Updated 7 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,769exploited flaws on CISA’s list

35added in the last 30 days

356new WordPress flaws this week

394,273entries in the database

19,341 results · page 3 of 387

Nov 4, 2026Premium Packages: Does not verify that a user claiming a guest order is the original buyerCVE-2026-118407 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Premium Packages WordPress plugin before 7.3.1 does not verify that a user claiming a guest order is the original buyer, allowing any authenticated user to take ownership of any unclaimed guest order, and thereby read the buyer's billing details and download their purchased files, by supplying only the order identifier.
Product
Premium Packages
Fixed in
7.3.1
What to do
Update Premium Packages to 7.3.1 or newer.
Full record and what to do →NVD record wpscan.com
Nov 4, 2026Premium Packages: Does not verify ownership or session bindingCVE-2026-118404 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Premium Packages WordPress plugin before 7.3.1 does not verify ownership or session binding when loading a previously saved shopping cart, allowing any unauthenticated user who obtains another shopper's saved-cart identifier to load that shopper's cart contents, including selected products, quantities and buyer-entered custom field data, into their own session.
Product
Premium Packages
Fixed in
7.3.1
What to do
Update Premium Packages to 7.3.1 or newer.
Full record and what to do →NVD record wpscan.com
Nov 4, 2026Premium Packages: Does not verify that the requester owns a guest order before returning its detailsCVE-2026-118403 · WordPress plugins & themes · reported by WPScanLow 3.7
The Premium Packages WordPress plugin before 7.3.1 does not verify that the requester owns a guest order before returning its details, allowing unauthenticated visitors who know a guest order's identifier to view its order status, payment status and total.
Product
Premium Packages
Fixed in
7.3.1
What to do
Update Premium Packages to 7.3.1 or newer.
Full record and what to do →NVD record wpscan.com
Nov 4, 2026WPvivid — Backup, Migration & Staging: Does not properly validate a backup storage directory path before using it to create directories and write filesCVE-2026-115426 · WordPress plugins & themes · reported by WPScanMedium 5.5
The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.138 does not properly validate a backup storage directory path before using it to create directories and write files, allowing administrators to cause those directories and files to be created outside the intended backup location via path traversal.
Product
WPvivid — Backup, Migration & Staging
Fixed in
0.9.138
What to do
Update WPvivid — Backup, Migration & Staging to 0.9.138 or newer.
Full record and what to do →NVD record wpscan.com
Nov 4, 2026Duplicator WordPress plugin before 5.1.0, duplicator-pro: Does not restrict its database charset and collation rewrite to schema statements during a restoreCVE-2026-115262 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Duplicator WordPress plugin before 5.1.0, duplicator-pro WordPress plugin before 5.1.0 does not restrict its database charset and collation rewrite to schema statements during a restore, so a value a Subscriber stores in their own profile can break out of its string literal and inject SQL into the restore's INSERT statement when an administrator restores the backup onto a server lacking one of the source's charsets or collations.
Product
Duplicator WordPress plugin before 5.1.0, duplicator-pro
Fixed in
5.1.0
What to do
Update Duplicator WordPress plugin before 5.1.0, duplicator-pro to 5.1.0 or newer.
Full record and what to do →NVD record wpscan.com
Nov 4, 2026WP Roster: Does not perform any capability or nonce checks before writing its stored roster dataCVE-2026-115257 · WordPress plugins & themes · reported by WPScanMedium 5.3
The WP Roster WordPress plugin before 2.36 does not perform any capability or nonce checks before writing its stored roster data, allowing unauthenticated attackers to overwrite, wipe or restore the content of any roster.
Product
WP Roster
Fixed in
2.36
What to do
Update WP Roster to 2.36 or newer.
Full record and what to do →NVD record wpscan.com
Nov 4, 2026Text Typing: Does not properly sanitize and escape a block attribute before storing it and later outputting it into a page element that is read and rendered by client-side scriptCVE-2026-115250 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Text Typing WordPress plugin before 2.2.2 does not properly sanitize and escape a block attribute before storing it and later outputting it into a page element that is read and rendered by client-side script, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks that execute in the browser of anyone viewing the affected page.
