Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
13,949 results · page 29 of 279
Oct 6, 2026Subscriber Cross Site Scripting (XSS) in Front End PM <= 11.4.6 versions.CVE-2026-39788 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Subscriber Cross Site Scripting (XSS) in Front End PM <= 11.4.6 versions.
- What to do
- Update the plugin to the newest version.
Oct 6, 2026Unauthenticated Broken Access Control in 10Web Social Photo Feed <= 1.4.35 versions.CVE-2026-39787 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Broken Access Control in 10Web Social Photo Feed <= 1.4.35 versions.
- What to do
- Update the plugin to the newest version.
Oct 6, 2026Serhii Pasyuk Gmedia Photo Gallery grand-media: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-39785 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Serhii Pasyuk Gmedia Photo Gallery grand-media allows Blind SQL Injection.This issue affects Gmedia Photo Gallery: from n/a through 1.25.1.
- Product
- Serhii Pasyuk Gmedia Photo Gallery grand-media
- Affected
- up to 1.25.1
- What to do
- Affects up to 1.25.1. Update Serhii Pasyuk Gmedia Photo Gallery grand-media to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2026Unauthenticated Cross Site Scripting (XSS) in Hotel Booking <= 3.8 versions.CVE-2026-39784 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Hotel Booking <= 3.8 versions.
- What to do
- Update the plugin to the newest version.
Oct 6, 2026Dan Rossiter Document Gallery document-gallery: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-39781 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dan Rossiter Document Gallery document-gallery allows Reflected XSS.This issue affects Document Gallery: from n/a through 5.1.1.
- Product
- Dan Rossiter Document Gallery document-gallery
- Affected
- up to 5.1.1
- What to do
- Affects up to 5.1.1. Update Dan Rossiter Document Gallery document-gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2026Unauthenticated Cross Site Scripting (XSS) in Youzify <= 1.3.7 versions.CVE-2026-39780 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Youzify <= 1.3.7 versions.
- What to do
- Update the plugin to the newest version.
Oct 6, 2026Unauthenticated Cross Site Scripting (XSS) in Ansar Import – One Click Starter Sites – for Elementor & Themes <= 2.1.2 versions.CVE-2026-39778 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Ansar Import – One Click Starter Sites – for Elementor & Themes <= 2.1.2 versions.
- What to do
- Update the plugin to the newest version.
Oct 6, 2026Editor Remote Code Execution (RCE) in Tabs <= 2.5 versions.CVE-2026-39776 · WordPress plugins & themes · reported by PatchstackHigh 8
Editor Remote Code Execution (RCE) in Tabs <= 2.5 versions.
- What to do
- Update the plugin to the newest version.
Oct 6, 2026Subscriber Privilege Escalation in JobZilla - Job Board WordPress Theme <= 2.2 versions.CVE-2026-39775 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Subscriber Privilege Escalation in JobZilla - Job Board WordPress Theme <= 2.2 versions.
- What to do
- Update the plugin to the newest version.
Oct 6, 2026Unauthenticated Privilege Escalation in Tourfic Pro <= 1.17.3 versions.CVE-2026-39774 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Unauthenticated Privilege Escalation in Tourfic Pro <= 1.17.3 versions.
- What to do
- Update the plugin to the newest version.
Oct 6, 2026Unauthenticated Privilege Escalation in Doctreat Core <= 1.7.0 versions.CVE-2026-39773 · WordPress plugins & themes · reported by PatchstackCritical 10
Unauthenticated Privilege Escalation in Doctreat Core <= 1.7.0 versions.
- What to do
- Update the plugin to the newest version.
Oct 6, 2026Captcha by BestWebSoft <= 5: Unauthenticated BypassCVE-2026-39772 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Bypass Vulnerability in Captcha by BestWebSoft <= 5.2.8 versions.
- Product
- Captcha by BestWebSoft <= 5
- What to do
- Update Captcha by BestWebSoft <= 5 to the newest version.
