Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
13,949 results · page 31 of 279
Oct 6, 2026iatoai IATO MCP iato-mcp: Missing AuthorizationCVE-2026-32582 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in iatoai IATO MCP iato-mcp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects IATO MCP: from n/a through 1.12.0.
- Product
- iatoai IATO MCP iato-mcp
- Affected
- up to 1.12.0
- What to do
- Affects up to 1.12.0. Update iatoai IATO MCP iato-mcp to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2026ZWEISCHNEIDER Faktur Pro for WooCommerce woorechnung: Authorization Bypass Through User-Controlled KeyCVE-2026-32576 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Authorization Bypass Through User-Controlled Key vulnerability in ZWEISCHNEIDER Faktur Pro for WooCommerce woorechnung allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Faktur Pro for WooCommerce: from n/a through 3.2.2.
- Product
- ZWEISCHNEIDER Faktur Pro for WooCommerce woorechnung
- Affected
- up to 3.2.2
- What to do
- Affects up to 3.2.2. Update ZWEISCHNEIDER Faktur Pro for WooCommerce woorechnung to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2026Unauthenticated Broken Access Control in FluentBooking Pro < 2.5.0 versions.CVE-2026-105072 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in FluentBooking Pro < 2.5.0 versions.
- What to do
- Update the plugin to the newest version.
Oct 5, 2026PressTigers Simple Event Planner simple-event-planner: Deserialization of Untrusted DataCVE-2026-97257 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in PressTigers Simple Event Planner simple-event-planner allows Object Injection.This issue affects Simple Event Planner: from n/a through 1.5.7.
- Product
- PressTigers Simple Event Planner simple-event-planner
- Affected
- up to 1.5.7
- What to do
- Affects up to 1.5.7. Update PressTigers Simple Event Planner simple-event-planner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026WP Sunshine Sunshine Photo Cart sunshine-photo-cart: Deserialization of Untrusted DataCVE-2026-93617 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Deserialization of Untrusted Data vulnerability in WP Sunshine Sunshine Photo Cart sunshine-photo-cart allows Object Injection.This issue affects Sunshine Photo Cart: from n/a through 3.7.1.
- Product
- WP Sunshine Sunshine Photo Cart sunshine-photo-cart
- Affected
- up to 3.7.1
- What to do
- Affects up to 3.7.1. Update WP Sunshine Sunshine Photo Cart sunshine-photo-cart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026Smackcoders Inc: Deserialization of Untrusted DataCVE-2026-103348 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Deserialization of Untrusted Data vulnerability in Smackcoders Inc. WP Ultimate Exporter wp-ultimate-exporter allows Object Injection.This issue affects WP Ultimate Exporter: from n/a through 3.0.
- Product
- Smackcoders Inc
- Affected
- up to 3.0
- What to do
- Affects up to 3.0. Update Smackcoders Inc to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026Kirillbdev WC Ukraine Shipping wc-ukr-shipping: Missing AuthorizationCVE-2026-103337 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Kirillbdev WC Ukraine Shipping wc-ukr-shipping allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WC Ukraine Shipping: from n/a through 1.23.2.
- Product
- Kirillbdev WC Ukraine Shipping wc-ukr-shipping
- Affected
- up to 1.23.2
- What to do
- Affects up to 1.23.2. Update Kirillbdev WC Ukraine Shipping wc-ukr-shipping to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026WP BASE WP BASE Booking wp-base-booking-of-appointments-services-and-events: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-103066 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP BASE WP BASE Booking wp-base-booking-of-appointments-services-and-events allows Blind SQL Injection.This issue affects WP BASE Booking: from n/a through 6.4.0.
- Product
- WP BASE WP BASE Booking wp-base-booking-of-appointments-services-and-events
- Affected
- up to 6.4.0
- What to do
- Affects up to 6.4.0. Update WP BASE WP BASE Booking wp-base-booking-of-appointments-services-and-events to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026Vektor Inc: Deserialization of Untrusted DataCVE-2026-100511 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in Vektor Inc. VK Google Job Posting Manager vk-google-job-posting-manager allows Object Injection.This issue affects VK Google Job Posting Manager: from n/a through 1.3.1.
- Product
- Vektor Inc
- Affected
- up to 1.3.1
- What to do
- Affects up to 1.3.1. Update Vektor Inc to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026WP Spell Check WP Spell Check wp-spell-check: Deserialization of Untrusted DataCVE-2026-100506 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Deserialization of Untrusted Data vulnerability in WP Spell Check WP Spell Check wp-spell-check allows Object Injection.This issue affects WP Spell Check: from n/a through 12.1.
