Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
13,949 results · page 32 of 279
Oct 5, 2026WP Mailster WP Mailster wp-mailster: Missing AuthorizationCVE-2026-105055 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WP Mailster WP Mailster wp-mailster allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Mailster: from n/a through 1.9.0.0.
- Product
- WP Mailster WP Mailster wp-mailster
- Affected
- up to 1.9.0.0
- What to do
- Affects up to 1.9.0.0. Update WP Mailster WP Mailster wp-mailster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026Liquid Web / StellarWP Event Tickets event-tickets: Missing AuthorizationCVE-2026-104675 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Tickets: from n/a through 5.30.0.
- Product
- Liquid Web / StellarWP Event Tickets event-tickets
- Affected
- up to 5.30.0
- What to do
- Affects up to 5.30.0. Update Liquid Web / StellarWP Event Tickets event-tickets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026Sonaar MP3 Audio Player for Music, Radio & Podcast by Sonaar mp3-music-player-by-sonaar: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-104673 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sonaar MP3 Audio Player for Music, Radio & Podcast by Sonaar mp3-music-player-by-sonaar allows Stored XSS.This issue affects MP3 Audio Player for Music, Radio & Podcast by Sonaar: from n/a through 5.14.2.
- Product
- Sonaar MP3 Audio Player for Music, Radio & Podcast by Sonaar mp3-music-player-by-sonaar
- Affected
- up to 5.14.2
- What to do
- Affects up to 5.14.2. Update Sonaar MP3 Audio Player for Music, Radio & Podcast by Sonaar mp3-music-player-by-sonaar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026WP Chill Image Photo Gallery Final Tiles Grid final-tiles-grid-gallery-lite: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-104409 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Image Photo Gallery Final Tiles Grid final-tiles-grid-gallery-lite allows Stored XSS.This issue affects Image Photo Gallery Final Tiles Grid: from n/a through 3.6.13.
- Product
- WP Chill Image Photo Gallery Final Tiles Grid final-tiles-grid-gallery-lite
- Affected
- up to 3.6.13
- What to do
- Affects up to 3.6.13. Update WP Chill Image Photo Gallery Final Tiles Grid final-tiles-grid-gallery-lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026Groundhogg Groundhogg groundhogg: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-104408 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Groundhogg Groundhogg groundhogg allows Blind SQL Injection.This issue affects Groundhogg: from n/a through 4.8.3.
- Product
- Groundhogg Groundhogg groundhogg
- Affected
- up to 4.8.3
- What to do
- Affects up to 4.8.3. Update Groundhogg Groundhogg groundhogg to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026Blubrry Podcasting PowerPress Podcasting powerpress: Cross-Site Request Forgery (CSRF)CVE-2026-104407 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Blubrry Podcasting PowerPress Podcasting powerpress allows Cross Site Request Forgery.This issue affects PowerPress Podcasting: from n/a through 11.17.9.
- Product
- Blubrry Podcasting PowerPress Podcasting powerpress
- Affected
- up to 11.17.9
- What to do
- Affects up to 11.17.9. Update Blubrry Podcasting PowerPress Podcasting powerpress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026Liquid Web / StellarWP GiveWP give: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-104404 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / StellarWP GiveWP give allows Stored XSS.This issue affects GiveWP: from n/a through 4.17.0.
- Product
- Liquid Web / StellarWP GiveWP give
- Affected
- up to 4.17.0
- What to do
- Affects up to 4.17.0. Update Liquid Web / StellarWP GiveWP give to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026Memberful Memberful - Membership Plugin memberful-wp: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2026-104401 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Memberful Memberful - Membership Plugin memberful-wp allows Retrieve Embedded Sensitive Data.This issue affects Memberful - Membership Plugin: from n/a through 1.81.2.
