Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
11,441 results · page 29 of 229
Oct 5, 2026CozyThemes Cozy Blocks cozy-addons: Authorization Bypass Through User-Controlled KeyCVE-2026-97070 · WordPress plugins & themes · reported by PatchstackMedium 6.9
Authorization Bypass Through User-Controlled Key vulnerability in CozyThemes Cozy Blocks cozy-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cozy Blocks: from n/a through 2.2.23.
- Product
- CozyThemes Cozy Blocks cozy-addons
- Affected
- up to 2.2.23
- What to do
- Affects up to 2.2.23. Update CozyThemes Cozy Blocks cozy-addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026WP BASE WP BASE Booking wp-base-booking-of-appointments-services-and-events: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-103352 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP BASE WP BASE Booking wp-base-booking-of-appointments-services-and-events allows Blind SQL Injection.This issue affects WP BASE Booking: from n/a through 6.4.0.
- Product
- WP BASE WP BASE Booking wp-base-booking-of-appointments-services-and-events
- Affected
- up to 6.4.0
- What to do
- Affects up to 6.4.0. Update WP BASE WP BASE Booking wp-base-booking-of-appointments-services-and-events to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026Rymera Web Co Product Feed PRO for WooCommerce woo-product-feed-pro: Deserialization of Untrusted DataCVE-2026-103349 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Deserialization of Untrusted Data vulnerability in Rymera Web Co Product Feed PRO for WooCommerce woo-product-feed-pro allows Object Injection.This issue affects Product Feed PRO for WooCommerce: from n/a through 13.5.7.
- Product
- Rymera Web Co Product Feed PRO for WooCommerce woo-product-feed-pro
- Affected
- up to 13.5.7
- What to do
- Affects up to 13.5.7. Update Rymera Web Co Product Feed PRO for WooCommerce woo-product-feed-pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026Etoile Web Design Incorporated Five Star Restaurant Reservations restaurant-reservations: Insertion of Sensitive Information Into Sent DataCVE-2026-103334 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Insertion of Sensitive Information Into Sent Data vulnerability in Etoile Web Design Incorporated Five Star Restaurant Reservations restaurant-reservations allows Retrieve Embedded Sensitive Data.This issue affects Five Star Restaurant Reservations: from n/a through 2.7.24.
- Product
- Etoile Web Design Incorporated Five Star Restaurant Reservations restaurant-reservations
- Affected
- up to 2.7.24
- What to do
- Affects up to 2.7.24. Update Etoile Web Design Incorporated Five Star Restaurant Reservations restaurant-reservations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026Stiofan UsersWP userswp: Missing AuthorizationCVE-2026-103086 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Stiofan UsersWP userswp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects UsersWP: from n/a through 1.2.74.
- Product
- Stiofan UsersWP userswp
- Affected
- up to 1.2.74
- What to do
- Affects up to 1.2.74. Update Stiofan UsersWP userswp to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026WP User Manager WP User Manager wp-user-manager: Improper Access ControlCVE-2026-103085 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Access Control vulnerability in WP User Manager WP User Manager wp-user-manager allows Privilege Abuse.This issue affects WP User Manager: from n/a through 2.9.20.
- Product
- WP User Manager WP User Manager wp-user-manager
- Affected
- up to 2.9.20
- What to do
- Affects up to 2.9.20. Update WP User Manager WP User Manager wp-user-manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026VillaTheme Lookzy woo-lookbook: Missing AuthorizationCVE-2026-102383 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in VillaTheme Lookzy woo-lookbook allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Lookzy: from n/a through 1.1.14.
- Product
- VillaTheme Lookzy woo-lookbook
- Affected
- up to 1.1.14
- What to do
- Affects up to 1.1.14. Update VillaTheme Lookzy woo-lookbook to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026VillaTheme Photo Reviews for WooCommerce woo-photo-reviews: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-100515 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VillaTheme Photo Reviews for WooCommerce woo-photo-reviews allows Reflected XSS.This issue affects Photo Reviews for WooCommerce: from n/a through 1.2.30.