- Product
- WP Spell Check WP Spell Check wp-spell-check
- Affected
- up to 12.1
- What to do
- Affects up to 12.1. Update WP Spell Check WP Spell Check wp-spell-check to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026Webful Creations RepairBuddy computer-repair-shop: Missing AuthorizationCVE-2026-97309 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Missing Authorization vulnerability in Webful Creations RepairBuddy computer-repair-shop allows Retrieve Embedded Sensitive Data.This issue affects RepairBuddy: from n/a through 4.1226.
- Product
- Webful Creations RepairBuddy computer-repair-shop
- Affected
- up to 4.1226
- What to do
- Affects up to 4.1226. Update Webful Creations RepairBuddy computer-repair-shop to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026Themeisle AI Chatbot for WordPress – Hyve Lite hyve-lite: Authorization Bypass Through User-Controlled KeyCVE-2026-97305 · WordPress plugins & themes · reported by PatchstackMedium 6.9
Authorization Bypass Through User-Controlled Key vulnerability in Themeisle AI Chatbot for WordPress – Hyve Lite hyve-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AI Chatbot for WordPress – Hyve Lite: from n/a through 2.0.2.
- Product
- Themeisle AI Chatbot for WordPress – Hyve Lite hyve-lite
- Affected
- up to 2.0.2
- What to do
- Affects up to 2.0.2. Update Themeisle AI Chatbot for WordPress – Hyve Lite hyve-lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026Arraytics Timetics timetics: Missing AuthorizationCVE-2026-97304 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Arraytics Timetics timetics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Timetics: from n/a through 1.0.63.
- Product
- Arraytics Timetics timetics
- Affected
- up to 1.0.63
- What to do
- Affects up to 1.0.63. Update Arraytics Timetics timetics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026Apps Mav Scratch & Win – Giveaways and Contests scratch-win-giveaways-for-website-facebook: Missing AuthorizationCVE-2026-97303 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Missing Authorization vulnerability in Apps Mav Scratch & Win – Giveaways and Contests scratch-win-giveaways-for-website-facebook allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Scratch & Win – Giveaways and Contests: from n/a through 3.0.2.
- Product
- Apps Mav Scratch & Win – Giveaways and Contests scratch-win-giveaways-for-website-facebook
- Affected
- up to 3.0.2
- What to do
- Affects up to 3.0.2. Update Apps Mav Scratch & Win – Giveaways and Contests scratch-win-giveaways-for-website-facebook to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026Liquid Web / StellarWP Advanced Post Manager advanced-post-manager: Deserialization of Untrusted DataCVE-2026-97283 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in Liquid Web / StellarWP Advanced Post Manager advanced-post-manager allows Object Injection.This issue affects Advanced Post Manager: from n/a through 4.5.5.
- Product
- Liquid Web / StellarWP Advanced Post Manager advanced-post-manager
- Affected
- up to 4.5.5
- What to do
- Affects up to 4.5.5. Update Liquid Web / StellarWP Advanced Post Manager advanced-post-manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026VillaTheme BuildKit – Product Builder for WooCommerce – Custom PC Builder woo-product-builder: Improper Validation of Specified Quantity in InputCVE-2026-97275 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Improper Validation of Specified Quantity in Input vulnerability in VillaTheme BuildKit – Product Builder for WooCommerce – Custom PC Builder woo-product-builder allows Input Data Manipulation.This issue affects BuildKit – Product Builder for WooCommerce – Custom PC Builder: from n/a through 1.0.28.
- Product
- VillaTheme BuildKit – Product Builder for WooCommerce – Custom PC Builder woo-product-builder
- Affected
- up to 1.0.28
- What to do
- Affects up to 1.0.28. Update VillaTheme BuildKit – Product Builder for WooCommerce – Custom PC Builder woo-product-builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026CozyThemes Cozy Blocks cozy-addons: Authorization Bypass Through User-Controlled KeyCVE-2026-97070 · WordPress plugins & themes · reported by PatchstackMedium 6.9
Authorization Bypass Through User-Controlled Key vulnerability in CozyThemes Cozy Blocks cozy-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cozy Blocks: from n/a through 2.2.23.