- Product
- Memberful Memberful - Membership Plugin memberful-wp
- Affected
- up to 1.81.2
- What to do
- Affects up to 1.81.2. Update Memberful Memberful - Membership Plugin memberful-wp to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026bPlugins B Blocks b-blocks: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-104400 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins B Blocks b-blocks allows Stored XSS.This issue affects B Blocks: from n/a through 2.1.8.
- Product
- bPlugins B Blocks b-blocks
- Affected
- up to 2.1.8
- What to do
- Affects up to 2.1.8. Update bPlugins B Blocks b-blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026Jeroen Peters Name Directory name-directory: Missing AuthorizationCVE-2026-104397 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Jeroen Peters Name Directory name-directory allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Name Directory: from n/a through 1.34.2.
- Product
- Jeroen Peters Name Directory name-directory
- Affected
- up to 1.34.2
- What to do
- Affects up to 1.34.2. Update Jeroen Peters Name Directory name-directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026Jeroen Peters Name Directory name-directory: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-104396 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jeroen Peters Name Directory name-directory allows Stored XSS.This issue affects Name Directory: from n/a through 1.34.2.
- Product
- Jeroen Peters Name Directory name-directory
- Affected
- up to 1.34.2
- What to do
- Affects up to 1.34.2. Update Jeroen Peters Name Directory name-directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026Sirv Sirv sirv: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-104389 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Sirv Sirv sirv allows Blind SQL Injection.This issue affects Sirv: from n/a through 8.2.5.
- Product
- Sirv Sirv sirv
- Affected
- up to 8.2.5
- What to do
- Affects up to 8.2.5. Update Sirv Sirv sirv to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026Blubrry Podcasting PowerPress Podcasting powerpress: Missing AuthorizationCVE-2026-104388 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Blubrry Podcasting PowerPress Podcasting powerpress allows Retrieve Embedded Sensitive Data.This issue affects PowerPress Podcasting: from n/a through 11.17.9.
- Product
- Blubrry Podcasting PowerPress Podcasting powerpress
- Affected
- up to 11.17.9
- What to do
- Affects up to 11.17.9. Update Blubrry Podcasting PowerPress Podcasting powerpress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026WPFunnels Team WP VR wpvr: Missing AuthorizationCVE-2026-104386 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in WPFunnels Team WP VR wpvr allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP VR: from n/a through 9.1.3.
- Product
- WPFunnels Team WP VR wpvr
- Affected
- up to 9.1.3
- What to do
- Affects up to 9.1.3. Update WPFunnels Team WP VR wpvr to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026Magepeople inc: Improper Validation of Specified Quantity in InputCVE-2026-103351 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Improper Validation of Specified Quantity in Input vulnerability in Magepeople inc. Taxi Booking Manager for WooCommerce ecab-taxi-booking-manager allows Input Data Manipulation.This issue affects Taxi Booking Manager for WooCommerce: from n/a through 2.1.1.
- Product
- Magepeople inc
- Affected
- up to 2.1.1
- What to do
- Affects up to 2.1.1. Update Magepeople inc to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026Deepen Bajracharya Video Conferencing with Zoom video-conferencing-with-zoom-api: Insertion of Sensitive Information Into Sent DataCVE-2026-103335 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Insertion of Sensitive Information Into Sent Data vulnerability in Deepen Bajracharya Video Conferencing with Zoom video-conferencing-with-zoom-api allows Retrieve Embedded Sensitive Data.This issue affects Video Conferencing with Zoom: from n/a through 4.6.10.
- Product
- Deepen Bajracharya Video Conferencing with Zoom video-conferencing-with-zoom-api
- Affected
- up to 4.6.10
- What to do
- Affects up to 4.6.10. Update Deepen Bajracharya Video Conferencing with Zoom video-conferencing-with-zoom-api to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026LeapWorx Premium Addons for Elementor premium-addons-for-elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-103084 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LeapWorx Premium Addons for Elementor premium-addons-for-elementor allows Stored XSS.This issue affects Premium Addons for Elementor: from n/a through 4.11.109.
