Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
8,640 results · page 3 of 173
Oct 20, 2026Nokia 1830 Global Express (GX) is vulnerable to a CLI ACL Bypass vulnerability where a low-privileged authenticated attacker can bypass the SSH isolation mechanCVE-2026-34485 · Other software · Nokia · reported by b48c3b8f-639e-4c16-8725-497bc411dad0
Nokia 1830 Global Express (GX) is vulnerable to a CLI ACL Bypass vulnerability where a low-privileged authenticated attacker can bypass the SSH isolation mechanism and gain access to the underlying operating system shell via a custom SSH command. This issue occurs by default in the system and is not the result of misconfiguration.
- Product
- Nokia 1830 Global Express (GX)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2026Nokia 1830 Global Express GX is vulnerable to a local privilege escalation vulnerability which exists in the administrative shell interface.CVE-2026-34484 · Other software · Nokia · reported by b48c3b8f-639e-4c16-8725-497bc411dad0
Nokia 1830 Global Express GX is vulnerable to a local privilege escalation vulnerability which exists in the administrative shell interface. An authenticated local attacker with restricted shell access can exploit this vulnerability to bypass local security restrictions and gain root access on the device.
- Product
- Nokia 1830 Global Express (GX)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2026LearnPress before 4.4.10 contains a missing authorization vulnerability in the admin_course_editor, admin_quiz_editor and admin_question_editor lp-ajax actions,CVE-2026-113353 · WordPress plugins & themes · reported by VulnCheckMedium 5.3
LearnPress before 4.4.10 contains a missing authorization vulnerability in the admin_course_editor, admin_quiz_editor and admin_question_editor lp-ajax actions, allowing instructors to modify other instructors' content. Authenticated instructors can reuse their own generic editor nonce with another object's id parameter to alter courses, change quiz answers, and trash questions.
- Fixed in
- 4.4.10
- What to do
- Update the plugin to 4.4.10 or newer.
Full record and what to do →NVD recordgithub.comlearnpresslms.com
Oct 19, 2026Ning compress-lzf before 1.2.0 contains an out-of-bounds memory access vulnerability in the sun.misc.Unsafe based UnsafeChunkDecoder that fails to validate backCVE-2026-109395 · Other software · ning · reported by VulnCheckHigh 8.8
Ning compress-lzf before 1.2.0 contains an out-of-bounds memory access vulnerability in the sun.misc.Unsafe based UnsafeChunkDecoder that fails to validate back-references and literal runs. Attackers can supply crafted LZF streams to applications using the default LZFDecoder to leak unrelated JVM heap memory into decompressed output or crash the JVM.
- Product
- compress-lzf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2026IBM MQ could allow an authenticated attacker to trigger a minor out-of-bounds read when sending malformed compressed data, though the data is not disclosed and CVE-2026-12669 · Other software · IBM · reported by psirt@us.ibm.comLow 3.1
IBM MQ could allow an authenticated attacker to trigger a minor out-of-bounds read when sending malformed compressed data, though the data is not disclosed and the request is rejected.
- Product
- MQ Operator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2026Rank Math SEO PRO for WordPress is affected by a supply-chain compromise in a subset of version 3.0.123 packages downloaded or updated between October 15, 2026 CVE-2026-111862 · WordPress plugins & themes · reported by WordfenceCritical 9.8
Rank Math SEO PRO for WordPress is affected by a supply-chain compromise in a subset of version 3.0.123 packages downloaded or updated between October 15, 2026 at 20:02 UTC and October 16, 2026 at 07:12 UTC. Rank Math states that the affected plugin files contained malware that could compromise a website if the plugin was activated and directs sites that activated an affected package to treat the website as compromised. The malware may establish persistent access, communicate with rank1cdn[.]com, recreate hidden backdoors on page visits, and expose WordPress credentials, database credentials, API keys, and other secrets accessible to the web server. Rank Math identifies three malicious wp_options keys, hidden PHP backdoors, unauthorized administrator accounts, a fake WordPress core file, PHP-executable .cache files, and a system cron marker as incident indicators. Only packages obtained during the vendor-confirmed window are claimed as affected; version 3.0.123 alone is not sufficient to establish compromise. Rank Math removed the affected files and released version 3.0.124 as the clean replacement.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordrankmath.comrankmath.com
Oct 19, 2026The software accepts user-supplied data without sufficient validation, allowing for the injection of malicious Expression Language (EL) code.CVE-2024-4412 · Other software · WSO2 · reported by ed10eef1-636d-4fbe-9993-6890dfa878f8Low 2.7
The software accepts user-supplied data without sufficient validation, allowing for the injection of malicious Expression Language (EL) code. This can lead to the execution of arbitrary operations within the affected deployment. Exploitation of this vulnerability requires administrator privileges. The impact is minimal as EL usage is restricted to certain read operations.