- Product
- CozyThemes Cozy Blocks cozy-addons
- Affected
- up to 2.2.23
- What to do
- Affects up to 2.2.23. Update CozyThemes Cozy Blocks cozy-addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026WP BASE WP BASE Booking wp-base-booking-of-appointments-services-and-events: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-103352 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP BASE WP BASE Booking wp-base-booking-of-appointments-services-and-events allows Blind SQL Injection.This issue affects WP BASE Booking: from n/a through 6.4.0.
- Product
- WP BASE WP BASE Booking wp-base-booking-of-appointments-services-and-events
- Affected
- up to 6.4.0
- What to do
- Affects up to 6.4.0. Update WP BASE WP BASE Booking wp-base-booking-of-appointments-services-and-events to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026Rymera Web Co Product Feed PRO for WooCommerce woo-product-feed-pro: Deserialization of Untrusted DataCVE-2026-103349 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Deserialization of Untrusted Data vulnerability in Rymera Web Co Product Feed PRO for WooCommerce woo-product-feed-pro allows Object Injection.This issue affects Product Feed PRO for WooCommerce: from n/a through 13.5.7.
- Product
- Rymera Web Co Product Feed PRO for WooCommerce woo-product-feed-pro
- Affected
- up to 13.5.7
- What to do
- Affects up to 13.5.7. Update Rymera Web Co Product Feed PRO for WooCommerce woo-product-feed-pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026Etoile Web Design Incorporated Five Star Restaurant Reservations restaurant-reservations: Insertion of Sensitive Information Into Sent DataCVE-2026-103334 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Insertion of Sensitive Information Into Sent Data vulnerability in Etoile Web Design Incorporated Five Star Restaurant Reservations restaurant-reservations allows Retrieve Embedded Sensitive Data.This issue affects Five Star Restaurant Reservations: from n/a through 2.7.24.
- Product
- Etoile Web Design Incorporated Five Star Restaurant Reservations restaurant-reservations
- Affected
- up to 2.7.24
- What to do
- Affects up to 2.7.24. Update Etoile Web Design Incorporated Five Star Restaurant Reservations restaurant-reservations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026Stiofan UsersWP userswp: Missing AuthorizationCVE-2026-103086 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Stiofan UsersWP userswp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects UsersWP: from n/a through 1.2.74.
- Product
- Stiofan UsersWP userswp
- Affected
- up to 1.2.74
- What to do
- Affects up to 1.2.74. Update Stiofan UsersWP userswp to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026WP User Manager WP User Manager wp-user-manager: Improper Access ControlCVE-2026-103085 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Access Control vulnerability in WP User Manager WP User Manager wp-user-manager allows Privilege Abuse.This issue affects WP User Manager: from n/a through 2.9.20.
- Product
- WP User Manager WP User Manager wp-user-manager
- Affected
- up to 2.9.20
- What to do
- Affects up to 2.9.20. Update WP User Manager WP User Manager wp-user-manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026VillaTheme Lookzy woo-lookbook: Missing AuthorizationCVE-2026-102383 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in VillaTheme Lookzy woo-lookbook allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Lookzy: from n/a through 1.1.14.
- Product
- VillaTheme Lookzy woo-lookbook
- Affected
- up to 1.1.14
- What to do
- Affects up to 1.1.14. Update VillaTheme Lookzy woo-lookbook to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026VillaTheme Photo Reviews for WooCommerce woo-photo-reviews: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-100515 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VillaTheme Photo Reviews for WooCommerce woo-photo-reviews allows Reflected XSS.This issue affects Photo Reviews for WooCommerce: from n/a through 1.2.30.
- Product
- VillaTheme Photo Reviews for WooCommerce woo-photo-reviews
- Affected
- up to 1.2.30
- What to do
- Affects up to 1.2.30. Update VillaTheme Photo Reviews for WooCommerce woo-photo-reviews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026Webful Creations RepairBuddy computer-repair-shop: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-100509 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Webful Creations RepairBuddy computer-repair-shop allows Stored XSS.This issue affects RepairBuddy: from n/a through 4.1225.
- Product
- Webful Creations RepairBuddy computer-repair-shop
- Affected
- up to 4.1225
- What to do
- Affects up to 4.1225. Update Webful Creations RepairBuddy computer-repair-shop to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026GhozyLab Image Slider Widget image-slider-widget: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-42700 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GhozyLab Image Slider Widget image-slider-widget allows Stored XSS.This issue affects Image Slider Widget: from n/a through 1.1.130.