Oct 6, 2026Subscriber SQL Injection in Buddyboss Platform <= 3.1.0 versions.CVE-2026-39771 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Subscriber SQL Injection in Buddyboss Platform <= 3.1.0 versions.
- What to do
- Update the plugin to the newest version.
Oct 6, 2026Unauthenticated Arbitrary File Upload in Doctreat <= 1.7.0 versions.CVE-2026-39770 · WordPress plugins & themes · reported by PatchstackCritical 10
Unauthenticated Arbitrary File Upload in Doctreat <= 1.7.0 versions.
- What to do
- Update the plugin to the newest version.
Oct 6, 2026Iqonic Designs Graphina – Charts and Graphs For Elementor graphina-elementor-charts-and-graphs: Authentication Bypass Using an Alternate Path or ChannelCVE-2026-39769 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Authentication Bypass Using an Alternate Path or Channel vulnerability in Iqonic Designs Graphina – Charts and Graphs For Elementor graphina-elementor-charts-and-graphs allows Password Recovery Exploitation.This issue affects Graphina – Charts and Graphs For Elementor: from n/a through 3.1.12.
- Product
- Iqonic Designs Graphina – Charts and Graphs For Elementor graphina-elementor-charts-and-graphs
- Affected
- up to 3.1.12
- What to do
- Affects up to 3.1.12. Update Iqonic Designs Graphina – Charts and Graphs For Elementor graphina-elementor-charts-and-graphs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2026Subscriber Denial of Service Attack in WPBase Cache <= 5.5.6 versions.CVE-2026-39767 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Subscriber Denial of Service Attack in WPBase Cache <= 5.5.6 versions.
- What to do
- Update the plugin to the newest version.
Oct 6, 2026Unauthenticated Cross Site Scripting (XSS) in ARForms <= 7.1.2 versions.CVE-2026-39766 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in ARForms <= 7.1.2 versions.
- What to do
- Update the plugin to the newest version.
Oct 6, 2026Shop Manager Privilege Escalation in Challan <= 3.7.88 versions.CVE-2026-39765 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Shop Manager Privilege Escalation in Challan <= 3.7.88 versions.
- What to do
- Update the plugin to the newest version.
Oct 6, 2026Unauthenticated SQL Injection in Radius Booking — Booking Calendar for Appointments & Services <= 1.0.19 versions.CVE-2026-39764 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in Radius Booking — Booking Calendar for Appointments & Services <= 1.0.19 versions.
- What to do
- Update the plugin to the newest version.
Oct 6, 2026Patterns In The Cloud Autoship Cloud for WooCommerce Subscription Products autoship-cloud: Missing AuthorizationCVE-2026-39762 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Patterns In The Cloud Autoship Cloud for WooCommerce Subscription Products autoship-cloud allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Autoship Cloud for WooCommerce Subscription Products: from n/a through 2.17.1.
- Product
- Patterns In The Cloud Autoship Cloud for WooCommerce Subscription Products autoship-cloud
- Affected
- up to 2.17.1
- What to do
- Affects up to 2.17.1. Update Patterns In The Cloud Autoship Cloud for WooCommerce Subscription Products autoship-cloud to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2026Unauthenticated Privilege Escalation in Meta Box AIO <= 3.7.1 versions.CVE-2026-39761 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated Privilege Escalation in Meta Box AIO <= 3.7.1 versions.
- What to do
- Update the plugin to the newest version.
Oct 6, 2026Employer / Sales Representative Arbitrary File Upload in Workreap Core <= 3.4.5 versions.CVE-2026-39759 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Employer / Sales Representative Arbitrary File Upload in Workreap Core <= 3.4.5 versions.
- What to do
- Update the plugin to the newest version.
Oct 6, 2026Unauthenticated Cross Site Scripting (XSS) in Midtrans-WooCommerce <= 2.32.3 versions.CVE-2026-39758 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Midtrans-WooCommerce <= 2.32.3 versions.