- Product
- WSO2 Enterprise Integrator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2026Picomatch through 4.0.7 contains a regular expression denial of service vulnerability that allows attackers to block the event loop by supplying single-branch rCVE-2026-112366 · Other software · micromatch · reported by VulnCheckHigh 8.7
Picomatch through 4.0.7 contains a regular expression denial of service vulnerability that allows attackers to block the event loop by supplying single-branch repeated extglob patterns. Attackers can provide globs like +(*) or +(*a), which analyzeRepeatedExtglob in lib/parse.js skips, causing exponential backtracking against short crafted strings and denying service to Node.js applications.
- Product
- picomatch
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2026sqlparse through 0.6.0 contains a PHP code injection vulnerability that allows attackers to inject PHP expressions by supplying SQL text containing unescaped doCVE-2026-112307 · Other software · andialbrecht · reported by VulnCheckHigh 8.4
sqlparse through 0.6.0 contains a PHP code injection vulnerability that allows attackers to inject PHP expressions by supplying SQL text containing unescaped dollar signs. Attackers can embed ${expr} or {${expr}} sequences that OutputPHPFilter places in double-quoted strings, executing arbitrary PHP code when the generated snippet runs.
- Product
- sqlparse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2026Camunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 contains an expression injection vulnerability where AdhocQueryValidator.validate() fails to check sub-qCVE-2026-109432 · Other software · Camunda · reported by VulnCheckCritical 9.3
Camunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 contains an expression injection vulnerability where AdhocQueryValidator.validate() fails to check sub-query expression maps within the orQueries field exposed by TaskQueryDto, allowing authenticated users to bypass the enableExpressionsInAdhocQueries restriction. Attackers can supply a malicious JUEL expression such as dueAfterExpression inside an orQueries entry to achieve arbitrary Java reflection and invoke java.lang.Runtime.exec, resulting in operating-system command execution as the engine service user.
- Product
- Camunda 7
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcodeant.aidocs.camunda.org
Oct 19, 2026LearnPress: Missing AuthorizationCVE-2026-110363 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LearnPress: from n/a through 4.4.10.
- Product
- LearnPress
- Affected
- up to 4.4.10
- What to do
- Affects up to 4.4.10. Update LearnPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 19, 2026Improper Control of Generation of Code ('Code Injection'), Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression LanCVE-2026-83531 · Email & office · Apache Software Foundation · reported by security@apache.orgHigh 8.8
Improper Control of Generation of Code ('Code Injection'), Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') vulnerability in Apache Camel. This issue affects Apache Camel: from 4.4.0 before 4.18.5, from 4.19.0 before 4.22.1. The dynamic-router-control endpoint, introduced in 4.4.0, lets routing participants manage Dynamic Router subscriptions by sending control messages. When it handled a subscribe or update request, DynamicRouterControlProducer took the subscription predicate and the name of the language used to compile it from the incoming message, either from the predicate and expressionLanguage fields of a DynamicRouterControlMessage body or from the CamelDynamicRouterPredicate and CamelDynamicRouterExpressionLanguage headers. DynamicRouterControlService then resolved that language from the CamelContext and compiled the expression into a Predicate, with no allow-list and no opt-in. The compiled predicate was added to the channel's rule base and evaluated against every exchange routed through the corresponding dynamic-router endpoint for as long as the subscription existed. A route that forwards messages
- Product
- Apache Camel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcamel.apache.orggithub.com
Oct 19, 2026HivePress: Improper Control of Generation of Code ('Code Injection')CVE-2026-110887 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Improper Control of Generation of Code ('Code Injection') vulnerability in HivePress HivePress hivepress allows Remote Code Inclusion.This issue affects HivePress: from n/a through 1.7.32.