Product
Text Typing
Fixed in
2.2.2
What to do
Update Text Typing to 2.2.2 or newer.
Full record and what to do →NVD record wpscan.com
Nov 4, 2026WPvivid — Backup, Migration & Staging: Does not validate the extension of the file it actually storesCVE-2026-115243 · WordPress plugins & themes · reported by WPScanMedium 6.7
The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.137 does not validate the extension of the file it actually stores when handling an import upload: it checks the extension of a separate request field while saving the uploaded file itself with WordPress's upload type-checking disabled, so an authenticated administrator can store a file with an arbitrary extension, including a PHP file, in the WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.137's import directory. This is an incomplete fix of CVE-2025-5961, whose extension check was applied to the wrong value.
Product
WPvivid — Backup, Migration & Staging
Fixed in
0.9.137
What to do
Update WPvivid — Backup, Migration & Staging to 0.9.137 or newer.
Full record and what to do →NVD record wpscan.com
Nov 4, 2026WPvivid — Backup, Migration & Staging: Does not sanitize the staging destination folder supplied to its staging-start handlerCVE-2026-115242 · WordPress plugins & themes · reported by WPScanMedium 5.5
The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.137 does not sanitize the staging destination folder supplied to its staging-start handler, applying only a generic text filter while the sibling writability-check handler applies the correct filename sanitizer, so an authenticated administrator can supply a path containing traversal sequences and make the WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.137 write the copied site files outside the WordPress installation directory.
Product
WPvivid — Backup, Migration & Staging
Fixed in
0.9.137
What to do
Update WPvivid — Backup, Migration & Staging to 0.9.137 or newer.
Full record and what to do →NVD record wpscan.com
Nov 4, 2026WPvivid — Backup, Migration & Staging: Does not verify that a submitted snapshot identifier names a snapshot it actually created before using itCVE-2026-115241 · WordPress plugins & themes · reported by WPScanMedium 6.5
The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.137 does not verify that a submitted snapshot identifier names a snapshot it actually created before using it as a database table-name prefix, so an authenticated administrator can supply the site's table prefix, or any other string, and cause the WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.137 to drop every matching table, including the core WordPress tables, destroying the site's database.
Product
WPvivid — Backup, Migration & Staging
Fixed in
0.9.137
What to do
Update WPvivid — Backup, Migration & Staging to 0.9.137 or newer.
Full record and what to do →NVD record wpscan.com
Nov 4, 2026Enable Media Replace: Does not pass a replaced media file through the WordPress upload pipelineCVE-2026-114431 · WordPress plugins & themes · reported by WPScanMedium 6.4
The Enable Media Replace WordPress plugin before 4.2.3 does not pass a replaced media file through the WordPress upload pipeline, so the upload prefilter that SVG-sanitizer Enable Media Replace WordPress plugin before 4.2.3 rely on never runs, allowing an authenticated user with upload access to store an SVG file containing script that executes when the file is opened directly. It requires an SVG-enabling Enable Media Replace WordPress plugin before 4.2.3 to be active, as the replace path otherwise rejects SVG uploads.
Product
Enable Media Replace
Fixed in
4.2.3
What to do
Update Enable Media Replace to 4.2.3 or newer.
Full record and what to do →NVD record wpscan.com
Nov 4, 2026Duplicator WordPress plugin before 5.1.0, duplicator-pro: Does not prevent direct access to some of its bundled PHP filesCVE-2026-112244 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Duplicator WordPress plugin before 5.1.0, duplicator-pro WordPress plugin before 5.1.0 does not prevent direct access to some of its bundled PHP files, which initialise without their expected context, trigger a fatal error, and return a stack trace that discloses the server's absolute filesystem paths to unauthenticated users.
Product
Duplicator WordPress plugin before 5.1.0, duplicator-pro
Fixed in
5.1.0
What to do
Update Duplicator WordPress plugin before 5.1.0, duplicator-pro to 5.1.0 or newer.
