Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
11,441 results · page 27 of 229
Oct 6, 2026Unauthenticated Cross Site Scripting (XSS) in ARForms <= 7.1.2 versions.CVE-2026-39766 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in ARForms <= 7.1.2 versions.
- What to do
- Update the plugin to the newest version.
Oct 6, 2026Shop Manager Privilege Escalation in Challan <= 3.7.88 versions.CVE-2026-39765 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Shop Manager Privilege Escalation in Challan <= 3.7.88 versions.
- What to do
- Update the plugin to the newest version.
Oct 6, 2026Unauthenticated SQL Injection in Radius Booking — Booking Calendar for Appointments & Services <= 1.0.19 versions.CVE-2026-39764 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in Radius Booking — Booking Calendar for Appointments & Services <= 1.0.19 versions.
- What to do
- Update the plugin to the newest version.
Oct 6, 2026Patterns In The Cloud Autoship Cloud for WooCommerce Subscription Products autoship-cloud: Missing AuthorizationCVE-2026-39762 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Patterns In The Cloud Autoship Cloud for WooCommerce Subscription Products autoship-cloud allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Autoship Cloud for WooCommerce Subscription Products: from n/a through 2.17.1.
- Product
- Patterns In The Cloud Autoship Cloud for WooCommerce Subscription Products autoship-cloud
- Affected
- up to 2.17.1
- What to do
- Affects up to 2.17.1. Update Patterns In The Cloud Autoship Cloud for WooCommerce Subscription Products autoship-cloud to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2026Unauthenticated Privilege Escalation in Meta Box AIO <= 3.7.1 versions.CVE-2026-39761 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated Privilege Escalation in Meta Box AIO <= 3.7.1 versions.
- What to do
- Update the plugin to the newest version.
Oct 6, 2026Employer / Sales Representative Arbitrary File Upload in Workreap Core <= 3.4.5 versions.CVE-2026-39759 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Employer / Sales Representative Arbitrary File Upload in Workreap Core <= 3.4.5 versions.
- What to do
- Update the plugin to the newest version.
Oct 6, 2026Unauthenticated Cross Site Scripting (XSS) in Midtrans-WooCommerce <= 2.32.3 versions.CVE-2026-39758 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Midtrans-WooCommerce <= 2.32.3 versions.
- What to do
- Update the plugin to the newest version.
Oct 6, 2026Subscriber Arbitrary File Upload in Taskbot <= 6.6 versions.CVE-2026-39757 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Subscriber Arbitrary File Upload in Taskbot <= 6.6 versions.
- What to do
- Update the plugin to the newest version.
Oct 6, 2026Unauthenticated Insecure Direct Object References (IDOR) in Wappointment <= 2.7.7 versions.CVE-2026-39756 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Insecure Direct Object References (IDOR) in Wappointment <= 2.7.7 versions.
- What to do
- Update the plugin to the newest version.
Oct 6, 2026Subscriber Arbitrary File Upload in WP Duplicate <= 1.1.11 versions.CVE-2026-39755 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Subscriber Arbitrary File Upload in WP Duplicate <= 1.1.11 versions.
- What to do
- Update the plugin to the newest version.
Oct 6, 2026Contributor Arbitrary File Download in Piotnet Addons For Elementor <= 7.1.71 versions.CVE-2026-39754 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Arbitrary File Download in Piotnet Addons For Elementor <= 7.1.71 versions.
- What to do
- Update the plugin to the newest version.
Oct 6, 2026Unauthenticated Privilege Escalation in Taskbot <= 6.6 versions.CVE-2026-39753 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated Privilege Escalation in Taskbot <= 6.6 versions.
- What to do
- Update the plugin to the newest version.
Oct 6, 2026Contributor Arbitrary File Deletion in Jobs for WordPress <= 2.8.2 versions.CVE-2026-39752 · WordPress plugins & themes · reported by PatchstackHigh 7.7
Contributor Arbitrary File Deletion in Jobs for WordPress <= 2.8.2 versions.
- What to do
- Update the plugin to the newest version.
Oct 6, 2026Unauthenticated Broken Access Control in PayPlug for WooCommerce (Official) <= 3.1.0 versions.CVE-2026-39751 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in PayPlug for WooCommerce (Official) <= 3.1.0 versions.
- What to do
- Update the plugin to the newest version.
Oct 6, 2026Unauthenticated Cross Site Scripting (XSS) in StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart <= 2.0.6 CVE-2026-39750 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart <= 2.0.6 versions.
- What to do
- Update the plugin to the newest version.
Oct 6, 2026Subscriber Broken Access Control in App for Cloudflare® <= 1.10.1 versions.CVE-2026-39749 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Subscriber Broken Access Control in App for Cloudflare® <= 1.10.1 versions.
- What to do
- Update the plugin to the newest version.
Oct 6, 2026Unauthenticated Cross Site Scripting (XSS) in EduMall <= 4.5.3 versions.CVE-2026-39748 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in EduMall <= 4.5.3 versions.
