Calendar WordPress plugin before 11.8.3 does not adequately restrict which options a lower-privileged user can load through one of its settings handlers, allowing users with the Editor role and above to disclose the values of arbitrary WordPress options, including core site configuration.
- Product
- Booking Calendar
- Fixed in
- 11.8.3
- What to do
- Update Booking Calendar to 11.8.3 or newer.
Oct 8, 2026Easy Digital Downloads: Does not restrict a block's order data to the current userCVE-2026-105194 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Easy Digital Downloads WordPress plugin before 3.7.1 does not restrict a block's order data to the current user, allowing users with subscriber-level access to view other customers' recent order products and obtain signed download links that grant access to paid digital files without purchase.
- Product
- Easy Digital Downloads
- Fixed in
- 3.7.1
- What to do
- Update Easy Digital Downloads to 3.7.1 or newer.
Oct 8, 2026Booking Calendar: Does not generate its per-booking access hashes with sufficient entropyCVE-2026-105193 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Booking Calendar WordPress plugin before 11.8 does not generate its per-booking access hashes with sufficient entropy, deriving each from a low-entropy time-seeded value, which can allow unauthenticated attackers who are able to determine a booking's creation time to predict the hash and then read that booking's personal data or modify the booking in place.
- Product
- Booking Calendar
- Fixed in
- 11.8
- What to do
- Update Booking Calendar to 11.8 or newer.
Oct 8, 2026Image Photo Gallery Final Tiles Grid: Does not sanitise several gallery configuration values that can be overridden through its gallery shortcode before printing them into an inline script blockCVE-2026-104646 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.14 does not sanitise several gallery configuration values that can be overridden through its gallery shortcode before printing them into an inline script block, allowing users with contributor-level access and above to inject arbitrary JavaScript that executes in the session of anyone viewing the post, including an administrator previewing a pending submission. No gallery ownership is required: any gallery that already exists on the site can be referenced.
- Product
- Image Photo Gallery Final Tiles Grid
- Fixed in
- 3.6.14
- What to do
- Update Image Photo Gallery Final Tiles Grid to 3.6.14 or newer.
Oct 8, 2026Image Photo Gallery Final Tiles Grid: Does not properly verify authorization on several of its gallery and image management actionsCVE-2026-104645 · WordPress plugins & themes · reported by WPScanLow 2.7
The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.14 does not properly verify authorization on several of its gallery and image management actions, checking ownership against a different object than the one being acted on, or omitting the check entirely, allowing any authenticated user with contributor-level access or above to clone, modify and reorder galleries and images belonging to other users and to write Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.14 metadata onto arbitrary posts they do not own.
- Product
- Image Photo Gallery Final Tiles Grid
- Fixed in
- 3.6.14
- What to do
- Update Image Photo Gallery Final Tiles Grid to 3.6.14 or newer.
Oct 8, 2026Frontend Dashboard: Does not perform any authorisation or nonce check on actions available to unauthenticated users that call an attacker-chosen PHP function or class method with the request dataCVE-2026-103692 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Frontend Dashboard WordPress plugin before 3.0.5 does not perform any authorisation or nonce check on actions available to unauthenticated users that call an attacker-chosen PHP function or class method with the request data, allowing unauthenticated users to take over any account, including administrators.
- Product
- Frontend Dashboard
- Fixed in
- 3.0.5
- What to do
- Update Frontend Dashboard to 3.0.5 or newer.
Oct 8, 2026Ultimate Multisite: Does not require authentication before a logged-out checkout is linked toCVE-2026-103646 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Ultimate Multisite WordPress plugin before 2.17.0 does not require authentication before a logged-out checkout is linked to, and logged in as, an existing WordPress account matching the submitted email address, and its duplicate-account check normalizes that address differently from the lookup used to create the customer, so an unauthenticated attacker can log in as any existing user, including a Network Super Admin, whose email address they know. This bypass is not addressed by the 2.15.1 fix for CVE-2026-75957 and remains exploitable in all versions up to and including 2.16.1, the releases that fix was expected to cover. Exploitation requires a checkout form configured without a password field (auto-generated password) and a target account that has no existing customer record in the Ultimate Multisite WordPress plugin before 2.17.0.
- Product
- Ultimate Multisite
- Affected
- up to 2.16.1
- Fixed in
- 2.17.0
- What to do
- Update Ultimate Multisite to 2.17.0 or newer.
