Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,038 results · page 3 of 21
Oct 10, 2026ThemeREX Group Convex convex: Deserialization of Untrusted DataCVE-2026-93943 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeREX Group Convex convex allows Object Injection.This issue affects Convex: from n/a through 1.16.0.
- Product
- ThemeREX Group Convex convex
- Affected
- up to 1.16.0
- What to do
- Affects up to 1.16.0. Update ThemeREX Group Convex convex to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026ThemeREX Group Dwell dwell: Deserialization of Untrusted DataCVE-2026-93942 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeREX Group Dwell dwell allows Object Injection.This issue affects Dwell: from n/a through 1.16.0.
- Product
- ThemeREX Group Dwell dwell
- Affected
- up to 1.16.0
- What to do
- Affects up to 1.16.0. Update ThemeREX Group Dwell dwell to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026ThemeREX Group Edema edema: Deserialization of Untrusted DataCVE-2026-93941 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeREX Group Edema edema allows Object Injection.This issue affects Edema: from n/a through 1.2.2.2.
- Product
- ThemeREX Group Edema edema
- Affected
- up to 1.2.2.2
- What to do
- Affects up to 1.2.2.2. Update ThemeREX Group Edema edema to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026ThemeREX Group Greeny greeny: Deserialization of Untrusted DataCVE-2026-93940 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeREX Group Greeny greeny allows Object Injection.This issue affects Greeny: from n/a through 2.10.0.
- Product
- ThemeREX Group Greeny greeny
- Affected
- up to 2.10.0
- What to do
- Affects up to 2.10.0. Update ThemeREX Group Greeny greeny to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026ThemeREX Group Hogwords hogwords: Deserialization of Untrusted DataCVE-2026-93938 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeREX Group Hogwords hogwords allows Object Injection.This issue affects Hogwords: from n/a through 1.2.7.
- Product
- ThemeREX Group Hogwords hogwords
- Affected
- up to 1.2.7
- What to do
- Affects up to 1.2.7. Update ThemeREX Group Hogwords hogwords to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026ThemeREX Group Hygia hygia: Deserialization of Untrusted DataCVE-2026-93937 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeREX Group Hygia hygia allows Object Injection.This issue affects Hygia: from n/a through 1.21.0.
- Product
- ThemeREX Group Hygia hygia
- Affected
- up to 1.21.0
- What to do
- Affects up to 1.21.0. Update ThemeREX Group Hygia hygia to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026ThemeREX Group IPharm ipharm: Deserialization of Untrusted DataCVE-2026-93936 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeREX Group IPharm ipharm allows Object Injection.This issue affects IPharm: from n/a through 1.2.4.
- Product
- ThemeREX Group IPharm ipharm
- Affected
- up to 1.2.4
- What to do
- Affects up to 1.2.4. Update ThemeREX Group IPharm ipharm to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026ThemeREX Group Let's Play playhockey: Deserialization of Untrusted DataCVE-2026-93935 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeREX Group Let's Play playhockey allows Object Injection.This issue affects Let's Play: from n/a through 1.1.15.
- Product
- ThemeREX Group Let's Play playhockey
- Affected
- up to 1.1.15
- What to do
- Affects up to 1.1.15. Update ThemeREX Group Let's Play playhockey to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026ThemeREX Group Partiso partiso: Deserialization of Untrusted DataCVE-2026-93934 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeREX Group Partiso partiso allows Object Injection.This issue affects Partiso: from n/a through 1.1.13.
- Product
- ThemeREX Group Partiso partiso
- Affected
- up to 1.1.13
- What to do
- Affects up to 1.1.13. Update ThemeREX Group Partiso partiso to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026ThemeREX Group Rosalinda rosalinda: Deserialization of Untrusted DataCVE-2026-93933 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeREX Group Rosalinda rosalinda allows Object Injection.This issue affects Rosalinda: from n/a through 1.2.4.
- Product
- ThemeREX Group Rosalinda rosalinda
- Affected
- up to 1.2.4
- What to do
- Affects up to 1.2.4. Update ThemeREX Group Rosalinda rosalinda to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026ThemeREX Group Smart Casa smart-casa: Deserialization of Untrusted DataCVE-2026-93932 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeREX Group Smart Casa smart-casa allows Object Injection.This issue affects Smart Casa: from n/a through 1.0.12.
