Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
11,441 results · page 28 of 229
Oct 6, 2026royalnavneet Delete All Comments of wordpress delete-all-comments-of-website: Missing AuthorizationCVE-2026-105059 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in royalnavneet Delete All Comments of wordpress delete-all-comments-of-website allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Delete All Comments of wordpress: from n/a through 7.1.
- Product
- royalnavneet Delete All Comments of wordpress delete-all-comments-of-website
- Affected
- up to 7.1
- What to do
- Affects up to 7.1. Update royalnavneet Delete All Comments of wordpress delete-all-comments-of-website to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2026Subscriber Privilege Escalation in WP User Profiles <= 2.7.3 versions.CVE-2026-105058 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Subscriber Privilege Escalation in WP User Profiles <= 2.7.3 versions.
- What to do
- Update the plugin to the newest version.
Oct 6, 2026Zero Spam <= 5: Unauthenticated BypassCVE-2026-105057 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Bypass Vulnerability in Zero Spam <= 5.7.11 versions.
- Product
- Zero Spam <= 5
- What to do
- Update Zero Spam <= 5 to the newest version.
Oct 6, 2026Unauthenticated Cross Site Scripting (XSS) in Form Block <= 1.8.1 versions.CVE-2026-104814 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Form Block <= 1.8.1 versions.
- What to do
- Update the plugin to the newest version.
Oct 6, 2026Editor Privilege Escalation in Import and export users and customers <= 2.5.5 versions.CVE-2026-104757 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Editor Privilege Escalation in Import and export users and customers <= 2.5.5 versions.
- What to do
- Update the plugin to the newest version.
Oct 6, 2026Unauthenticated PHP Object Injection in Haaken <= 1.5 versions.CVE-2026-104747 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated PHP Object Injection in Haaken <= 1.5 versions.
- What to do
- Update the plugin to the newest version.
Oct 6, 2026Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.17.0 versions.CVE-2026-104672 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.17.0 versions.
- What to do
- Update the plugin to the newest version.
Oct 6, 2026Unauthenticated Cross Site Scripting (XSS) in LearnPress <= 4.4.9 versions.CVE-2026-104670 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in LearnPress <= 4.4.9 versions.
- What to do
- Update the plugin to the newest version.
Oct 6, 2026Unauthenticated Broken Access Control in picu <= 3.10.1 versions.CVE-2026-104406 · WordPress plugins & themes · reported by PatchstackHigh 7.3
Unauthenticated Broken Access Control in picu <= 3.10.1 versions.
- What to do
- Update the plugin to the newest version.
Oct 6, 2026Unauthenticated Privilege Escalation in GiveWP <= 4.17.0 versions.CVE-2026-104405 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Privilege Escalation in GiveWP <= 4.17.0 versions.
- What to do
- Update the plugin to the newest version.
Oct 6, 2026StylemixThemes Motors: Insertion of Sensitive Information Into Sent DataCVE-2026-104399 · WordPress plugins & themes · reported by PatchstackMedium 6.9
Insertion of Sensitive Information Into Sent Data vulnerability in StylemixThemes Motors allows Retrieve Embedded Sensitive Data. This issue affects Motors: from n/a through 1.4.124.
- Product
- StylemixThemes Motors
- Affected
- up to 1.4.124
- What to do
- Affects up to 1.4.124. Update StylemixThemes Motors to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2026Unauthenticated Cross Site Scripting (XSS) in picu <= 3.10.1 versions.CVE-2026-104395 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in picu <= 3.10.1 versions.
- What to do
- Update the plugin to the newest version.
Oct 6, 2026Unauthenticated Cross Site Scripting (XSS) in Charitable <= 1.8.12.3 versions.CVE-2026-104394 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Charitable <= 1.8.12.3 versions.
- What to do
- Update the plugin to the newest version.
Oct 6, 2026Unauthenticated Broken Access Control in PowerPress Podcasting <= 11.17.9 versions.CVE-2026-104387 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Unauthenticated Broken Access Control in PowerPress Podcasting <= 11.17.9 versions.
- What to do
- Update the plugin to the newest version.