Full record and what to do →NVD record wpscan.com
Nov 4, 2026Duplicator WordPress plugin before 5.1.0, duplicator-pro: Does not sanitise and escape a parameter before reflecting it on one of its administrative pages in certain configurationsCVE-2026-112243 · WordPress plugins & themes · reported by WPScanMedium 5.8
The Duplicator WordPress plugin before 5.1.0, duplicator-pro WordPress plugin before 5.1.0 does not sanitise and escape a parameter before reflecting it on one of its administrative pages in certain configurations, leading to Reflected Cross-Site Scripting that executes in the session of a logged-in administrator who is tricked into opening a crafted link.
Product
Duplicator WordPress plugin before 5.1.0, duplicator-pro
Fixed in
5.1.0
What to do
Update Duplicator WordPress plugin before 5.1.0, duplicator-pro to 5.1.0 or newer.
Full record and what to do →NVD record wpscan.com
Nov 4, 2026WP Remote Users Sync: Does not adequately restrict access to the user export files it writes beneath the public web rootCVE-2026-111962 · WordPress plugins & themes · reported by WPScanLow 3.7
The WP Remote Users Sync WordPress plugin before 2.2.0 does not adequately restrict access to the user export files it writes beneath the public web root, relying on an Apache access-control file that other web servers such as Nginx ignore, which allows an unauthenticated attacker who requests the export's predictable file name while it is present to retrieve the exported users' personal data.
Product
WP Remote Users Sync
Fixed in
2.2.0
What to do
Update WP Remote Users Sync to 2.2.0 or newer.
Full record and what to do →NVD record wpscan.com
Nov 4, 2026Post Duplicator: Does not check whether the requesting user may view each post before returning a list of posts for a post typeCVE-2026-111740 · WordPress plugins & themes · reported by WPScanLow 2.7
The Post Duplicator WordPress plugin before 3.0.17 does not check whether the requesting user may view each post before returning a list of posts for a post type, allowing users with a role as low as Contributor to read the titles and hierarchy of other users' draft and private posts.
Product
Post Duplicator
Fixed in
3.0.17
What to do
Update Post Duplicator to 3.0.17 or newer.
Full record and what to do →NVD record wpscan.com
Nov 4, 2026Essential Real Estate: Does not verify that a media attachment belongs to the requesting user before deleting itCVE-2026-110964 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Essential Real Estate WordPress plugin before 5.3.5 does not verify that a media attachment belongs to the requesting user before deleting it, allowing a self-registered customer-level user to delete other users' media library attachments, including those owned by administrators.
Product
Essential Real Estate
Fixed in
5.3.5
What to do
Update Essential Real Estate to 5.3.5 or newer.
Full record and what to do →NVD record wpscan.com
Nov 4, 2026PowerPack Addons for Elementor: Widgets, Form Styler and Templates: Does not validate a user-supplied URL before using it in a server-side HTTP requestCVE-2026-110692 · WordPress plugins & themes · reported by WPScanMedium 4.1
The PowerPack Addons for Elementor: Widgets, Form Styler and Templates WordPress plugin before 3.1.3 does not validate a user-supplied URL before using it in a server-side HTTP request, which could allow users with the contributor role and above to perform Server-Side Request Forgery attacks against internal and loopback resources and read the response back.
Product
PowerPack Addons for Elementor: Widgets, Form Styler and Templates
Fixed in
3.1.3
What to do
Update PowerPack Addons for Elementor: Widgets, Form Styler and Templates to 3.1.3 or newer.
Full record and what to do →NVD record wpscan.com
Nov 4, 2026FV Flowplayer Video Player: Does not perform proper authorization checks on one of its video-migration functionsCVE-2026-108068 · WordPress plugins & themes · reported by WPScanLow 3.8
The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not perform proper authorization checks on one of its video-migration functions, which is protected by a nonce only, allowing users with Contributor-level permissions and above to disclose and bulk-modify the FV Flowplayer Video Player WordPress plugin before 7.5.56.7212's stored video records across the whole site.
Product
FV Flowplayer Video Player
Fixed in
7.5.56.7212
What to do
Update FV Flowplayer Video Player to 7.5.56.7212 or newer.