- Product
- GhozyLab Image Slider Widget image-slider-widget
- Affected
- up to 1.1.130
- What to do
- Affects up to 1.1.130. Update GhozyLab Image Slider Widget image-slider-widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026Jose Fernandez Adsmonetizer adsensei-b30: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-15643 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jose Fernandez Adsmonetizer adsensei-b30 allows Reflected XSS.This issue affects Adsmonetizer: from n/a through 3.2.4.
- Product
- Jose Fernandez Adsmonetizer adsensei-b30
- Affected
- up to 3.2.4
- What to do
- Affects up to 3.2.4. Update Jose Fernandez Adsmonetizer adsensei-b30 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026Joomla Extension - joomlafry.com - Unauthenticated forced execution of published automation tasks in TF Content 2.9.0 - 2.9.4 - The extension exposes the site tCVE-2026-102779 · Websites & servers · reported by security@joomla.orgMedium 6.9
Joomla Extension - joomlafry.com - Unauthenticated forced execution of published automation tasks in TF Content 2.9.0 - 2.9.4 - The extension exposes the site task `records.custom_action` without authentication, ACL, CSRF, task-trigger, content-binding, or cron-token enforcement. A Guest can supply the numeric ID of any published TF Content task and make the component dispatch its configured executor immediately.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2026Joomla Extension - svenbluege.de - Server-side request forgery in the Google Photos picker in Event Gallery extension < 6.6.0 - The Google Photos picker of the CVE-2026-102777 · Websites & servers · reported by security@joomla.orgMedium 6.3
Joomla Extension - svenbluege.de - Server-side request forgery in the Google Photos picker in Event Gallery extension < 6.6.0 - The Google Photos picker of the back-end upload page fetches the thumbnails of the picked images through the server, with the OAuth access token of the Google Photos account. The task took the address to fetch from the request without checking it and asked for no form token. A prepared page on another web site could therefore make the server send the access token of the account to any address, or fetch addresses inside the server's network, in the name of a logged in administrator; a back-end user with the permission "Manage" could do the same directly. The token is valid for about an hour and reaches what the picker session of the account reaches.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2026LearnPress: Stored cross-site scriptingCVE-2026-105397 · WordPress plugins & themes · reported by VulnCheckMedium 5.1
LearnPress plugin for WordPress through 4.4.9.1 contains a stored cross-site scripting vulnerability that allows authenticated instructors to inject scripts via quiz question hint and explanation fields. Attackers with the Instructor role can submit unsanitized payloads through the update_question AJAX handler that execute in the session of every student taking the quiz.
- Product
- LearnPress
- Affected
- up to 4.4.9.1
- What to do
- Affects up to 4.4.9.1. Update LearnPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026Joomla Extension - joomlafry.com - Unauthenticated cross-record publication and mass assignment in TF Content 2.9.0 - 2.9.4 - The extension unconditionally authCVE-2026-102780 · Websites & servers · reported by security@joomla.orgMedium 6.9
Joomla Extension - joomlafry.com - Unauthenticated cross-record publication and mass assignment in TF Content 2.9.0 - 2.9.4 - The extension unconditionally authorizes both creation and editing in its public `RecordController`. Its shared frontend save controller accepts the raw `jform` array, assigns the request-selected existing record ID, and saves it without filtering submitted properties through the configured form. A Guest can obtain a valid token from Joomla's public login form and modify any TF Content row, including mass-assigning `published`, `access`, and `created_by`.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2026Joomla Extension - svenbluege.de - Cross-site scripting and open redirect on the share mini page in Event Gallery extension < 6.6.0 - The page a shared image liCVE-2026-102778 · Websites & servers · reported by security@joomla.orgMedium 5.3
Joomla Extension - svenbluege.de - Cross-site scripting and open redirect on the share mini page in Event Gallery extension < 6.6.0 - The page a shared image link opens (the share mini page of the front end) can link the article the image was shared from when the option "Share article links" is on. It took the address of the article from the shared link and printed it into the page without checking or escaping it; with the link type "Image Page with Redirect" it followed the address at once. A prepared link could therefore run a script in the page, in the session of the visitor who opened it, or send the visitor to another web site. Nothing on the server is changed or read by the server.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2026Joomla Extension - svenbluege.de - Cross-site request forgery of list tasks of the backend in Event Gallery extension < 6.6.0 - Eight tasks which the buttons ofCVE-2026-102776 · Websites & servers · reported by security@joomla.orgMedium 5.1