Oct 6, 2026Unauthenticated Sensitive Data Exposure in Groundhogg <= 4.8.3 versions.CVE-2026-104385 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Sensitive Data Exposure in Groundhogg <= 4.8.3 versions.
- What to do
- Update the plugin to the newest version.
Oct 6, 2026Tomlister Payflex Payment Gateway payflex-payment-gateway: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-103346 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tomlister Payflex Payment Gateway payflex-payment-gateway allows Reflected XSS.This issue affects Payflex Payment Gateway: from n/a through 2.7.1.
- Product
- Tomlister Payflex Payment Gateway payflex-payment-gateway
- Affected
- up to 2.7.1
- What to do
- Affects up to 2.7.1. Update Tomlister Payflex Payment Gateway payflex-payment-gateway to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2026Subscriber Broken Access Control in WPO365 <= 44.1 versions.CVE-2026-102915 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Subscriber Broken Access Control in WPO365 <= 44.1 versions.
- What to do
- Update the plugin to the newest version.
Oct 6, 2026Unauthenticated Sensitive Data Exposure in Xserver Migrator <= 1.6.6 versions.CVE-2026-102387 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Sensitive Data Exposure in Xserver Migrator <= 1.6.6 versions.
- What to do
- Update the plugin to the newest version.
Oct 6, 2026Unauthenticated Broken Authentication in Advanced Google reCAPTCHA <= 5.40 versions.CVE-2026-100518 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Broken Authentication in Advanced Google reCAPTCHA <= 5.40 versions.
- What to do
- Update the plugin to the newest version.
Oct 6, 2026elegro Crypto Payment: Does not require a shared secret to be configured before trusting incoming payment notification requestsCVE-2026-94299 · WordPress plugins & themes · reported by WPScanMedium 6.5
The elegro Crypto Payment WordPress plugin through 1.0.1 does not require a shared secret to be configured before trusting incoming payment notification requests, allowing unauthenticated attackers to forge payment confirmations and change the status of arbitrary orders on any installation where that secret has been left at its default empty value.
- Product
- elegro Crypto Payment
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update elegro Crypto Payment to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2026File Media Renamer: Does not verify that the requesting user is authorised to modify a given media attachmentCVE-2026-94278 · WordPress plugins & themes · reported by WPScanMedium 5.5
The File Media Renamer WordPress plugin through 1.3 does not verify that the requesting user is authorised to modify a given media attachment, allowing any user with file-upload privileges to rename attachments belonging to other users, including administrators, and to corrupt unrelated stored site data that referenced the old file path.
- Product
- File Media Renamer
- Affected
- up to 1.3
- What to do
- Affects up to 1.3. Update File Media Renamer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2026Deema Payment Gateway: Does not verify the payment with the payment providerCVE-2026-94271 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Deema Payment Gateway WordPress plugin through 1.1.2 does not verify the payment with the payment provider when handling the return from the hosted checkout, and does not check the payment status or amount, allowing unauthenticated users to have orders marked as paid without any payment being taken.
- Product
- Deema Payment Gateway
- Affected
- up to 1.1.2
- What to do
- Affects up to 1.1.2. Update Deema Payment Gateway to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2026Deema Payment Gateway: Does not verify the authenticity of incoming payment provider notificationsCVE-2026-94270 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Deema Payment Gateway WordPress plugin through 1.1.2 does not verify the authenticity of incoming payment provider notifications, and ships with that verification disabled by default, allowing unauthenticated attackers to mark an unpaid order as paid, or to cancel or refund an existing order.
- Product
- Deema Payment Gateway
- Affected
- up to 1.1.2
- What to do
- Affects up to 1.1.2. Update Deema Payment Gateway to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2026Fast Courier: Does not restrict an unauthenticated REST route that writes order fulfillment dataCVE-2026-89289 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Fast Courier WordPress plugin through 5.2.3 does not restrict an unauthenticated REST route that writes order fulfillment data, allowing unauthenticated attackers to overwrite the courier status and customer-facing tracking details of any WooCommerce order by supplying its id.
