Updated 8 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,756exploited flaws on CISA’s list

35added in the last 30 days

282new WordPress flaws this week

13,949entries in the database

13,949 results · page 34 of 279

Oct 3, 2026Real Cookie Banner: GDPR & ePrivacy Cookie Consent: Stored Cross-Site ScriptingCVE-2026-92977 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Real Cookie Banner: GDPR & ePrivacy Cookie Consent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment in all versions up to, and including, 5.3.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Malicious script payloads placed in the title attribute of an anchor tag survive WordPress's comment kses filter at save time, as the payload is only promoted to executable HTML attributes when the plugin's page-wide regex strips the closing quote delimiter at render time; exploitability is therefore subject to the standard comment moderation workflow before the comment is publicly displayed.
Product
Real Cookie Banner: GDPR & ePrivacy Cookie Consent
Affected
up to 5.3.5
What to do
Affects up to 5.3.5. Update Real Cookie Banner: GDPR & ePrivacy Cookie Consent to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 3, 2026EWWW Image Optimizer: Reflected Cross-Site ScriptingCVE-2026-92826 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The EWWW Image Optimizer plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via REQUEST_URI Parameter Key in all versions up to, and including, 8.7.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Successful exploitation requires that the enable_help option is active, as the vulnerable HelpScout Beacon script block is only emitted when that setting is enabled.
Product
EWWW Image Optimizer
Affected
up to 8.7.7
What to do
Affects up to 8.7.7. Update EWWW Image Optimizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 3, 2026EmbedPress – PDF Embedder, 3D PDF FlipBook, Google Reviews, YouTube Videos, Upload & Embed PDF documents: Stored Cross-Site ScriptingCVE-2026-92727 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The EmbedPress – PDF Embedder, 3D PDF FlipBook, Google Reviews, YouTube Videos, Upload & Embed PDF documents plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'slidesShow' Block Attribute in all versions up to, and including, 4.6.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The slidesShow block attribute is interpolated into an unquoted data-carousel-options HTML attribute, allowing a payload containing spaces to break out of the attribute and inject additional DOM attributes such as onfocus event handlers onto the wrapper element.
Product
EmbedPress – PDF Embedder, 3D PDF FlipBook, Google Reviews, YouTube Videos, Upload & Embed PDF documents
Affected
up to 4.6.6
What to do
Affects up to 4.6.6. Update EmbedPress – PDF Embedder, 3D PDF FlipBook, Google Reviews, YouTube Videos, Upload & Embed PDF documents to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 3, 2026Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress: Reflected Cross-Site ScriptingCVE-2026-92551 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via ppress_billing_address Filename Parameter in all versions up to, and including, 4.17.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. The vulnerability is exploitable via any page hosting the ProfilePress Tabbed Widget by supplying a malicious filename for the ppress_billing_address file upload field in a crafted POST request.
Product
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress
Affected
up to 4.17.4
What to do
Affects up to 4.17.4. Update Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record pastebin.com plugins.trac.wordpress.org
Oct 3, 2026LearnPress – WordPress LMS Plugin for Create and Sell Online Courses: Reflected DOM-Based Cross-Site ScriptingCVE-2026-92538 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Reflected DOM-Based Cross-Site Scripting via the 'orderby' parameter in all versions up to, and including, 4.4.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
Affected
up to 4.4.7
What to do
Affects up to 4.4.7. Update LearnPress – WordPress LMS Plugin for Create and Sell Online Courses to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 3, 2026Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress: Sensitive Information ExposureCVE-2026-92536 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.17.4 via the get_user_profile_structure. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract other users' email addresses, login names, and registration dates via the Member Directory's per-row user rebinding when attacker-controlled base64 payloads in the [pp-custom-html] shortcode invoke [profile-email], [profile-username], and [profile-date-registered]. When the WordPress users_can_register option is enabled, unauthenticated attackers can also exploit this vulnerability by supplying the split shortcode fragments through the plugin's own registration handler, which processes the reg_nickname and reg_bio fields without a nonce requirement.
Product
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress
Affected
up to 4.17.4
What to do
Affects up to 4.17.4. Update Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 2, 2026Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership: Stored Cross-Site ScriptingCVE-2026-96270 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'form_id' parameter in all versions up to, and including, 2.13.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload is stored in the registering user's 'submitted' usermeta via update_user_meta() and is only triggered when an administrator opens the affected user record in the wp-admin Users modal, which inserts the unescaped output via jQuery .html().
Product
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership
Affected
up to 2.13.1
What to do
Affects up to 2.13.1. Update Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record github.com plugins.trac.wordpress.org
