Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,599 results · page 3 of 32
Sep 30, 2026Administrator SQL Injection in Category Discount Woocommerce <= 5.18 versions.CVE-2026-96828 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Administrator SQL Injection in Category Discount Woocommerce <= 5.18 versions.
- Affected
- up to 5.18
- What to do
- Affects up to 5.18. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 30, 2026Administrator SQL Injection in Admin Notices Manager <= 1.6.0 versions.CVE-2026-96827 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Administrator SQL Injection in Admin Notices Manager <= 1.6.0 versions.
- Affected
- up to 1.6.0
- What to do
- Affects up to 1.6.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 30, 2026Administrator SQL Injection in Estatik <= 4.3.5 versions.CVE-2026-96345 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Administrator SQL Injection in Estatik <= 4.3.5 versions.
- Affected
- up to 4.3.5
- What to do
- Affects up to 4.3.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 30, 2026Author PHP Object Injection in Minimum and Maximum Quantity for WooCommerce <= 2.1.2 versions.CVE-2026-93651 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Author PHP Object Injection in Minimum and Maximum Quantity for WooCommerce <= 2.1.2 versions.
- Affected
- up to 2.1.2
- What to do
- Affects up to 2.1.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 30, 2026Administrator SQL Injection in WP Activity Log <= 5.6.6 versions.CVE-2026-62085 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Administrator SQL Injection in WP Activity Log <= 5.6.6 versions.
- Affected
- up to 5.6.6
- What to do
- Affects up to 5.6.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 30, 2026InPost PL: Does not verify the authenticity of incoming shipment webhook requestsCVE-2026-93580 · WordPress plugins & themes · reported by WPScanMedium 5.3
The InPost PL WordPress plugin before 1.9.8 does not verify the authenticity of incoming shipment webhook requests, relying only on a non-secret identifier and an IP check that is not enforced, allowing unauthenticated attackers who know a target order's parcel tracking number to forge its shipment status and prematurely mark the order completed.
- Product
- InPost PL
- Fixed in
- 1.9.8
- What to do
- Update InPost PL to 1.9.8 or newer.
Sep 30, 2026Robin Image Optimizer: Does not check the user's capabilities before dispatching one of its bundled admin framework's request handlersCVE-2026-89190 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Robin Image Optimizer WordPress plugin before 2.0.8 does not check the user's capabilities before dispatching one of its bundled admin framework's request handlers, allowing users with a subscriber-level account to render admin-only Robin Image Optimizer WordPress plugin before 2.0.8 pages and disclose the Robin Image Optimizer WordPress plugin before 2.0.8's stored settings.
- Product
- Robin Image Optimizer
- Fixed in
- 2.0.8
- What to do
- Update Robin Image Optimizer to 2.0.8 or newer.
Sep 27, 2026Online Scheduling and Appointment Booking System: Does not prevent deserialization of untrusted input and does not correctly restrict a privileged maintenance feature to administratorsCVE-2026-86841 · WordPress plugins & themes · reported by WPScanMedium 4.7
The Online Scheduling and Appointment Booking System WordPress plugin before 28.3 does not prevent deserialization of untrusted input and does not correctly restrict a privileged maintenance feature to administrators, allowing users granted a custom booking-management capability, which an administrator must explicitly assign, to inject arbitrary PHP objects, overwrite privileged site options, and read stored integration secrets.
- Product
- Online Scheduling and Appointment Booking System
- Fixed in
- 28.3
- What to do
- Update Online Scheduling and Appointment Booking System to 28.3 or newer.
Sep 27, 2026Download Manager: Does not sanitise and escape data submitted through its email-locked download subscription form before outputting it back in an admin pageCVE-2026-86609 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Download Manager WordPress plugin before 7.5.6 does not sanitise and escape data submitted through its email-locked download subscription form before outputting it back in an admin page, which could allow unauthenticated attackers to perform Stored Cross-Site Scripting attacks against administrators. This affects the commercial Pro edition only; the free Download Manager WordPress plugin before 7.5.6 published under the same slug does not ship the affected feature.
- Product
- Download Manager
- Fixed in
- 7.5.6
- What to do
- Update Download Manager to 7.5.6 or newer.