- Product
- VillaTheme Photo Reviews for WooCommerce woo-photo-reviews
- Affected
- up to 1.2.30
- What to do
- Affects up to 1.2.30. Update VillaTheme Photo Reviews for WooCommerce woo-photo-reviews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026Webful Creations RepairBuddy computer-repair-shop: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-100509 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Webful Creations RepairBuddy computer-repair-shop allows Stored XSS.This issue affects RepairBuddy: from n/a through 4.1225.
- Product
- Webful Creations RepairBuddy computer-repair-shop
- Affected
- up to 4.1225
- What to do
- Affects up to 4.1225. Update Webful Creations RepairBuddy computer-repair-shop to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026GhozyLab Image Slider Widget image-slider-widget: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-42700 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GhozyLab Image Slider Widget image-slider-widget allows Stored XSS.This issue affects Image Slider Widget: from n/a through 1.1.130.
- Product
- GhozyLab Image Slider Widget image-slider-widget
- Affected
- up to 1.1.130
- What to do
- Affects up to 1.1.130. Update GhozyLab Image Slider Widget image-slider-widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026Jose Fernandez Adsmonetizer adsensei-b30: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-15643 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jose Fernandez Adsmonetizer adsensei-b30 allows Reflected XSS.This issue affects Adsmonetizer: from n/a through 3.2.4.
- Product
- Jose Fernandez Adsmonetizer adsensei-b30
- Affected
- up to 3.2.4
- What to do
- Affects up to 3.2.4. Update Jose Fernandez Adsmonetizer adsensei-b30 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026LearnPress: Stored cross-site scriptingCVE-2026-105397 · WordPress plugins & themes · reported by VulnCheckMedium 5.1
LearnPress plugin for WordPress through 4.4.9.1 contains a stored cross-site scripting vulnerability that allows authenticated instructors to inject scripts via quiz question hint and explanation fields. Attackers with the Instructor role can submit unsanitized payloads through the update_question AJAX handler that execute in the session of every student taking the quiz.
- Product
- LearnPress
- Affected
- up to 4.4.9.1
- What to do
- Affects up to 4.4.9.1. Update LearnPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026Kit Kit: Missing AuthorizationCVE-2026-105421 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Kit Kit (formerly ConvertKit) for WooCommerce convertkit-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kit (formerly ConvertKit) for WooCommerce: from n/a through 2.2.0.
- Product
- Kit Kit
- Affected
- up to 2.2.0
- What to do
- Affects up to 2.2.0. Update Kit Kit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026WP SYNTEX Polylang polylang: Missing AuthorizationCVE-2026-39783 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WP SYNTEX Polylang polylang allows Retrieve Embedded Sensitive Data.This issue affects Polylang: from n/a through 3.8.7.
- Product
- WP SYNTEX Polylang polylang
- Affected
- up to 3.8.7
- What to do
- Affects up to 3.8.7. Update WP SYNTEX Polylang polylang to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026Arraytics WP Event Solution wp-event-solution: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2026-105073 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Arraytics WP Event Solution wp-event-solution allows Retrieve Embedded Sensitive Data.This issue affects WP Event Solution: from n/a through 4.1.25.
- Product
- Arraytics WP Event Solution wp-event-solution
- Affected
- up to 4.1.25
- What to do
- Affects up to 4.1.25. Update Arraytics WP Event Solution wp-event-solution to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026Arraytics WP Event Solution wp-event-solution: Missing AuthorizationCVE-2026-103684 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Arraytics WP Event Solution wp-event-solution allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Event Solution: from n/a through 4.1.25.
- Product
- Arraytics WP Event Solution wp-event-solution
- Affected
- up to 4.1.25
- What to do
- Affects up to 4.1.25. Update Arraytics WP Event Solution wp-event-solution to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026WP ManageNinja LLC Fluent Forms Pro Add On Pack fluentformpro: Missing AuthorizationCVE-2026-94669 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WP ManageNinja LLC Fluent Forms Pro Add On Pack fluentformpro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Fluent Forms Pro Add On Pack: from n/a through 6.2.13.
