Updated 5 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,756exploited flaws on CISA’s list

35added in the last 30 days

316new WordPress flaws this week

13,949entries in the database

11,441 results · page 30 of 229

Oct 4, 2026farvisun Mindio Magic MCP mindio-magic-mcp: Insertion of Sensitive Information Into Sent DataCVE-2026-104402 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Insertion of Sensitive Information Into Sent Data vulnerability in farvisun Mindio Magic MCP mindio-magic-mcp allows Retrieve Embedded Sensitive Data.This issue affects Mindio Magic MCP: from n/a through 0.5.6.
Product
farvisun Mindio Magic MCP mindio-magic-mcp
Affected
up to 0.5.6
What to do
Affects up to 0.5.6. Update farvisun Mindio Magic MCP mindio-magic-mcp to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record patchstack.com
Oct 4, 2026StylemixThemes Cost Calculator Builder cost-calculator-builder: Insertion of Sensitive Information Into Sent DataCVE-2026-97307 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Insertion of Sensitive Information Into Sent Data vulnerability in StylemixThemes Cost Calculator Builder cost-calculator-builder allows Retrieve Embedded Sensitive Data.This issue affects Cost Calculator Builder: from n/a through 4.0.17.
Product
StylemixThemes Cost Calculator Builder cost-calculator-builder
Affected
up to 4.0.17
What to do
Affects up to 4.0.17. Update StylemixThemes Cost Calculator Builder cost-calculator-builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record patchstack.com
Oct 4, 2026VeronaLabs WP Statistics wp-statistics: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-97276 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VeronaLabs WP Statistics wp-statistics allows Reflected XSS.This issue affects WP Statistics: from n/a through 14.16.14.
Product
VeronaLabs WP Statistics wp-statistics
Affected
up to 14.16.14
What to do
Affects up to 14.16.14. Update VeronaLabs WP Statistics wp-statistics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record patchstack.com
Oct 4, 2026Unlimited Elements Unlimited Elements For Elementor: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-103355 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor allows Blind SQL Injection.This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 2.0.20.
Product
Unlimited Elements Unlimited Elements For Elementor
Affected
up to 2.0.20
What to do
Affects up to 2.0.20. Update Unlimited Elements Unlimited Elements For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record patchstack.com
Oct 4, 2026Liquid Web / StellarWP Gutenberg Blocks by Kadence Blocks kadence-blocks: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-103354 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / StellarWP Gutenberg Blocks by Kadence Blocks kadence-blocks allows Stored XSS.This issue affects Gutenberg Blocks by Kadence Blocks: from n/a through 3.7.11.1.
Product
Liquid Web / StellarWP Gutenberg Blocks by Kadence Blocks kadence-blocks
Affected
up to 3.7.11.1
What to do
Affects up to 3.7.11.1. Update Liquid Web / StellarWP Gutenberg Blocks by Kadence Blocks kadence-blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record patchstack.com
Oct 4, 2026Unlimited Elements Unlimited Elements For Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-103344 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor allows Reflected XSS.This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 2.0.20.
Product
Unlimited Elements Unlimited Elements For Elementor
Affected
up to 2.0.20
What to do
Affects up to 2.0.20. Update Unlimited Elements Unlimited Elements For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record patchstack.com
Oct 4, 2026Cozmoslabs TranslatePress translatepress-multilingual: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-103062 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cozmoslabs TranslatePress translatepress-multilingual allows Stored XSS.This issue affects TranslatePress: from n/a through 3.3.6.
Product
Cozmoslabs TranslatePress translatepress-multilingual
Affected
up to 3.3.6
What to do
Affects up to 3.3.6. Update Cozmoslabs TranslatePress translatepress-multilingual to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record patchstack.com
Oct 4, 2026User Private Files: Does not properly protect its stored private files on multisite installationsCVE-2026-97332 · WordPress plugins & themes · reported by WPScanMedium 5.3
The User Private Files WordPress plugin before 2.2.0 does not properly protect its stored private files on multisite installations, where the rewrite rule it relies on to route file requests through its access check is never reached, allowing unauthenticated users to retrieve other users' private files directly.
Product
User Private Files
Fixed in
2.2.0
What to do
Update User Private Files to 2.2.0 or newer.
NVD record wpscan.com github.com
Oct 4, 2026CoCart: Does not scope its REST API authentication filter to its own endpointsCVE-2026-93549 · WordPress plugins & themes · reported by WPScanHigh 8.8
The CoCart WordPress plugin before 4.9.7 does not scope its REST API authentication filter to its own endpoints, which disables WordPress core's REST nonce protection for every route, allowing an attacker to perform a cross-site request forgery attack that creates a new administrator account using a logged-in administrator's session.