- What to do
- Update the plugin to the newest version.
Oct 6, 2026Subscriber SQL Injection in Woffice <= 5.4.35 versions.CVE-2026-39747 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Subscriber SQL Injection in Woffice <= 5.4.35 versions.
- What to do
- Update the plugin to the newest version.
Oct 6, 2026Unauthenticated SQL Injection in Booknetic <= 4.8.5 versions.CVE-2026-39746 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in Booknetic <= 4.8.5 versions.
- What to do
- Update the plugin to the newest version.
Oct 6, 2026Unauthenticated Cross Site Scripting (XSS) in Contact Form to DB by BestWebSoft <= 1.7.6 versions.CVE-2026-39745 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Contact Form to DB by BestWebSoft <= 1.7.6 versions.
- What to do
- Update the plugin to the newest version.
Oct 6, 2026Unauthenticated Cross Site Scripting (XSS) in Database for CF7 <= 1.2.6 versions.CVE-2026-39731 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Database for CF7 <= 1.2.6 versions.
- What to do
- Update the plugin to the newest version.
Oct 6, 2026Marcin Wise Chat wise-chat: Missing AuthorizationCVE-2026-39730 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Missing Authorization vulnerability in Marcin Wise Chat wise-chat allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Wise Chat: from n/a through 3.4.3.
- Product
- Marcin Wise Chat wise-chat
- Affected
- up to 3.4.3
- What to do
- Affects up to 3.4.3. Update Marcin Wise Chat wise-chat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2026Unauthenticated Sensitive Data Exposure in Edwiser Bridge <= 4.3.4 versions.CVE-2026-39729 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Unauthenticated Sensitive Data Exposure in Edwiser Bridge <= 4.3.4 versions.
- What to do
- Update the plugin to the newest version.
Oct 6, 2026Unauthenticated Server Side Request Forgery (SSRF) in Instapage Plugin <= 3.7.2 versions.CVE-2026-39728 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Unauthenticated Server Side Request Forgery (SSRF) in Instapage Plugin <= 3.7.2 versions.
- What to do
- Update the plugin to the newest version.
Oct 6, 2026Subscriber Cross Site Scripting (XSS) in WC Fields Factory <= 4.1.12 versions.CVE-2026-39727 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Subscriber Cross Site Scripting (XSS) in WC Fields Factory <= 4.1.12 versions.
- What to do
- Update the plugin to the newest version.
Oct 6, 2026Unauthenticated Cross Site Scripting (XSS) in Lumise Product Designer <= 2.1.1 versions.CVE-2026-39726 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Lumise Product Designer <= 2.1.1 versions.
- What to do
- Update the plugin to the newest version.
Oct 6, 2026Unauthenticated Cross Site Scripting (XSS) in HTTP Requests Manager <= 1.3.11 versions.CVE-2026-39724 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in HTTP Requests Manager <= 1.3.11 versions.
- What to do
- Update the plugin to the newest version.
Oct 6, 2026Unauthenticated Cross Site Scripting (XSS) in WPLMS <= 4.972 versions.CVE-2026-39722 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in WPLMS <= 4.972 versions.
- What to do
- Update the plugin to the newest version.
Oct 6, 2026Unauthenticated Cross Site Scripting (XSS) in Mapster WP Maps <= 2.0.4 versions.CVE-2026-39720 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Mapster WP Maps <= 2.0.4 versions.
- What to do
- Update the plugin to the newest version.
Oct 6, 2026Unauthenticated Server Side Request Forgery (SSRF) in PDF Smart Viewer for Elementor <= 1.0.4 versions.CVE-2026-39719 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Unauthenticated Server Side Request Forgery (SSRF) in PDF Smart Viewer for Elementor <= 1.0.4 versions.
- What to do
- Update the plugin to the newest version.
Oct 6, 2026Subscriber SQL Injection in Mooberry Book Manager 4.16.2 versions.CVE-2026-32581 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Subscriber SQL Injection in Mooberry Book Manager 4.16.2 versions.
- What to do
- Update the plugin to the newest version.
Oct 6, 2026Unauthenticated SQL Injection in WooCommerce Lottery <= 2.2.9 versions.CVE-2026-32580 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated SQL Injection in WooCommerce Lottery <= 2.2.9 versions.
- What to do
- Update the plugin to the newest version.
Oct 6, 2026Unauthenticated Arbitrary File Upload in Kognetiks Chatbot for WordPress <= 2.4.9 versions.CVE-2026-32579 · WordPress plugins & themes · reported by PatchstackCritical 10
Unauthenticated Arbitrary File Upload in Kognetiks Chatbot for WordPress <= 2.4.9 versions.
- What to do
- Update the plugin to the newest version.
Oct 6, 2026Subscriber Broken Access Control in ECPay Ecommerce for WooCommerce <= 1.1.2606090 versions.CVE-2026-32578 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Subscriber Broken Access Control in ECPay Ecommerce for WooCommerce <= 1.1.2606090 versions.