- Product
- HivePress
- Affected
- up to 1.7.32
- What to do
- Affects up to 1.7.32. Update HivePress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 19, 2026Blaze Demo Importer: Does not sanitize uploaded SVG files and registers the SVG MIME type for the WordPress media library unconditionallyCVE-2026-106933 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Blaze Demo Importer WordPress plugin before 1.0.17 does not sanitize uploaded SVG files and registers the SVG MIME type for the WordPress media library unconditionally, allowing authenticated users with the Author role or higher to upload a crafted SVG that executes arbitrary JavaScript in the browser of any user who opens the file.
- Product
- Blaze Demo Importer
- Fixed in
- 1.0.17
- What to do
- Update Blaze Demo Importer to 1.0.17 or newer.
Oct 18, 2026The Bootstrap Shortcodes plugin for WordPress before 3.4.6 is vulnerable to stored XSS via the id attribute of the [bs_tcontent] shortcode.CVE-2026-112111 · WordPress plugins & themes · reported by MITREMedium 5.1
The Bootstrap Shortcodes plugin for WordPress before 3.4.6 is vulnerable to stored XSS via the id attribute of the [bs_tcontent] shortcode. The bs_tcontent() shortcode handler in inc/bs_tabs.php emits the id attribute value into an unquoted HTML attribute. esc_attr() is applied, but it does not encode space characters, so a space in the supplied value terminates the attribute and any following text is parsed as additional HTML attributes, including JavaScript event handlers. This allows authenticated attackers with Contributor-level access and above to inject arbitrary web script that executes in the browser of any user who views the page and interacts with the injected element.
- Product
- Bootstrap Shortcodes
- Fixed in
- 3.4.6
- What to do
- Update Bootstrap Shortcodes to 3.4.6 or newer.
Oct 18, 2026In the Linux kernel, the following vulnerability has been resolved: iio: pressure: bmp280: fix out-of-bounds access in sampling frequency lookup The sampling CVE-2026-98660 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
In the Linux kernel, the following vulnerability has been resolved: iio: pressure: bmp280: fix out-of-bounds access in sampling frequency lookup The sampling frequency tables store each frequency as an integer part and a fractional part in micro units. num_sampling_freq_avail is initialized to the number of flattened integer elements because read_avail() returns the table as a flat array. bmp280_write_sampling_frequency(), however, indexes the same table as a two-dimensional array and uses num_sampling_freq_avail as the number of rows. Convert the flattened element count back to the number of rows before iterating over the table.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Oct 18, 2026In the Linux kernel, the following vulnerability has been resolved: iio: pressure: rohm-bm1390: Return error when read fails The data reading function ignoresCVE-2026-98659 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
In the Linux kernel, the following vulnerability has been resolved: iio: pressure: rohm-bm1390: Return error when read fails The data reading function ignores the cached error value, and unconditionally returns 0. Return cached 'ret' -value after stopping the measurement so user knows if read failed and data is garbage.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Oct 18, 2026JQ::Lite versions before 2.51 for Perl execute Perl code embedded in a query's regular expression by compiling it with string eval.CVE-2026-78497 · Other software · reported by 9b29abf9-4ab0-4765-b253-1875cd9b441eHigh 8.4
JQ::Lite versions before 2.51 for Perl execute Perl code embedded in a query's regular expression by compiling it with string eval. The pattern given to test(), match(), or the match and =~ conditions of select() is placed in a `qr'...'` literal and compiled as source text, so a `(?{ ... })` code block in it runs without `use re 'eval'`. Single quotes in the pattern are escaped, but a code block runs in place and needs none. An attacker who supplies a query, or text that an application inserts into the pattern of one, can execute arbitrary Perl code in the calling process.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.commetacpan.org
Oct 18, 2026HivePress: Improper Control of Generation of Code ('Code Injection')CVE-2026-110885 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Control of Generation of Code ('Code Injection') vulnerability in HivePress HivePress hivepress allows Code Injection.This issue affects HivePress: from n/a through 1.7.32.