Full record and what to do →NVD record wpscan.com
Nov 4, 2026FV Flowplayer Video Player: Does not properly verify record ownership before modifying or deleting stored video and meta recordsCVE-2026-108067 · WordPress plugins & themes · reported by WPScanLow 3.8
The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not properly verify record ownership before modifying or deleting stored video and meta records, allowing authenticated users with Contributor-level access and above to modify or delete arbitrary records belonging to other users, and to disclose the associated meta data in the response.
Product
FV Flowplayer Video Player
Fixed in
7.5.56.7212
What to do
Update FV Flowplayer Video Player to 7.5.56.7212 or newer.
Full record and what to do →NVD record wpscan.com
Nov 4, 2026SEOPress: Does not sanitise and escape some of its analytics tracking settings before outputting them in an inline script printed on every front-end pageCVE-2026-108041 · WordPress plugins & themes · reported by WPScanHigh 7.1
The SEOPress WordPress plugin before 10.4 does not sanitise and escape some of its analytics tracking settings before outputting them in an inline script printed on every front-end page, allowing users granted a SEOPress WordPress plugin before 10.4 capability that an administrator can delegate to lower-privileged roles to perform Stored Cross-Site Scripting attacks that execute in the browser of any site visitor, including a logged-in administrator viewing the front end.
Product
SEOPress
Fixed in
10.4
What to do
Update SEOPress to 10.4 or newer.
Full record and what to do →NVD record wpscan.com
Nov 4, 2026Kali Forms — Contact Form & Drag-and-Drop Builder: Does not prevent users with author-level access and above from storing arbitrary JavaScript in a form button configurationCVE-2026-106649 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.29 does not prevent users with author-level access and above from storing arbitrary JavaScript in a form button configuration, which is later output into a JavaScript execution context and runs in the browser session of any user who clicks the button, including an administrator.
Product
Kali Forms — Contact Form & Drag-and-Drop Builder
Fixed in
2.4.29
What to do
Update Kali Forms — Contact Form & Drag-and-Drop Builder to 2.4.29 or newer.
Full record and what to do →NVD record wpscan.com
Nov 4, 2026Booking Package: Does not require payment to be completed before saving a booking on calendars configured to require online paymentCVE-2026-106000 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Booking Package WordPress plugin before 1.7.34 does not require payment to be completed before saving a booking on calendars configured to require online payment, allowing unauthenticated users to create confirmed bookings without paying.
Product
Booking Package
Fixed in
1.7.34
What to do
Update Booking Package to 1.7.34 or newer.
Full record and what to do →NVD record wpscan.com
Nov 4, 2026Form Maker by 10Web: Does not consistently escape user-submitted field values before rendering them on its submissions admin pageCVE-2026-105413 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Form Maker by 10Web WordPress plugin before 1.15.51 does not consistently escape user-submitted field values before rendering them on its submissions admin page, allowing unauthenticated users to store a payload that executes as arbitrary web scripts in the session of an administrator who views the submissions.
Product
Form Maker by 10Web
Fixed in
1.15.51
What to do
Update Form Maker by 10Web to 1.15.51 or newer.
Full record and what to do →NVD record wpscan.com
Nov 4, 2026ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce: Does not perform a capability check on an AJAX action that returns the stored before-and-after values of a record changeCVE-2026-105191 · WordPress plugins & themes · reported by WPScanMedium 4.3
The ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce WordPress plugin before 1.17.11 does not perform a capability check on an AJAX action that returns the stored before-and-after values of a record change, allowing any authenticated user, including Subscribers, to read other users' sensitive HR, CRM and Accounting data by enumerating record identifiers.
Product
ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce
Fixed in
1.17.11
What to do
Update ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce to 1.17.11 or newer.
Full record and what to do →NVD record wpscan.com
Nov 4, 2026CookieYes: Does not correctly restrict who can write its cookie-category script fieldsCVE-2026-104719 · WordPress plugins & themes · reported by WPScanMedium 6.4
The CookieYes WordPress plugin before 3.5.8 does not correctly restrict who can write its cookie-category script fields, and does not sanitize or escape them, allowing users with the Contributor role to store JavaScript that executes in the browsers of site visitors and of an administrator reviewing the content.