Oct 8, 2026GPTranslate: Does not properly restrict who can store translationsCVE-2026-103309 · WordPress plugins & themes · reported by WPScanHigh 7.5
The GPTranslate WordPress plugin before 2.34.14 does not properly restrict who can store translations, and does not escape them when outputting them in translated pages, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks when server-side translations are enabled.
- Product
- GPTranslate
- Fixed in
- 2.34.14
- What to do
- Update GPTranslate to 2.34.14 or newer.
Oct 8, 2026Super Forms – Drag & Drop Form Builder: Arbitrary Directory DeletionCVE-2026-17609 · WordPress plugins & themes · reported by WordfenceCritical 9.1
The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Arbitrary Directory Deletion in all versions up to, and including, 6.3.316 via the submit_form function. This is due to insufficient validation of attacker-controlled JSON field declarations against the actual form schema, combined with a non-effective ABSPATH guard that dirname() trivially bypasses by stripping the trailing slash. This makes it possible for unauthenticated attackers to recursively delete arbitrary directories on the server, including the WordPress root directory. Exploitation requires that an administrator has enabled the 'Delete files from server after form submissions' setting, though this is a documented and commonly-enabled feature.
- Product
- Super Forms – Drag & Drop Form Builder
- Affected
- up to 6.3.316
- What to do
- Affects up to 6.3.316. Update Super Forms – Drag & Drop Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 8, 2026Super Forms – Drag & Drop Form Builder: Unrestricted File Type UploadCVE-2026-17196 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Unrestricted File Type Upload in all versions up to, and including, 6.3.316 via the upload_files function. This is due to missing file type validation in the upload_files function, which reads and applies an attacker-controlled extensions string from _super_elements post meta verbatim as the allowed MIME type map. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload files that may be executable, which makes remote code execution possible. The attack requires a preceding step: poisoning the _super_elements post meta via the super_save_form AJAX handler, which lacks a capability and nonce check but requires the attacker to be authenticated as at minimum a Subscriber-level user; the subsequent file upload via super_upload_files requires no authentication at all.
- Product
- Super Forms – Drag & Drop Form Builder
- Affected
- up to 6.3.316
- What to do
- Affects up to 6.3.316. Update Super Forms – Drag & Drop Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 7, 2026Uncanny Automator – AI + Automation for WordPress | AI Agent, AI Page Builder, Free AI Usage Included: PHP Object InjectionCVE-2026-82627 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Uncanny Automator – AI + Automation for WordPress | AI Agent, AI Page Builder, Free AI Usage Included plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 7.6.1.1 via deserialization of untrusted input. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject a PHP Object when a third-party integration plugin (such as PeepSo, MailPoet, WPForms, etc) is installed and a recipe is configured that stores attacker-controlled data as trigger meta. The additional presence of a POP chain within Uncanny Automator allows attackers to delete arbitrary files on the server.
- Product
- Uncanny Automator – AI + Automation for WordPress | AI Agent, AI Page Builder, Free AI Usage Included
- Affected
- up to 7.6.1.1
- What to do
- Affects up to 7.6.1.1. Update Uncanny Automator – AI + Automation for WordPress | AI Agent, AI Page Builder, Free AI Usage Included to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 7, 2026Aurora Heatmap: Stored Cross-Site ScriptingCVE-2026-94154 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Aurora Heatmap plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter in all versions up to, and including, 1.7.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever an admin user clicks the injected heatmap link.
- Product
- Aurora Heatmap
- Affected
- up to 1.7.2
- What to do
- Affects up to 1.7.2. Update Aurora Heatmap to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 7, 2026LatePoint - Appointment Booking & Reservation: Insecure Direct Object ReferenceCVE-2026-17538 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The LatePoint - Appointment Booking & Reservation plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 5.6.9. This is due to the process_step_customer() function using is_user_logged_in() as the sole gate before merging POSTed customer data into an existing LatePoint customer, without any ownership checks. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify the personal information (first name, last name, email, phone, notes) of arbitrary LatePoint customers, and, when the contact_merge setting is 'phone', to overwrite the victim's email address and take over the account via a password reset.
- Product
- LatePoint - Appointment Booking & Reservation
- Affected
- up to 5.6.9
- What to do
- Affects up to 5.6.9. Update LatePoint - Appointment Booking & Reservation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 7, 2026WPMU DEV Forminator: Missing AuthorizationCVE-2026-96335 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in WPMU DEV Forminator allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Forminator: from n/a through 1.57.2.