Product
CoCart
Fixed in
4.9.7
What to do
Update CoCart to 4.9.7 or newer.
NVD record wpscan.com
Oct 4, 2026Five Star Business Profile and Schema: Does not properly restrict the callbacks used to resolve schema field default valuesCVE-2026-86817 · WordPress plugins & themes · reported by WPScanMedium 4.9
The Five Star Business Profile and Schema WordPress plugin before 2.4.0 does not properly restrict the callbacks used to resolve schema field default values, allowing authenticated users with Author-level access and above to store input that discloses sensitive data, including other users' password hashes and arbitrary site option values, in public output readable by unauthenticated visitors.
Product
Five Star Business Profile and Schema
Fixed in
2.4.0
What to do
Update Five Star Business Profile and Schema to 2.4.0 or newer.
NVD record wpscan.com
Oct 4, 2026Horizontal scrolling announcements: Does not sanitise and escape one of its announcement settings before outputting it into an attribute context on the front endCVE-2026-17005 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Horizontal scrolling announcements WordPress plugin through 2.6 does not sanitise and escape one of its announcement settings before outputting it into an attribute context on the front end, allowing users granted access to the announcement management page (Contributor and above, once permitted) to perform Stored Cross-Site Scripting attacks that execute in the browser of anyone viewing the announcement.
Product
Horizontal scrolling announcements
Affected
up to 2.6
What to do
Affects up to 2.6. Update Horizontal scrolling announcements to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record wpscan.com
Oct 4, 2026Simple Shopping Cart: Does not escape some of its settings field values before outputting them on an admin settings pageCVE-2026-104119 · WordPress plugins & themes · reported by WPScanLow 3.5
The Simple Shopping Cart WordPress plugin before 5.2.6 does not escape some of its settings field values before outputting them on an admin settings page, allowing high-privilege users such as administrators to perform Stored Cross-Site Scripting attacks, which is notably impactful on multisite installations where administrators do not have the unfiltered_html capability.
Product
Simple Shopping Cart
Fixed in
5.2.6
What to do
Update Simple Shopping Cart to 5.2.6 or newer.
NVD record wpscan.com
Oct 4, 2026Razorpay for WooCommerce: Does not perform ownership or authorization checks on a REST API route used during checkoutCVE-2026-104118 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Razorpay for WooCommerce WordPress plugin before 4.8.8 does not perform ownership or authorization checks on a REST API route used during checkout, allowing unauthenticated attackers to modify the shipping information stored on arbitrary orders.
Product
Razorpay for WooCommerce
Fixed in
4.8.8
What to do
Update Razorpay for WooCommerce to 4.8.8 or newer.
NVD record wpscan.com
Oct 3, 2026Ultimate Member Ultimate Member ultimate-member: Authorization Bypass Through User-Controlled KeyCVE-2026-96451 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Authorization Bypass Through User-Controlled Key vulnerability in Ultimate Member Ultimate Member ultimate-member allows Privilege Escalation.This issue affects Ultimate Member: from n/a through 2.13.1.
Product
Ultimate Member Ultimate Member ultimate-member
Affected
up to 2.13.1
What to do
Affects up to 2.13.1. Update Ultimate Member Ultimate Member ultimate-member to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record patchstack.com
Oct 3, 2026Unlimited Elements Unlimited Elements For Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-103342 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor allows Reflected XSS.This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 2.0.20.
Product
Unlimited Elements Unlimited Elements For Elementor
Affected
up to 2.0.20
What to do
Affects up to 2.0.20. Update Unlimited Elements Unlimited Elements For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record patchstack.com
Oct 3, 2026Themeum Kirki kirki: Improper Validation of Specified Quantity in InputCVE-2026-103065 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Improper Validation of Specified Quantity in Input vulnerability in Themeum Kirki kirki allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Kirki: from n/a through 6.3.1.
Product
Themeum Kirki kirki
Affected
up to 6.3.1
What to do
Affects up to 6.3.1. Update Themeum Kirki kirki to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record patchstack.com
Oct 3, 2026Twenty20 Image Before-After: Stored Cross-Site ScriptingCVE-2026-92767 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Twenty20 Image Before-After plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'offset' Shortcode Attribute in all versions up to, and including, 2.0.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Twenty20 Image Before-After
Affected
up to 2.0.5
What to do
Affects up to 2.0.5. Update Twenty20 Image Before-After to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 3, 2026The Beaver Builder Page Builder – Drag and Drop Website Builder: Arbitrary shortcode executionCVE-2026-92084 · WordPress plugins & themes · reported by WordfenceCritical 9.1