Sep 27, 2026UpdraftPlus: WP Backup & Migration Plugin WordPress plugin before 1.26.8, UpdraftPlus: WP Backup & Migration: Does not have any capability check in a routine that outputs its stored remote storage settings into admin pagCVE-2026-82841 · WordPress plugins & themes · reported by WPScanMedium 5.3
The UpdraftPlus: WP Backup & Migration Plugin WordPress plugin before 1.26.8, UpdraftPlus: WP Backup & Migration Plugin WordPress plugin before 2.26.8.26 does not have any capability check in a routine that outputs its stored remote storage settings into admin pages when the site is left in a particular post-migration state, allowing any authenticated user, such as a subscriber, to retrieve the credentials of the configured backup destinations, such as passwords and secret keys.
- Product
- UpdraftPlus: WP Backup & Migration Plugin WordPress plugin before 1.26.8, UpdraftPlus: WP Backup & Migration
- Fixed in
- 1.26.8
- What to do
- Update UpdraftPlus: WP Backup & Migration Plugin WordPress plugin before 1.26.8, UpdraftPlus: WP Backup & Migration to 1.26.8 or newer.
Sep 26, 2026miniOrange OTP Login, Verification and SMS Notifications: Authentication BypassCVE-2026-85984 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress is vulnerable to Authentication Bypass via the mo_wp_login_intent parameter in all versions up to, and including, 5.5.5. This is due to a missing password-intent guard in the skip_pass_fallback-enabled configuration branch of the mo_by_pass_login() function, which treats administrator role membership alone as sufficient authentication whenever the unauthenticated, unverified POST parameter mo_wp_login_intent is submitted with the value otp, causing mo_get_user() to skip wp_authenticate_username_password() and resolve a WP_User purely from a username lookup. This makes it possible for unauthenticated attackers to log in as any existing administrator account by supplying only a known username and an empty password alongside mo_wp_login_intent=otp, with no password or OTP verification required. Exploitation is conditional on a site administrator having simultaneously enabled the following plugin options: WP Login OTP, Login with Only OTP, Allow Users to Login with Username and Password, and Admin OTP Bypass.
- Product
- miniOrange OTP Login, Verification and SMS Notifications
- Affected
- up to 5.5.5
- What to do
- Affects up to 5.5.5. Update miniOrange OTP Login, Verification and SMS Notifications to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 26, 2026File Manager WordPress plugin before 8.0.5, FileOrganizer WordPress plugin before 1.2.1, File Manager Pro: Do not correctly validate the origin of window messages received by the file browser they load on their admin scrCVE-2026-85081 · WordPress plugins & themes · reported by WPScanHigh 7.5
The File Manager WordPress plugin before 8.0.5, FileOrganizer WordPress plugin before 1.2.1, File Manager Pro WordPress plugin before 2.1.3 do not correctly validate the origin of window messages received by the file browser they load on their admin screens, accepting any origin that is a leading string prefix of the site's own address, which allows an unauthenticated attacker to run arbitrary JavaScript in the session of a logged-in administrator who visits a page under their control. The defect is in the file-manager library all three bundle, and every version below 2.1.70 carries it. Updating the bundled library closes it.
- Product
- File Manager WordPress plugin before 8.0.5, FileOrganizer WordPress plugin before 1.2.1, File Manager Pro
- Fixed in
- 8.0.5
- What to do
- Update File Manager WordPress plugin before 8.0.5, FileOrganizer WordPress plugin before 1.2.1, File Manager Pro to 8.0.5 or newer.
Sep 25, 2026OpenStation — Desktop Windows, Dock & Virtual Desktops for WP Admin: Authorization bypassCVE-2026-19775 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The OpenStation — Desktop Windows, Dock & Virtual Desktops for WP Admin plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.1.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with custom-level access and above, to read the title, status, date, permalink, and a 300-character content excerpt of any private, draft, pending, or future post, as well as the content and AI-moderation verdicts of unapproved and spam comments. Any authenticated user with the 'read' capability can self-enable the required AI feature by visiting the /openstation/ portal and toggling their own ai.enabled setting via the POST /desktop-mode/v1/os-settings endpoint, removing any practical barrier to exploitation.