- Product
- LeapWorx Premium Addons for Elementor premium-addons-for-elementor
- Affected
- up to 4.11.109
- What to do
- Affects up to 4.11.109. Update LeapWorx Premium Addons for Elementor premium-addons-for-elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026Ahmad JS Help Desk js-support-ticket: Authorization Bypass Through User-Controlled KeyCVE-2026-103079 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Authorization Bypass Through User-Controlled Key vulnerability in Ahmad JS Help Desk js-support-ticket allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JS Help Desk: from n/a through 4.0.0.
- Product
- Ahmad JS Help Desk js-support-ticket
- Affected
- up to 4.0.0
- What to do
- Affects up to 4.0.0. Update Ahmad JS Help Desk js-support-ticket to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026Ahmad JS Help Desk js-support-ticket: Authorization Bypass Through User-Controlled KeyCVE-2026-103078 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Authorization Bypass Through User-Controlled Key vulnerability in Ahmad JS Help Desk js-support-ticket allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JS Help Desk: from n/a through 4.0.0.
- Product
- Ahmad JS Help Desk js-support-ticket
- Affected
- up to 4.0.0
- What to do
- Affects up to 4.0.0. Update Ahmad JS Help Desk js-support-ticket to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026Brainstorm Force Presto Player presto-player: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-102914 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force Presto Player presto-player allows Stored XSS.This issue affects Presto Player: from n/a through 4.5.2.
- Product
- Brainstorm Force Presto Player presto-player
- Affected
- up to 4.5.2
- What to do
- Affects up to 4.5.2. Update Brainstorm Force Presto Player presto-player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026Brainstorm Force Starter Templates astra-sites: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-102393 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force Starter Templates astra-sites allows Stored XSS.This issue affects Starter Templates: from n/a through 4.7.7.
- Product
- Brainstorm Force Starter Templates astra-sites
- Affected
- up to 4.7.7
- What to do
- Affects up to 4.7.7. Update Brainstorm Force Starter Templates astra-sites to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026UPI QR Code Payment Gateway: Does not verify that a payment-confirmation request actually belongs to the order and customer it claims to confirmCVE-2026-84169 · WordPress plugins & themes · reported by WPScanMedium 5.3
The UPI QR Code Payment Gateway WordPress plugin through 1.4.3 does not verify that a payment-confirmation request actually belongs to the order and customer it claims to confirm, allowing unauthenticated attackers to mark an arbitrary order as paid without making any payment.
- Product
- UPI QR Code Payment Gateway
- Affected
- up to 1.4.3
- What to do
- Affects up to 1.4.3. Update UPI QR Code Payment Gateway to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026File Uploads Addon for WooCommerce: Does not verify that the person requesting a customer-uploaded file is the customer who uploaded itCVE-2026-78371 · WordPress plugins & themes · reported by WPScanMedium 5.9
The File Uploads Addon for WooCommerce WordPress plugin before 1.7.6 does not verify that the person requesting a customer-uploaded file is the customer who uploaded it, allowing unauthenticated attackers who know or guess a file's name to download other customers' uploaded files.
- Product
- File Uploads Addon for WooCommerce
- Fixed in
- 1.7.6
- What to do
- Update File Uploads Addon for WooCommerce to 1.7.6 or newer.
Oct 5, 2026File Uploads Addon for WooCommerce: Stores customer-uploaded files in a publicly web-accessible uploads directory and the access restriction it generates is ineffectiveCVE-2026-13607 · WordPress plugins & themes · reported by WPScanMedium 5.9
The File Uploads Addon for WooCommerce WordPress plugin through 1.7.6 stores customer-uploaded files in a publicly web-accessible uploads directory and the access restriction it generates is ineffective, so an unauthenticated attacker who knows or guesses a file's name can retrieve customer-uploaded files directly, bypassing the File Uploads Addon for WooCommerce WordPress plugin through 1.7.6's authenticated download mechanism.