The The Beaver Builder Page Builder – Drag and Drop Website Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.11.0.5. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. Exploitation requires the target site to have a Beaver Builder page containing the Sidebar module populated with a widget that displays attacker-controllable text, such as the core Recent Comments widget, with comment moderation disabled or the attacker's comment approved.
Product
The Beaver Builder Page Builder – Drag and Drop Website Builder
Affected
up to 2.11.0.5
What to do
Affects up to 2.11.0.5. Update The Beaver Builder Page Builder – Drag and Drop Website Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 3, 2026WPC Product Options for WooCommerce: Stored Cross-Site ScriptingCVE-2026-97660 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The WPC Product Options for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via wpcpo-* Array Key via Multipart Field Name in all versions up to, and including, 4.0.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable via guest checkout without authentication because the malicious payload is embedded in a multipart Content-Disposition field name beginning with 'wpcpo-', which PHP's RFC1867 parser preserves byte-for-byte and stores into order item meta.
Product
WPC Product Options for WooCommerce
Affected
up to 4.0.5
What to do
Affects up to 4.0.5. Update WPC Product Options for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 3, 2026Burst Statistics – Simple WordPress Analytics (Google Analytics Alternative): Improper Authentication leading to Account PersistenceCVE-2026-97343 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Burst Statistics – Simple WordPress Analytics (Google Analytics Alternative) plugin for WordPress is vulnerable to Improper Authentication leading to Account Persistence in all versions up to, and including, 3.7.1. This is due to the `maybe_load_shared_dashboard()` handler issuing a genuine WordPress session cookie for the `burst_statistics_viewer` account to any visitor presenting a valid share token via `wp_set_auth_cookie()`, while the plugin only blocks Application Passwords for the resulting `burst_viewer` role and does not restrict the core `/wp-json/wp/v2/users/me` password update endpoint or filter the `edit_user` capability for that account — leaving WordPress core's built-in rule that any authenticated user may update their own account fully in effect. This makes it possible for unauthenticated attackers to set an attacker-chosen password on the `burst_statistics_viewer` WordPress account, constituting a permanent takeover of that limited-privilege (`view_burst_statistics`) account that persists through share-token revocation, share-token expiration, and execution of the plugin's daily `cleanup_viewer_sessions()` routine. Exploitation requires that the attacker have o
Product
Burst Statistics – Simple WordPress Analytics (Google Analytics Alternative)
Affected
up to 3.7.1
What to do
Affects up to 3.7.1. Update Burst Statistics – Simple WordPress Analytics (Google Analytics Alternative) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record github.com plugins.trac.wordpress.org
Oct 3, 2026WP Visitor Statistics (Real Time Traffic): Generic SQL InjectionCVE-2026-96267 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The WP Visitor Statistics (Real Time Traffic) plugin for WordPress is vulnerable to generic SQL Injection via the 'fullRef' parameter in all versions up to, and including, 8.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This is a second-order SQL injection: an unauthenticated attacker submits a crafted referrer URL to the wmcTrack tracking endpoint, which persists the raw unescaped value into the wp_logVisit table, and the injection is triggered when an administrator next views the Traffic Sources dashboard.
Product
WP Visitor Statistics (Real Time Traffic)
Affected
up to 8.7
What to do
Affects up to 8.7. Update WP Visitor Statistics (Real Time Traffic) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 3, 2026Nelio Content – Editorial Calendar & Social Media Auto-Posting: Authorization bypassCVE-2026-94505 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Nelio Content – Editorial Calendar & Social Media Auto-Posting plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5.0 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to permanently delete any reusable social message (nc_reusable_social post), including those authored by administrators or other privileged users.
Product
Nelio Content – Editorial Calendar & Social Media Auto-Posting
Affected
up to 4.5.0
What to do
Affects up to 4.5.0. Update Nelio Content – Editorial Calendar & Social Media Auto-Posting to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 3, 2026WPFront Notification Bar: Reflected Cross-Site ScriptingCVE-2026-93896 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WPFront Notification Bar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 3.5.1. This is due to the debug-log output path (write_debug_logs) reflecting the raw value of $_SERVER['REQUEST_URI'] through vprintf() directly inside a <script> block emitted on wp_footer, without any sanitization or escaping (see the 'Current URL is "%s"' log entry produced by the URL-text display filter in the filter() method). This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a specially crafted link.