- Product
- WP ManageNinja LLC Fluent Forms Pro Add On Pack fluentformpro
- Affected
- up to 6.2.13
- What to do
- Affects up to 6.2.13. Update WP ManageNinja LLC Fluent Forms Pro Add On Pack fluentformpro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026Deepak Anand WP Dummy Content Generator wp-dummy-content-generator: Missing AuthorizationCVE-2026-39763 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Deepak Anand WP Dummy Content Generator wp-dummy-content-generator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Dummy Content Generator: from n/a through 4.0.0.
- Product
- Deepak Anand WP Dummy Content Generator wp-dummy-content-generator
- Affected
- up to 4.0.0
- What to do
- Affects up to 4.0.0. Update Deepak Anand WP Dummy Content Generator wp-dummy-content-generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026VillaTheme CURCY woo-multi-currency: Incorrect CalculationCVE-2026-97071 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Incorrect Calculation vulnerability in VillaTheme CURCY woo-multi-currency allows Integer Attacks.This issue affects CURCY: from n/a through 2.2.17.
- Product
- VillaTheme CURCY woo-multi-currency
- Affected
- up to 2.2.17
- What to do
- Affects up to 2.2.17. Update VillaTheme CURCY woo-multi-currency to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026Brainstorm Force Starter Templates astra-sites: Missing AuthorizationCVE-2026-39721 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Brainstorm Force Starter Templates astra-sites allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Starter Templates: from n/a through 4.7.7.
- Product
- Brainstorm Force Starter Templates astra-sites
- Affected
- up to 4.7.7
- What to do
- Affects up to 4.7.7. Update Brainstorm Force Starter Templates astra-sites to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026Nikki Blight QR Redirector qr-redirector: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-105069 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nikki Blight QR Redirector qr-redirector allows Stored XSS.This issue affects QR Redirector: from n/a through 2.0.5.
- Product
- Nikki Blight QR Redirector qr-redirector
- Affected
- up to 2.0.5
- What to do
- Affects up to 2.0.5. Update Nikki Blight QR Redirector qr-redirector to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026Pixelite Events Manager events-manager: Insertion of Sensitive Information Into Sent DataCVE-2026-105068 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Insertion of Sensitive Information Into Sent Data vulnerability in Pixelite Events Manager events-manager allows Retrieve Embedded Sensitive Data.This issue affects Events Manager: from n/a through 7.4.5.
- Product
- Pixelite Events Manager events-manager
- Affected
- up to 7.4.5
- What to do
- Affects up to 7.4.5. Update Pixelite Events Manager events-manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026Unlimited Elements Unlimited Elements For Elementor: Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')CVE-2026-105064 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor allows Parameter Injection.This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 2.0.22.
- Product
- Unlimited Elements Unlimited Elements For Elementor
- Affected
- up to 2.0.22
- What to do
- Affects up to 2.0.22. Update Unlimited Elements Unlimited Elements For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026Brandtoss WP Admin Audit wp-admin-audit: Missing AuthorizationCVE-2026-105062 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Brandtoss WP Admin Audit wp-admin-audit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Admin Audit: from n/a through 1.2.17.
- Product
- Brandtoss WP Admin Audit wp-admin-audit
- Affected
- up to 1.2.17
- What to do
- Affects up to 1.2.17. Update Brandtoss WP Admin Audit wp-admin-audit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026Themepoints Logo Showcase logo-showcase: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-105060 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themepoints Logo Showcase logo-showcase allows Stored XSS.This issue affects Logo Showcase: from n/a through 4.0.4.
- Product
- Themepoints Logo Showcase logo-showcase
- Affected
- up to 4.0.4
- What to do
- Affects up to 4.0.4. Update Themepoints Logo Showcase logo-showcase to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026impleCode eCommerce Product Catalog ecommerce-product-catalog: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-105056 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in impleCode eCommerce Product Catalog ecommerce-product-catalog allows Stored XSS.This issue affects eCommerce Product Catalog: from n/a through 3.6.2.