- Product
- File Uploads Addon for WooCommerce
- Affected
- up to 1.7.6
- What to do
- Affects up to 1.7.6. Update File Uploads Addon for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 4, 2026farvisun Mindio Magic MCP mindio-magic-mcp: Insertion of Sensitive Information Into Sent DataCVE-2026-104402 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Insertion of Sensitive Information Into Sent Data vulnerability in farvisun Mindio Magic MCP mindio-magic-mcp allows Retrieve Embedded Sensitive Data.This issue affects Mindio Magic MCP: from n/a through 0.5.6.
- Product
- farvisun Mindio Magic MCP mindio-magic-mcp
- Affected
- up to 0.5.6
- What to do
- Affects up to 0.5.6. Update farvisun Mindio Magic MCP mindio-magic-mcp to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 4, 2026StylemixThemes Cost Calculator Builder cost-calculator-builder: Insertion of Sensitive Information Into Sent DataCVE-2026-97307 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Insertion of Sensitive Information Into Sent Data vulnerability in StylemixThemes Cost Calculator Builder cost-calculator-builder allows Retrieve Embedded Sensitive Data.This issue affects Cost Calculator Builder: from n/a through 4.0.17.
- Product
- StylemixThemes Cost Calculator Builder cost-calculator-builder
- Affected
- up to 4.0.17
- What to do
- Affects up to 4.0.17. Update StylemixThemes Cost Calculator Builder cost-calculator-builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 4, 2026VeronaLabs WP Statistics wp-statistics: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-97276 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VeronaLabs WP Statistics wp-statistics allows Reflected XSS.This issue affects WP Statistics: from n/a through 14.16.14.
- Product
- VeronaLabs WP Statistics wp-statistics
- Affected
- up to 14.16.14
- What to do
- Affects up to 14.16.14. Update VeronaLabs WP Statistics wp-statistics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 4, 2026Unlimited Elements Unlimited Elements For Elementor: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-103355 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor allows Blind SQL Injection.This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 2.0.20.
- Product
- Unlimited Elements Unlimited Elements For Elementor
- Affected
- up to 2.0.20
- What to do
- Affects up to 2.0.20. Update Unlimited Elements Unlimited Elements For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 4, 2026Liquid Web / StellarWP Gutenberg Blocks by Kadence Blocks kadence-blocks: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-103354 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / StellarWP Gutenberg Blocks by Kadence Blocks kadence-blocks allows Stored XSS.This issue affects Gutenberg Blocks by Kadence Blocks: from n/a through 3.7.11.1.
- Product
- Liquid Web / StellarWP Gutenberg Blocks by Kadence Blocks kadence-blocks
- Affected
- up to 3.7.11.1
- What to do
- Affects up to 3.7.11.1. Update Liquid Web / StellarWP Gutenberg Blocks by Kadence Blocks kadence-blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 4, 2026Unlimited Elements Unlimited Elements For Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-103344 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor allows Reflected XSS.This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 2.0.20.
- Product
- Unlimited Elements Unlimited Elements For Elementor
- Affected
- up to 2.0.20
- What to do
- Affects up to 2.0.20. Update Unlimited Elements Unlimited Elements For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 4, 2026Cozmoslabs TranslatePress translatepress-multilingual: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-103062 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cozmoslabs TranslatePress translatepress-multilingual allows Stored XSS.This issue affects TranslatePress: from n/a through 3.3.6.
- Product
- Cozmoslabs TranslatePress translatepress-multilingual
- Affected
- up to 3.3.6
- What to do
- Affects up to 3.3.6. Update Cozmoslabs TranslatePress translatepress-multilingual to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 4, 2026User Private Files: Does not properly protect its stored private files on multisite installationsCVE-2026-97332 · WordPress plugins & themes · reported by WPScanMedium 5.3
The User Private Files WordPress plugin before 2.2.0 does not properly protect its stored private files on multisite installations, where the rewrite rule it relies on to route file requests through its access check is never reached, allowing unauthenticated users to retrieve other users' private files directly.
