Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
13,899 results · page 25 of 278
Oct 9, 2026Magepeople inc: Missing AuthorizationCVE-2026-95589 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Magepeople inc. Deposits and Partial Payments for WooCommerce advanced-partial-payment-or-deposit-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Deposits and Partial Payments for WooCommerce: from n/a through 4.0.1.
- Product
- Magepeople inc
- Affected
- up to 4.0.1
- What to do
- Affects up to 4.0.1. Update Magepeople inc to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 9, 2026Dimitri Grassi Salon booking system salon-booking-system: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-94668 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dimitri Grassi Salon booking system salon-booking-system allows Reflected XSS.This issue affects Salon booking system: from n/a through 10.31.5.
- Product
- Dimitri Grassi Salon booking system salon-booking-system
- Affected
- up to 10.31.5
- What to do
- Affects up to 10.31.5. Update Dimitri Grassi Salon booking system salon-booking-system to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 9, 2026Crocoblock JetReviews jet-reviews: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-94667 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetReviews jet-reviews allows Stored XSS.This issue affects JetReviews: from n/a through 3.1.2.
- Product
- Crocoblock JetReviews jet-reviews
- Affected
- up to 3.1.2
- What to do
- Affects up to 3.1.2. Update Crocoblock JetReviews jet-reviews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 9, 2026ZealousWeb Generate PDF using Contact Form 7 generate-pdf-using-contact-form-7: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2026-94666 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ZealousWeb Generate PDF using Contact Form 7 generate-pdf-using-contact-form-7 allows Path Traversal.This issue affects Generate PDF using Contact Form 7: from n/a through 4.2.1.
- Product
- ZealousWeb Generate PDF using Contact Form 7 generate-pdf-using-contact-form-7
- Affected
- up to 4.2.1
- What to do
- Affects up to 4.2.1. Update ZealousWeb Generate PDF using Contact Form 7 generate-pdf-using-contact-form-7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 9, 2026Mamunur Rashid Classified Listing classified-listing: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-94665 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mamunur Rashid Classified Listing classified-listing allows Stored XSS.This issue affects Classified Listing: from n/a through 6.1.2.
- Product
- Mamunur Rashid Classified Listing classified-listing
- Affected
- up to 6.1.2
- What to do
- Affects up to 6.1.2. Update Mamunur Rashid Classified Listing classified-listing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 9, 2026add-ons: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2026-94664 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in add-ons.org PDF for Contact Form 7 pdf-for-contact-form-7 allows Path Traversal.This issue affects PDF for Contact Form 7: from n/a through 7.1.0.
- Product
- add-ons
- Affected
- up to 7.1.0
- What to do
- Affects up to 7.1.0. Update add-ons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 9, 2026Metagauss ProfileGrid profilegrid-user-profiles-groups-and-communities: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-94663 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Metagauss ProfileGrid profilegrid-user-profiles-groups-and-communities allows Blind SQL Injection.This issue affects ProfileGrid: from n/a through 6.0.0.2.
- Product
- Metagauss ProfileGrid profilegrid-user-profiles-groups-and-communities
- Affected
- up to 6.0.0.2
- What to do
- Affects up to 6.0.0.2. Update Metagauss ProfileGrid profilegrid-user-profiles-groups-and-communities to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 9, 2026Crocoblock JetBlog jet-blog: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-94661 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetBlog jet-blog allows Reflected XSS.This issue affects JetBlog: from n/a through 2.4.10.
- Product
- Crocoblock JetBlog jet-blog
- Affected
- up to 2.4.10
- What to do
- Affects up to 2.4.10. Update Crocoblock JetBlog jet-blog to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 9, 2026Stiofan UsersWP userswp: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-94641 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Stiofan UsersWP userswp allows Reflected XSS.This issue affects UsersWP: from n/a through 1.2.73.
- Product
- Stiofan UsersWP userswp
- Affected
- up to 1.2.73
- What to do
- Affects up to 1.2.73. Update Stiofan UsersWP userswp to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 9, 2026Stiofan BlockStrap Page Builder - Bootstrap Blocks blockstrap-page-builder-blocks: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-94632 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Stiofan BlockStrap Page Builder - Bootstrap Blocks blockstrap-page-builder-blocks allows Reflected XSS.This issue affects BlockStrap Page Builder - Bootstrap Blocks: from n/a through 0.1.58.