Product
CookieYes
Fixed in
3.5.8
What to do
Update CookieYes to 3.5.8 or newer.
Full record and what to do →NVD record wpscan.com
Nov 4, 2026Mollie Payments for WooCommerce: Does not verify a product's publication status before creating an order for it through its PayPal express-checkout endpointCVE-2026-101166 · WordPress plugins & themes · reported by WPScanLow 3.7
The Mollie Payments for WooCommerce WordPress plugin before 8.2.0 does not verify a product's publication status before creating an order for it through its PayPal express-checkout endpoint, allowing unauthenticated users to order draft or unpublished products.
Product
Mollie Payments for WooCommerce
Fixed in
8.2.0
What to do
Update Mollie Payments for WooCommerce to 8.2.0 or newer.
Full record and what to do →NVD record wpscan.com
Nov 4, 2026Mollie Payments for WooCommerce: Does not verify an order's payment state or the requested payment gateway before removing a configured payment-surcharge feeCVE-2026-101165 · WordPress plugins & themes · reported by WPScanLow 3.7
The Mollie Payments for WooCommerce WordPress plugin before 8.2.0 does not verify an order's payment state or the requested payment gateway before removing a configured payment-surcharge fee, allowing unauthenticated users to reduce an order's total before completing payment.
Product
Mollie Payments for WooCommerce
Fixed in
8.2.0
What to do
Update Mollie Payments for WooCommerce to 8.2.0 or newer.
Full record and what to do →NVD record wpscan.com
Nov 3, 2026The MongoDB Entity Framework Core provider does not neutralize special elements in values passed to SetProperty when an ExecuteUpdate call also contains a setteCVE-2026-120567 · Other software · MongoDB · reported by cna@mongodb.comLow 2.3
The MongoDB Entity Framework Core provider does not neutralize special elements in values passed to SetProperty when an ExecuteUpdate call also contains a setter that reads the entity being updated. In that case the update is sent as an aggregation pipeline, and a caller-supplied string beginning with $ is evaluated as an expression rather than stored as data. A party who can influence such a value may modify or remove fields in the records being updated, or copy other fields of the same record into them.
Product
Entity Framework Core Provider
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jira.mongodb.org
Nov 3, 2026The MongoDB C Driver does not validate the type or format of a namespace field returned by the server in a query response.CVE-2026-120956 · Other software · MongoDB · reported by cna@mongodb.comHigh 7.1
The MongoDB C Driver does not validate the type or format of a namespace field returned by the server in a query response. A MongoDB endpoint that a client application connects to, without needing any credentials, can return a malformed value in that field. This causes the client application process to terminate, and can also cause the driver to read memory outside an allocated buffer and to send a small amount of the application's own uninitialized heap memory back to the endpoint in a follow-up command. The impact is limited to the process that embeds the driver.
Product
C Driver
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jira.mongodb.org
Nov 3, 2026The GridFS file download API in the MongoDB C Driver does not check the result of an internal operation under certain error conditions during file retrieval.CVE-2026-120955 · Other software · MongoDB · reported by cna@mongodb.comHigh 8.7
The GridFS file download API in the MongoDB C Driver does not check the result of an internal operation under certain error conditions during file retrieval. This can cause the process to terminate when stream operations continue. A user who can influence file download parameters can trigger this condition, which may result in service unavailability for applications using the affected API.
Product
C Driver
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jira.mongodb.org
Nov 3, 2026MongoDB Database Tools mongofiles does not resolve existing parent-directory symlinks when validating output paths for get_regex.CVE-2026-119673 · Other software · MongoDB · reported by cna@mongodb.comLow 1
MongoDB Database Tools mongofiles does not resolve existing parent-directory symlinks when validating output paths for get_regex. An unauthorized user who can both upload a GridFS file and place a symlink in the operator's download working directory can cause a later retrieval to create a file containing unauthorized user-controlled data outside that directory, using the operator process's filesystem permissions. The issue can occur with default traversal and overwrite settings. Exploitation requires an operator to retrieve matching files from the affected working directory; the demonstrated default behavior creates a new file rather than overwriting an existing file. This issue affects MongoDB Database Tools versions 100.2.0 through versions before 100.20.1.