- What to do
- Update the plugin to the newest version.
Oct 6, 2026Subscriber Arbitrary File Upload in Taskbot <= 6.6 versions.CVE-2026-39757 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Subscriber Arbitrary File Upload in Taskbot <= 6.6 versions.
- What to do
- Update the plugin to the newest version.
Oct 6, 2026Unauthenticated Insecure Direct Object References (IDOR) in Wappointment <= 2.7.7 versions.CVE-2026-39756 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Insecure Direct Object References (IDOR) in Wappointment <= 2.7.7 versions.
- What to do
- Update the plugin to the newest version.
Oct 6, 2026Subscriber Arbitrary File Upload in WP Duplicate <= 1.1.11 versions.CVE-2026-39755 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Subscriber Arbitrary File Upload in WP Duplicate <= 1.1.11 versions.
- What to do
- Update the plugin to the newest version.
Oct 6, 2026Contributor Arbitrary File Download in Piotnet Addons For Elementor <= 7.1.71 versions.CVE-2026-39754 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Arbitrary File Download in Piotnet Addons For Elementor <= 7.1.71 versions.
- What to do
- Update the plugin to the newest version.
Oct 6, 2026Unauthenticated Privilege Escalation in Taskbot <= 6.6 versions.CVE-2026-39753 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated Privilege Escalation in Taskbot <= 6.6 versions.
- What to do
- Update the plugin to the newest version.
Oct 6, 2026Contributor Arbitrary File Deletion in Jobs for WordPress <= 2.8.2 versions.CVE-2026-39752 · WordPress plugins & themes · reported by PatchstackHigh 7.7
Contributor Arbitrary File Deletion in Jobs for WordPress <= 2.8.2 versions.
- What to do
- Update the plugin to the newest version.
Oct 6, 2026Unauthenticated Broken Access Control in PayPlug for WooCommerce (Official) <= 3.1.0 versions.CVE-2026-39751 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in PayPlug for WooCommerce (Official) <= 3.1.0 versions.
- What to do
- Update the plugin to the newest version.
Oct 6, 2026Unauthenticated Cross Site Scripting (XSS) in StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart <= 2.0.6 CVE-2026-39750 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart <= 2.0.6 versions.
- What to do
- Update the plugin to the newest version.
Oct 6, 2026Subscriber Broken Access Control in App for Cloudflare® <= 1.10.1 versions.CVE-2026-39749 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Subscriber Broken Access Control in App for Cloudflare® <= 1.10.1 versions.
- What to do
- Update the plugin to the newest version.
Oct 6, 2026Unauthenticated Cross Site Scripting (XSS) in EduMall <= 4.5.3 versions.CVE-2026-39748 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in EduMall <= 4.5.3 versions.
- What to do
- Update the plugin to the newest version.
Oct 6, 2026Subscriber SQL Injection in Woffice <= 5.4.35 versions.CVE-2026-39747 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Subscriber SQL Injection in Woffice <= 5.4.35 versions.
- What to do
- Update the plugin to the newest version.
Oct 6, 2026Unauthenticated SQL Injection in Booknetic <= 4.8.5 versions.CVE-2026-39746 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in Booknetic <= 4.8.5 versions.
- What to do
- Update the plugin to the newest version.
Oct 6, 2026Unauthenticated Cross Site Scripting (XSS) in Contact Form to DB by BestWebSoft <= 1.7.6 versions.CVE-2026-39745 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Contact Form to DB by BestWebSoft <= 1.7.6 versions.
- What to do
- Update the plugin to the newest version.
Oct 6, 2026Unauthenticated Cross Site Scripting (XSS) in Database for CF7 <= 1.2.6 versions.CVE-2026-39731 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Database for CF7 <= 1.2.6 versions.
- What to do
- Update the plugin to the newest version.
Oct 6, 2026Marcin Wise Chat wise-chat: Missing AuthorizationCVE-2026-39730 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Missing Authorization vulnerability in Marcin Wise Chat wise-chat allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Wise Chat: from n/a through 3.4.3.
