Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
19,369 results · page 28 of 388
Sep 12, 2026Socket Firewall (socketdev/socket-registry-firewall) in registry mode before 2.0.0 does not verify upstream TLS certificates by default.CVE-2026-90651 · Other software · Socket · reported by MITREHigh 8.1
Socket Firewall (socketdev/socket-registry-firewall) in registry mode before 2.0.0 does not verify upstream TLS certificates by default. When the api_ssl_verify and upstream_ssl_verify configuration keys are omitted from socket.yml, the generated configuration sets SOCKET_API_SSL_VERIFY='false' and UPSTREAM_SSL_VERIFY='false', and the OpenResty/Lua HTTP client used for outbound requests accepts any certificate, including self-signed and otherwise untrusted certificates, without validating the chain. An attacker positioned to intercept traffic between Socket Firewall and the Socket API or an upstream package registry can present a crafted certificate and modify responses in transit, including substituting malicious package content or altering the allow/block decisions the firewall enforces. Setting api_ssl_verify: true and upstream_ssl_verify: true enables verification; however, in versions before 1.1.334, the generated nginx configuration did not emit lua_ssl_trusted_certificate, and thus verification could not be used successfully without manually patching the generated configuration. Version 2.0.0 changes the default for both settings to true.
- Product
- Socket Firewall
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.socket.devgithub.com
Sep 12, 2026Product XML Feed Manager for WooCommerce: Does not restrictCVE-2026-87919 · WordPress plugins & themes · reported by WPScanMedium 4.9
The Product XML Feed Manager for WooCommerce WordPress plugin before 3.1.1 does not restrict which object method its product shortcode may call, nor check the user's capability over the targeted product, allowing users with contributor-level access to delete arbitrary WooCommerce products by previewing a post that contains the shortcode.
- Product
- Product XML Feed Manager for WooCommerce
- Fixed in
- 3.1.1
- What to do
- Update Product XML Feed Manager for WooCommerce to 3.1.1 or newer.
Sep 12, 2026WPBot: Does not perform any authorization or nonce check on several AJAX actions that relay prompts to its configured AI providersCVE-2026-87918 · WordPress plugins & themes · reported by WPScanMedium 5.3
The WPBot WordPress plugin before 8.5.7 does not perform any authorization or nonce check on several AJAX actions that relay prompts to its configured AI providers, allowing unauthenticated attackers to make those third-party API calls, and consume the associated cost, using the site's own configured API keys.
- Product
- WPBot
- Fixed in
- 8.5.7
- What to do
- Update WPBot to 8.5.7 or newer.
Sep 12, 2026WPBot: Does not perform any capability or nonce check on the AJAX action that lists stored chat sessionsCVE-2026-87916 · WordPress plugins & themes · reported by WPScanMedium 5.3
The WPBot WordPress plugin before 8.6.0 does not perform any capability or nonce check on the AJAX action that lists stored chat sessions, allowing unauthenticated attackers to retrieve the name, email address and phone number of every chat visitor by requesting a wide date range.
- Product
- WPBot
- Fixed in
- 8.6.0
- What to do
- Update WPBot to 8.6.0 or newer.
Sep 12, 2026Rox Appointment Booking: Does not perform any authorization check on the endpoint that returns a booking's confirmation detailsCVE-2026-87894 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Rox Appointment Booking WordPress plugin before 1.2.3 does not perform any authorization check on the endpoint that returns a booking's confirmation details, and each booking is addressed by a sequential numeric identifier, allowing unauthenticated attackers to read any customer's name, email, phone, booking details and payment status by enumerating that identifier.
- Product
- Rox Appointment Booking
- Fixed in
- 1.2.3
- What to do
- Update Rox Appointment Booking to 1.2.3 or newer.
Sep 12, 2026Rox Appointment Booking: Does not verify the order total or the selected payment method against its own server-side pricingCVE-2026-87892 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Rox Appointment Booking WordPress plugin before 1.2.0 does not verify the order total or the selected payment method against its own server-side pricing when creating a booking, allowing unauthenticated attackers to create confirmed bookings at an arbitrary price and to bypass the site's configured payment-method restrictions.
- Product
- Rox Appointment Booking
- Fixed in
- 1.2.0
- What to do
- Update Rox Appointment Booking to 1.2.0 or newer.