Product
Database Tools
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com
Nov 3, 2026Docker Sandboxes sbx cp does not safely confine host-side paths to a shared workspace.CVE-2026-103916 · Other software · Docker · reported by security@docker.comHigh 8.4
Docker Sandboxes sbx cp does not safely confine host-side paths to a shared workspace. A malicious sandbox can create or replace a workspace symlink so that a later user-initiated copy reads a host file outside the workspace into the sandbox or writes sandbox-controlled data to a host path outside the workspace with the invoking user's permissions.
Product
Docker Sandboxes
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.docker.com docs.docker.com
Nov 3, 2026SurrealDB 2.0.0 before 3.3.1 does not enforce --deny-funcs restrictions on method-style function calls in the streaming engine, because MethodPart::evaluate invCVE-2026-121416 · Other software · surrealdb · reported by VulnCheckHigh 7.1
SurrealDB 2.0.0 before 3.3.1 does not enforce --deny-funcs restrictions on method-style function calls in the streaming engine, because MethodPart::evaluate invokes resolved functions without a capability check. Authenticated users who can submit queries can run denied functions via method syntax, e.g. [1,2].map() or $f.put()/$f.get() to write and read file bucket data despite file::* denials.
Product
surrealdb
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com vulncheck.com
Nov 3, 2026The click tracking middleware does not validate the authentication code of a recipient if the code is omitted.CVE-2026-120328 · Other software · TYPO3 · reported by f4fb688c-4412-4426-b4b8-421ecf27b14aMedium 6.9
The click tracking middleware does not validate the authentication code of a recipient if the code is omitted. Unauthenticated attackers can retrieve personal data of newsletter recipients, which is inserted into links of sent mails.
Product
Extension "Mail"
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record typo3.org
Nov 3, 2026The Eupago Gateway For Woocommerce WordPress plugin from 4.5.0 through 4.7.5 does not verify the authenticity of incoming payment-confirmation webhook requests CVE-2026-91075 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Eupago Gateway For Woocommerce WordPress plugin from 4.5.0 through 4.7.5 does not verify the authenticity of incoming payment-confirmation webhook requests in some configurations, allowing unauthenticated attackers to forge a payment confirmation and mark a pending order as paid without paying for it.
Affected
up to 4.7.5
What to do
Affects up to 4.7.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Nov 3, 2026In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, ThreadX Modules does not revoke a module's trace-buffer-full callback when the module is stopped and unlCVE-2026-113421 · Other software · Eclipse Foundation · reported by emo@eclipse.orgHigh 7.3
In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, ThreadX Modules does not revoke a module's trace-buffer-full callback when the module is stopped and unloaded. With event tracing enabled and a kernel-owned trace buffer still active, a later buffer wrap invokes the callback from privileged thread context after the module's code has been released, so a user-mode module can have its code run with kernel privileges after unload, or, once the memory is reused, redirect control flow or cause a fault.
Product
Eclipse ThreadX
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com gitlab.eclipse.org
Nov 3, 2026The CryptoCloud WordPress plugin from 3.0.0 through 3.0.1 does not verify the authenticity of the payment notifications received by its gateway callback, as theCVE-2026-103327 · WordPress plugins & themes · reported by WPScanMedium 5.3
The CryptoCloud WordPress plugin from 3.0.0 through 3.0.1 does not verify the authenticity of the payment notifications received by its gateway callback, as the integrity check is skipped while the webhook secret is left at its empty default, allowing unauthenticated attackers to mark arbitrary orders as paid or failed without any payment being made.