- Product
- HivePress
- Affected
- up to 1.7.32
- What to do
- Affects up to 1.7.32. Update HivePress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 18, 2026Modern Events Calendar Lite WordPress plugin before 7.37.0, Modern Event Calendar Pro: Does not sanitise and escape a parameter before using it in a SQL statementCVE-2026-96534 · WordPress plugins & themes · reported by WPScanHigh 7.7
The Modern Events Calendar Lite WordPress plugin before 7.37.0, Modern Event Calendar Pro WordPress plugin before 7.37.0 does not sanitise and escape a parameter before using it in a SQL statement, allowing authenticated users with minimal privileges (Subscriber and above) to perform SQL injection attacks.
- Product
- Modern Events Calendar Lite WordPress plugin before 7.37.0, Modern Event Calendar Pro
- Fixed in
- 7.37.0
- What to do
- Update Modern Events Calendar Lite WordPress plugin before 7.37.0, Modern Event Calendar Pro to 7.37.0 or newer.
Oct 17, 2026Fleet before 4.83.0 contains a denial of service vulnerability that allows unauthenticated attackers to exhaust server memory by sending gzip-compressed requestCVE-2026-111924 · Other software · fleetdm · reported by VulnCheckHigh 8.7
Fleet before 4.83.0 contains a denial of service vulnerability that allows unauthenticated attackers to exhaust server memory by sending gzip-compressed request bodies. Attackers can send small, highly compressed requests with Content-Encoding: gzip to unauthenticated endpoints that expand during decoding, crashing the entire Fleet instance.
- Product
- fleet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 17, 2026WP User Manager: Does not roll back the WordPress account it creates during payment-gated registrationCVE-2026-110527 · WordPress plugins & themes · reported by WPScanMedium 5.3
The WP User Manager WordPress plugin before 2.9.20 does not roll back the WordPress account it creates during payment-gated registration when the subsequent payment step fails, allowing unauthenticated users to create functional accounts without completing payment.
- Product
- WP User Manager
- Fixed in
- 2.9.20
- What to do
- Update WP User Manager to 2.9.20 or newer.
Oct 17, 2026PeachPay — Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net, NMI): Does not perform any capability or ownership check before returning an order's secret key in response to an unCVE-2026-103376 · WordPress plugins & themes · reported by WPScanMedium 5.3
The PeachPay — Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net, NMI) WordPress plugin before 1.120.70 does not perform any capability or ownership check before returning an order's secret key in response to an unauthenticated request, allowing anyone to retrieve the key for any paid order and use it to view that order's customer name, email address, postal address and contents.
- Product
- PeachPay — Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net, NMI)
- Fixed in
- 1.120.70
- What to do
- Update PeachPay — Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net, NMI) to 1.120.70 or newer.
Oct 17, 2026LearnPress – WordPress LMS Plugin for Create and Sell Online Courses: Authorization bypassCVE-2026-107744 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.4.10 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to enumerate the complete site user roster and extract the full email address of any WordPress account, including administrator accounts, character-by-character by using the search response as an oracle against both user_login and user_email columns.
- Product
- LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
- Affected
- up to 4.4.10
- What to do
- Affects up to 4.4.10. Update LearnPress – WordPress LMS Plugin for Create and Sell Online Courses to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 17, 2026LearnPress: PHP Object InjectionCVE-2026-104736 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The LearnPress plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 4.4.10 via deserialization of untrusted input from the 'checkout-email' request parameter during the checkout AJAX action. The value is passed through sanitize_text_field(), which does not strip serialized object syntax, then stored in the LearnPress session table and later fed to LP_Helper::maybe_unserialize() → unserialize() (without an allowed_classes restriction) by LP_Session_Handler::get() on subsequent requests. This makes it possible for unauthenticated attackers to inject a PHP Object.
- Product
- LearnPress
- Affected
- up to 4.4.10
- What to do
- Affects up to 4.4.10. Update LearnPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 16, 2026LearnPress – WordPress LMS Plugin for Create and Sell Online Courses: Stored Cross-Site ScriptingCVE-2026-109208 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'quantity (REST) / order_comments (checkout)' parameter in all versions up to, and including, 4.4.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. With guest checkout enabled the attack is fully unauthenticated; with guest checkout disabled, any Subscriber-level user can exploit both vectors through their own checkout.