- Product
- Fast Courier
- Affected
- up to 5.2.3
- What to do
- Affects up to 5.2.3. Update Fast Courier to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2026Slider Pro: Does not perform any capability or authorisation check on one of its AJAX actionsCVE-2026-86786 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Slider Pro WordPress plugin through 1.0.0 does not perform any capability or authorisation check on one of its AJAX actions, allowing unauthenticated users to retrieve the title, excerpt and permalink of non-public posts, including drafts, pending, scheduled, private and trashed posts, as well as post revisions and media metadata.
- Product
- Slider Pro
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Slider Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2026ACPT (Premium): Remote Code ExecutionCVE-2026-105701 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The ACPT (Premium) plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.0.66 via the render function. This is due to missing capability check on the REST API form creation endpoint and unsandboxed Twig environment rendering email templates. This makes it possible for authenticated attackers, with subscriber-level access and above, to execute code on the server. The exploit requires the attacker to first create a form with malicious email_settings via the REST API endpoint, then trigger form submission to execute the injected Twig expressions.
- Product
- ACPT (Premium)
- Affected
- up to 2.0.66
- What to do
- Affects up to 2.0.66. Update ACPT (Premium) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2026Unauthenticated Broken Access Control in WP Event Solution <= 4.1.25 versions.CVE-2026-97300 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Broken Access Control in WP Event Solution <= 4.1.25 versions.
- What to do
- Update the plugin to the newest version.
Oct 6, 2026Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App: Stored Cross-Site ScriptingCVE-2026-75962 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'user_email' parameter in all versions up to, and including, 4.0.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable without authentication on WordPress Multisite installations with public registration enabled, as WordPress accepts email addresses containing numeric HTML character references that Post SMTP's stricter validator rejects, persisting the attacker-controlled address verbatim to the email log via the failed-send exception message.
- Product
- Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App
- Affected
- up to 4.0.1
- What to do
- Affects up to 4.0.1. Update Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 6, 2026Unauthenticated Sensitive Data Exposure in Sitemovr <= 1.0.1 versions.CVE-2026-41563 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Sensitive Data Exposure in Sitemovr <= 1.0.1 versions.
- What to do
- Update the plugin to the newest version.
Oct 6, 2026WP Migration Plugin DB & Files – WP Synchro <= 1: Subscriber BypassCVE-2026-41558 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Subscriber Bypass Vulnerability in WP Migration Plugin DB & Files – WP Synchro <= 1.16.1 versions.
- Product
- WP Migration Plugin DB & Files – WP Synchro <= 1
- What to do
- Update WP Migration Plugin DB & Files – WP Synchro <= 1 to the newest version.
Oct 6, 2026Unauthenticated Broken Access Control in Fluent Affiliate Pro <= 1.6.4 versions.CVE-2026-39789 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in Fluent Affiliate Pro <= 1.6.4 versions.
- What to do
- Update the plugin to the newest version.
Oct 6, 2026Unauthenticated Cross Site Scripting (XSS) in Real 3D FlipBook <= 5.5 versions.CVE-2026-39760 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Real 3D FlipBook <= 5.5 versions.
- What to do
- Update the plugin to the newest version.
Oct 6, 2026Green Invoice Morning for WooCommerce wc-gateway-greeninvoice: Missing AuthorizationCVE-2026-39723 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in Green Invoice Morning for WooCommerce wc-gateway-greeninvoice allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Morning for WooCommerce: from n/a through 2.4.1.
- Product
- Green Invoice Morning for WooCommerce wc-gateway-greeninvoice
- Affected
- up to 2.4.1
- What to do
- Affects up to 2.4.1. Update Green Invoice Morning for WooCommerce wc-gateway-greeninvoice to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2026Contributor Broken Access Control in WDS MCP Content Manager <= 3.10.4 versions.CVE-2026-39599 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Contributor Broken Access Control in WDS MCP Content Manager <= 3.10.4 versions.
- What to do
- Update the plugin to the newest version.
Oct 6, 2026iatoai IATO MCP iato-mcp: Missing AuthorizationCVE-2026-32582 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in iatoai IATO MCP iato-mcp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects IATO MCP: from n/a through 1.12.0.