Affected
up to 3.0.1
What to do
Affects up to 3.0.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Nov 3, 2026The authentication endpoint does not properly encode user-supplied input before rendering it within the web page.CVE-2025-5769 · Other software · WSO2 · reported by ed10eef1-636d-4fbe-9993-6890dfa878f8Medium 6.1
The authentication endpoint does not properly encode user-supplied input before rendering it within the web page. This lack of output encoding allows an attacker to inject malicious JavaScript payloads into the authentication flow, which are then executed by the victim's browser. By exploiting this vulnerability, an attacker can redirect the user's browser to a malicious website, modify the content of the web page displayed to the user, or exfiltrate information from the browser. However, due to the implementation of the httpOnly flag on session-related sensitive cookies, session hijacking and similar attacks are not possible.
Product
WSO2 API Control Plane
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.docs.wso2.com
Nov 3, 2026AZEXO Store Locator: Does not have a capability check or any authorization controlCVE-2026-115205 · WordPress plugins & themes · reported by WPScanMedium 6.5
The AZEXO Store Locator WordPress plugin through 1.4 does not have a capability check or any authorization control when deleting a post, allowing any authenticated user, such as a subscriber, to delete arbitrary posts and pages.
Product
AZEXO Store Locator
Affected
up to 1.4
What to do
Affects up to 1.4. Update AZEXO Store Locator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Nov 3, 2026DT LMS: Does not perform capability or nonce checks on one of its AJAX actionsCVE-2026-106004 · WordPress plugins & themes · reported by WPScanMedium 5.3
The DT LMS WordPress plugin through 1.2 does not perform capability or nonce checks on one of its AJAX actions, allowing unauthenticated attackers to revoke any learner's course and class completion status.
Product
DT LMS
Affected
up to 1.2
What to do
Affects up to 1.2. Update DT LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Nov 3, 2026DT Directory Lite Addon: Does not perform nonce or capability checks on its settings handlersCVE-2026-105993 · WordPress plugins & themes · reported by WPScanMedium 5.3
The DT Directory Lite Addon WordPress plugin through 1.1 does not perform nonce or capability checks on its settings handlers, allowing unauthenticated attackers to modify the DT Directory Lite Addon WordPress plugin through 1.1's configuration and skin options.
Product
DT Directory Lite Addon
Affected
up to 1.1
What to do
Affects up to 1.1. Update DT Directory Lite Addon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Nov 3, 2026Gallery for Social Photo: Does not validate a user-supplied URL before using it to perform a server-side requestCVE-2026-105967 · WordPress plugins & themes · reported by WPScanMedium 5.8
The Gallery for Social Photo WordPress plugin through 1.0.0.41 does not validate a user-supplied URL before using it to perform a server-side request, allowing unauthenticated attackers to make the server issue requests to arbitrary internal hosts and read the responses.
Product
Gallery for Social Photo
Affected
up to 1.0.0.41
What to do
Affects up to 1.0.0.41. Update Gallery for Social Photo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Nov 3, 2026weMail: Does not restrict a site-wide third-party email-service API key to administratorsCVE-2026-104648 · WordPress plugins & themes · reported by WPScanMedium 4.9
The weMail WordPress plugin through 2.1.6 does not restrict a site-wide third-party email-service API key to administrators, exposing it in an admin screen that users with the Editor role can reach by default, which allows them to obtain a reusable credential usable without a WordPress session to impersonate other users and sever the site's email-service connection.
Product
weMail
Affected
up to 2.1.6
What to do
Affects up to 2.1.6. Update weMail to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Nov 3, 2026weMail: Does not correctly verify user capabilities in its REST API permission checksCVE-2026-104647 · WordPress plugins & themes · reported by WPScanLow 3.8
The weMail WordPress plugin through 2.1.6 does not correctly verify user capabilities in its REST API permission checks, treating any user whose role is in the weMail WordPress plugin through 2.1.6's allowed-roles list (Editor and above by default) as authorised for every action, which allows such users to perform administrator-level actions including enumerating all registered users with their email addresses and modifying the weMail WordPress plugin through 2.1.6's own access-control configuration.