- Product
- OpenStation — Desktop Windows, Dock & Virtual Desktops for WP Admin
- Affected
- up to 1.1.7
- What to do
- Affects up to 1.1.7. Update OpenStation — Desktop Windows, Dock & Virtual Desktops for WP Admin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 24, 2026MasterStudy LMS: Does not perform any capability or nonce checks on an administrative maintenance actionCVE-2026-88845 · WordPress plugins & themes · reported by WPScanMedium 4.3
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not perform any capability or nonce checks on an administrative maintenance action, allowing any authenticated user, such as a subscriber, to trigger it and create published content on the site attributed to their own account.
- Product
- MasterStudy LMS
- Fixed in
- 3.7.50
- What to do
- Update MasterStudy LMS to 3.7.50 or newer.
Sep 23, 2026Administrator SQL Injection in Email Log <= 2.63 versions.CVE-2026-94174 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Administrator SQL Injection in Email Log <= 2.63 versions.
- Affected
- up to 2.63
- What to do
- Affects up to 2.63. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 23, 2026Forminator Forms: Does not restrictCVE-2026-87071 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Forminator Forms WordPress plugin before 1.57.2.1 does not restrict which metadata keys a form submission may supply, and does not exclude the keys WordPress reserves for its own use, so unauthenticated visitors submitting a public form that collects post content can attach metadata of their choosing to the post their submission creates.
- Product
- Forminator Forms
- Fixed in
- 1.57.2.1
- What to do
- Update Forminator Forms to 1.57.2.1 or newer.
Sep 23, 2026Forminator Forms: Does not verify that a request came from a trusted proxy before preferring client-supplied forwarding headers over the connecting addressCVE-2026-87070 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Forminator Forms WordPress plugin before 1.57.2.1 does not verify that a request came from a trusted proxy before preferring client-supplied forwarding headers over the connecting address, and it uses that value both to enforce its per-visitor voting limit and to record who submitted an entry. Unauthenticated visitors can therefore vote without limit on any poll and can choose the address stored against every submission they make.
- Product
- Forminator Forms
- Fixed in
- 1.57.2.1
- What to do
- Update Forminator Forms to 1.57.2.1 or newer.
Sep 23, 2026Ninja Tables: Does not restrict shortcode expansion to administrator-authored table rows whichCVE-2026-86612 · WordPress plugins & themes · reported by WPScanMedium 5.6
The Ninja Tables WordPress plugin before 5.2.17 does not restrict shortcode expansion to administrator-authored table rows which, in a non-default configuration, allows unauthenticated users to have arbitrary shortcodes executed on a public page, and to permanently break that page, by submitting an ordinary form entry.
- Product
- Ninja Tables
- Fixed in
- 5.2.17
- What to do
- Update Ninja Tables to 5.2.17 or newer.
Sep 23, 2026JSM Show Post Metadata: Does not properly escape a post meta key before outputting it into an inline event-handler attribute in an admin-facing meta boxCVE-2026-88997 · WordPress plugins & themes · reported by WPScanMedium 6.8
The JSM Show Post Metadata WordPress plugin before 4.9.1 does not properly escape a post meta key before outputting it into an inline event-handler attribute in an admin-facing meta box, allowing users with contributor-level access and above to inject arbitrary JavaScript that executes in the session of a higher-privileged user who reviews the affected post.
- Product
- JSM Show Post Metadata
- Fixed in
- 4.9.1
- What to do
- Update JSM Show Post Metadata to 4.9.1 or newer.
Sep 23, 2026Paymob for WooCommerce: Does not perform a capability check on several admin AJAX actions that manage its payment-gateway configurationCVE-2026-87981 · WordPress plugins & themes · reported by WPScanMedium 4.7
The Paymob for WooCommerce WordPress plugin before 4.1.14 does not perform a capability check on several admin AJAX actions that manage its payment-gateway configuration, allowing users with contributor-level access to delete, wipe, or modify that configuration, including the stored payment credentials.
- Product
- Paymob for WooCommerce
- Fixed in
- 4.1.14
- What to do
- Update Paymob for WooCommerce to 4.1.14 or newer.