- Product
- ThemeREX Group Smart Casa smart-casa
- Affected
- up to 1.0.12
- What to do
- Affects up to 1.0.12. Update ThemeREX Group Smart Casa smart-casa to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026ThemeREX Group Smash smash: Deserialization of Untrusted DataCVE-2026-93931 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeREX Group Smash smash allows Object Injection.This issue affects Smash: from n/a through 1.12.0.
- Product
- ThemeREX Group Smash smash
- Affected
- up to 1.12.0
- What to do
- Affects up to 1.12.0. Update ThemeREX Group Smash smash to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026ThemeREX Group Tantra tantra: Deserialization of Untrusted DataCVE-2026-93930 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeREX Group Tantra tantra allows Object Injection.This issue affects Tantra: from n/a through 2.9.0.
- Product
- ThemeREX Group Tantra tantra
- Affected
- up to 2.9.0
- What to do
- Affects up to 2.9.0. Update ThemeREX Group Tantra tantra to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026ThemeREX Group Travesia travesia: Deserialization of Untrusted DataCVE-2026-93929 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeREX Group Travesia travesia allows Object Injection.This issue affects Travesia: from n/a through 1.1.16.
- Product
- ThemeREX Group Travesia travesia
- Affected
- up to 1.1.16
- What to do
- Affects up to 1.1.16. Update ThemeREX Group Travesia travesia to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026Axiomthemes Veto veto: Deserialization of Untrusted DataCVE-2026-93927 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in Axiomthemes Veto veto allows Object Injection.This issue affects Veto: from n/a through 1.6.0.
- Product
- Axiomthemes Veto veto
- Affected
- up to 1.6.0
- What to do
- Affects up to 1.6.0. Update Axiomthemes Veto veto to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026ThemeREX Group Gutentype gutentype: Deserialization of Untrusted DataCVE-2026-62046 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeREX Group Gutentype gutentype allows Object Injection.This issue affects Gutentype: from n/a through 2.1.12.
- Product
- ThemeREX Group Gutentype gutentype
- Affected
- up to 2.1.12
- What to do
- Affects up to 2.1.12. Update ThemeREX Group Gutentype gutentype to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026ThemeREX Group Booklovers booklovers: Deserialization of Untrusted DataCVE-2026-62045 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeREX Group Booklovers booklovers allows Object Injection.This issue affects Booklovers: from n/a through 2.13.0.
- Product
- ThemeREX Group Booklovers booklovers
- Affected
- up to 2.13.0
- What to do
- Affects up to 2.13.0. Update ThemeREX Group Booklovers booklovers to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026WPCOM Member: Authentication BypassCVE-2026-104803 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The WPCOM Member plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.7.27 via the `uuid` and `code` parameters of the social-login callback handler registered on the `init` hook. The vulnerability exists because the `login` function's social-login flow performs no nonce validation, no OAuth state verification, and no per-visitor namespace isolation in the session store, allowing an unauthenticated attacker to issue a crafted GET request that writes an attacker-named, attacker-valued entry into the global session namespace (bypassing the per-visitor prefix by prepending an underscore), then issue a second GET request triggering `weapp_new_user()` to read that forged entry and resolve the attacker-supplied `openid` value to a bound WordPress account before `wp_set_auth_cookie()` establishes a fully authenticated session. This makes it possible for unauthenticated attackers to log in as any WordPress user — including administrators — whose bound social provider identifier (openid/unionid) is known or discoverable. Successful exploitation requires that the target site has at least one social provider configured (which activates the vulner
- Product
- WPCOM Member
- Affected
- up to 1.7.27
- What to do
- Affects up to 1.7.27. Update WPCOM Member to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 10, 2026PPOM – Product Addons & Custom Fields for WooCommerce: Arbitrary file deletionCVE-2026-104801 · WordPress plugins & themes · reported by WordfenceCritical 9.1
The PPOM – Product Addons & Custom Fields for WooCommerce plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the rename_files function in all versions up to, and including, 34.0.10 This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). The relocated file is moved byte-identically into the publicly accessible wp-content/uploads/ppom_files/confirmed/ directory, meaning the attack also results in arbitrary file read for any web-readable file on the server.