- Product
- Marcin Wise Chat wise-chat
- Affected
- up to 3.4.3
- What to do
- Affects up to 3.4.3. Update Marcin Wise Chat wise-chat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2026Unauthenticated Sensitive Data Exposure in Edwiser Bridge <= 4.3.4 versions.CVE-2026-39729 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Unauthenticated Sensitive Data Exposure in Edwiser Bridge <= 4.3.4 versions.
- What to do
- Update the plugin to the newest version.
Oct 6, 2026Unauthenticated Server Side Request Forgery (SSRF) in Instapage Plugin <= 3.7.2 versions.CVE-2026-39728 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Unauthenticated Server Side Request Forgery (SSRF) in Instapage Plugin <= 3.7.2 versions.
- What to do
- Update the plugin to the newest version.
Oct 6, 2026Subscriber Cross Site Scripting (XSS) in WC Fields Factory <= 4.1.12 versions.CVE-2026-39727 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Subscriber Cross Site Scripting (XSS) in WC Fields Factory <= 4.1.12 versions.
- What to do
- Update the plugin to the newest version.
Oct 6, 2026Unauthenticated Cross Site Scripting (XSS) in Lumise Product Designer <= 2.1.1 versions.CVE-2026-39726 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Lumise Product Designer <= 2.1.1 versions.
- What to do
- Update the plugin to the newest version.
Oct 6, 2026Unauthenticated Cross Site Scripting (XSS) in HTTP Requests Manager <= 1.3.11 versions.CVE-2026-39724 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in HTTP Requests Manager <= 1.3.11 versions.
- What to do
- Update the plugin to the newest version.
Oct 6, 2026Unauthenticated Cross Site Scripting (XSS) in WPLMS <= 4.972 versions.CVE-2026-39722 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in WPLMS <= 4.972 versions.
- What to do
- Update the plugin to the newest version.
Oct 6, 2026Unauthenticated Cross Site Scripting (XSS) in Mapster WP Maps <= 2.0.4 versions.CVE-2026-39720 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Mapster WP Maps <= 2.0.4 versions.
- What to do
- Update the plugin to the newest version.
Oct 6, 2026Unauthenticated Server Side Request Forgery (SSRF) in PDF Smart Viewer for Elementor <= 1.0.4 versions.CVE-2026-39719 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Unauthenticated Server Side Request Forgery (SSRF) in PDF Smart Viewer for Elementor <= 1.0.4 versions.
- What to do
- Update the plugin to the newest version.
Oct 6, 2026Subscriber SQL Injection in Mooberry Book Manager 4.16.2 versions.CVE-2026-32581 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Subscriber SQL Injection in Mooberry Book Manager 4.16.2 versions.
- What to do
- Update the plugin to the newest version.
Oct 6, 2026Unauthenticated SQL Injection in WooCommerce Lottery <= 2.2.9 versions.CVE-2026-32580 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated SQL Injection in WooCommerce Lottery <= 2.2.9 versions.
- What to do
- Update the plugin to the newest version.
Oct 6, 2026Unauthenticated Arbitrary File Upload in Kognetiks Chatbot for WordPress <= 2.4.9 versions.CVE-2026-32579 · WordPress plugins & themes · reported by PatchstackCritical 10
Unauthenticated Arbitrary File Upload in Kognetiks Chatbot for WordPress <= 2.4.9 versions.
- What to do
- Update the plugin to the newest version.
Oct 6, 2026Subscriber Broken Access Control in ECPay Ecommerce for WooCommerce <= 1.1.2606090 versions.CVE-2026-32578 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Subscriber Broken Access Control in ECPay Ecommerce for WooCommerce <= 1.1.2606090 versions.
- What to do
- Update the plugin to the newest version.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. The WordPress, CMS and hosting-panel entries come from the National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan and others); we show who. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, a booking system, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.