Product
weMail
Affected
up to 2.1.6
What to do
Affects up to 2.1.6. Update weMail to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Nov 3, 2026WATI Chat and Notification: Does not require a validCVE-2026-103379 · WordPress plugins & themes · reported by WPScanMedium 5.3
The WATI Chat and Notification WordPress plugin through 1.1.8 does not require a valid, non-empty secret on a public endpoint that returns its stored API token, which an unauthenticated attacker can then present to a second public endpoint to obtain the order-received URL of any WooCommerce order and read the customer's name, address, phone number and email address. The endpoints are reachable in the WATI Chat and Notification WordPress plugin through 1.1.8's default state and are closed only once a WATI account is connected.
Product
WATI Chat and Notification
Affected
up to 1.1.8
What to do
Affects up to 1.1.8. Update WATI Chat and Notification to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Nov 2, 2026Octo STS (github.com/octo-sts/app) before 0.11.2 returns trust policy configuration to callers whose OIDC token does not satisfy that policy.CVE-2026-105770 · Other software · octo-sts · reported by 82cea9a6-e9e3-46fe-bdb0-3673de380178Medium 5.3
Octo STS (github.com/octo-sts/app) before 0.11.2 returns trust policy configuration to callers whose OIDC token does not satisfy that policy. TrustPolicy.CheckToken included the policy's issuer, subject and audience values or patterns and claim_pattern names and regular expressions in its PermissionDenied errors, which Exchange returned verbatim. Exchange also selected the GitHub App installation before checking the token, so errors from resolving the policy's app or app_pattern pin were returned to callers the policy does not trust. An attacker who holds any validly signed OIDC token, such as a GitHub Actions token from a repository they own, and who knows or guesses a target owner/repo and identity name can read that policy's matching rules, even when the policy is stored in a private repository. These rules often name internal repositories, branches, environments or cloud account identifiers. The issue does not allow minting tokens or bypassing a trust policy. This issue is fixed in 0.11.2.
Product
app
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Nov 2, 2026The PayHere Payment Gateway WordPress plugin from 2.4.0 through 2.4.5 does not verify the authenticity of payment notifications when the merchant secret is unseCVE-2026-103310 · WordPress plugins & themes · reported by WPScanMedium 5.3
The PayHere Payment Gateway WordPress plugin from 2.4.0 through 2.4.5 does not verify the authenticity of payment notifications when the merchant secret is unset, which is the default state, allowing unauthenticated attackers to forge a payment confirmation and mark any order as paid without payment.
Affected
up to 2.4.5
What to do
Affects up to 2.4.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Nov 1, 2026Google::Auth versions from 0.11 through 0.12 for Perl accept an authorization code from any local process because the gcloud-auth login callback does not check CVE-2026-74760 · Other software · reported by 9b29abf9-4ab0-4765-b253-1875cd9b441eHigh 8.8
Google::Auth versions from 0.11 through 0.12 for Perl accept an authorization code from any local process because the gcloud-auth login callback does not check the OAuth state. The gcloud-auth login and application-default login commands send a state parameter with the authorization request, then take the code from the first request to reach their loopback listener without comparing the returned state. A local attacker can submit an authorization code for their own Google account. The CLI exchanges it and stores the refresh token as the user's credentials, so the user's tools then act as the attacker's account.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record metacpan.org
Nov 1, 2026MapPress: Does not restrictCVE-2026-118168 · WordPress plugins & themes · reported by WPScanMedium 5.3
The MapPress WordPress plugin before 2.97.15 does not restrict which user's data its front-end map embed handler renders, allowing unauthenticated visitors to retrieve the email address and display name of any user on the site by enumerating user IDs.
Product
MapPress
Fixed in
2.97.15
What to do
Update MapPress to 2.97.15 or newer.
Full record and what to do →NVD record wpscan.com
Nov 1, 2026Media Library Assistant: Does not escape one of its shortcode attributes before outputting it in an attribute of generated linksCVE-2026-113482 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Media Library Assistant WordPress plugin before 3.44 does not escape one of its shortcode attributes before outputting it in an attribute of generated links, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
Media Library Assistant
Fixed in
3.44
What to do
Update Media Library Assistant to 3.44 or newer.
Full record and what to do →NVD record wpscan.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.