Product
WPFront Notification Bar
Affected
up to 3.5.1
What to do
Affects up to 3.5.1. Update WPFront Notification Bar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 3, 2026Mail logging – WP Mail Catcher: Stored Cross-Site ScriptingCVE-2026-93889 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Mail logging – WP Mail Catcher plugin for WordPress is vulnerable to Stored Cross-Site Scripting via PHPMailer 'wp_mail_failed' Error Message in all versions up to, and including, 2.1.12 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires a separately installed plugin, such as Contact Form 7, that passes unauthenticated user-controlled input into mail fields whose content PHPMailer will include in its failure error message.
Product
Mail logging – WP Mail Catcher
Affected
up to 2.1.12
What to do
Affects up to 2.1.12. Update Mail logging – WP Mail Catcher to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 3, 2026Photo Gallery by 10Web – Mobile-Friendly Image Gallery: Reflected Cross-Site ScriptingCVE-2026-92974 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'thumb_url' parameter in all versions up to, and including, 1.8.46 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Exploitation requires that the authenticated victim holds the manage_options capability, as the editimage_bwg AJAX action performs a capability check but no nonce verification, meaning the payload can be delivered via a crafted GET request without a CSRF token.
Product
Photo Gallery by 10Web – Mobile-Friendly Image Gallery
Affected
up to 1.8.46
What to do
Affects up to 1.8.46. Update Photo Gallery by 10Web – Mobile-Friendly Image Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 3, 2026VikAppointments Services Booking Calendar: Arbitrary file deletionCVE-2026-87115 · WordPress plugins & themes · reported by WordfenceCritical 9.1
The VikAppointments Services Booking Calendar plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the extract function in all versions up to, and including, 1.2.21. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). Exploitation requires at least one File-type custom field to be published on the confirmation page shortcode, as this field is not created by default during plugin installation.
Product
VikAppointments Services Booking Calendar
Affected
up to 1.2.21
What to do
Affects up to 1.2.21. Update VikAppointments Services Booking Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 3, 2026WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System: Local File InclusionCVE-2026-75028 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.0.18 via the (template scope) function. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.
Product
WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System
Affected
up to 3.0.18
What to do
Affects up to 3.0.18. Update WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 3, 2026Smart Manager – Advanced WooCommerce Bulk Edit & Inventory Management: Generic SQL InjectionCVE-2026-18443 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Smart Manager – Advanced WooCommerce Bulk Edit & Inventory Management plugin for WordPress is vulnerable to generic SQL Injection via the 'access_privileges' parameter in all versions up to, and including, 8.97.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This exploit is only possible on installations where an administrator has saved a role-based deny-list Access Privilege configuration that does not explicitly block the internal 'access-privilege' module, as this condition allows the authorization filter to implicitly permit Subscriber-level users to invoke the vulnerable handler.
Product
Smart Manager – Advanced WooCommerce Bulk Edit & Inventory Management
Affected
up to 8.97.0
What to do
Affects up to 8.97.0. Update Smart Manager – Advanced WooCommerce Bulk Edit & Inventory Management to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 3, 2026Responsive Plus – Elementor Templates & Starter Sites: Stored Cross-Site ScriptingCVE-2026-15795 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Responsive Plus – Elementor Templates & Starter Sites plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and including, 3.5.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Responsive Plus – Elementor Templates & Starter Sites
Affected
up to 3.5.3
What to do
Affects up to 3.5.3. Update Responsive Plus – Elementor Templates & Starter Sites to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 3, 2026WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System: Authorization bypassCVE-2026-11601 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.0.19. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to read, create, update, clone, and delete email notification flows, including overwriting the default reservation confirmation, cancellation, and admin alert emails with attacker-controlled content sent from the site's legitimate address, or destroying reservation notification flows entirely. The vulnerable endpoints are active by default on every WPCafe installation without any configuration requirement, as the Email_Automation_Service_Provider::is_enable() method unconditionally returns true and the plugin ships with five pre-configured default email flows upon activation.