- Product
- impleCode eCommerce Product Catalog ecommerce-product-catalog
- Affected
- up to 3.6.2
- What to do
- Affects up to 3.6.2. Update impleCode eCommerce Product Catalog ecommerce-product-catalog to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026WP Mailster WP Mailster wp-mailster: Missing AuthorizationCVE-2026-105055 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WP Mailster WP Mailster wp-mailster allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Mailster: from n/a through 1.9.0.0.
- Product
- WP Mailster WP Mailster wp-mailster
- Affected
- up to 1.9.0.0
- What to do
- Affects up to 1.9.0.0. Update WP Mailster WP Mailster wp-mailster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026Liquid Web / StellarWP Event Tickets event-tickets: Missing AuthorizationCVE-2026-104675 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Tickets: from n/a through 5.30.0.
- Product
- Liquid Web / StellarWP Event Tickets event-tickets
- Affected
- up to 5.30.0
- What to do
- Affects up to 5.30.0. Update Liquid Web / StellarWP Event Tickets event-tickets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026Sonaar MP3 Audio Player for Music, Radio & Podcast by Sonaar mp3-music-player-by-sonaar: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-104673 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sonaar MP3 Audio Player for Music, Radio & Podcast by Sonaar mp3-music-player-by-sonaar allows Stored XSS.This issue affects MP3 Audio Player for Music, Radio & Podcast by Sonaar: from n/a through 5.14.2.
- Product
- Sonaar MP3 Audio Player for Music, Radio & Podcast by Sonaar mp3-music-player-by-sonaar
- Affected
- up to 5.14.2
- What to do
- Affects up to 5.14.2. Update Sonaar MP3 Audio Player for Music, Radio & Podcast by Sonaar mp3-music-player-by-sonaar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026WP Chill Image Photo Gallery Final Tiles Grid final-tiles-grid-gallery-lite: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-104409 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Image Photo Gallery Final Tiles Grid final-tiles-grid-gallery-lite allows Stored XSS.This issue affects Image Photo Gallery Final Tiles Grid: from n/a through 3.6.13.
- Product
- WP Chill Image Photo Gallery Final Tiles Grid final-tiles-grid-gallery-lite
- Affected
- up to 3.6.13
- What to do
- Affects up to 3.6.13. Update WP Chill Image Photo Gallery Final Tiles Grid final-tiles-grid-gallery-lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026Groundhogg Groundhogg groundhogg: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-104408 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Groundhogg Groundhogg groundhogg allows Blind SQL Injection.This issue affects Groundhogg: from n/a through 4.8.3.
- Product
- Groundhogg Groundhogg groundhogg
- Affected
- up to 4.8.3
- What to do
- Affects up to 4.8.3. Update Groundhogg Groundhogg groundhogg to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026Blubrry Podcasting PowerPress Podcasting powerpress: Cross-Site Request Forgery (CSRF)CVE-2026-104407 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Blubrry Podcasting PowerPress Podcasting powerpress allows Cross Site Request Forgery.This issue affects PowerPress Podcasting: from n/a through 11.17.9.
- Product
- Blubrry Podcasting PowerPress Podcasting powerpress
- Affected
- up to 11.17.9
- What to do
- Affects up to 11.17.9. Update Blubrry Podcasting PowerPress Podcasting powerpress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026Liquid Web / StellarWP GiveWP give: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-104404 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / StellarWP GiveWP give allows Stored XSS.This issue affects GiveWP: from n/a through 4.17.0.
- Product
- Liquid Web / StellarWP GiveWP give
- Affected
- up to 4.17.0
- What to do
- Affects up to 4.17.0. Update Liquid Web / StellarWP GiveWP give to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026Memberful Memberful - Membership Plugin memberful-wp: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2026-104401 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Memberful Memberful - Membership Plugin memberful-wp allows Retrieve Embedded Sensitive Data.This issue affects Memberful - Membership Plugin: from n/a through 1.81.2.