Sep 12, 2026Rox Appointment Booking: Does not perform any capability or authorization checkCVE-2026-87891 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Rox Appointment Booking WordPress plugin before 1.2.0 does not perform any capability or authorization check when saving its holiday schedule, allowing unauthenticated attackers to overwrite the dates the booking system treats as unavailable, which can block legitimate bookings or open dates the site owner intended to keep closed.
- Product
- Rox Appointment Booking
- Fixed in
- 1.2.0
- What to do
- Update Rox Appointment Booking to 1.2.0 or newer.
Sep 12, 2026YayPricing: Does not perform an authorization check on a REST route that saves its pricing rulesCVE-2026-87888 · WordPress plugins & themes · reported by WPScanHigh 8
The YayPricing WordPress plugin before 3.5.7 does not perform an authorization check on a REST route that saves its pricing rules, allowing users with the subscriber role and above to store JavaScript that executes in the browser of an administrator who opens the YayPricing WordPress plugin before 3.5.7's settings page.
- Product
- YayPricing
- Fixed in
- 3.5.7
- What to do
- Update YayPricing to 3.5.7 or newer.
Sep 12, 2026Zonify: Does not perform any capability or authentication check before returning the site's stored account login tokenCVE-2026-87842 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Zonify WordPress plugin before 1.0.5 does not perform any capability or authentication check before returning the site's stored account login token, allowing unauthenticated attackers to retrieve it and authenticate to the site owner's linked service account.
- Product
- Zonify
- Fixed in
- 1.0.5
- What to do
- Update Zonify to 1.0.5 or newer.
Sep 12, 2026Sprout Invoices: Does not perform a capability or ownership check before allowing a private note to be overwritten through one of its AJAX actionsCVE-2026-87797 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Sprout Invoices WordPress plugin before 20.8.16 does not perform a capability or ownership check before allowing a private note to be overwritten through one of its AJAX actions, allowing any authenticated user such as a subscriber to overwrite private notes on records belonging to other users.
- Product
- Sprout Invoices
- Fixed in
- 20.8.16
- What to do
- Update Sprout Invoices to 20.8.16 or newer.
Sep 12, 2026Add User Autocomplete: Does not perform any capability or nonce check before creating a pending site-membership invitation carrying a caller-supplied roleCVE-2026-87759 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Add User Autocomplete WordPress plugin before 1.2 does not perform any capability or nonce check before creating a pending site-membership invitation carrying a caller-supplied role, allowing any authenticated user, such as a subscriber, to grant themselves the administrator role on a multisite installation.
- Product
- Add User Autocomplete
- Fixed in
- 1.2
- What to do
- Update Add User Autocomplete to 1.2 or newer.
Sep 12, 2026WP Highlight Box: Does not escape some shortcode attributes before outputting them in a page where the shortcode is embeddedCVE-2026-86790 · WordPress plugins & themes · reported by WPScanMedium 6.8
The WP Highlight Box WordPress plugin through 1.0 does not escape some shortcode attributes before outputting them in a page where the shortcode is embedded, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- WP Highlight Box
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update WP Highlight Box to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 12, 2026WP Component: Does not have any capability or nonce checks on one of the actions it makes available to unauthenticated usersCVE-2026-85681 · WordPress plugins & themes · reported by WPScanCritical 9.8
The WP Component WordPress plugin through 2.2.4 does not have any capability or nonce checks on one of the actions it makes available to unauthenticated users, and it takes both the option name and the option value from the request, allowing unauthenticated attackers to overwrite any of the site's options. On a single site installation this leads to a full takeover, as registration can be enabled with a default role of administrator.
- Product
- WP Component
- Affected
- up to 2.2.4
- What to do
- Affects up to 2.2.4. Update WP Component to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 12, 2026WP images upload on piclect: Does not validate the name or type of uploaded files before writing them to a publicly accessible directoryCVE-2026-84171 · WordPress plugins & themes · reported by WPScanCritical 9.8
The WP images upload on piclect WordPress plugin through 1.0 does not validate the name or type of uploaded files before writing them to a publicly accessible directory, allowing unauthenticated attackers to upload arbitrary files and execute arbitrary code on the server.