- Product
- PPOM – Product Addons & Custom Fields for WooCommerce
- Affected
- up to 34.0.10
- What to do
- Affects up to 34.0.10. Update PPOM – Product Addons & Custom Fields for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 10, 2026Avada (Fusion) Builder: Authorization bypassCVE-2026-97670 · WordPress plugins & themes · reported by WordfenceCritical 9.1
The Avada (Fusion) Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.16.1. This is due to the plugin not properly verifying authorization before dispatching a WordPress action hook whose name is taken from an attacker-supplied form-field value (via the notification email_message [field] placeholder and the {action_hook,...} dynamic-data token; the 3.16.1 trust gate is_content_request_supplied() only inspects $_POST['args']/$_GET['args'], never the $_POST['formData'] the public form-submit endpoint parses). This makes it possible for unauthenticated attackers to invoke arbitrary WordPress action hooks (multiple per request), causing state changes up to permanent, irreversible destruction of site content: a verified unauthenticated request permanently deleted trashed posts, pages, and comments via the core wp_scheduled_delete action. Other non-deny-listed hooks extend the impact to denial of service (e.g. wp_maybe_auto_update) and, where vulnerable third-party handlers are installed, further privileged writes. The same unauthenticated dynamic-data pipeline additionally exposes a blind arbitrary user/post-meta read; the read res
- Product
- Avada (Fusion) Builder
- Affected
- up to 7.16.1
- What to do
- Affects up to 7.16.1. Update Avada (Fusion) Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 20263D Product configurator for WooCommerce: Remote Code ExecutionCVE-2026-103889 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The 3D Product configurator for WooCommerce plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.16.2 via the 'xpv_image' parameter parameter. This is due to missing authentication and nonce checks on the wp_loaded handler combined with no sanitization of the xpv_image POST parameter before it is echoed unescaped into a Dompdf-rendered HTML template with PHP execution enabled. This makes it possible for unauthenticated attackers to execute code on the server. The only nonce and authentication check in the handler is entirely enclosed in a block comment with no replacement, making the endpoint reachable via a single unauthenticated POST to any URL on the site.
- Product
- 3D Product configurator for WooCommerce
- Affected
- up to 2.16.2
- What to do
- Affects up to 2.16.2. Update 3D Product configurator for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 10, 2026Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection): Arbitrary File UploadCVE-2026-94589 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection) plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.4.5 via the extcf7_submit function. This is due to missing file extension, MIME type, and size validation in the signature field's validation_filter(), combined with the absence of PHP-execution guards in the upload directory and a sanitize_file_name() bypass that converts shell.php- into shell.php. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible.
- Product
- Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection)
- Affected
- up to 3.4.5
- What to do
- Affects up to 3.4.5. Update Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 10, 2026Blocksy Companion: Privilege escalationCVE-2026-107645 · WordPress plugins & themes · reported by WordfenceCritical 9.1
The Blocksy Companion plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 2.1.58 This is due to the implement_user_registration() AJAX handler explicitly disabling Dokan's vendor-registration nonce check (via add_filter('dokan_register_nonce_check', '__return_false')) and then trusting an attacker-supplied $_POST['role'] value when invoking wc_create_new_customer() and wc_set_customer_auth_cookie(). This makes it possible for unauthenticated attackers to elevate their privileges to a Dokan 'seller' (vendor) account — including sites where the Dokan vendor signup is explicitly turned off — and to be auto-authenticated into that account, which grants publishing capabilities beyond those of a normal customer.