Sep 23, 2026Forminator Forms: Does not bind its saved-draft notification to the visitor who created the draftCVE-2026-87074 · WordPress plugins & themes · reported by WPScanLow 3.7
The Forminator Forms WordPress plugin before 1.57.2.1 does not bind its saved-draft notification to the visitor who created the draft, and takes both the recipient address and the link written into the message from the request, so unauthenticated visitors can make the site send a message from its own mail configuration to any address, carrying a link of their choosing inside the site's own template. The token that authorises the send is handed to the anonymous caller by the Forminator Forms WordPress plugin before 1.57.2.1 itself and can be replayed without limit.
- Product
- Forminator Forms
- Fixed in
- 1.57.2.1
- What to do
- Update Forminator Forms to 1.57.2.1 or newer.
Sep 23, 2026Forminator Forms: Does not perform a nonceCVE-2026-87069 · WordPress plugins & themes · reported by WPScanLow 3.1
The Forminator Forms WordPress plugin before 1.57.2.1 does not perform a nonce, capability or ownership check before running a one-time payment-field migration during the construction of one of its admin screens, and that construction happens on every wp-admin request for any logged-in user. Any authenticated user, including a Subscriber with no permissions in the Forminator Forms WordPress plugin before 1.57.2.1, can therefore rewrite the saved field configuration of any form on the site, including a live payment form.
- Product
- Forminator Forms
- Fixed in
- 1.57.2.1
- What to do
- Update Forminator Forms to 1.57.2.1 or newer.
Sep 23, 2026Real3D Flipbook: Does not sanitize or escape several flipbook editor fields before rendering them back in the admin editorCVE-2025-15696 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Real3D Flipbook WordPress plugin before 5.4 does not sanitize or escape several flipbook editor fields before rendering them back in the admin editor, allowing users with the Author role and above to inject arbitrary web scripts that execute in the browser of any user who later opens the affected flipbook for editing, including administrators.
- Product
- Real3D Flipbook
- Fixed in
- 5.4
- What to do
- Update Real3D Flipbook to 5.4 or newer.
Sep 22, 2026The Ninja Forms WordPress plugin 3.15.3 does not escape submitted form field values before outputting them on the submission edit screen in the admin area, whicCVE-2026-92438 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Ninja Forms WordPress plugin 3.15.3 does not escape submitted form field values before outputting them on the submission edit screen in the admin area, which could allow unauthenticated users to submit values through a public form that then execute in the browser of any high-privileged user who reviews the submission.
- What to do
- Update the plugin to the newest version.
Sep 22, 2026The Ninja Forms WordPress plugin 3.15.3 does not prevent user-submitted form field values from being deserialised when an administrator later exports form submiCVE-2026-91827 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Ninja Forms WordPress plugin 3.15.3 does not prevent user-submitted form field values from being deserialised when an administrator later exports form submissions to CSV, allowing unauthenticated attackers to perform PHP Object Injection; if a suitable POP chain is present via another installed plugin or theme, this can lead to actions such as arbitrary file operations or remote code execution.
- What to do
- Update the plugin to the newest version.
Sep 22, 2026CMP – Coming Soon & Maintenance Plugin by NiteoThemes: Unauthorized modification of data that can lead to privilege escalationCVE-2026-12470 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The CMP – Coming Soon & Maintenance Plugin by NiteoThemes plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the 'cmp_ajax_import_settings' AJAX action in all versions up to, and including, 4.1.17. This makes it possible for authenticated attackers, with Editor-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.
- Product
- CMP – Coming Soon & Maintenance Plugin by NiteoThemes
- Affected
- up to 4.1.17
- What to do
- Affects up to 4.1.17. Update CMP – Coming Soon & Maintenance Plugin by NiteoThemes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 22, 2026Meta Box AIO: Privilege Escalation to AdministratorCVE-2026-13355 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Meta Box AIO plugin for WordPress is vulnerable to Privilege Escalation to Administrator in versions up to, and including, 3.11.0. This is due to a chained flaw: the populate_via_query_string() function in the mb-frontend-submission component unconditionally overrides the form's target object_id from the GET parameter 'rwmb_frontend_field_object_id' without any authorization check, and Form::process() lacks the user_can_edit() check present in render(), allowing unauthenticated attackers to overwrite the post_content of any page with an arbitrary shortcode via wp_update_post(); the mb-user-profile component then directly trusts the 'role' and 'auto_login' shortcode attributes in the injected [mb_user_profile_register] shortcode with no role validation. This makes it possible for unauthenticated attackers to elevate their privileges to Administrator. The standalone plugins Meta Box Frontend Submission (in versions up to 4.5.6) and Meta Box User Profile (versions up to 3.11.0) are also affected.