- Product
- User Private Files
- Fixed in
- 2.2.0
- What to do
- Update User Private Files to 2.2.0 or newer.
Oct 4, 2026CoCart: Does not scope its REST API authentication filter to its own endpointsCVE-2026-93549 · WordPress plugins & themes · reported by WPScanHigh 8.8
The CoCart WordPress plugin before 4.9.7 does not scope its REST API authentication filter to its own endpoints, which disables WordPress core's REST nonce protection for every route, allowing an attacker to perform a cross-site request forgery attack that creates a new administrator account using a logged-in administrator's session.
- Product
- CoCart
- Fixed in
- 4.9.7
- What to do
- Update CoCart to 4.9.7 or newer.
Oct 4, 2026Five Star Business Profile and Schema: Does not properly restrict the callbacks used to resolve schema field default valuesCVE-2026-86817 · WordPress plugins & themes · reported by WPScanMedium 4.9
The Five Star Business Profile and Schema WordPress plugin before 2.4.0 does not properly restrict the callbacks used to resolve schema field default values, allowing authenticated users with Author-level access and above to store input that discloses sensitive data, including other users' password hashes and arbitrary site option values, in public output readable by unauthenticated visitors.
- Product
- Five Star Business Profile and Schema
- Fixed in
- 2.4.0
- What to do
- Update Five Star Business Profile and Schema to 2.4.0 or newer.
Oct 4, 2026Horizontal scrolling announcements: Does not sanitise and escape one of its announcement settings before outputting it into an attribute context on the front endCVE-2026-17005 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Horizontal scrolling announcements WordPress plugin through 2.6 does not sanitise and escape one of its announcement settings before outputting it into an attribute context on the front end, allowing users granted access to the announcement management page (Contributor and above, once permitted) to perform Stored Cross-Site Scripting attacks that execute in the browser of anyone viewing the announcement.
- Product
- Horizontal scrolling announcements
- Affected
- up to 2.6
- What to do
- Affects up to 2.6. Update Horizontal scrolling announcements to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 4, 2026Simple Shopping Cart: Does not escape some of its settings field values before outputting them on an admin settings pageCVE-2026-104119 · WordPress plugins & themes · reported by WPScanLow 3.5
The Simple Shopping Cart WordPress plugin before 5.2.6 does not escape some of its settings field values before outputting them on an admin settings page, allowing high-privilege users such as administrators to perform Stored Cross-Site Scripting attacks, which is notably impactful on multisite installations where administrators do not have the unfiltered_html capability.
- Product
- Simple Shopping Cart
- Fixed in
- 5.2.6
- What to do
- Update Simple Shopping Cart to 5.2.6 or newer.
Oct 4, 2026Razorpay for WooCommerce: Does not perform ownership or authorization checks on a REST API route used during checkoutCVE-2026-104118 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Razorpay for WooCommerce WordPress plugin before 4.8.8 does not perform ownership or authorization checks on a REST API route used during checkout, allowing unauthenticated attackers to modify the shipping information stored on arbitrary orders.
- Product
- Razorpay for WooCommerce
- Fixed in
- 4.8.8
- What to do
- Update Razorpay for WooCommerce to 4.8.8 or newer.
Oct 3, 2026Ultimate Member Ultimate Member ultimate-member: Authorization Bypass Through User-Controlled KeyCVE-2026-96451 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Authorization Bypass Through User-Controlled Key vulnerability in Ultimate Member Ultimate Member ultimate-member allows Privilege Escalation.This issue affects Ultimate Member: from n/a through 2.13.1.
- Product
- Ultimate Member Ultimate Member ultimate-member
- Affected
- up to 2.13.1
- What to do
- Affects up to 2.13.1. Update Ultimate Member Ultimate Member ultimate-member to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 3, 2026Unlimited Elements Unlimited Elements For Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-103342 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor allows Reflected XSS.This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 2.0.20.