- Product
- WP images upload on piclect
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update WP images upload on piclect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 12, 2026wpstorecart: Does not prevent directCVE-2026-84099 · WordPress plugins & themes · reported by WPScanHigh 8.1
The wpstorecart WordPress plugin through 5.0.7 does not prevent direct, unauthenticated access to a bundled add-on that deserializes user-supplied input without restricting the permitted classes, allowing unauthenticated attackers to inject arbitrary PHP objects, which may be escalated further when a suitable gadget chain is present on the site.
- Product
- wpstorecart
- Affected
- up to 5.0.7
- What to do
- Affects up to 5.0.7. Update wpstorecart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 12, 2026Album Cover Finder: Does not properly sanitize and escape a parameter before using it in a SQL queryCVE-2026-84047 · WordPress plugins & themes · reported by WPScanHigh 8.6
The Album Cover Finder WordPress plugin through 0.7.0 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks.
- Product
- Album Cover Finder
- Affected
- up to 0.7.0
- What to do
- Affects up to 0.7.0. Update Album Cover Finder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 12, 2026BEAR: Does not perform ownership checks on several handlers that return product data by a user-supplied identifierCVE-2026-84025 · WordPress plugins & themes · reported by WPScanLow 2.2
The BEAR WordPress plugin before 1.2.2 does not perform ownership checks on several handlers that return product data by a user-supplied identifier, allowing users who are restricted to their own products to read other owners' product information, including protected downloadable file URLs and private product metadata.
- Product
- BEAR
- Fixed in
- 1.2.2
- What to do
- Update BEAR to 1.2.2 or newer.
Sep 12, 2026BEAR: Does not verify a CSRF nonce before saving its meta field configurationCVE-2026-84024 · WordPress plugins & themes · reported by WPScanMedium 4.3
The BEAR WordPress plugin before 1.2.2 does not verify a CSRF nonce before saving its meta field configuration, allowing an attacker to overwrite that configuration by tricking a logged-in administrator into visiting a crafted page.
- Product
- BEAR
- Fixed in
- 1.2.2
- What to do
- Update BEAR to 1.2.2 or newer.
Sep 12, 2026BEAR: Does not verify a CSRF nonce or check user capabilities before updating taxonomy termsCVE-2026-84023 · WordPress plugins & themes · reported by WPScanMedium 6.5
The BEAR WordPress plugin before 1.2.2 does not verify a CSRF nonce or check user capabilities before updating taxonomy terms, allowing an attacker to modify arbitrary terms by tricking a logged-in privileged user into visiting a crafted page.
- Product
- BEAR
- Fixed in
- 1.2.2
- What to do
- Update BEAR to 1.2.2 or newer.
Sep 12, 2026Custom Menu Wizard Widget: Does not sanitize and escape several shortcode attributes before rendering them into HTMLCVE-2026-83532 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Custom Menu Wizard Widget WordPress plugin through 3.3.1 does not sanitize and escape several shortcode attributes before rendering them into HTML, allowing users with contributor-level access and above to inject arbitrary web scripts that execute when the affected content is viewed.
- Product
- Custom Menu Wizard Widget
- Affected
- up to 3.3.1
- What to do
- Affects up to 3.3.1. Update Custom Menu Wizard Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 12, 2026Masteriyo LMS: Does not verify ownership ofCVE-2026-82851 · WordPress plugins & themes · reported by WPScanLow 2.7
The Masteriyo LMS WordPress plugin before 3.4.1 does not verify ownership of, or restrict the type of, the records a user requests for download, allowing users with the instructor role to retrieve the full content and metadata of arbitrary posts, including other instructors' private and draft courses.
- Product
- Masteriyo LMS
- Fixed in
- 3.4.1
- What to do
- Update Masteriyo LMS to 3.4.1 or newer.
Sep 12, 2026Masteriyo LMS: Does not sanitise and escape one of its course fields before outputting it back in the course editorCVE-2026-82847 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Masteriyo LMS WordPress plugin before 3.4.1 does not sanitise and escape one of its course fields before outputting it back in the course editor, allowing users with the instructor role to perform Stored Cross-Site Scripting attacks against higher privileged users such as administrators.
- Product
- Masteriyo LMS
- Fixed in
- 3.4.1
- What to do
- Update Masteriyo LMS to 3.4.1 or newer.