- Product
- LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
- Affected
- up to 4.4.10
- What to do
- Affects up to 4.4.10. Update LearnPress – WordPress LMS Plugin for Create and Sell Online Courses to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 16, 2026tarteaucitron.js before 1.37.0 contains a regular expression denial of service vulnerability that allows attackers to block visitor pages by supplying unescapedCVE-2026-111714 · Other software · AmauriC · reported by VulnCheckLow 2.3
tarteaucitron.js before 1.37.0 contains a regular expression denial of service vulnerability that allows attackers to block visitor pages by supplying unescaped cookie names to cookie.purge. Attackers can plant a cookie from a sibling subdomain or inject a purgeBtn element with a catastrophic-backtracking data-cookie pattern that freezes the page when the purge button is clicked.
- Product
- tarteaucitron.js
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2026FilePress through 3.0.1 contains an sql injection vulnerability that allows authenticated low-privilege users to inject SQL into ORDER BY clauses via the unvaliCVE-2026-111619 · Other software · zyx0814 · reported by VulnCheckHigh 7.1
FilePress through 3.0.1 contains an sql injection vulnerability that allows authenticated low-privilege users to inject SQL into ORDER BY clauses via the unvalidated asc parameter. Attackers can use blind boolean or time-based subqueries in dzz/pichome/library/filelist.php and dzz/collection/filelist.php to extract database rows including administrator credential hashes.
- Product
- FilePress
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2026YITH PayPal Express Checkout for WooCommerce: Missing AuthorizationCVE-2026-111409 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in YITH YITH PayPal Express Checkout for WooCommerce yith-paypal-express-checkout-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YITH PayPal Express Checkout for WooCommerce: from n/a through 1.61.0.
- Product
- YITH PayPal Express Checkout for WooCommerce
- Affected
- up to 1.61.0
- What to do
- Affects up to 1.61.0. Update YITH PayPal Express Checkout for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 16, 2026WP User Avatar / ProfilePress: Arbitrary Shortcode ExecutionCVE-2026-104003 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The WP User Avatar / ProfilePress plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 4.17.5. This is due to the get_user_profile_structure() function assembling the front-end profile buffer — which includes raw comment excerpts inlined by author_comment_query() — and passing the entire buffer to do_shortcode() after only a narrow neutralization pass (ppress_neutralize_buffer_shortcodes) that blocks pp-custom-html and bracket fragments containing HTML delimiters but leaves any other well-formed shortcode intact. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary shortcodes (from any active plugin or theme) with attacker-chosen attributes by posting a comment whose body contains the shortcode markup; the shortcode is then executed server-side when any visitor loads the target's front-end profile Comments tab, letting the attacker reach capability-gated or data-returning shortcodes and inject raw HTML markup into a publicly viewable page.
- Product
- WP User Avatar / ProfilePress
- Affected
- up to 4.17.5
- What to do
- Affects up to 4.17.5. Update WP User Avatar / ProfilePress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpastebin.complugins.trac.wordpress.org
Oct 16, 2026Salon Booking System: Does not correctly verify the authenticity of REST API requests and discards WordPress core's nonce check for cookie-authenticated sessions across the whole REST APICVE-2026-110015 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Salon Booking System WordPress plugin before 10.31.9 does not correctly verify the authenticity of REST API requests and discards WordPress core's nonce check for cookie-authenticated sessions across the whole REST API, allowing unauthenticated attackers who trick a logged-in administrator into clicking a crafted link to forge requests in that administrator's browser, up to creating a new administrator account.
- Product
- Salon Booking System
- Fixed in
- 10.31.9
- What to do
- Update Salon Booking System to 10.31.9 or newer.
Oct 16, 2026HivePress – Business Directory, Listings & Classified Ads: Stored Cross-Site ScriptingCVE-2026-109388 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The HivePress – Business Directory, Listings & Classified Ads Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'message' parameter in all versions up to, and including, 1.7.32 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that the site administrator has enabled user listing submission, and the script executes in the victim's browser at the moment of successful login via the embedded form on the attacker's listing page.