- Product
- Stiofan BlockStrap Page Builder - Bootstrap Blocks blockstrap-page-builder-blocks
- Affected
- up to 0.1.58
- What to do
- Affects up to 0.1.58. Update Stiofan BlockStrap Page Builder - Bootstrap Blocks blockstrap-page-builder-blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 9, 2026WP Hosting AS Pay with Vipps for WooCommerce woo-vipps: Deserialization of Untrusted DataCVE-2026-94568 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Deserialization of Untrusted Data vulnerability in WP Hosting AS Pay with Vipps for WooCommerce woo-vipps allows Object Injection.This issue affects Pay with Vipps for WooCommerce: from n/a through 6.2.0.
- Product
- WP Hosting AS Pay with Vipps for WooCommerce woo-vipps
- Affected
- up to 6.2.0
- What to do
- Affects up to 6.2.0. Update WP Hosting AS Pay with Vipps for WooCommerce woo-vipps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 9, 2026PX-lab Zombify zombify: Unrestricted Upload of File with Dangerous TypeCVE-2026-94503 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in PX-lab Zombify zombify allows Upload a Web Shell to a Web Server.This issue affects Zombify: from n/a through 1.7.7.
- Product
- PX-lab Zombify zombify
- Affected
- up to 1.7.7
- What to do
- Affects up to 1.7.7. Update PX-lab Zombify zombify to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 9, 2026Muffingroup Betheme betheme: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-94415 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Muffingroup Betheme betheme allows Reflected XSS.This issue affects Betheme: from n/a through 28.5.8.
- Product
- Muffingroup Betheme betheme
- Affected
- up to 28.5.8
- What to do
- Affects up to 28.5.8. Update Muffingroup Betheme betheme to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 9, 2026Heateor Support Sassy Social Share sassy-social-share: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-94170 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Heateor Support Sassy Social Share sassy-social-share allows Reflected XSS.This issue affects Sassy Social Share: from n/a through 3.3.79.
- Product
- Heateor Support Sassy Social Share sassy-social-share
- Affected
- up to 3.3.79
- What to do
- Affects up to 3.3.79. Update Heateor Support Sassy Social Share sassy-social-share to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 9, 2026Extend Themes Kubio AI Page Builder kubio: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-94167 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Extend Themes Kubio AI Page Builder kubio allows Reflected XSS.This issue affects Kubio AI Page Builder: from n/a through 2.9.3.
- Product
- Extend Themes Kubio AI Page Builder kubio
- Affected
- up to 2.9.3
- What to do
- Affects up to 2.9.3. Update Extend Themes Kubio AI Page Builder kubio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 9, 2026UpSolution UpSolution Core us-core: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-94166 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in UpSolution UpSolution Core us-core allows Reflected XSS.This issue affects UpSolution Core: from n/a through 8.44.
- Product
- UpSolution UpSolution Core us-core
- Affected
- up to 8.44
- What to do
- Affects up to 8.44. Update UpSolution UpSolution Core us-core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 9, 2026ThemeGoods Grand Restaurant grandrestaurant: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-94161 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods Grand Restaurant grandrestaurant allows Reflected XSS.This issue affects Grand Restaurant: from n/a before 7.0.11.
- Product
- ThemeGoods Grand Restaurant grandrestaurant
- Fixed in
- 7.0.11
- What to do
- Update ThemeGoods Grand Restaurant grandrestaurant to 7.0.11 or newer.
Oct 9, 2026KlbTheme Total Donations totaldonations: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-94159 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in KlbTheme Total Donations totaldonations allows Stored XSS.This issue affects Total Donations: from n/a through 2.0.5.
- Product
- KlbTheme Total Donations totaldonations
- Affected
- up to 2.0.5
- What to do
- Affects up to 2.0.5. Update KlbTheme Total Donations totaldonations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 9, 2026bkninja Gloria Admin Panel gloria-admin-panel: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-94158 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bkninja Gloria Admin Panel gloria-admin-panel allows Reflected XSS.This issue affects Gloria Admin Panel: from n/a through 1.3.