- Product
- Unlimited Elements Unlimited Elements For Elementor
- Affected
- up to 2.0.20
- What to do
- Affects up to 2.0.20. Update Unlimited Elements Unlimited Elements For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 3, 2026Themeum Kirki kirki: Improper Validation of Specified Quantity in InputCVE-2026-103065 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Improper Validation of Specified Quantity in Input vulnerability in Themeum Kirki kirki allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Kirki: from n/a through 6.3.1.
- Product
- Themeum Kirki kirki
- Affected
- up to 6.3.1
- What to do
- Affects up to 6.3.1. Update Themeum Kirki kirki to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 3, 2026Twenty20 Image Before-After: Stored Cross-Site ScriptingCVE-2026-92767 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Twenty20 Image Before-After plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'offset' Shortcode Attribute in all versions up to, and including, 2.0.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Twenty20 Image Before-After
- Affected
- up to 2.0.5
- What to do
- Affects up to 2.0.5. Update Twenty20 Image Before-After to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 3, 2026The Beaver Builder Page Builder – Drag and Drop Website Builder: Arbitrary shortcode executionCVE-2026-92084 · WordPress plugins & themes · reported by WordfenceCritical 9.1
The The Beaver Builder Page Builder – Drag and Drop Website Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.11.0.5. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. Exploitation requires the target site to have a Beaver Builder page containing the Sidebar module populated with a widget that displays attacker-controllable text, such as the core Recent Comments widget, with comment moderation disabled or the attacker's comment approved.
- Product
- The Beaver Builder Page Builder – Drag and Drop Website Builder
- Affected
- up to 2.11.0.5
- What to do
- Affects up to 2.11.0.5. Update The Beaver Builder Page Builder – Drag and Drop Website Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 3, 2026WPC Product Options for WooCommerce: Stored Cross-Site ScriptingCVE-2026-97660 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The WPC Product Options for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via wpcpo-* Array Key via Multipart Field Name in all versions up to, and including, 4.0.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable via guest checkout without authentication because the malicious payload is embedded in a multipart Content-Disposition field name beginning with 'wpcpo-', which PHP's RFC1867 parser preserves byte-for-byte and stores into order item meta.
- Product
- WPC Product Options for WooCommerce
- Affected
- up to 4.0.5
- What to do
- Affects up to 4.0.5. Update WPC Product Options for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 3, 2026Burst Statistics – Simple WordPress Analytics (Google Analytics Alternative): Improper Authentication leading to Account PersistenceCVE-2026-97343 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Burst Statistics – Simple WordPress Analytics (Google Analytics Alternative) plugin for WordPress is vulnerable to Improper Authentication leading to Account Persistence in all versions up to, and including, 3.7.1. This is due to the `maybe_load_shared_dashboard()` handler issuing a genuine WordPress session cookie for the `burst_statistics_viewer` account to any visitor presenting a valid share token via `wp_set_auth_cookie()`, while the plugin only blocks Application Passwords for the resulting `burst_viewer` role and does not restrict the core `/wp-json/wp/v2/users/me` password update endpoint or filter the `edit_user` capability for that account — leaving WordPress core's built-in rule that any authenticated user may update their own account fully in effect. This makes it possible for unauthenticated attackers to set an attacker-chosen password on the `burst_statistics_viewer` WordPress account, constituting a permanent takeover of that limited-privilege (`view_burst_statistics`) account that persists through share-token revocation, share-token expiration, and execution of the plugin's daily `cleanup_viewer_sessions()` routine. Exploitation requires that the attacker have o
- Product
- Burst Statistics – Simple WordPress Analytics (Google Analytics Alternative)
- Affected
- up to 3.7.1
- What to do
- Affects up to 3.7.1. Update Burst Statistics – Simple WordPress Analytics (Google Analytics Alternative) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 3, 2026WP Visitor Statistics (Real Time Traffic): Generic SQL InjectionCVE-2026-96267 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The WP Visitor Statistics (Real Time Traffic) plugin for WordPress is vulnerable to generic SQL Injection via the 'fullRef' parameter in all versions up to, and including, 8.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This is a second-order SQL injection: an unauthenticated attacker submits a crafted referrer URL to the wmcTrack tracking endpoint, which persists the raw unescaped value into the wp_logVisit table, and the injection is triggered when an administrator next views the Traffic Sources dashboard.