- Product
- Memberful Memberful - Membership Plugin memberful-wp
- Affected
- up to 1.81.2
- What to do
- Affects up to 1.81.2. Update Memberful Memberful - Membership Plugin memberful-wp to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026bPlugins B Blocks b-blocks: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-104400 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins B Blocks b-blocks allows Stored XSS.This issue affects B Blocks: from n/a through 2.1.8.
- Product
- bPlugins B Blocks b-blocks
- Affected
- up to 2.1.8
- What to do
- Affects up to 2.1.8. Update bPlugins B Blocks b-blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026Jeroen Peters Name Directory name-directory: Missing AuthorizationCVE-2026-104397 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Jeroen Peters Name Directory name-directory allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Name Directory: from n/a through 1.34.2.
- Product
- Jeroen Peters Name Directory name-directory
- Affected
- up to 1.34.2
- What to do
- Affects up to 1.34.2. Update Jeroen Peters Name Directory name-directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026Jeroen Peters Name Directory name-directory: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-104396 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jeroen Peters Name Directory name-directory allows Stored XSS.This issue affects Name Directory: from n/a through 1.34.2.
- Product
- Jeroen Peters Name Directory name-directory
- Affected
- up to 1.34.2
- What to do
- Affects up to 1.34.2. Update Jeroen Peters Name Directory name-directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026Sirv Sirv sirv: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-104389 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Sirv Sirv sirv allows Blind SQL Injection.This issue affects Sirv: from n/a through 8.2.5.
- Product
- Sirv Sirv sirv
- Affected
- up to 8.2.5
- What to do
- Affects up to 8.2.5. Update Sirv Sirv sirv to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026Blubrry Podcasting PowerPress Podcasting powerpress: Missing AuthorizationCVE-2026-104388 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Blubrry Podcasting PowerPress Podcasting powerpress allows Retrieve Embedded Sensitive Data.This issue affects PowerPress Podcasting: from n/a through 11.17.9.
- Product
- Blubrry Podcasting PowerPress Podcasting powerpress
- Affected
- up to 11.17.9
- What to do
- Affects up to 11.17.9. Update Blubrry Podcasting PowerPress Podcasting powerpress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026WPFunnels Team WP VR wpvr: Missing AuthorizationCVE-2026-104386 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in WPFunnels Team WP VR wpvr allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP VR: from n/a through 9.1.3.
- Product
- WPFunnels Team WP VR wpvr
- Affected
- up to 9.1.3
- What to do
- Affects up to 9.1.3. Update WPFunnels Team WP VR wpvr to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026Magepeople inc: Improper Validation of Specified Quantity in InputCVE-2026-103351 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Improper Validation of Specified Quantity in Input vulnerability in Magepeople inc. Taxi Booking Manager for WooCommerce ecab-taxi-booking-manager allows Input Data Manipulation.This issue affects Taxi Booking Manager for WooCommerce: from n/a through 2.1.1.
- Product
- Magepeople inc
- Affected
- up to 2.1.1
- What to do
- Affects up to 2.1.1. Update Magepeople inc to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026Deepen Bajracharya Video Conferencing with Zoom video-conferencing-with-zoom-api: Insertion of Sensitive Information Into Sent DataCVE-2026-103335 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Insertion of Sensitive Information Into Sent Data vulnerability in Deepen Bajracharya Video Conferencing with Zoom video-conferencing-with-zoom-api allows Retrieve Embedded Sensitive Data.This issue affects Video Conferencing with Zoom: from n/a through 4.6.10.
- Product
- Deepen Bajracharya Video Conferencing with Zoom video-conferencing-with-zoom-api
- Affected
- up to 4.6.10
- What to do
- Affects up to 4.6.10. Update Deepen Bajracharya Video Conferencing with Zoom video-conferencing-with-zoom-api to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026LeapWorx Premium Addons for Elementor premium-addons-for-elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-103084 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LeapWorx Premium Addons for Elementor premium-addons-for-elementor allows Stored XSS.This issue affects Premium Addons for Elementor: from n/a through 4.11.109.