- Product
- bkninja Gloria Admin Panel gloria-admin-panel
- Affected
- up to 1.3
- What to do
- Affects up to 1.3. Update bkninja Gloria Admin Panel gloria-admin-panel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 9, 2026Shinetheme Traveler traveler: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-93947 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Shinetheme Traveler traveler allows Blind SQL Injection.This issue affects Traveler: from n/a through 3.2.9.
- Product
- Shinetheme Traveler traveler
- Affected
- up to 3.2.9
- What to do
- Affects up to 3.2.9. Update Shinetheme Traveler traveler to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 9, 2026Crocoblock JetBlocks For Elementor jet-blocks: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-62049 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetBlocks For Elementor jet-blocks allows Stored XSS.This issue affects JetBlocks For Elementor: from n/a through 1.5.2.1.
- Product
- Crocoblock JetBlocks For Elementor jet-blocks
- Affected
- up to 1.5.2.1
- What to do
- Affects up to 1.5.2.1. Update Crocoblock JetBlocks For Elementor jet-blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 9, 2026Kirki: Does not validate the host of a URL it is given before fetching itCVE-2026-84224 · WordPress plugins & themes · reported by WPScanMedium 4.1
The Kirki WordPress plugin before 6.3.2 does not validate the host of a URL it is given before fetching it, allowing users with editor-level access and above to make the site issue requests to internal services that are not otherwise reachable, and to tell which of those are live from the response.
- Product
- Kirki
- Fixed in
- 6.3.2
- What to do
- Update Kirki to 6.3.2 or newer.
Oct 9, 2026Kirki: Does not prevent shortcodes held in comments from being executedCVE-2026-84220 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Kirki WordPress plugin before 6.3.2 does not prevent shortcodes held in comments from being executed when it renders them, and displays comments regardless of their moderation status, allowing unauthenticated visitors to run shortcodes registered on the site and to read private custom fields of the page being viewed.
- Product
- Kirki
- Fixed in
- 6.3.2
- What to do
- Update Kirki to 6.3.2 or newer.
Oct 9, 2026WP Media WP Rocket wp-rocket: Missing AuthorizationCVE-2026-97075 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in WP Media WP Rocket wp-rocket allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Rocket: from n/a before 3.23.5.
- Product
- WP Media WP Rocket wp-rocket
- Fixed in
- 3.23.5
- What to do
- Update WP Media WP Rocket wp-rocket to 3.23.5 or newer.
Oct 9, 2026Redux Framework: Privilege escalationCVE-2025-14123 · WordPress plugins & themes · reported by WordfenceMedium 6.8
The Redux Framework plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 4.5.11. This is due to the plugin saving arbitrary meta keys under a registered option name without sufficient capability checks or key allowlist / restrictions. This makes it possible for authenticated attackers, with Subscriber-level access and above, to set an arbitrary role (e.g., Administrator) when performing a profile update if a plugin or theme using this framework has added at least one user profile field that leverages Redux_Users::set_profile/set_section/set_field.
- Product
- Redux Framework
- Affected
- up to 4.5.11
- What to do
- Affects up to 4.5.11. Update Redux Framework to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 9, 2026WP Media WP Rocket wp-rocket: Executable Regular Expression ErrorCVE-2026-97076 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Executable Regular Expression Error vulnerability in WP Media WP Rocket wp-rocket allows Code Injection.This issue affects WP Rocket: from n/a before 3.23.5.
- Product
- WP Media WP Rocket wp-rocket
- Fixed in
- 3.23.5
- What to do
- Update WP Media WP Rocket wp-rocket to 3.23.5 or newer.
Oct 9, 2026FooSales: Does not verify that an authenticated caller is entitled to actCVE-2026-93548 · WordPress plugins & themes · reported by WPScanHigh 8.8
The FooSales WordPress plugin before 1.43.3 does not verify that an authenticated caller is entitled to act as the user a request names, allowing any authenticated user to have the FooSales WordPress plugin before 1.43.3 act as an arbitrary other user, including an administrator, resulting in that user's account details being exposed and their account being taken over.