Product
WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System
Affected
up to 3.0.19
What to do
Affects up to 3.0.19. Update WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 3, 2026WPC Estimated Delivery Date for WooCommerce: Reflected Cross-Site ScriptingCVE-2026-104313 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WPC Estimated Delivery Date for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'rule_data' parameter in all versions up to, and including, 4.0.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
WPC Estimated Delivery Date for WooCommerce
Affected
up to 4.0.1
What to do
Affects up to 4.0.1. Update WPC Estimated Delivery Date for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 3, 2026The WP Ultimate Review: Arbitrary shortcode executionCVE-2026-103519 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The The WP Ultimate Review plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.4.3. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for authenticated attackers, with subscriber-level access and above, to execute arbitrary shortcodes. The bypass relies on WordPress's own strip_shortcodes() function unwrapping the [[tag]] double-bracket escape to a bare [tag] that survives wp_insert_post storage and fires when the publicly queryable xs_review post type is rendered through the_content.
Product
The WP Ultimate Review
Affected
up to 2.4.3
What to do
Affects up to 2.4.3. Update The WP Ultimate Review to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 3, 2026WPMobile.App – Android and iOS App Builder: Stored Cross-Site ScriptingCVE-2026-103421 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The WPMobile.App – Android and iOS App Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'REQUEST_URI (path segment after /android_json/search/)' parameter in all versions up to, and including, 11.84 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the app's content mode to be configured as 'webview' (i.e., the 'speed' option is not set to '1'), which is a supported and still-shipped mode, though no longer the default.
Product
WPMobile.App – Android and iOS App Builder
Affected
up to 11.84
What to do
Affects up to 11.84. Update WPMobile.App – Android and iOS App Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 3, 2026The WP Ultimate Review: Arbitrary shortcode executionCVE-2026-100157 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The The WP Ultimate Review plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.4.3. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. The nonce required to pass the only gate is emitted to unauthenticated visitors via the public review form, and submitted shortcode payloads are auto-published without admin approval by default, meaning exploitation requires no account and no privileged interaction.
Product
The WP Ultimate Review
Affected
up to 2.4.3
What to do
Affects up to 2.4.3. Update The WP Ultimate Review to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 3, 2026Wp Social Login and Register Social Counter: Stored Cross-Site ScriptingCVE-2026-97344 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Wp Social Login and Register Social Counter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Avatar Alt Attribute via Arbitrary User Meta Write in all versions up to, and including, 3.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the attacker to chain two steps: invoking the nonce-only dismiss_ajax_call endpoint (nonce accessible to Subscribers via any wp-admin page) to set the xs_social_profile_image meta flag on their own account, which activates the unescaped img output branch in xs_social_get_avatar, and then setting their display name to a script payload that core's ENT_NOQUOTES handling preserves unescaped.
Product
Wp Social Login and Register Social Counter
Affected
up to 3.2.1
What to do
Affects up to 3.2.1. Update Wp Social Login and Register Social Counter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 3, 2026Visitor Traffic Real Time Statistics: Stored DOM-Based Cross-Site ScriptingCVE-2026-97341 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Visitor Traffic Real Time Statistics plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via 'X-Real-IP' HTTP Header in all versions up to, and including, 8.16 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires no authentication, no nonce, and no capability — the wp_ajax_nopriv_ahcfree_track_visitor endpoint accepts the forged X-Real-IP header from any unauthenticated HTTP request and stores the entity-encoded payload verbatim in the database.
Product
Visitor Traffic Real Time Statistics
Affected
up to 8.16
What to do
Affects up to 8.16. Update Visitor Traffic Real Time Statistics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 3, 2026Simple Membership: Unauthorized modification of data and sensitive information disclosureCVE-2026-97337 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Simple Membership plugin for WordPress is vulnerable to unauthorized modification of data and sensitive information disclosure in versions up to, and including, 4.8.3 via the resend-activation and email-activation endpoints. The endpoints are dispatched from SwpmInitTimeTasks::check_and_do_email_activation() on frontend init with no authentication, nonce, capability, or ownership check, and the recipient address used by SwpmRegistration::send_reg_email() is taken from an attacker-controlled $_POST['email'] parameter (overriding the member's registered address). This makes it possible for unauthenticated attackers to redirect an arbitrary pending member's activation email — and the follow-up 'registration complete' email containing the member's username and plaintext password — to an attacker-chosen address, and to then activate that member's account without their consent.