- Product
- Meta Box AIO
- Affected
- up to 3.11.0
- What to do
- Affects up to 3.11.0. Update Meta Box AIO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 21, 2026Payment Gateway for PayPal on WooCommerce: Does not verify that an incoming payment notification was confirmed in the store's configured payment environment or paid to the store's own merchant account before marking an oCVE-2026-92400 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Payment Gateway for PayPal on WooCommerce WordPress plugin before 9.2.1 does not verify that an incoming payment notification was confirmed in the store's configured payment environment or paid to the store's own merchant account before marking an order complete, allowing unauthenticated users to mark their own orders as paid using a genuine transaction from a payment sandbox they control.
- Product
- Payment Gateway for PayPal on WooCommerce
- Fixed in
- 9.2.1
- What to do
- Update Payment Gateway for PayPal on WooCommerce to 9.2.1 or newer.
Sep 20, 2026Tripzzy: Does not perform any capability or ownership checks on its administrative booking-management actionsCVE-2026-87840 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Tripzzy WordPress plugin before 1.5.1 does not perform any capability or ownership checks on its administrative booking-management actions, which are additionally exposed to unauthenticated users and gated only by a token the Tripzzy WordPress plugin before 1.5.1 issues to any anonymous visitor on request, allowing unauthenticated attackers to alter the contents, stored totals and notes of arbitrary bookings.
- Product
- Tripzzy
- Fixed in
- 1.5.1
- What to do
- Update Tripzzy to 1.5.1 or newer.
Sep 20, 2026Forminator Forms: Does not apply the role validation it enforces elsewhereCVE-2026-87068 · WordPress plugins & themes · reported by WPScanMedium 6.6
The Forminator Forms WordPress plugin before 1.57.2.1 does not apply the role validation it enforces elsewhere when a registration form is nested inside an imported quiz, allowing a user who may import quizzes to publish a live, publicly reachable form that grants any role, including administrator, to anyone who submits it. The same user is refused an identical form through both the ordinary form editor and the ordinary form import.
- Product
- Forminator Forms
- Fixed in
- 1.57.2.1
- What to do
- Update Forminator Forms to 1.57.2.1 or newer.
Sep 20, 2026Forminator Forms: Does not restrictCVE-2026-87067 · WordPress plugins & themes · reported by WPScanHigh 8.5
The Forminator Forms WordPress plugin before 1.57.2.1 does not restrict which classes may be instantiated when it deserialises a value taken from an XML-RPC request, allowing users who hold its forms-management permission to write a file of their choosing and execute arbitrary code. That permission belongs to an administrator by default, and to any role the site has granted it through the Forminator Forms WordPress plugin before 1.57.2.1's own settings, so the issue is reachable well below administrator on sites that use that feature.
- Product
- Forminator Forms
- Fixed in
- 1.57.2.1
- What to do
- Update Forminator Forms to 1.57.2.1 or newer.
Sep 20, 2026SAML Single Sign On: Does not honour the configured criterion for linking an incoming single sign-on identity to a WordPress accountCVE-2026-82842 · WordPress plugins & themes · reported by WPScanHigh 8.1
The SAML Single Sign On WordPress plugin before 6.0.0 does not honour the configured criterion for linking an incoming single sign-on identity to a WordPress account, always resolving the identity by login name whatever the site has chosen, which allows an attacker who can have the site's identity provider assert a login name of their choosing to authenticate as any account, including an administrator, without proving ownership of that account.
- Product
- SAML Single Sign On
- Fixed in
- 6.0.0
- What to do
- Update SAML Single Sign On to 6.0.0 or newer.
Sep 18, 2026The Forminator Forms – Contact Form, Payment Form & Custom Form Builder: Arbitrary shortcode executionCVE-2026-92229 · WordPress plugins & themes · reported by WordfenceCritical 9.1
The The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.57.2. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
- Product
- The Forminator Forms – Contact Form, Payment Form & Custom Form Builder
- Affected
- up to 1.57.2
- What to do
- Affects up to 1.57.2. Update The Forminator Forms – Contact Form, Payment Form & Custom Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 17, 2026Administrator SQL Injection in MC Woocommerce Wishlist <= 1.9.21 versions.CVE-2026-66631 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Administrator SQL Injection in MC Woocommerce Wishlist <= 1.9.21 versions.