- Product
- WP Visitor Statistics (Real Time Traffic)
- Affected
- up to 8.7
- What to do
- Affects up to 8.7. Update WP Visitor Statistics (Real Time Traffic) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 3, 2026Nelio Content – Editorial Calendar & Social Media Auto-Posting: Authorization bypassCVE-2026-94505 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Nelio Content – Editorial Calendar & Social Media Auto-Posting plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5.0 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to permanently delete any reusable social message (nc_reusable_social post), including those authored by administrators or other privileged users.
- Product
- Nelio Content – Editorial Calendar & Social Media Auto-Posting
- Affected
- up to 4.5.0
- What to do
- Affects up to 4.5.0. Update Nelio Content – Editorial Calendar & Social Media Auto-Posting to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 3, 2026WPFront Notification Bar: Reflected Cross-Site ScriptingCVE-2026-93896 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WPFront Notification Bar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 3.5.1. This is due to the debug-log output path (write_debug_logs) reflecting the raw value of $_SERVER['REQUEST_URI'] through vprintf() directly inside a <script> block emitted on wp_footer, without any sanitization or escaping (see the 'Current URL is "%s"' log entry produced by the URL-text display filter in the filter() method). This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a specially crafted link.
- Product
- WPFront Notification Bar
- Affected
- up to 3.5.1
- What to do
- Affects up to 3.5.1. Update WPFront Notification Bar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 3, 2026Mail logging – WP Mail Catcher: Stored Cross-Site ScriptingCVE-2026-93889 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Mail logging – WP Mail Catcher plugin for WordPress is vulnerable to Stored Cross-Site Scripting via PHPMailer 'wp_mail_failed' Error Message in all versions up to, and including, 2.1.12 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires a separately installed plugin, such as Contact Form 7, that passes unauthenticated user-controlled input into mail fields whose content PHPMailer will include in its failure error message.
- Product
- Mail logging – WP Mail Catcher
- Affected
- up to 2.1.12
- What to do
- Affects up to 2.1.12. Update Mail logging – WP Mail Catcher to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 3, 2026Photo Gallery by 10Web – Mobile-Friendly Image Gallery: Reflected Cross-Site ScriptingCVE-2026-92974 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'thumb_url' parameter in all versions up to, and including, 1.8.46 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Exploitation requires that the authenticated victim holds the manage_options capability, as the editimage_bwg AJAX action performs a capability check but no nonce verification, meaning the payload can be delivered via a crafted GET request without a CSRF token.
- Product
- Photo Gallery by 10Web – Mobile-Friendly Image Gallery
- Affected
- up to 1.8.46
- What to do
- Affects up to 1.8.46. Update Photo Gallery by 10Web – Mobile-Friendly Image Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 3, 2026VikAppointments Services Booking Calendar: Arbitrary file deletionCVE-2026-87115 · WordPress plugins & themes · reported by WordfenceCritical 9.1
The VikAppointments Services Booking Calendar plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the extract function in all versions up to, and including, 1.2.21. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). Exploitation requires at least one File-type custom field to be published on the confirmation page shortcode, as this field is not created by default during plugin installation.
- Product
- VikAppointments Services Booking Calendar
- Affected
- up to 1.2.21
- What to do
- Affects up to 1.2.21. Update VikAppointments Services Booking Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. The WordPress, CMS and hosting-panel entries come from the National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan and others); we show who. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, a booking system, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.