- Product
- HivePress – Business Directory, Listings & Classified Ads
- Affected
- up to 1.7.32
- What to do
- Affects up to 1.7.32. Update HivePress – Business Directory, Listings & Classified Ads to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.complugins.trac.wordpress.org
Oct 16, 2026HivePress – Business Directory, Listings & Classified Ads: Stored Cross-Site ScriptingCVE-2026-109193 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The HivePress – Business Directory, Listings & Classified Ads Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '<custom user attribute slug> (e.g. hp_custom_link)' parameter in all versions up to, and including, 1.7.32 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that an administrator has configured a custom user attribute with a display_format template placing the %value% token inside an href, src, or style attribute context, which is a documented and expected use of the plugin's attribute display feature.
- Product
- HivePress – Business Directory, Listings & Classified Ads
- Affected
- up to 1.7.32
- What to do
- Affects up to 1.7.32. Update HivePress – Business Directory, Listings & Classified Ads to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.complugins.trac.wordpress.org
Oct 16, 2026TranslatePress – Translate Multilingual sites with AI Translation: Stored Cross-Site ScriptingCVE-2026-107768 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 3.3.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the target site to allow unmoderated comment submission on at least one post and to have a secondary language configured — both conditions reflect TranslatePress's primary use case.
- Product
- TranslatePress – Translate Multilingual sites with AI Translation
- Affected
- up to 3.3.7
- What to do
- Affects up to 3.3.7. Update TranslatePress – Translate Multilingual sites with AI Translation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 16, 2026WP Compress – Instant Performance & Speed Optimization: Privilege EscalationCVE-2026-104755 · WordPress plugins & themes · reported by WordfenceMedium 4.8
The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 7.25.00 The vulnerability exists because the `start_comms` dispatcher (`wps_ic_comms::start_comms`), hooked on every front-end request, gates access only by comparing the caller-supplied `apikey` parameter against the stored plugin API key with no WordPress capability check and no nonce verification, then passes the unvalidated `group`, `setting`, and `value` parameters directly to `change_setting()`, which writes them into the `WPS_IC_SETTINGS` option without an allow-list. This makes it possible for unauthenticated attackers to write arbitrary permission keys into the plugin's settings, causing `wps_ic_users::checkAndAddCaps()` to grant any WordPress role — including Subscriber — the `manage_wpc_settings` capability and thereby achieve plugin-administrator-equivalent control over the plugin's optimization, CDN, and critical-CSS surfaces. The API key required to pass the authorization check can itself be obtained without authentication via the `wpc_send_critical_remote` nopriv AJAX action: when the external critical-CSS service
- Product
- WP Compress – Instant Performance & Speed Optimization
- Affected
- up to 7.25.00
- What to do
- Affects up to 7.25.00. Update WP Compress – Instant Performance & Speed Optimization to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 16, 2026PilotPress: Privilege EscalationCVE-2026-85659 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The PilotPress plugin for WordPress is vulnerable to Privilege Escalation via Account Takeover in all versions up to, and including, 2.0.43. The vulnerability exists because the `update_cc_details()` AJAX handler forwards an attacker-supplied `username` parameter to ONTRAPORT via `api_call('update_cc_details', ...)` before performing the local `username_exists()` collision check, and aborts without rolling back the remote rename when a collision is detected — leaving the remote ONTRAPORT contact renamed to an existing WordPress Administrator's login. On a subsequent login attempt, `user_login()` (hooked to `wp_authenticate`) authenticates against ONTRAPORT using the renamed login and the attacker's own password, resolves the local WordPress user row via `get_user_by('login', $username)` — which now selects the real Administrator's row — and calls `wp_set_password()` against that Administrator's user ID; because the `user_level != 10` guard only suppresses PilotPress's own cookie issuance rather than returning a `WP_Error` to core, WordPress proceeds to validate the newly-synchronized password and issues a full Administrator authentication cookie to the attacker. This makes it possi
- Product
- PilotPress
- Affected
- up to 2.0.43
- What to do
- Affects up to 2.0.43. Update PilotPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 16, 2026ELEX WordPress HelpDesk & Customer Ticketing System: Arbitrary File UploadCVE-2026-103768 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.3.7 via the initMailPart function. This is due to insufficient file type validation when saving IMAP email attachments. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible.