Product
Simple Membership
Affected
up to 4.8.3
What to do
Affects up to 4.8.3. Update Simple Membership to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 3, 2026Pie Register: Does not restrict access to an invitation-code reportCVE-2026-96962 · WordPress plugins & themes · reported by WPScanLow 3.7
The Pie Register WordPress plugin before 3.8.4.14 does not restrict access to an invitation-code report, allowing unauthenticated visitors who know a valid invitation code to obtain the username and email address of every user who registered with that code.
Product
Pie Register
Fixed in
3.8.4.14
What to do
Update Pie Register to 3.8.4.14 or newer.
NVD record wpscan.com
Oct 3, 2026Strong Testimonials: Stored Cross-Site ScriptingCVE-2026-96650 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Strong Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'platform_user_photo' Custom Field in all versions up to, and including, 3.3.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that an administrator has added custom text fields named 'platform' and 'platform_user_photo' to a public testimonial submission form, as the plugin does not reserve those internal metadata keys.
Product
Strong Testimonials
Affected
up to 3.3.11
What to do
Affects up to 3.3.11. Update Strong Testimonials to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 3, 2026Transliterator – Multilingual and Multi-script Text Conversion: Stored Cross-Site ScriptingCVE-2026-96575 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Transliterator – Multilingual and Multi-script Text Conversion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Predictable {rstr_keep} Placeholder in all versions up to, and including, 2.5.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload survives WordPress comment save-time sanitization because the tags and attributes used (such as a[title] and code) are permitted by the core comment kses allow-list, and the literal characters comprising the plugin's shortcode markers and placeholder tokens are not stripped.
Product
Transliterator – Multilingual and Multi-script Text Conversion
Affected
up to 2.5.8
What to do
Affects up to 2.5.8. Update Transliterator – Multilingual and Multi-script Text Conversion to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 3, 2026SEOPress – AI SEO Plugin & On-site SEO: Stored Cross-Site ScriptingCVE-2026-96564 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The SEOPress – AI SEO Plugin & On-site SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Author Display Name in all versions up to, and including, 10.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the 'Track Authors' custom dimension to be configured in the plugin's Google Analytics 4 or Matomo settings, and the attacker must be able to publish public singular content (e.g., via bbPress forum topics) so that the injected display name is rendered in the tracking script.
Product
SEOPress – AI SEO Plugin & On-site SEO
Affected
up to 10.2
What to do
Affects up to 10.2. Update SEOPress – AI SEO Plugin & On-site SEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 3, 2026Loco Translate: Does not sanitise and escape some bundle configuration values before outputting them back in an admin pageCVE-2026-94239 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Loco Translate WordPress plugin before 2.8.9 does not sanitise and escape some bundle configuration values before outputting them back in an admin page, allowing users with the translator capability and above to perform Stored Cross-Site Scripting attacks against high privilege users such as administrators.
Product
Loco Translate
Fixed in
2.8.9
What to do
Update Loco Translate to 2.8.9 or newer.
NVD record wpscan.com
Oct 3, 2026Loco Translate: Does not restrictCVE-2026-94238 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Loco Translate WordPress plugin before 2.8.9 does not restrict which file paths its translation file routes will read, allowing users granted the Loco Translate WordPress plugin before 2.8.9's translator capability to retrieve the contents of files of certain types from anywhere on the server, including outside the web root.
Product
Loco Translate
Fixed in
2.8.9
What to do
Update Loco Translate to 2.8.9 or newer.
NVD record wpscan.com
Oct 3, 2026GD Rating System: Stored Cross-Site ScriptingCVE-2026-93430 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The GD Rating System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'title' and 'url' Render Args in gdrts_live_handler AJAX in all versions up to, and including, 3.7.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Although the AJAX action requires a per-item nonce, that nonce is publicly emitted in the page's <script class="gdrts-rating-data"> JSON block on every page rendering the rating item, making it obtainable by any unauthenticated visitor and therefore not an authentication barrier.