- Product
- Blocksy Companion
- Affected
- up to 2.1.58
- What to do
- Affects up to 2.1.58. Update Blocksy Companion to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 10, 2026Advanced IP Blocker: Authentication BypassCVE-2026-104732 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Advanced IP Blocker plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 8.13.13 The vulnerability exists because `handle_login_action()` performs no server-side check — via transient, session marker, or equivalent — that a requester completed step-1 password authentication before processing a step-2 TOTP submission for the POSTed `user_id`; compounding this, an error branch in the function unconditionally mints a fresh `advaipbl-2fa-interim-{user_id}` nonce and delivers it in a `Location` header to any unauthenticated caller, after which `display_2fa_login_form_step_2()` renders a valid `advaipbl-2fa-verify-{user_id}` nonce in HTML — both nonces computed against a fixed `uid=0` empty-session context and therefore fully reusable by the attacker across subsequent requests. This makes it possible for unauthenticated attackers to bypass authentication entirely for any 2FA-enabled account, including administrators, by brute-forcing an unthrottled 6-digit TOTP code (no attempt counter, no account lockout, and no `wp_login_failed` firing) and receiving a fully authenticated session cookie via `wp_set_auth_cookie` without ever supplying the
- Product
- Advanced IP Blocker
- Affected
- up to 8.13.13
- What to do
- Affects up to 8.13.13. Update Advanced IP Blocker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 9, 2026MultiNet Interactive AB EduAdmin Booking eduadmin-booking: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-96809 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in MultiNet Interactive AB EduAdmin Booking eduadmin-booking allows Blind SQL Injection.This issue affects EduAdmin Booking: from n/a before 6.0.0.
- Product
- MultiNet Interactive AB EduAdmin Booking eduadmin-booking
- Fixed in
- 6.0.0
- What to do
- Update MultiNet Interactive AB EduAdmin Booking eduadmin-booking to 6.0.0 or newer.
Oct 9, 2026wpdreams Ajax Search Pro ajax-search-pro: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-96331 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in wpdreams Ajax Search Pro ajax-search-pro allows Blind SQL Injection.This issue affects Ajax Search Pro: from n/a through 4.29.1.
- Product
- wpdreams Ajax Search Pro ajax-search-pro
- Affected
- up to 4.29.1
- What to do
- Affects up to 4.29.1. Update wpdreams Ajax Search Pro ajax-search-pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 9, 2026tagDiv tagDiv Opt-In Builder td-subscription: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-96330 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in tagDiv tagDiv Opt-In Builder td-subscription allows Blind SQL Injection.This issue affects tagDiv Opt-In Builder: from n/a through 1.7.6.
- Product
- tagDiv tagDiv Opt-In Builder td-subscription
- Affected
- up to 1.7.6
- What to do
- Affects up to 1.7.6. Update tagDiv tagDiv Opt-In Builder td-subscription to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 9, 2026jegtheme JNews - Pay Writer jnews-pay-writer: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-96328 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in jegtheme JNews - Pay Writer jnews-pay-writer allows Blind SQL Injection.This issue affects JNews - Pay Writer: from n/a through 12.0.1.
- Product
- jegtheme JNews - Pay Writer jnews-pay-writer
- Affected
- up to 12.0.1
- What to do
- Affects up to 12.0.1. Update jegtheme JNews - Pay Writer jnews-pay-writer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 9, 2026VibeThemes WPLMS wplms_plugin: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-96327 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VibeThemes WPLMS wplms_plugin allows Blind SQL Injection.This issue affects WPLMS: from n/a before 1.9.9.8.2.
- Product
- VibeThemes WPLMS wplms_plugin
- Fixed in
- 1.9.9.8.2
- What to do
- Update VibeThemes WPLMS wplms_plugin to 1.9.9.8.2 or newer.
Oct 9, 2026PX-lab Zombify zombify: Unrestricted Upload of File with Dangerous TypeCVE-2026-94503 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in PX-lab Zombify zombify allows Upload a Web Shell to a Web Server.This issue affects Zombify: from n/a through 1.7.7.
- Product
- PX-lab Zombify zombify
- Affected
- up to 1.7.7
- What to do
- Affects up to 1.7.7. Update PX-lab Zombify zombify to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 9, 2026Shinetheme Traveler traveler: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-93947 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Shinetheme Traveler traveler allows Blind SQL Injection.This issue affects Traveler: from n/a through 3.2.9.