- Product
- ELEX WordPress HelpDesk & Customer Ticketing System
- Affected
- up to 3.3.7
- What to do
- Affects up to 3.3.7. Update ELEX WordPress HelpDesk & Customer Ticketing System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 15, 2026ValleyBell libvgm through commit a6eed945 contains a heap out-of-bounds read vulnerability in the PCM data-block decompressor caused by an unbounded compressionCVE-2026-111150 · Other software · ValleyBell · reported by VulnCheckMedium 6.8
ValleyBell libvgm through commit a6eed945 contains a heap out-of-bounds read vulnerability in the PCM data-block decompressor caused by an unbounded compression-table index. Attackers can supply a crafted .vgm file with a small type 0x7F table and wider compressed values, causing DecompressDataBlk to over-read heap memory and crash consumers.
- Product
- libvgm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026ytnef through 2.1.2 contains a heap out-of-bounds read vulnerability in MAPIPrint() that allows attackers to read past heap allocations by supplying compressed CVE-2026-111146 · Other software · Yeraze · reported by VulnCheckMedium 6.9
ytnef through 2.1.2 contains a heap out-of-bounds read vulnerability in MAPIPrint() that allows attackers to read past heap allocations by supplying compressed RTF properties. Attackers can deliver a crafted winmail.dat whose decompressed RTF lacks a NUL terminator, causing printf to over-read, crashing ytnefprint and leaking adjacent heap bytes.
- Product
- ytnef
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026ytnef through 2.1.2 contains a heap out-of-bounds read vulnerability in DecompressRTF() in lib/ytnef.c that never validates uncompressedSize for uncompressed RTCVE-2026-111145 · Other software · Yeraze · reported by VulnCheckMedium 6.9
ytnef through 2.1.2 contains a heap out-of-bounds read vulnerability in DecompressRTF() in lib/ytnef.c that never validates uncompressedSize for uncompressed RTF streams. Attackers can supply a crafted winmail.dat TNEF attachment with a malicious PT_BINARY MAPI property to crash ytnefprint or libytnef callers and leak adjacent heap memory.
- Product
- ytnef
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026Ansilove libansilove through 1.4.2 contains an out-of-bounds read vulnerability in ansilove_xbin() in src/loaders/xbin.c that lacks bounds checks for compressedCVE-2026-111143 · Other software · ansilove · reported by VulnCheckMedium 6.8
Ansilove libansilove through 1.4.2 contains an out-of-bounds read vulnerability in ansilove_xbin() in src/loaders/xbin.c that lacks bounds checks for compressed run-length records. Attackers can supply a crafted compressed XBIN file ending in a control byte such as 0x7F to read past the input buffer, crashing applications that render untrusted XBIN art.
- Product
- libansilove
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026CFITSIO through 4.7.0 contains a heap-based out-of-bounds read vulnerability in the HCOMPRESS tile decoder that allows attackers to read past the compressed tilCVE-2026-111125 · Other software · HEASARC · reported by VulnCheckMedium 6.9
CFITSIO through 4.7.0 contains a heap-based out-of-bounds read vulnerability in the HCOMPRESS tile decoder that allows attackers to read past the compressed tile buffer via input_nnybble in fits_hdecompress.c. Attackers can supply a crafted FITS file with ZCMPTYPE HCOMPRESS_1 declaring oversized tile geometry to crash applications calling fits_read_pix or disclose limited heap memory.
- Product
- cfitsio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026CFITSIO through 4.7.0 contains a heap-based out-of-bounds read vulnerability in the imcompress.c unquantize helpers that allows attackers to read memory before CVE-2026-111124 · Other software · HEASARC · reported by VulnCheckMedium 6.9
CFITSIO through 4.7.0 contains a heap-based out-of-bounds read vulnerability in the imcompress.c unquantize helpers that allows attackers to read memory before the fits_rand_value table via a zero or negative ZDITHER0 seed. Attackers can supply a crafted FITS file with a SUBTRACTIVE_DITHER_1 compressed image, read through fits_open_file() and fits_read_pix(), to cause crashes or leak heap contents in decoded pixels.