Sep 12, 2026Masteriyo LMS: Does not prevent user-supplied values heldCVE-2026-82845 · WordPress plugins & themes · reported by WPScanCritical 9.9
The Masteriyo LMS WordPress plugin before 3.4.1 does not prevent user-supplied values held as metadata from being deserialized when they are read back, allowing users with a minimal account to inject arbitrary PHP objects and, by way of a class shipped in a library bundled with the Masteriyo LMS WordPress plugin before 3.4.1, write and execute arbitrary code on the server. A weaker form of the same issue is reachable without an account and yields an arbitrary file write rather than code execution.
- Product
- Masteriyo LMS
- Fixed in
- 3.4.1
- What to do
- Update Masteriyo LMS to 3.4.1 or newer.
Sep 12, 2026BE REST Endpoints: Does not perform any authorization check before allowing widgets to be readCVE-2026-81742 · WordPress plugins & themes · reported by WPScanHigh 8.8
The BE REST Endpoints WordPress plugin through 1.0.0 does not perform any authorization check before allowing widgets to be read, created, updated and deleted, and does not sanitize the values it stores in them, allowing unauthenticated users to inject arbitrary web scripts which will execute in the browser of any user visiting the site.
- Product
- BE REST Endpoints
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update BE REST Endpoints to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 12, 2026Export & Import WPBakery Page Builder: Does not perform any CSRF check on its template-import feature and does not sanitise the imported data before storing it and echoing it backCVE-2026-81429 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Export & Import WPBakery Page Builder WordPress plugin through 1.0.2 does not perform any CSRF check on its template-import feature and does not sanitise the imported data before storing it and echoing it back, allowing attackers to make a logged-in administrator import a crafted template via a forged request that results in Stored Cross-Site Scripting executed in the administrator's session.
- Product
- Export & Import WPBakery Page Builder
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update Export & Import WPBakery Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 12, 2026DS Ad Rotator: Does not perform any capability checkCVE-2026-81402 · WordPress plugins & themes · reported by WPScanCritical 9.8
The DS Ad Rotator WordPress plugin through 0.8 does not perform any capability check, nonce verification, or file-type validation on its image upload handler, allowing unauthenticated attackers to upload arbitrary files, including PHP, to a web-accessible directory, which can lead to remote code execution.
- Product
- DS Ad Rotator
- Affected
- up to 0.8
- What to do
- Affects up to 0.8. Update DS Ad Rotator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 12, 2026Gpx2Graphics: Does not perform a CSRF checkCVE-2026-81090 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Gpx2Graphics WordPress plugin through 0.3 does not perform a CSRF check when handling file uploads, nor validate the type of the uploaded file, allowing attackers to make a logged-in administrator upload arbitrary files such as PHP via a CSRF attack, leading to Remote Code Execution.
- Product
- Gpx2Graphics
- Affected
- up to 0.3
- What to do
- Affects up to 0.3. Update Gpx2Graphics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 12, 2026Yogeta WP Cloud: Does not validate a user-supplied file path before passing it to a file-read function on a public endpoint that lacks any authorization checkCVE-2026-80494 · WordPress plugins & themes · reported by WPScanHigh 8.6
The Yogeta WP Cloud WordPress plugin through 1.0 does not validate a user-supplied file path before passing it to a file-read function on a public endpoint that lacks any authorization check, allowing unauthenticated attackers to download arbitrary files from the server, including files containing sensitive credentials.
- Product
- Yogeta WP Cloud
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Yogeta WP Cloud to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 12, 2026SAMO Forms: Does not properly sanitise and escape user input before using it in SQL queries in several unauthenticated actionsCVE-2026-80491 · WordPress plugins & themes · reported by WPScanHigh 8.6
The SAMO Forms WordPress plugin through 1.0.0 does not properly sanitise and escape user input before using it in SQL queries in several unauthenticated actions, allowing unauthenticated attackers to perform SQL injection attacks.
- Product
- SAMO Forms
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update SAMO Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 12, 2026SureRank SEO: Does not exclude users' registered account email addresses from the structured data it outputs on public pages by defaultCVE-2026-78152 · WordPress plugins & themes · reported by WPScanMedium 5.3
The SureRank SEO WordPress plugin before 1.10.1 does not exclude users' registered account email addresses from the structured data it outputs on public pages by default, allowing unauthenticated visitors to obtain the email address of any user who has published content.