- Product
- Shinetheme Traveler traveler
- Affected
- up to 3.2.9
- What to do
- Affects up to 3.2.9. Update Shinetheme Traveler traveler to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 8, 2026Bricksforge: Unauthenticated arbitrary file uploadCVE-2026-85097 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Bricksforge plugin for WordPress is vulnerable to unauthenticated arbitrary file upload in versions up to, and including, 3.1.8.9. This is due to insufficient validation of the attacker-controlled URL field in the 'temporaryFileUploads' parameter during form submission. An unauthenticated attacker can first obtain a valid nonce via the bricksforge_regenerate_nonce AJAX endpoint, then upload a GIF/PHP polyglot file to the temporary upload directory where MIME type validation is correctly performed. Subsequently, the attacker can submit a form with a crafted 'temporaryFileUploads' parameter where the server-side file path points to the validated GIF file, but the attacker-controlled url field ends with a .php extension. This makes it possible for unauthenticated attackers to upload and execute arbitrary PHP code on the server.
- Product
- Bricksforge
- Affected
- up to 3.1.8.9
- What to do
- Affects up to 3.1.8.9. Update Bricksforge to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 8, 2026Frontend Dashboard: Does not perform any authorisation or nonce check on actions available to unauthenticated users that call an attacker-chosen PHP function or class method with the request dataCVE-2026-103692 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Frontend Dashboard WordPress plugin before 3.0.5 does not perform any authorisation or nonce check on actions available to unauthenticated users that call an attacker-chosen PHP function or class method with the request data, allowing unauthenticated users to take over any account, including administrators.
- Product
- Frontend Dashboard
- Fixed in
- 3.0.5
- What to do
- Update Frontend Dashboard to 3.0.5 or newer.
Oct 8, 2026Ultimate Multisite: Does not require authentication before a logged-out checkout is linked toCVE-2026-103646 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Ultimate Multisite WordPress plugin before 2.17.0 does not require authentication before a logged-out checkout is linked to, and logged in as, an existing WordPress account matching the submitted email address, and its duplicate-account check normalizes that address differently from the lookup used to create the customer, so an unauthenticated attacker can log in as any existing user, including a Network Super Admin, whose email address they know. This bypass is not addressed by the 2.15.1 fix for CVE-2026-75957 and remains exploitable in all versions up to and including 2.16.1, the releases that fix was expected to cover. Exploitation requires a checkout form configured without a password field (auto-generated password) and a target account that has no existing customer record in the Ultimate Multisite WordPress plugin before 2.17.0.
- Product
- Ultimate Multisite
- Affected
- up to 2.16.1
- Fixed in
- 2.17.0
- What to do
- Update Ultimate Multisite to 2.17.0 or newer.
Oct 8, 2026Super Forms – Drag & Drop Form Builder: Arbitrary Directory DeletionCVE-2026-17609 · WordPress plugins & themes · reported by WordfenceCritical 9.1
The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Arbitrary Directory Deletion in all versions up to, and including, 6.3.316 via the submit_form function. This is due to insufficient validation of attacker-controlled JSON field declarations against the actual form schema, combined with a non-effective ABSPATH guard that dirname() trivially bypasses by stripping the trailing slash. This makes it possible for unauthenticated attackers to recursively delete arbitrary directories on the server, including the WordPress root directory. Exploitation requires that an administrator has enabled the 'Delete files from server after form submissions' setting, though this is a documented and commonly-enabled feature.
- Product
- Super Forms – Drag & Drop Form Builder
- Affected
- up to 6.3.316
- What to do
- Affects up to 6.3.316. Update Super Forms – Drag & Drop Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 7, 2026Liquid Web / StellarWP The Events Calendar: Deserialization of Untrusted DataCVE-2026-95606 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in Liquid Web / StellarWP The Events Calendar allows Object Injection. This issue affects The Events Calendar: from n/a through 6.17.4.
- Product
- Liquid Web / StellarWP The Events Calendar
- Affected
- up to 6.17.4
- What to do
- Affects up to 6.17.4. Update Liquid Web / StellarWP The Events Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 7, 2026Passionate Programmer Peter WP Data Access: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-95605 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Passionate Programmer Peter WP Data Access allows Blind SQL Injection. This issue affects WP Data Access: from n/a through 5.5.82.