- Product
- FooSales
- Fixed in
- 1.43.3
- What to do
- Update FooSales to 1.43.3 or newer.
Oct 9, 2026SendPress Newsletters: Protects a logging endpoint with a hardcoded token that is the same on every site rather than a per-site secretCVE-2026-92990 · WordPress plugins & themes · reported by WPScanMedium 5.3
The SendPress Newsletters WordPress plugin through 1.26.1.20 protects a logging endpoint with a hardcoded token that is the same on every site rather than a per-site secret, allowing unauthenticated users to read newsletter sending logs, including recipient email addresses.
- Product
- SendPress Newsletters
- Affected
- up to 1.26.1.20
- What to do
- Affects up to 1.26.1.20. Update SendPress Newsletters to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 9, 2026SendPress Newsletters: Does not check the user's capability on several newsletter-management actionsCVE-2026-92989 · WordPress plugins & themes · reported by WPScanMedium 4.3
The SendPress Newsletters WordPress plugin through 1.26.1.20 does not check the user's capability on several newsletter-management actions, allowing any authenticated subscriber-level user to synchronise all site users into a mailing list and to drive the newsletter send queue.
- Product
- SendPress Newsletters
- Affected
- up to 1.26.1.20
- What to do
- Affects up to 1.26.1.20. Update SendPress Newsletters to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 9, 2026Social Web Suite: Does not restrictCVE-2026-88931 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Social Web Suite WordPress plugin through 4.1.12 does not restrict which of its settings may be written through an unauthenticated endpoint, allowing attackers to overwrite arbitrary Social Web Suite WordPress plugin through 4.1.12 options, including the shared secret that guards its own privileged endpoints.
- Product
- Social Web Suite
- Affected
- up to 4.1.12
- What to do
- Affects up to 4.1.12. Update Social Web Suite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 9, 2026UnitechPay: Does not verify the authenticity of the payment notifications it receivesCVE-2026-87841 · WordPress plugins & themes · reported by WPScanMedium 5.3
The UnitechPay WordPress plugin through 1.0.6.3 does not verify the authenticity of the payment notifications it receives, allowing unauthenticated attackers to mark orders placed through it as paid without any payment being made, as well as to force other orders into a failed state.
- Product
- UnitechPay
- Affected
- up to 1.0.6.3
- What to do
- Affects up to 1.0.6.3. Update UnitechPay to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 9, 2026SKU Error Fixer for WooCommerce: Does not perform any capability or nonce checks on two of its AJAX actionsCVE-2026-86850 · WordPress plugins & themes · reported by WPScanMedium 6.5
The SKU Error Fixer for WooCommerce WordPress plugin through 1.0 does not perform any capability or nonce checks on two of its AJAX actions, which are also available to unauthenticated users, allowing them to permanently delete product variations it classifies as obsolete, and to disclose those variations' details, with no recoverable copy left behind.
- Product
- SKU Error Fixer for WooCommerce
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update SKU Error Fixer for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 9, 2026The Ocean Pro Demos and Ocean eComm Treasure Box plugins for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content' parameter in all versions CVE-2026-81929 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Ocean Pro Demos and Ocean eComm Treasure Box plugins for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content' parameter in all versions up to, and including, 1.5.4, and 1.8.0, respectively, due to insufficient authorization, input sanitization, and output escaping in the Popup Builder's save_popup_content AJAX action. This makes it possible for unauthenticated attackers to inject arbitrary web scripts into a published Gutenberg popup that will execute whenever a user accesses a page on which the popup is configured to display. A valid premium license, the Popup Builder module, and at least one published Gutenberg popup configured for display are required.
- Affected
- up to 1.5.4
- What to do
- Affects up to 1.5.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 9, 2026Code Snippets: Does not sanitise and escape a user-supplied parameter before using it in a SQL query in some of its snippet-migration import endpointsCVE-2026-106097 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Code Snippets WordPress plugin before 3.10.0 does not sanitise and escape a user-supplied parameter before using it in a SQL query in some of its snippet-migration import endpoints, which are accessible to any user holding site-administration capabilities; on a WordPress Multisite network those belong to subsite Administrators, allowing a subsite Administrator who is not a network Super Admin to perform UNION-based SQL injection against shared network tables and disclose network-wide data such as other users' password hashes.