Joomla Extension - svenbluege.de - Cross-site request forgery of list tasks of the backend in Event Gallery extension < 6.6.0 - Eight tasks which the buttons of the back-end lists call did not check the form token: setting the default payment method, shipping method, image type set, order status and watermark; putting an event into the shop or taking it out; choosing the main image of an event and whether an image is shown only as the main image; and sorting the images of an event. A prepared page on another web site could trigger them in the name of a logged in administrator and change those settings and flags. Nothing can be deleted or read this way; orders are not affected.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2026Joomla Extension - phoca.cz - Authorisation bypass through user-controlled key (IDOR) in Order View in Phoca Cart 5.0.0 - 6.1.8 - Phoca Cart's order-file downloCVE-2026-102775 · Websites & servers · reported by security@joomla.orgHigh 8.7
Joomla Extension - phoca.cz - Authorisation bypass through user-controlled key (IDOR) in Order View in Phoca Cart 5.0.0 - 6.1.8 - Phoca Cart's order-file download endpoint does not verify the download tokens it asks for. The d (download token) and o (order token) parameters are checked for non-emptiness only — they are never compared to the stored download_token / order_token values. As a result, any remote user (including a guest with no account at all) can download any customer's digital goods by enumerating sequential id values and supplying arbitrary non-empty tokens.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2026Joomla Extension - ordasoft.com - Unauthenticated SQL injection in OrdaSoft Joomla CCK < 8.3.16 - The order column for records was user provided and not properlCVE-2026-102428 · Websites & servers · reported by security@joomla.orgCritical 9.3
Joomla Extension - ordasoft.com - Unauthenticated SQL injection in OrdaSoft Joomla CCK < 8.3.16 - The order column for records was user provided and not properly validated, leading to a SQL injection vector.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2026Joomla Extension - joomshaper.com - Reflected XSS in the Dynamic Content Filter addon in SP Page Builder Pro 3.0.0 - 5.6.1p2 - The slider minimum and maximum vaCVE-2026-102426 · Websites & servers · reported by security@joomla.orgMedium 5.3
Joomla Extension - joomshaper.com - Reflected XSS in the Dynamic Content Filter addon in SP Page Builder Pro 3.0.0 - 5.6.1p2 - The slider minimum and maximum values are taken from the dc_filter_<fieldId> request parameter, split on the delimiter "l-r", HTML-escaped inside the data-value attribute, and then echoed without escaping as the span element's text content. An unauthenticated attacker reflects arbitrary HTML or JavaScript into the rendered page through a crafted dc_filter_<fieldId> value.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2026Kit Kit: Missing AuthorizationCVE-2026-105421 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Kit Kit (formerly ConvertKit) for WooCommerce convertkit-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kit (formerly ConvertKit) for WooCommerce: from n/a through 2.2.0.
- Product
- Kit Kit
- Affected
- up to 2.2.0
- What to do
- Affects up to 2.2.0. Update Kit Kit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026WP SYNTEX Polylang polylang: Missing AuthorizationCVE-2026-39783 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WP SYNTEX Polylang polylang allows Retrieve Embedded Sensitive Data.This issue affects Polylang: from n/a through 3.8.7.
- Product
- WP SYNTEX Polylang polylang
- Affected
- up to 3.8.7
- What to do
- Affects up to 3.8.7. Update WP SYNTEX Polylang polylang to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026Arraytics WP Event Solution wp-event-solution: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2026-105073 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Arraytics WP Event Solution wp-event-solution allows Retrieve Embedded Sensitive Data.This issue affects WP Event Solution: from n/a through 4.1.25.
- Product
- Arraytics WP Event Solution wp-event-solution
- Affected
- up to 4.1.25
- What to do
- Affects up to 4.1.25. Update Arraytics WP Event Solution wp-event-solution to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026Arraytics WP Event Solution wp-event-solution: Missing AuthorizationCVE-2026-103684 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Arraytics WP Event Solution wp-event-solution allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Event Solution: from n/a through 4.1.25.
- Product
- Arraytics WP Event Solution wp-event-solution
- Affected
- up to 4.1.25
- What to do
- Affects up to 4.1.25. Update Arraytics WP Event Solution wp-event-solution to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026WP ManageNinja LLC Fluent Forms Pro Add On Pack fluentformpro: Missing AuthorizationCVE-2026-94669 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WP ManageNinja LLC Fluent Forms Pro Add On Pack fluentformpro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Fluent Forms Pro Add On Pack: from n/a through 6.2.13.