- Product
- WPMU DEV Forminator
- Affected
- up to 1.57.2
- What to do
- Affects up to 1.57.2. Update WPMU DEV Forminator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 7, 2026Liquid Web / StellarWP The Events Calendar: Deserialization of Untrusted DataCVE-2026-95606 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in Liquid Web / StellarWP The Events Calendar allows Object Injection. This issue affects The Events Calendar: from n/a through 6.17.4.
- Product
- Liquid Web / StellarWP The Events Calendar
- Affected
- up to 6.17.4
- What to do
- Affects up to 6.17.4. Update Liquid Web / StellarWP The Events Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 7, 2026Passionate Programmer Peter WP Data Access: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-95605 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Passionate Programmer Peter WP Data Access allows Blind SQL Injection. This issue affects WP Data Access: from n/a through 5.5.82.
- Product
- Passionate Programmer Peter WP Data Access
- Affected
- up to 5.5.82
- What to do
- Affects up to 5.5.82. Update Passionate Programmer Peter WP Data Access to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 7, 2026Fontsplugin Disable and Remove Google Fonts | GDPR & DSGVO friendly disable-remove-google-fonts: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-95595 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Fontsplugin Disable and Remove Google Fonts | GDPR & DSGVO friendly disable-remove-google-fonts allows Reflected XSS. This issue affects Disable and Remove Google Fonts | GDPR & DSGVO friendly: from n/a through 2.0.2.
- Product
- Fontsplugin Disable and Remove Google Fonts | GDPR & DSGVO friendly disable-remove-google-fonts
- Affected
- up to 2.0.2
- What to do
- Affects up to 2.0.2. Update Fontsplugin Disable and Remove Google Fonts | GDPR & DSGVO friendly disable-remove-google-fonts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 7, 2026Unlimited Elements Unlimited Elements For Elementor: Deserialization of Untrusted DataCVE-2026-95534 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) allows Object Injection. This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 2.0.19.
- Product
- Unlimited Elements Unlimited Elements For Elementor
- Affected
- up to 2.0.19
- What to do
- Affects up to 2.0.19. Update Unlimited Elements Unlimited Elements For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 7, 2026Everest Forms: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-94670 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Everest Forms allows Reflected XSS. This issue affects Everest Forms: from n/a through 3.6.1.
- Product
- Everest Forms
- Affected
- up to 3.6.1
- What to do
- Affects up to 3.6.1. Update Everest Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 7, 2026Unlimited Elements Unlimited Elements For Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-94662 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) allows Stored XSS. This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 2.0.19.
- Product
- Unlimited Elements Unlimited Elements For Elementor
- Affected
- up to 2.0.19
- What to do
- Affects up to 2.0.19. Update Unlimited Elements Unlimited Elements For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 7, 202610Web Slider by 10Web slider-wd: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-42710 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in 10Web Slider by 10Web slider-wd allows Blind SQL Injection.This issue affects Slider by 10Web: from n/a through 1.2.63.
- Product
- 10Web Slider by 10Web slider-wd
- Affected
- up to 1.2.63
- What to do
- Affects up to 1.2.63. Update 10Web Slider by 10Web slider-wd to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 7, 2026AF themes WP Post Author wp-post-author: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-42708 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AF themes WP Post Author wp-post-author allows Blind SQL Injection.This issue affects WP Post Author: from n/a through 4.0.0.
- Product
- AF themes WP Post Author wp-post-author
- Affected
- up to 4.0.0
- What to do
- Affects up to 4.0.0. Update AF themes WP Post Author wp-post-author to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 7, 2026Piggly Dev Pix por Piggly: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-42714 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Piggly Dev Pix por Piggly (para Woocommerce) pix-por-piggly allows Blind SQL Injection.This issue affects Pix por Piggly (para Woocommerce): from n/a through 2.1.2.
- Product
- Piggly Dev Pix por Piggly
- Affected
- up to 2.1.2
- What to do
- Affects up to 2.1.2. Update Piggly Dev Pix por Piggly to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 7, 2026Gopiplus Post title marquee scroll post-title-marquee-scroll: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-42713 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Gopiplus Post title marquee scroll post-title-marquee-scroll allows Blind SQL Injection.This issue affects Post title marquee scroll: from n/a through 9.9.