- Product
- Code Snippets
- Fixed in
- 3.10.0
- What to do
- Update Code Snippets to 3.10.0 or newer.
Oct 9, 2026Code Snippets: Does not perform a capability check on one of its snippet-management actions and derives the network scope of the targeted snippet from the request instead of from the stored recordCVE-2026-106095 · WordPress plugins & themes · reported by WPScanLow 3.3
The Code Snippets WordPress plugin before 3.10.0 does not perform a capability check on one of its snippet-management actions and derives the network scope of the targeted snippet from the request instead of from the stored record, allowing an administrator of a single subsite on a multisite network to activate, deactivate and reprioritise network-scoped snippets that run across every site in the network.
- Product
- Code Snippets
- Fixed in
- 3.10.0
- What to do
- Update Code Snippets to 3.10.0 or newer.
Oct 9, 2026AWP Classifieds: Does not validate the type of files extracted from an uploaded ZIP archive during its listing-import featureCVE-2025-15700 · WordPress plugins & themes · reported by WPScanHigh 8.8
The AWP Classifieds WordPress plugin before 4.4.9 does not validate the type of files extracted from an uploaded ZIP archive during its listing-import feature, allowing users with the AWP Classifieds WordPress plugin before 4.4.9's management capability to upload arbitrary PHP files to a publicly accessible, network-shared directory and achieve remote code execution.
- Product
- AWP Classifieds
- Fixed in
- 4.4.9
- What to do
- Update AWP Classifieds to 4.4.9 or newer.
Oct 8, 2026Kodezen LLC aBlocks ablocks: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-40804 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kodezen LLC aBlocks ablocks allows Reflected XSS.This issue affects aBlocks: from n/a through 2.16.0.
- Product
- Kodezen LLC aBlocks ablocks
- Affected
- up to 2.16.0
- What to do
- Affects up to 2.16.0. Update Kodezen LLC aBlocks ablocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 8, 2026MainWP MainWP Child mainwp-child: Deserialization of Untrusted DataCVE-2026-105436 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in MainWP MainWP Child mainwp-child allows Object Injection.This issue affects MainWP Child: from n/a through 6.2.1.
- Product
- MainWP MainWP Child mainwp-child
- Affected
- up to 6.2.1
- What to do
- Affects up to 6.2.1. Update MainWP MainWP Child mainwp-child to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 8, 2026Themeum Tutor LMS tutor: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')CVE-2026-42698 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Themeum Tutor LMS tutor allows Leveraging Race Conditions.This issue affects Tutor LMS: from n/a through 4.1.1.
- Product
- Themeum Tutor LMS tutor
- Affected
- up to 4.1.1
- What to do
- Affects up to 4.1.1. Update Themeum Tutor LMS tutor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 8, 2026Katie Seaborn Zotpress zotpress: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-27420 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Katie Seaborn Zotpress zotpress allows Stored XSS.This issue affects Zotpress: from n/a through 7.4.4.
- Product
- Katie Seaborn Zotpress zotpress
- Affected
- up to 7.4.4
- What to do
- Affects up to 7.4.4. Update Katie Seaborn Zotpress zotpress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 8, 2026Liquid Web / StellarWP WPComplete wpcomplete: Cross-Site Request Forgery (CSRF)CVE-2026-66479 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Liquid Web / StellarWP WPComplete wpcomplete allows Stored XSS.This issue affects WPComplete: from n/a through 2.9.5.6.
- Product
- Liquid Web / StellarWP WPComplete wpcomplete
- Affected
- up to 2.9.5.6
- What to do
- Affects up to 2.9.5.6. Update Liquid Web / StellarWP WPComplete wpcomplete to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 8, 2026Melapress WP 2FA wp-2fa: Cross-Site Request Forgery (CSRF)CVE-2026-62142 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Cross-Site Request Forgery (CSRF) vulnerability in Melapress WP 2FA wp-2fa allows Cross Site Request Forgery.This issue affects WP 2FA: from n/a through 4.1.0.