- Product
- iatoai IATO MCP iato-mcp
- Affected
- up to 1.12.0
- What to do
- Affects up to 1.12.0. Update iatoai IATO MCP iato-mcp to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2026ZWEISCHNEIDER Faktur Pro for WooCommerce woorechnung: Authorization Bypass Through User-Controlled KeyCVE-2026-32576 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Authorization Bypass Through User-Controlled Key vulnerability in ZWEISCHNEIDER Faktur Pro for WooCommerce woorechnung allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Faktur Pro for WooCommerce: from n/a through 3.2.2.
- Product
- ZWEISCHNEIDER Faktur Pro for WooCommerce woorechnung
- Affected
- up to 3.2.2
- What to do
- Affects up to 3.2.2. Update ZWEISCHNEIDER Faktur Pro for WooCommerce woorechnung to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2026Unauthenticated Broken Access Control in FluentBooking Pro < 2.5.0 versions.CVE-2026-105072 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in FluentBooking Pro < 2.5.0 versions.
- What to do
- Update the plugin to the newest version.
Oct 5, 2026PressTigers Simple Event Planner simple-event-planner: Deserialization of Untrusted DataCVE-2026-97257 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in PressTigers Simple Event Planner simple-event-planner allows Object Injection.This issue affects Simple Event Planner: from n/a through 1.5.7.
- Product
- PressTigers Simple Event Planner simple-event-planner
- Affected
- up to 1.5.7
- What to do
- Affects up to 1.5.7. Update PressTigers Simple Event Planner simple-event-planner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026WP Sunshine Sunshine Photo Cart sunshine-photo-cart: Deserialization of Untrusted DataCVE-2026-93617 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Deserialization of Untrusted Data vulnerability in WP Sunshine Sunshine Photo Cart sunshine-photo-cart allows Object Injection.This issue affects Sunshine Photo Cart: from n/a through 3.7.1.
- Product
- WP Sunshine Sunshine Photo Cart sunshine-photo-cart
- Affected
- up to 3.7.1
- What to do
- Affects up to 3.7.1. Update WP Sunshine Sunshine Photo Cart sunshine-photo-cart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026Smackcoders Inc: Deserialization of Untrusted DataCVE-2026-103348 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Deserialization of Untrusted Data vulnerability in Smackcoders Inc. WP Ultimate Exporter wp-ultimate-exporter allows Object Injection.This issue affects WP Ultimate Exporter: from n/a through 3.0.
- Product
- Smackcoders Inc
- Affected
- up to 3.0
- What to do
- Affects up to 3.0. Update Smackcoders Inc to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026Kirillbdev WC Ukraine Shipping wc-ukr-shipping: Missing AuthorizationCVE-2026-103337 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Kirillbdev WC Ukraine Shipping wc-ukr-shipping allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WC Ukraine Shipping: from n/a through 1.23.2.
- Product
- Kirillbdev WC Ukraine Shipping wc-ukr-shipping
- Affected
- up to 1.23.2
- What to do
- Affects up to 1.23.2. Update Kirillbdev WC Ukraine Shipping wc-ukr-shipping to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026WP BASE WP BASE Booking wp-base-booking-of-appointments-services-and-events: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-103066 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP BASE WP BASE Booking wp-base-booking-of-appointments-services-and-events allows Blind SQL Injection.This issue affects WP BASE Booking: from n/a through 6.4.0.
- Product
- WP BASE WP BASE Booking wp-base-booking-of-appointments-services-and-events
- Affected
- up to 6.4.0
- What to do
- Affects up to 6.4.0. Update WP BASE WP BASE Booking wp-base-booking-of-appointments-services-and-events to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026Vektor Inc: Deserialization of Untrusted DataCVE-2026-100511 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in Vektor Inc. VK Google Job Posting Manager vk-google-job-posting-manager allows Object Injection.This issue affects VK Google Job Posting Manager: from n/a through 1.3.1.
- Product
- Vektor Inc
- Affected
- up to 1.3.1
- What to do
- Affects up to 1.3.1. Update Vektor Inc to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026WP Spell Check WP Spell Check wp-spell-check: Deserialization of Untrusted DataCVE-2026-100506 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Deserialization of Untrusted Data vulnerability in WP Spell Check WP Spell Check wp-spell-check allows Object Injection.This issue affects WP Spell Check: from n/a through 12.1.