- Product
- SureRank SEO
- Fixed in
- 1.10.1
- What to do
- Update SureRank SEO to 1.10.1 or newer.
Sep 12, 2026Temporary Login Without Password: Does not prevent a temporary user from creating an Application PasswordCVE-2026-77753 · WordPress plugins & themes · reported by WPScanMedium 5.5
The Temporary Login Without Password WordPress plugin before 1.9.9 does not prevent a temporary user from creating an Application Password, and does not revoke one when the temporary access expires or is disabled, allowing the recipient of a temporary login to retain working access to the site over REST and XML-RPC after the administrator believes it has been withdrawn. The retained access carries whatever role was granted, which for the Temporary Login Without Password WordPress plugin before 1.9.9's main use case is Administrator.
- Product
- Temporary Login Without Password
- Fixed in
- 1.9.9
- What to do
- Update Temporary Login Without Password to 1.9.9 or newer.
Sep 12, 2026Temporary Login Without Password: Does not verify that the user requesting a temporary login holds network super admin rights before granting the new account those rightsCVE-2026-77752 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Temporary Login Without Password WordPress plugin before 1.9.9 does not verify that the user requesting a temporary login holds network super admin rights before granting the new account those rights, allowing an administrator of a single site on a multisite network to take over the whole network. The same missing check also allows an existing account, including the attacker's own, to be promoted.
- Product
- Temporary Login Without Password
- Fixed in
- 1.9.9
- What to do
- Update Temporary Login Without Password to 1.9.9 or newer.
Sep 12, 2026Booking for Appointments and Events Calendar: Does not verify that the user editing a customer or employee record is entitled to modify the WordPress account linked to itCVE-2026-77705 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Booking for Appointments and Events Calendar WordPress plugin before 2.4.10 does not verify that the user editing a customer or employee record is entitled to modify the WordPress account linked to it, allowing users holding Amelia's customer or employee management permissions to set the password and email address of other users' WordPress accounts and take them over.
- Product
- Booking for Appointments and Events Calendar
- Fixed in
- 2.4.10
- What to do
- Update Booking for Appointments and Events Calendar to 2.4.10 or newer.
Sep 12, 2026Booking for Appointments and Events Calendar: Does not verify that a payment was actually taken before recording a bookingCVE-2026-77689 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Booking for Appointments and Events Calendar WordPress plugin before 9.8.1 does not verify that a payment was actually taken before recording a booking as paid, trusting the payment gateway named in a public, unauthenticated booking request even when the site has never configured that gateway. This lets an unauthenticated attacker obtain confirmed, fully paid appointments and events without any payment being collected.
- Product
- Booking for Appointments and Events Calendar
- Fixed in
- 9.8.1
- What to do
- Update Booking for Appointments and Events Calendar to 9.8.1 or newer.
Sep 12, 2026WebTotem Backups: Does not validate a user-supplied file pathCVE-2026-77006 · WordPress plugins & themes · reported by WPScanCritical 9.6
The WebTotem Backups WordPress plugin before 1.1.0 does not validate a user-supplied file path, does not check the capability of the user making the request, and discards the result of its own CSRF check, allowing any authenticated user, such as a subscriber, to delete arbitrary files on the server, which can lead to a site takeover.
- Product
- WebTotem Backups
- Fixed in
- 1.1.0
- What to do
- Update WebTotem Backups to 1.1.0 or newer.
Sep 12, 2026CODE MONKEYS PROPOSALS: Does not validate a user-supplied file path before deleting a fileCVE-2026-77005 · WordPress plugins & themes · reported by WPScanCritical 9.6
The CODE MONKEYS PROPOSALS WordPress plugin through 1.0.1 does not validate a user-supplied file path before deleting a file, and does not check the capability of the user making the request, allowing any authenticated user, such as a subscriber, to delete arbitrary files on the server, which can lead to a site takeover.
- Product
- CODE MONKEYS PROPOSALS
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update CODE MONKEYS PROPOSALS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 12, 2026Frontegg SAML SSO: Does not verify the signature or issuer of SAML authentication responses before establishing a sessionCVE-2026-75800 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Frontegg SAML SSO WordPress plugin through 1.0.1 does not verify the signature or issuer of SAML authentication responses before establishing a session, allowing unauthenticated attackers to log in as any user, including administrators, as well as to create arbitrary accounts.