- Product
- Gopiplus Post title marquee scroll post-title-marquee-scroll
- Affected
- up to 9.9
- What to do
- Affects up to 9.9. Update Gopiplus Post title marquee scroll post-title-marquee-scroll to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 7, 2026David Lingren Media LIbrary Assistant media-library-assistant: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-97294 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Lingren Media LIbrary Assistant media-library-assistant allows Stored XSS.This issue affects Media LIbrary Assistant: from n/a through 3.41.
- Product
- David Lingren Media LIbrary Assistant media-library-assistant
- Affected
- up to 3.41
- What to do
- Affects up to 3.41. Update David Lingren Media LIbrary Assistant media-library-assistant to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 7, 2026SERVIT Software Solutions affiliate-toolkit affiliate-toolkit-starter: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-42721 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in SERVIT Software Solutions affiliate-toolkit affiliate-toolkit-starter allows Blind SQL Injection.This issue affects affiliate-toolkit: from n/a through 3.9.1.
- Product
- SERVIT Software Solutions affiliate-toolkit affiliate-toolkit-starter
- Affected
- up to 3.9.1
- What to do
- Affects up to 3.9.1. Update SERVIT Software Solutions affiliate-toolkit affiliate-toolkit-starter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 7, 2026Sarah Giles Dynamic User Directory dynamic-user-directory: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-42720 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Sarah Giles Dynamic User Directory dynamic-user-directory allows Blind SQL Injection.This issue affects Dynamic User Directory: from n/a through 2.4.
- Product
- Sarah Giles Dynamic User Directory dynamic-user-directory
- Affected
- up to 2.4
- What to do
- Affects up to 2.4. Update Sarah Giles Dynamic User Directory dynamic-user-directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 7, 2026sc Internet Vivoo WP Rentals wprentals: Missing AuthorizationCVE-2026-27434 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in sc Internet Vivoo WP Rentals wprentals allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Rentals: from n/a through 3.14.2.
- Product
- sc Internet Vivoo WP Rentals wprentals
- Affected
- up to 3.14.2
- What to do
- Affects up to 3.14.2. Update sc Internet Vivoo WP Rentals wprentals to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 7, 2026WP Media Rocket Lazy Load rocket-lazy-load: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-105884 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Media Rocket Lazy Load rocket-lazy-load allows Stored XSS.This issue affects Rocket Lazy Load: from n/a through 2.4.0.
- Product
- WP Media Rocket Lazy Load rocket-lazy-load
- Affected
- up to 2.4.0
- What to do
- Affects up to 2.4.0. Update WP Media Rocket Lazy Load rocket-lazy-load to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 7, 2026WP Chill Modula Image Gallery modula-best-grid-gallery: Missing AuthorizationCVE-2026-105876 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WP Chill Modula Image Gallery modula-best-grid-gallery allows Retrieve Embedded Sensitive Data.This issue affects Modula Image Gallery: from n/a through 3.0.11.
- Product
- WP Chill Modula Image Gallery modula-best-grid-gallery
- Affected
- up to 3.0.11
- What to do
- Affects up to 3.0.11. Update WP Chill Modula Image Gallery modula-best-grid-gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 7, 2026BdThemes Prime Slider – Addons For Elementor bdthemes-prime-slider-lite: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-105875 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BdThemes Prime Slider – Addons For Elementor bdthemes-prime-slider-lite allows Stored XSS.This issue affects Prime Slider – Addons For Elementor: from n/a through 4.6.2.
- Product
- BdThemes Prime Slider – Addons For Elementor bdthemes-prime-slider-lite
- Affected
- up to 4.6.2
- What to do
- Affects up to 4.6.2. Update BdThemes Prime Slider – Addons For Elementor bdthemes-prime-slider-lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 7, 2026BdThemes Element Pack Elementor Addons bdthemes-element-pack-lite: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-105873 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BdThemes Element Pack Elementor Addons bdthemes-element-pack-lite allows Stored XSS.This issue affects Element Pack Elementor Addons: from n/a through 8.8.6.
- Product
- BdThemes Element Pack Elementor Addons bdthemes-element-pack-lite
- Affected
- up to 8.8.6
- What to do
- Affects up to 8.8.6. Update BdThemes Element Pack Elementor Addons bdthemes-element-pack-lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. The WordPress, CMS and hosting-panel entries come from the National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan and others); we show who. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, a booking system, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.