- Product
- WP ManageNinja LLC Fluent Forms Pro Add On Pack fluentformpro
- Affected
- up to 6.2.13
- What to do
- Affects up to 6.2.13. Update WP ManageNinja LLC Fluent Forms Pro Add On Pack fluentformpro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026Deepak Anand WP Dummy Content Generator wp-dummy-content-generator: Missing AuthorizationCVE-2026-39763 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Deepak Anand WP Dummy Content Generator wp-dummy-content-generator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Dummy Content Generator: from n/a through 4.0.0.
- Product
- Deepak Anand WP Dummy Content Generator wp-dummy-content-generator
- Affected
- up to 4.0.0
- What to do
- Affects up to 4.0.0. Update Deepak Anand WP Dummy Content Generator wp-dummy-content-generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026VillaTheme CURCY woo-multi-currency: Incorrect CalculationCVE-2026-97071 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Incorrect Calculation vulnerability in VillaTheme CURCY woo-multi-currency allows Integer Attacks.This issue affects CURCY: from n/a through 2.2.17.
- Product
- VillaTheme CURCY woo-multi-currency
- Affected
- up to 2.2.17
- What to do
- Affects up to 2.2.17. Update VillaTheme CURCY woo-multi-currency to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026Brainstorm Force Starter Templates astra-sites: Missing AuthorizationCVE-2026-39721 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Brainstorm Force Starter Templates astra-sites allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Starter Templates: from n/a through 4.7.7.
- Product
- Brainstorm Force Starter Templates astra-sites
- Affected
- up to 4.7.7
- What to do
- Affects up to 4.7.7. Update Brainstorm Force Starter Templates astra-sites to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026Nikki Blight QR Redirector qr-redirector: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-105069 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nikki Blight QR Redirector qr-redirector allows Stored XSS.This issue affects QR Redirector: from n/a through 2.0.5.
- Product
- Nikki Blight QR Redirector qr-redirector
- Affected
- up to 2.0.5
- What to do
- Affects up to 2.0.5. Update Nikki Blight QR Redirector qr-redirector to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026Pixelite Events Manager events-manager: Insertion of Sensitive Information Into Sent DataCVE-2026-105068 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Insertion of Sensitive Information Into Sent Data vulnerability in Pixelite Events Manager events-manager allows Retrieve Embedded Sensitive Data.This issue affects Events Manager: from n/a through 7.4.5.
- Product
- Pixelite Events Manager events-manager
- Affected
- up to 7.4.5
- What to do
- Affects up to 7.4.5. Update Pixelite Events Manager events-manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026Unlimited Elements Unlimited Elements For Elementor: Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')CVE-2026-105064 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor allows Parameter Injection.This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 2.0.22.
- Product
- Unlimited Elements Unlimited Elements For Elementor
- Affected
- up to 2.0.22
- What to do
- Affects up to 2.0.22. Update Unlimited Elements Unlimited Elements For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026Brandtoss WP Admin Audit wp-admin-audit: Missing AuthorizationCVE-2026-105062 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Brandtoss WP Admin Audit wp-admin-audit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Admin Audit: from n/a through 1.2.17.
- Product
- Brandtoss WP Admin Audit wp-admin-audit
- Affected
- up to 1.2.17
- What to do
- Affects up to 1.2.17. Update Brandtoss WP Admin Audit wp-admin-audit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026Themepoints Logo Showcase logo-showcase: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-105060 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themepoints Logo Showcase logo-showcase allows Stored XSS.This issue affects Logo Showcase: from n/a through 4.0.4.
- Product
- Themepoints Logo Showcase logo-showcase
- Affected
- up to 4.0.4
- What to do
- Affects up to 4.0.4. Update Themepoints Logo Showcase logo-showcase to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026impleCode eCommerce Product Catalog ecommerce-product-catalog: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-105056 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in impleCode eCommerce Product Catalog ecommerce-product-catalog allows Stored XSS.This issue affects eCommerce Product Catalog: from n/a through 3.6.2.
- Product
- impleCode eCommerce Product Catalog ecommerce-product-catalog
- Affected
- up to 3.6.2
- What to do
- Affects up to 3.6.2. Update impleCode eCommerce Product Catalog ecommerce-product-catalog to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. The WordPress, CMS and hosting-panel entries come from the National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan and others); we show who. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, a booking system, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.