- Product
- Frontegg SAML SSO
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update Frontegg SAML SSO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 11, 2026A web interface reflects a portion of the request URL into a script context and a hyperlink attribute without adequate encoding, and does not require authenticaCVE-2026-90443 · Other software · CISA · reported by ics-cert@hq.dhs.govMedium 5.3
A web interface reflects a portion of the request URL into a script context and a hyperlink attribute without adequate encoding, and does not require authentication to reach. This allows an unauthenticated network attacker to craft a link that, when visited by a user, executes arbitrary script in the context of the affected application and can redirect the user's browser to an arbitrary external site. Successful exploitation could allow an attacker to act with the compromised user's session privileges within the application.
- Product
- Malcolm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordraw.githubusercontent.comcisa.gov
Sep 11, 2026Concrete CMS below 9.5.3 does not apply HTML output escaping to the file description and tags fields when rendering the Document Library block, so a user with pCVE-2026-81917 · Other software · Concrete CMS · reported by ff5b8ace-8b95-4078-9743-eac1ca5451deMedium 5.1
Concrete CMS below 9.5.3 does not apply HTML output escaping to the file description and tags fields when rendering the Document Library block, so a user with permission to edit file properties could store a script payload that executed in the browser of any visitor to a page displaying the block with the description or tags column enabled, including unauthenticated visitors. Successful exploitation could allow theft of session data or actions performed in the visitor's context. The block controller returned the description and tags values without the h() escaping already applied to the title column, and the block view template wrote the returned value directly into the results table The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 5.1 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:L/VA:N/SC:H/SI:H/SA:N. Thanks Nguyen Manh Thuan for reporting.
- Product
- Concrete CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.concretecms.org
Sep 11, 2026In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Skip Update HDCP Config In Transition State Transition state does not havCVE-2026-89773 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Skip Update HDCP Config In Transition State Transition state does not have a valid dm_stream_ctx that should skip configuring HDCP routine. The routine is valid to go through only when a valid stream is created.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Sep 11, 2026In the Linux kernel, the following vulnerability has been resolved: iomap: don't free integrity payload that doesn't exist fs_bio_integrity_alloc might not alCVE-2026-89770 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
In the Linux kernel, the following vulnerability has been resolved: iomap: don't free integrity payload that doesn't exist fs_bio_integrity_alloc might not allocate a bio integrity payload if PI verification is disabled on the block device. Check for that case before calling fs_bio_integrity_free in iomap_bio_read_folio_range_sync to avoid a NULL pointer dereferences. Make the branch cover the PI verification as well - while fs_bio_integrity_verify works without an integrity payload, it requires one to actually do useful work.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Sep 11, 2026In the Linux kernel, the following vulnerability has been resolved: nfsd: ensure nfsd_file_do_acquire() does not use a non-opened file ->atomic_open is permitCVE-2026-89687 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 7.5
In the Linux kernel, the following vulnerability has been resolved: nfsd: ensure nfsd_file_do_acquire() does not use a non-opened file ->atomic_open is permitted to return success without actually opening the file. It indicates this by calling finish_no_open(). This means dentry_create() can return a file which hasn't been opened. This is extremely unlikely as ->atomic_open handlers typically use finish_no_open() only for already existing files, and dentry_create() isn't called in that case, and the parent being locked should prevent races. However out of an abundance of caution it seems wise to teach nfsd to only use the file returned by dentry_create() if FMODE_OPENED is set, indicating that it has in fact been opened.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Sep 11, 2026In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: fix host memory disclosure on R2T for a read command nvme_tcp_handle_r2t() does CVE-2026-89481 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 7.5
In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: fix host memory disclosure on R2T for a read command nvme_tcp_handle_r2t() does not check the direction of the request the R2T refers to. A malicious controller can send an R2T for a READ and the host will answer it: nvme_tcp_setup_h2c_data_pdu() builds the H2CData header and nvme_tcp_try_send_data() sends the request's data buffer. That buffer is the READ destination, so its contents go to the controller. The command then completes normally and nothing is logged. Against a test controller that answers every READ with an R2T, a 4096 byte buffered read returned all 4096 bytes, split over two R2Ts. The pages contained stale kernel data, including an array of struct page pointers. Reject an R2T for a request that is not a write.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Sep 11, 2026Concrete CMS below 9.5.3 does not perform an object-level authorization check when a Page Type was updated.CVE-2026-81915 · Other software · Concrete CMS · reported by ff5b8ace-8b95-4078-9743-eac1ca5451deMedium 5.1
Concrete CMS below 9.5.3 does not perform an object-level authorization check when a Page Type was updated. The Types::submit() dashboard controller loaded and saved the Page Type identified by a user-supplied ptID without calling canEditPageType(), so a signed-in dashboard user permitted to edit one Page Type could modify the configuration of Page Types outside their assigned authorization boundary. The update_page_type token was validated but is action- and user-scoped rather than object-scoped, so it did not constrain which Page Type could be targeted. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 5.1 with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Andrew Gonzalez for reporting.