- Product
- LeapWorx Premium Addons for Elementor premium-addons-for-elementor
- Affected
- up to 4.11.109
- What to do
- Affects up to 4.11.109. Update LeapWorx Premium Addons for Elementor premium-addons-for-elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026Ahmad JS Help Desk js-support-ticket: Authorization Bypass Through User-Controlled KeyCVE-2026-103079 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Authorization Bypass Through User-Controlled Key vulnerability in Ahmad JS Help Desk js-support-ticket allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JS Help Desk: from n/a through 4.0.0.
- Product
- Ahmad JS Help Desk js-support-ticket
- Affected
- up to 4.0.0
- What to do
- Affects up to 4.0.0. Update Ahmad JS Help Desk js-support-ticket to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026Ahmad JS Help Desk js-support-ticket: Authorization Bypass Through User-Controlled KeyCVE-2026-103078 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Authorization Bypass Through User-Controlled Key vulnerability in Ahmad JS Help Desk js-support-ticket allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JS Help Desk: from n/a through 4.0.0.
- Product
- Ahmad JS Help Desk js-support-ticket
- Affected
- up to 4.0.0
- What to do
- Affects up to 4.0.0. Update Ahmad JS Help Desk js-support-ticket to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026Brainstorm Force Presto Player presto-player: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-102914 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force Presto Player presto-player allows Stored XSS.This issue affects Presto Player: from n/a through 4.5.2.
- Product
- Brainstorm Force Presto Player presto-player
- Affected
- up to 4.5.2
- What to do
- Affects up to 4.5.2. Update Brainstorm Force Presto Player presto-player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026Brainstorm Force Starter Templates astra-sites: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-102393 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force Starter Templates astra-sites allows Stored XSS.This issue affects Starter Templates: from n/a through 4.7.7.
- Product
- Brainstorm Force Starter Templates astra-sites
- Affected
- up to 4.7.7
- What to do
- Affects up to 4.7.7. Update Brainstorm Force Starter Templates astra-sites to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026UPI QR Code Payment Gateway: Does not verify that a payment-confirmation request actually belongs to the order and customer it claims to confirmCVE-2026-84169 · WordPress plugins & themes · reported by WPScanMedium 5.3
The UPI QR Code Payment Gateway WordPress plugin through 1.4.3 does not verify that a payment-confirmation request actually belongs to the order and customer it claims to confirm, allowing unauthenticated attackers to mark an arbitrary order as paid without making any payment.
- Product
- UPI QR Code Payment Gateway
- Affected
- up to 1.4.3
- What to do
- Affects up to 1.4.3. Update UPI QR Code Payment Gateway to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026File Uploads Addon for WooCommerce: Does not verify that the person requesting a customer-uploaded file is the customer who uploaded itCVE-2026-78371 · WordPress plugins & themes · reported by WPScanMedium 5.9
The File Uploads Addon for WooCommerce WordPress plugin before 1.7.6 does not verify that the person requesting a customer-uploaded file is the customer who uploaded it, allowing unauthenticated attackers who know or guess a file's name to download other customers' uploaded files.
- Product
- File Uploads Addon for WooCommerce
- Fixed in
- 1.7.6
- What to do
- Update File Uploads Addon for WooCommerce to 1.7.6 or newer.
Oct 5, 2026File Uploads Addon for WooCommerce: Stores customer-uploaded files in a publicly web-accessible uploads directory and the access restriction it generates is ineffectiveCVE-2026-13607 · WordPress plugins & themes · reported by WPScanMedium 5.9
The File Uploads Addon for WooCommerce WordPress plugin through 1.7.6 stores customer-uploaded files in a publicly web-accessible uploads directory and the access restriction it generates is ineffective, so an unauthenticated attacker who knows or guesses a file's name can retrieve customer-uploaded files directly, bypassing the File Uploads Addon for WooCommerce WordPress plugin through 1.7.6's authenticated download mechanism.
- Product
- File Uploads Addon for WooCommerce
- Affected
- up to 1.7.6
- What to do
- Affects up to 1.7.6. Update File Uploads Addon for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. The WordPress, CMS and hosting-panel entries come from the National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan and others); we show who. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, a booking system, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.