- Product
- Melapress WP 2FA wp-2fa
- Affected
- up to 4.1.0
- What to do
- Affects up to 4.1.0. Update Melapress WP 2FA wp-2fa to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 8, 2026Creator LMS Creator LMS creatorlms: Missing AuthorizationCVE-2026-62128 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Creator LMS Creator LMS creatorlms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Creator LMS: from n/a through 1.2.21.
- Product
- Creator LMS Creator LMS creatorlms
- Affected
- up to 1.2.21
- What to do
- Affects up to 1.2.21. Update Creator LMS Creator LMS creatorlms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 8, 2026MediaRon LLC WP Plugin Info Card wp-plugin-info-card: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-62127 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MediaRon LLC WP Plugin Info Card wp-plugin-info-card allows Stored XSS.This issue affects WP Plugin Info Card: from n/a through 6.3.5.
- Product
- MediaRon LLC WP Plugin Info Card wp-plugin-info-card
- Affected
- up to 6.3.5
- What to do
- Affects up to 6.3.5. Update MediaRon LLC WP Plugin Info Card wp-plugin-info-card to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 8, 2026WPMU DEV Forminator forminator: Cross-Site Request Forgery (CSRF)CVE-2026-106611 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in WPMU DEV Forminator forminator allows Cross Site Request Forgery.This issue affects Forminator: from n/a through 1.57.3.
- Product
- WPMU DEV Forminator forminator
- Affected
- up to 1.57.3
- What to do
- Affects up to 1.57.3. Update WPMU DEV Forminator forminator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 8, 2026Groundhogg HollerBox holler-box: Authorization Bypass Through User-Controlled KeyCVE-2026-106603 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Authorization Bypass Through User-Controlled Key vulnerability in Groundhogg HollerBox holler-box allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HollerBox: from n/a through 2.3.14.
- Product
- Groundhogg HollerBox holler-box
- Affected
- up to 2.3.14
- What to do
- Affects up to 2.3.14. Update Groundhogg HollerBox holler-box to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 8, 2026Liquid Web / StellarWP GiveWP give: Missing AuthorizationCVE-2026-106600 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Liquid Web / StellarWP GiveWP give allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GiveWP: from n/a through 4.18.0.
- Product
- Liquid Web / StellarWP GiveWP give
- Affected
- up to 4.18.0
- What to do
- Affects up to 4.18.0. Update Liquid Web / StellarWP GiveWP give to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 8, 2026Visual Composer Visual Composer Website Builder visualcomposer: Missing AuthorizationCVE-2026-106596 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Visual Composer Visual Composer Website Builder visualcomposer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Visual Composer Website Builder: from n/a through 45.16.3.
- Product
- Visual Composer Visual Composer Website Builder visualcomposer
- Affected
- up to 45.16.3
- What to do
- Affects up to 45.16.3. Update Visual Composer Visual Composer Website Builder visualcomposer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 8, 2026Liquid Web / StellarWP Event Tickets event-tickets: Authorization Bypass Through User-Controlled KeyCVE-2026-105893 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Authorization Bypass Through User-Controlled Key vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Manipulating User-Controlled Variables.This issue affects Event Tickets: from n/a through 5.30.0.1.
- Product
- Liquid Web / StellarWP Event Tickets event-tickets
- Affected
- up to 5.30.0.1
- What to do
- Affects up to 5.30.0.1. Update Liquid Web / StellarWP Event Tickets event-tickets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 8, 2026Liquid Web / StellarWP Event Tickets event-tickets: Missing AuthorizationCVE-2026-105891 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Tickets: from n/a through 5.30.0.1.
- Product
- Liquid Web / StellarWP Event Tickets event-tickets
- Affected
- up to 5.30.0.1
- What to do
- Affects up to 5.30.0.1. Update Liquid Web / StellarWP Event Tickets event-tickets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. The WordPress, CMS and hosting-panel entries come from the National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan and others); we show who. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, a booking system, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.