- Product
- Passionate Programmer Peter WP Data Access
- Affected
- up to 5.5.82
- What to do
- Affects up to 5.5.82. Update Passionate Programmer Peter WP Data Access to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2026Unauthenticated SQL Injection in ARMember Premium <= 7.8 versions.CVE-2026-42417 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in ARMember Premium <= 7.8 versions.
- What to do
- Update the plugin to the newest version.
Oct 6, 2026Unauthenticated SQL Injection in Porto Theme - Functionality <= 3.9.3 versions.CVE-2026-42415 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in Porto Theme - Functionality <= 3.9.3 versions.
- What to do
- Update the plugin to the newest version.
Oct 6, 2026Unauthenticated SQL Injection in Newsletter Subscription Form – User Subscriptions Form, Capture Email <= 1.5.9 versions.CVE-2026-41555 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in Newsletter Subscription Form – User Subscriptions Form, Capture Email <= 1.5.9 versions.
- What to do
- Update the plugin to the newest version.
Oct 6, 2026Unauthenticated PHP Object Injection in GDPR Framework By Data443 <= 2.5.0 versions.CVE-2026-39797 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in GDPR Framework By Data443 <= 2.5.0 versions.
- What to do
- Update the plugin to the newest version.
Oct 6, 2026Unauthenticated SQL Injection in SendPress Newsletters <= 1.26.1.20 versions.CVE-2026-39795 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in SendPress Newsletters <= 1.26.1.20 versions.
- What to do
- Update the plugin to the newest version.
Oct 6, 2026Serhii Pasyuk Gmedia Photo Gallery grand-media: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-39785 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Serhii Pasyuk Gmedia Photo Gallery grand-media allows Blind SQL Injection.This issue affects Gmedia Photo Gallery: from n/a through 1.25.1.
- Product
- Serhii Pasyuk Gmedia Photo Gallery grand-media
- Affected
- up to 1.25.1
- What to do
- Affects up to 1.25.1. Update Serhii Pasyuk Gmedia Photo Gallery grand-media to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2026Unauthenticated Privilege Escalation in Doctreat Core <= 1.7.0 versions.CVE-2026-39773 · WordPress plugins & themes · reported by PatchstackCritical 10
Unauthenticated Privilege Escalation in Doctreat Core <= 1.7.0 versions.
- What to do
- Update the plugin to the newest version.
Oct 6, 2026Unauthenticated Arbitrary File Upload in Doctreat <= 1.7.0 versions.CVE-2026-39770 · WordPress plugins & themes · reported by PatchstackCritical 10
Unauthenticated Arbitrary File Upload in Doctreat <= 1.7.0 versions.
- What to do
- Update the plugin to the newest version.
Oct 6, 2026Unauthenticated SQL Injection in Radius Booking — Booking Calendar for Appointments & Services <= 1.0.19 versions.CVE-2026-39764 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in Radius Booking — Booking Calendar for Appointments & Services <= 1.0.19 versions.
- What to do
- Update the plugin to the newest version.
Oct 6, 2026Unauthenticated Privilege Escalation in Meta Box AIO <= 3.7.1 versions.CVE-2026-39761 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated Privilege Escalation in Meta Box AIO <= 3.7.1 versions.
- What to do
- Update the plugin to the newest version.
Oct 6, 2026Employer / Sales Representative Arbitrary File Upload in Workreap Core <= 3.4.5 versions.CVE-2026-39759 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Employer / Sales Representative Arbitrary File Upload in Workreap Core <= 3.4.5 versions.
- What to do
- Update the plugin to the newest version.
Oct 6, 2026Subscriber Arbitrary File Upload in Taskbot <= 6.6 versions.CVE-2026-39757 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Subscriber Arbitrary File Upload in Taskbot <= 6.6 versions.
- What to do
- Update the plugin to the newest version.
Oct 6, 2026Subscriber Arbitrary File Upload in WP Duplicate <= 1.1.11 versions.CVE-2026-39755 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Subscriber Arbitrary File Upload in WP Duplicate <= 1.1.11 versions.
- What to do
- Update the plugin to the newest version.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. The WordPress, CMS and hosting-panel entries come from the National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan and others); we show who. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, a booking system, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.