- What to do
- Update the plugin to the newest version.
Oct 6, 2026Unauthenticated Cross Site Scripting (XSS) in Frontend File Manager <= 23.6 versions.CVE-2026-32577 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Frontend File Manager <= 23.6 versions.
- What to do
- Update the plugin to the newest version.
Oct 6, 2026Unauthenticated Cross Site Scripting (XSS) in SUMO Affiliates Pro <= 11.7.0 versions.CVE-2026-32575 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in SUMO Affiliates Pro <= 11.7.0 versions.
- What to do
- Update the plugin to the newest version.
Oct 6, 2026EDGARROJAS Smart Forms smart-forms: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-32574 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in EDGARROJAS Smart Forms smart-forms allows DOM-Based XSS.This issue affects Smart Forms: from n/a through 2.6.104.
- Product
- EDGARROJAS Smart Forms smart-forms
- Affected
- up to 2.6.104
- What to do
- Affects up to 2.6.104. Update EDGARROJAS Smart Forms smart-forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2026Unauthenticated Cross Site Scripting (XSS) in WP User Frontend Pro <= 4.2.13 versions.CVE-2026-32572 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in WP User Frontend Pro <= 4.2.13 versions.
- What to do
- Update the plugin to the newest version.
Oct 6, 2026Subscriber Cross Site Scripting (XSS) in Ohio Extra <= 3.6.8 versions.CVE-2026-32571 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Subscriber Cross Site Scripting (XSS) in Ohio Extra <= 3.6.8 versions.
- What to do
- Update the plugin to the newest version.
Oct 6, 2026Unauthenticated Cross Site Scripting (XSS) in Progressify - Progressive Web App (PWA) <= 1.6.0 versions.CVE-2026-32570 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Progressify - Progressive Web App (PWA) <= 1.6.0 versions.
- What to do
- Update the plugin to the newest version.
Oct 6, 2026Unauthenticated Cross Site Scripting (XSS) in WP Media folder <= 6.2.2 versions.CVE-2026-32569 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in WP Media folder <= 6.2.2 versions.
- What to do
- Update the plugin to the newest version.
Oct 6, 2026Subscriber Remote Code Execution (RCE) in WooCommerce Designer Pro <= 1.9.33 versions.CVE-2026-32568 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Subscriber Remote Code Execution (RCE) in WooCommerce Designer Pro <= 1.9.33 versions.
- What to do
- Update the plugin to the newest version.
Oct 6, 2026Unauthenticated SQL Injection in WooCommerce Appointments <= 5.3.2 versions.CVE-2026-32557 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in WooCommerce Appointments <= 5.3.2 versions.
- What to do
- Update the plugin to the newest version.
Oct 6, 2026Subscriber SQL Injection in WP2LEADS <= 3.5.7 versions.CVE-2026-25434 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Subscriber SQL Injection in WP2LEADS <= 3.5.7 versions.
- What to do
- Update the plugin to the newest version.
Oct 6, 2026Subscriber Broken Access Control in WP2LEADS <= 3.5.7 versions.CVE-2026-25433 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Subscriber Broken Access Control in WP2LEADS <= 3.5.7 versions.
- What to do
- Update the plugin to the newest version.
Oct 6, 2026Crocoblock JetElements For Elementor jet-elements: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-105879 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetElements For Elementor jet-elements allows Stored XSS.This issue affects JetElements For Elementor: from n/a through 2.9.2.2.
- Product
- Crocoblock JetElements For Elementor jet-elements
- Affected
- up to 2.9.2.2
- What to do
- Affects up to 2.9.2.2. Update Crocoblock JetElements For Elementor jet-elements to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2026Subscriber SQL Injection in Paid Member Subscriptions <= 3.1.1 versions.CVE-2026-105317 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Subscriber SQL Injection in Paid Member Subscriptions <= 3.1.1 versions.
- What to do
- Update the plugin to the newest version.
Oct 6, 2026Unauthenticated Sensitive Data Exposure in SiteVault – Backup, Restore, Migration & Cloning <= 1.5.17 versions.CVE-2026-105071 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Sensitive Data Exposure in SiteVault – Backup, Restore, Migration & Cloning <= 1.5.17 versions.
- What to do
- Update the plugin to the newest version.
Oct 6, 2026Unauthenticated Privilege Escalation in Salon booking system <= 10.31.7 versions.CVE-2026-105070 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Unauthenticated Privilege Escalation in Salon booking system <= 10.31.7 versions.
- What to do
- Update the plugin to the newest version.
Oct 6, 2026Unauthenticated Cross Site Scripting (XSS) in WP Mailster <= 1.9.0.0 versions.CVE-2026-105061 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in WP Mailster <= 1.9.0.0 versions.
- What to do
- Update the plugin to the newest version.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. The WordPress, CMS and hosting-panel entries come from the National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan and others); we show who. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, a booking system, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.