- Product
- WP Spell Check WP Spell Check wp-spell-check
- Affected
- up to 12.1
- What to do
- Affects up to 12.1. Update WP Spell Check WP Spell Check wp-spell-check to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026Webful Creations RepairBuddy computer-repair-shop: Missing AuthorizationCVE-2026-97309 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Missing Authorization vulnerability in Webful Creations RepairBuddy computer-repair-shop allows Retrieve Embedded Sensitive Data.This issue affects RepairBuddy: from n/a through 4.1226.
- Product
- Webful Creations RepairBuddy computer-repair-shop
- Affected
- up to 4.1226
- What to do
- Affects up to 4.1226. Update Webful Creations RepairBuddy computer-repair-shop to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026Themeisle AI Chatbot for WordPress – Hyve Lite hyve-lite: Authorization Bypass Through User-Controlled KeyCVE-2026-97305 · WordPress plugins & themes · reported by PatchstackMedium 6.9
Authorization Bypass Through User-Controlled Key vulnerability in Themeisle AI Chatbot for WordPress – Hyve Lite hyve-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AI Chatbot for WordPress – Hyve Lite: from n/a through 2.0.2.
- Product
- Themeisle AI Chatbot for WordPress – Hyve Lite hyve-lite
- Affected
- up to 2.0.2
- What to do
- Affects up to 2.0.2. Update Themeisle AI Chatbot for WordPress – Hyve Lite hyve-lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026Arraytics Timetics timetics: Missing AuthorizationCVE-2026-97304 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Arraytics Timetics timetics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Timetics: from n/a through 1.0.63.
- Product
- Arraytics Timetics timetics
- Affected
- up to 1.0.63
- What to do
- Affects up to 1.0.63. Update Arraytics Timetics timetics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026Apps Mav Scratch & Win – Giveaways and Contests scratch-win-giveaways-for-website-facebook: Missing AuthorizationCVE-2026-97303 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Missing Authorization vulnerability in Apps Mav Scratch & Win – Giveaways and Contests scratch-win-giveaways-for-website-facebook allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Scratch & Win – Giveaways and Contests: from n/a through 3.0.2.
- Product
- Apps Mav Scratch & Win – Giveaways and Contests scratch-win-giveaways-for-website-facebook
- Affected
- up to 3.0.2
- What to do
- Affects up to 3.0.2. Update Apps Mav Scratch & Win – Giveaways and Contests scratch-win-giveaways-for-website-facebook to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026Liquid Web / StellarWP Advanced Post Manager advanced-post-manager: Deserialization of Untrusted DataCVE-2026-97283 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in Liquid Web / StellarWP Advanced Post Manager advanced-post-manager allows Object Injection.This issue affects Advanced Post Manager: from n/a through 4.5.5.
- Product
- Liquid Web / StellarWP Advanced Post Manager advanced-post-manager
- Affected
- up to 4.5.5
- What to do
- Affects up to 4.5.5. Update Liquid Web / StellarWP Advanced Post Manager advanced-post-manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026VillaTheme BuildKit – Product Builder for WooCommerce – Custom PC Builder woo-product-builder: Improper Validation of Specified Quantity in InputCVE-2026-97275 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Improper Validation of Specified Quantity in Input vulnerability in VillaTheme BuildKit – Product Builder for WooCommerce – Custom PC Builder woo-product-builder allows Input Data Manipulation.This issue affects BuildKit – Product Builder for WooCommerce – Custom PC Builder: from n/a through 1.0.28.
- Product
- VillaTheme BuildKit – Product Builder for WooCommerce – Custom PC Builder woo-product-builder
- Affected
- up to 1.0.28
- What to do
- Affects up to 1.0.28. Update VillaTheme BuildKit – Product Builder for WooCommerce – Custom PC Builder woo-product-builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. The WordPress, CMS and hosting-panel entries come from the National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan and others); we show who. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, a booking system, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.