- Product
- Concrete CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.concretecms.org
Sep 11, 2026When tarfile extracts a link on a system that doesn't support links, it falls back to extracting a member from the archive.CVE-2026-87910 · Other software · Python Software Foundation · reported by cna@python.orgMedium 5.7
When tarfile extracts a link on a system that doesn't support links, it falls back to extracting a member from the archive. In this case, the filter function is run twice: once for the extracted member, and once with name set to the location of the link. For one of the calls, the return value was ignored. Instead, the member should be skipped if either call returns None.
- Product
- CPython
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 11, 2026When XML batch processing is turned on and the XPath option is selected, the raw batch input goes through a default XPath/JAXP setup with no entity restrictionsCVE-2026-82578 · Other software · NextGen Healthcare · reported by ics-cert@hq.dhs.govHigh 8.7
When XML batch processing is turned on and the XPath option is selected, the raw batch input goes through a default XPath/JAXP setup with no entity restrictions, so XXE injection can allow data exfiltration and denial-of-service attacks.
- Product
- Mirth Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 11, 2026MetForm: Does not properly neutralize newline characters in user-submitted values that are placed into notification email headersCVE-2026-86813 · WordPress plugins & themes · reported by WPScanMedium 4.8
The MetForm WordPress plugin before 4.1.9 does not properly neutralize newline characters in user-submitted values that are placed into notification email headers, allowing unauthenticated attackers to inject additional email headers, such as Bcc, into the emails the site sends when a submitted field value is configured to populate a header.
- Product
- MetForm
- Fixed in
- 4.1.9
- What to do
- Update MetForm to 4.1.9 or newer.
Sep 11, 2026The Persian Elementor WordPress plugin from 2.7.10 before 2.8.2 does not verify that the payment authority returned to its ZarinPal payment callback belongs to CVE-2026-86809 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Persian Elementor WordPress plugin from 2.7.10 before 2.8.2 does not verify that the payment authority returned to its ZarinPal payment callback belongs to the transaction being completed, allowing unauthenticated attackers to complete a pending order using a valid payment authority obtained from a different transaction.
- Fixed in
- 2.8.2
- What to do
- Update the plugin to 2.8.2 or newer.
Sep 11, 2026The Payment Gateway PayPay for WooCommerce WordPress plugin from 0.5 to 0.9.3 does not verify the authenticity of the payment notifications it receives before aCVE-2026-82215 · WordPress plugins & themes · reported by WPScanMedium 5.9
The Payment Gateway PayPay for WooCommerce WordPress plugin from 0.5 to 0.9.3 does not verify the authenticity of the payment notifications it receives before acting on them, allowing unauthenticated attackers who know the store's merchant identifier to mark arbitrary orders as paid, or to cancel or fail them.
- What to do
- Update the plugin to the newest version.
Sep 11, 2026The Nexi XPay Build WordPress plugin from 7.6.1 to 7.6.2 does not verify that the saved payment token being requested belongs to the current user, allowing unauCVE-2026-82213 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Nexi XPay Build WordPress plugin from 7.6.1 to 7.6.2 does not verify that the saved payment token being requested belongs to the current user, allowing unauthenticated attackers to retrieve other customers' stored card token references together with a valid authorisation signature.
- What to do
- Update the plugin to the newest version.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.