- Product
- cfitsio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026A Regular-Expression Denial of Service (ReDoS) in the Markdown2.CVE-2026-88753 · Other software · reported by MITREHigh 7.5
A Regular-Expression Denial of Service (ReDoS) in the Markdown2. extract_metadata() function (lib/markdown2.py) of trentm markdown2 through v2.5.5 allows attackers to cause a Denial of Service (DoS) via a crafted Markdown document.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Oct 15, 2026In Symfony Expression Language versions prior to 5.4.54, 6.4.48, 7.4.21, and 8.1.9, the parser of the ExpressionLanguage component built its node tree with no bCVE-2026-109449 · Other software · sensiolabs · reported by 596c5446-0ce5-4ba2-aa66-48b3b757a647High 8.7
In Symfony Expression Language versions prior to 5.4.54, 6.4.48, 7.4.21, and 8.1.9, the parser of the ExpressionLanguage component built its node tree with no bound on its depth. An expression made of tens of thousands of nested unary operators, array literals, binary operators or property accesses crashed the PHP process, while the tree was being freed. #[Assert\ExpressionSyntax] passes the validated value to ExpressionLanguage::lint(), so an application validating expressions written by its users could be crashed by a single request, and so could any code parsing untrusted expressions. This issue affects symfony/expression-language through v5.4.53, v6.0.0-BETA1 through v6.4.47, v7.0.0-BETA1 through v7.4.20, and v8.0.0-BETA1 through v8.1.8.
- Product
- symfony
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026PhastPress: Server-Side Request ForgeryCVE-2026-3712 · WordPress plugins & themes · reported by WordfenceHigh 7.3
The PhastPress plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.10 This is due to the scripts service endpoint constructing its URL whitelist dynamically from the attacker-controlled HTTP 'Host' header. This makes it possible for unauthenticated attackers to spoof the header to match any target URL, bypassing the whitelist and forcing the server to make HTTP requests to arbitrary internal or external destinations and return the response content.
- Product
- PhastPress
- Affected
- up to 3.10
- What to do
- Affects up to 3.10. Update PhastPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 14, 2026Nodemailer 3.0.0 before 10.0.13 has a regular expression denial of service in SMTPConnection._actionEHLO, whose four AUTH mechanism detection regexes contain ovCVE-2026-110869 · Other software · nodemailer · reported by VulnCheckHigh 8.7
Nodemailer 3.0.0 before 10.0.13 has a regular expression denial of service in SMTPConnection._actionEHLO, whose four AUTH mechanism detection regexes contain overlapping whitespace sub-patterns that backtrack quadratically. A malicious or man-in-the-middle SMTP server can reply to EHLO with 250-AUTH, a long whitespace run and a non-matching token, blocking the Node.js event loop for tens of seconds to hours before authentication.
- Product
- nodemailer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 14, 2026GitPython before 3.2.0 contains a regular expression denial of service vulnerability in the _re_actor_epoch pattern used by parse_actor_and_date on author, commCVE-2026-110856 · Other software · gitpython-developers · reported by VulnCheckHigh 8.7
GitPython before 3.2.0 contains a regular expression denial of service vulnerability in the _re_actor_epoch pattern used by parse_actor_and_date on author, committer, and tagger lines. Attackers can serve repositories with commit or tag objects containing long space-filled lines lacking a valid epoch or timezone, causing quadratic backtracking and CPU exhaustion.
- Product
- GitPython
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 14, 2026n8n before 2.41.4 and 2.42.x before 2.42.1 contains an SQL injection vulnerability in version 1 of the Microsoft SQL node, which substitutes Query field expressCVE-2026-110840 · Other software · n8n-io · reported by VulnCheckHigh 7
n8n before 2.41.4 and 2.42.x before 2.42.1 contains an SQL injection vulnerability in version 1 of the Microsoft SQL node, which substitutes Query field expression values directly into SQL text without parameterisation. When a workflow binds untrusted input such as webhook fields to the Query field, unauthenticated external callers can execute arbitrary SQL against the connected database with the stored credential's privileges.
- Product
- n8n
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 14, 2026bbPress before 2.6.19 contains an information disclosure vulnerability that allows unauthenticated visitors to view restricted subforum posts because hide_sitewCVE-2026-110762 · WordPress plugins & themes · reported by VulnCheckMedium 6.3
bbPress before 2.6.19 contains an information disclosure vulnerability that allows unauthenticated visitors to view restricted subforum posts because hide_sitewide ignores ancestor forum visibility. Topics and replies in public subforums nested under private or hidden parents expose title, permalink and body via the BuddyPress activity stream and REST endpoint.
- Fixed in
- 2.6.19
- What to do
- Update the plugin to 2.6.19 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.