- Affected
- up to 1.9.21
- What to do
- Affects up to 1.9.21. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 17, 2026Administrator SQL Injection in PublishPress Series <= 3.1.3 versions.CVE-2026-66630 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Administrator SQL Injection in PublishPress Series <= 3.1.3 versions.
- Affected
- up to 3.1.3
- What to do
- Affects up to 3.1.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 17, 2026Administrator SQL Injection in WC Vendors Marketplace <= 2.7.2.1 versions.CVE-2026-66625 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Administrator SQL Injection in WC Vendors Marketplace <= 2.7.2.1 versions.
- Affected
- up to 2.7.2.1
- What to do
- Affects up to 2.7.2.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 17, 2026Administrator SQL Injection in WPMasterToolKit <= 2.22.0 versions.CVE-2026-66624 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Administrator SQL Injection in WPMasterToolKit <= 2.22.0 versions.
- Affected
- up to 2.22.0
- What to do
- Affects up to 2.22.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 17, 2026Administrator SQL Injection in Newsletters <= 4.18 versions.CVE-2026-66619 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Administrator SQL Injection in Newsletters <= 4.18 versions.
- Affected
- up to 4.18
- What to do
- Affects up to 4.18. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 17, 2026Administrator SQL Injection in WP Maps <= 4.9.9 versions.CVE-2026-66618 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Administrator SQL Injection in WP Maps <= 4.9.9 versions.
- Affected
- up to 4.9.9
- What to do
- Affects up to 4.9.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 17, 2026Unauthenticated Broken Authentication in EduAdmin Booking <= 5.4.2 versions.CVE-2026-62101 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated Broken Authentication in EduAdmin Booking <= 5.4.2 versions.
- Affected
- up to 5.4.2
- What to do
- Affects up to 5.4.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 17, 2026Robokassa payment gateway for Woocommerce: Does not verify the authenticity of incoming payment notificationsCVE-2026-91017 · WordPress plugins & themes · reported by WPScanLow 3.7
The Robokassa payment gateway for Woocommerce WordPress plugin before 1.8.9 does not verify the authenticity of incoming payment notifications when its non-default deferred-payment feature is enabled, allowing unauthenticated attackers to forge a notification and mark arbitrary WooCommerce orders as paid or on-hold without payment or a valid signature.
- Product
- Robokassa payment gateway for Woocommerce
- Fixed in
- 1.8.9
- What to do
- Update Robokassa payment gateway for Woocommerce to 1.8.9 or newer.
Sep 17, 2026WPLP Cookie Consent: Does not escape a value submitted through a public endpoint for the JavaScript context it is later output in on an administrative screenCVE-2026-85130 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WPLP Cookie Consent WordPress plugin before 4.4.4 does not escape a value submitted through a public endpoint for the JavaScript context it is later output in on an administrative screen, allowing unauthenticated users to run arbitrary JavaScript in the session of an administrator who interacts with the logged entry. Only multisite installations are affected.
- Product
- WPLP Cookie Consent
- Fixed in
- 4.4.4
- What to do
- Update WPLP Cookie Consent to 4.4.4 or newer.
Sep 17, 2026Choose User Role at Registration: Does not validate the role requested at registration against the roles an administrator chose to offerCVE-2026-85128 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Choose User Role at Registration WordPress plugin before 1.3.3 does not validate the role requested at registration against the roles an administrator chose to offer, allowing unauthenticated users to request any role, including administrator, and to be granted it once the request is approved. Exploitation requires the Choose User Role at Registration WordPress plugin before 1.3.3's role selection feature and public account registration to both be enabled.
- Product
- Choose User Role at Registration
- Fixed in
- 1.3.3
- What to do
- Update Choose User Role at Registration to 1.3.3 or newer.
Sep 16, 2026Royal Elementor Addons: Does not properly sanitize and escape values submitted through its form widget before including them in the body of administrator notification emailsCVE-2026-13407 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Royal Elementor Addons WordPress plugin before 1.7.1067 does not properly sanitize and escape values submitted through its form widget before including them in the body of administrator notification emails, allowing unauthenticated attackers to inject arbitrary HTML into emails sent to the site administrator on form submission.