Product
GD Rating System
Affected
up to 3.7.1
What to do
Affects up to 3.7.1. Update GD Rating System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 3, 2026Unlimited Elements for Elementor: Does not sanitise and escape a parameter before using it in a SQL statementCVE-2026-92923 · WordPress plugins & themes · reported by WPScanMedium 6.3
The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not sanitise and escape a parameter before using it in a SQL statement, allowing users with a role as low as subscriber to perform blind SQL injection attacks and read arbitrary data from the database. Version 2.0.18 removed the subscriber-level access, so from 2.0.18 onward the issue requires a Contributor role or above.
Product
Unlimited Elements for Elementor
Fixed in
2.0.21
What to do
Update Unlimited Elements for Elementor to 2.0.21 or newer.
NVD record wpscan.com
Oct 3, 2026Mailchimp for WooCommerce: Does not require authenticationCVE-2026-92437 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Mailchimp for WooCommerce WordPress plugin before 6.3 does not require authentication, a nonce or an ownership check before it acts on a customer's abandoned-cart record identified from request-supplied data, allowing an unauthenticated attacker to modify or delete another customer's stored cart.
Product
Mailchimp for WooCommerce
Fixed in
6.3
What to do
Update Mailchimp for WooCommerce to 6.3 or newer.
NVD record wpscan.com
Oct 3, 2026Alt Text AI – Automatically generate image alt text for SEO and accessibility: Authorization bypassCVE-2026-91108 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Alt Text AI – Automatically generate image alt text for SEO and accessibility plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.10.41. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to overwrite the post_content of any post or page on the site — including content they do not own — with LLM-generated text influenced by attacker-controlled keywords, enabling black-hat SEO manipulation and unauthorized consumption of the site owner's paid AltText.ai API credits. The nonce required to invoke the action is emitted on every admin page including /wp-admin/profile.php, which is accessible to Subscribers, making the nonce trivially obtainable by any authenticated user.
Product
Alt Text AI – Automatically generate image alt text for SEO and accessibility
Affected
up to 1.10.41
What to do
Affects up to 1.10.41. Update Alt Text AI – Automatically generate image alt text for SEO and accessibility to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 3, 2026TillKit: Does not require the hard-codedCVE-2026-91078 · WordPress plugins & themes · reported by WPScanHigh 8.2
The TillKit WordPress plugin before 1.0.5 does not require the hard-coded, publicly known PIN of the privileged POS account it creates on activation to be changed before use, and it authenticates its public POS login endpoint on that PIN alone with no identity or capability check, allowing unauthenticated attackers to obtain a privileged POS session and thereby read customer and site-user personal data and modify store data.
Product
TillKit
Fixed in
1.0.5
What to do
Update TillKit to 1.0.5 or newer.
NVD record wpscan.com
Oct 3, 2026SaveTo Wishlist Lite: Does not sanitise and escape parameters before using them in the ORDER BY clause of a SQL queryCVE-2026-89236 · WordPress plugins & themes · reported by WPScanHigh 8.6
The SaveTo Wishlist Lite WordPress plugin before 1.1.5 does not sanitise and escape parameters before using them in the ORDER BY clause of a SQL query, allowing unauthenticated attackers to append additional SQL queries and extract sensitive information from the database.
Product
SaveTo Wishlist Lite
Fixed in
1.1.5
What to do
Update SaveTo Wishlist Lite to 1.1.5 or newer.
NVD record wpscan.com
Oct 3, 2026Kubio AI Page Builder: Does not limit its widening of the allowed HTML elements to the editor contextCVE-2026-88783 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Kubio AI Page Builder WordPress plugin before 2.9.3 does not limit its widening of the allowed HTML elements to the editor context, so the wider set is applied when filtering content submitted by unauthenticated users as well, allowing them to store markup which the Kubio AI Page Builder WordPress plugin before 2.9.3's own script later executes in the browser of any visitor, or of an administrator reviewing the still-unapproved submission.
Product
Kubio AI Page Builder
Fixed in
2.9.3
What to do
Update Kubio AI Page Builder to 2.9.3 or newer.
NVD record wpscan.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. The WordPress, CMS and hosting-panel entries come from the National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan and others); we show who. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Start a project

Tell us what you're building.

A website, a booking system, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.

01The person who'll build it writes back

02A planning call, then a written plan with the price and the date

03A preview on your phone while it's being built

04Launch night handled: redirects, email, Google

843-331-6339

Not ready to talk yet? Run the free website check and see what Google sees.