- Product
- Royal Elementor Addons
- Fixed in
- 1.7.1067
- What to do
- Update Royal Elementor Addons to 1.7.1067 or newer.
Sep 16, 2026FluentBoards: Does not properly verify that a user holds board-manager privileges before performing several board-management operationsCVE-2026-89328 · WordPress plugins & themes · reported by WPScanLow 3.8
The FluentBoards WordPress plugin before 2.0.15 does not properly verify that a user holds board-manager privileges before performing several board-management operations, checking only board membership. This allows any member of a board to carry out manager-only actions on it, including adding or removing members and enabling public access to a private board.
- Product
- FluentBoards
- Fixed in
- 2.0.15
- What to do
- Update FluentBoards to 2.0.15 or newer.
Sep 16, 2026LearnPress: Does not check the user's capabilities in one of its administrative course toolsCVE-2026-86447 · WordPress plugins & themes · reported by WPScanMedium 5.3
The LearnPress WordPress plugin before 4.4.7 does not check the user's capabilities in one of its administrative course tools, allowing unauthenticated attackers to list every enrolled student's display name and user identifier against the course they are enrolled on, and to recover their email addresses through the same handler's search filter.
- Product
- LearnPress
- Fixed in
- 4.4.7
- What to do
- Update LearnPress to 4.4.7 or newer.
Sep 16, 2026LearnPress: Does not check the user's capabilities in one of its administrative template handlersCVE-2026-86445 · WordPress plugins & themes · reported by WPScanMedium 5.3
The LearnPress WordPress plugin before 4.4.7 does not check the user's capabilities in one of its administrative template handlers, allowing unauthenticated attackers to retrieve the text, identifier and type of every published quiz question on the site, along with a keyword search over them, which is content the LearnPress WordPress plugin before 4.4.7 otherwise keeps non-public.
- Product
- LearnPress
- Fixed in
- 4.4.7
- What to do
- Update LearnPress to 4.4.7 or newer.
Sep 16, 2026Tutor LMS: Does not correctly determine whether an incoming request is addressed to its own REST APICVE-2026-85569 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Tutor LMS WordPress plugin before 4.0.8 does not correctly determine whether an incoming request is addressed to its own REST API, and does not enforce the permission recorded against an API credential, allowing the holder of a read-only key to act as the administrator account that issued it.
- Product
- Tutor LMS
- Fixed in
- 4.0.8
- What to do
- Update Tutor LMS to 4.0.8 or newer.
Sep 16, 2026WP Import Export Lite: Does not escape custom field names retrieved from the database before inserting them into the DOM of one of its administration screensCVE-2026-76558 · WordPress plugins & themes · reported by WPScanMedium 6.8
The WP Import Export Lite WordPress plugin before 3.9.33 does not escape custom field names retrieved from the database before inserting them into the DOM of one of its administration screens, allowing users with a role as low as contributor to perform Stored XSS attacks which will trigger in the browser of a high privileged user, such as an administrator, viewing that screen.
- Product
- WP Import Export Lite
- Fixed in
- 3.9.33
- What to do
- Update WP Import Export Lite to 3.9.33 or newer.
Sep 15, 2026miniOrange JWT Authentication for WP REST APIs: Authentication method downgradeCVE-2026-89027 · WordPress plugins & themes · reported by VulnCheckMedium 6.9
miniOrange JWT Authentication for WP REST APIs plugin for WordPress before 4.8.0 contains an authentication method downgrade vulnerability that allows unauthenticated attackers to bypass administrator-configured authentication by supplying a specific GET parameter without any capability check or nonce verification. Attackers can force the plugin to use Basic HTTP authentication regardless of configured JWT or API token settings, then exploit distinguishable error codes and the absence of rate limiting to perform unthrottled username enumeration and credential guessing attacks.
- Product
- miniOrange JWT Authentication for WP REST APIs
- Fixed in
- 4.8.0
- What to do
- Update miniOrange JWT Authentication for WP REST APIs to 4.8.0 or newer.
Full record and what to do →NVD recordwordpress.orgvulncheck.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.