Oct 2, 2026Beaver Builder Page Builder – Drag and Drop Website Builder: Blind SQL InjectionCVE-2026-95865 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Beaver Builder Page Builder – Drag and Drop Website Builder plugin for WordPress is vulnerable to blind SQL Injection via 'fields[][value]' Parameter in all versions up to, and including, 2.11.0.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The vulnerable get_autosuggest_values AJAX endpoint is reachable by any Contributor who owns a draft post, as the required fl_ajax_update nonce is emitted into the block editor for any user who can edit a Beaver Builder post type.
Product
Beaver Builder Page Builder – Drag and Drop Website Builder
Affected
up to 2.11.0.5
What to do
Affects up to 2.11.0.5. Update Beaver Builder Page Builder – Drag and Drop Website Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 2, 2026SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent: Time-based SQL InjectionCVE-2026-94539 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent plugin for WordPress is vulnerable to time-based SQL Injection via the 'sort_by' parameter in all versions up to, and including, 3.5.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with custom-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Exploitation requires the authenticated attacker to hold both a Subscriber-level (or higher) WordPress role and a SupportCandy Agent account with the 'Assign Agents' permission configured.
Product
SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent
Affected
up to 3.5.3
What to do
Affects up to 3.5.3. Update SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.svn.wordpress.org plugins.trac.wordpress.org
Oct 2, 2026SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent: Stored Cross-Site ScriptingCVE-2026-94378 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name' parameter in all versions up to, and including, 3.5.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This exploit chain requires the 'Register user if not exists' setting to be disabled, which is its default configuration.
Product
SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent
Affected
up to 3.5.3
What to do
Affects up to 3.5.3. Update SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.svn.wordpress.org plugins.trac.wordpress.org
Oct 2, 2026Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership: Authorization bypassCVE-2026-93428 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.13.1 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to view privacy-restricted member profile field values — including fields explicitly configured as owner-only, members-only, or role-restricted — by querying the publicly accessible wp_ajax_nopriv_um_get_members endpoint. The nonce required by the endpoint ('um-frontend-nonce') is emitted to all unauthenticated visitors via wp_localize_script, meaning it provides no meaningful access control and any anonymous visitor can satisfy the endpoint's authentication requirements.
Product
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership
Affected
up to 2.13.1
What to do
Affects up to 2.13.1. Update Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record github.com plugins.trac.wordpress.org
Oct 2, 2026Ivory Search – WordPress Search: Reflected Cross-Site ScriptingCVE-2026-92243 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Ivory Search – WordPress Search Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in all versions up to, and including, 5.5.18 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that the targeted search form has the 'Highlight Search Terms' option enabled by an administrator, and that the malicious search query returns at least one post result.
Product
Ivory Search – WordPress Search
Affected
up to 5.5.18
What to do
Affects up to 5.5.18. Update Ivory Search – WordPress Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 2, 2026Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress: Stored Cross-Site ScriptingCVE-2026-100180 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment in all versions up to, and including, 3.2.19 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Immediate persistence without moderator approval is possible when the attacker submits from an email address with at least one previously approved comment, though the widened allowlist bypasses sanitization regardless of approval status.
Product
Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress
Affected
up to 3.2.19
What to do
Affects up to 3.2.19. Update Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 2, 2026Webriti Wallstreet wallstreet: Cross-Site Request Forgery (CSRF)CVE-2026-39718 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Cross-Site Request Forgery (CSRF) vulnerability in Webriti Wallstreet wallstreet allows Cross Site Request Forgery.This issue affects Wallstreet: from n/a through 2.8.6.
Product
Webriti Wallstreet wallstreet
Affected
up to 2.8.6
What to do
Affects up to 2.8.6. Update Webriti Wallstreet wallstreet to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record patchstack.com
Oct 2, 2026All in One SEO: Does not correctly determineCVE-2026-19856 · WordPress plugins & themes · reported by WPScanMedium 6.5
The All in One SEO WordPress plugin before 5.0.2.1 does not correctly determine which shortcodes are present in content derived from user input before deciding which ones to strip, allowing unauthenticated users to execute arbitrary shortcodes registered on the site. On sites upgraded from older versions the protection is disabled outright, making the issue reachable without any crafted input.
Product
All in One SEO
Fixed in
5.0.2.1
What to do
Update All in One SEO to 5.0.2.1 or newer.
NVD record wpscan.com
Oct 2, 2026CodeArt Google MP3 Audio Player plugin (google-mp3-audio-player) for WordPress through 1.0.11 contains an unauthenticated arbitrary file read vulnerability thatCVE-2014-125130 · WordPress plugins & themes · reported by VulnCheckHigh 8.7
CodeArt Google MP3 Audio Player plugin (google-mp3-audio-player) for WordPress through 1.0.11 contains an unauthenticated arbitrary file read vulnerability that allows remote attackers to retrieve sensitive files by supplying a path-traversal payload in the file parameter of direct_download.php. Attackers can request paths ../../wp-config.php without authentication to download configuration files containing database credentials and secret keys, leading to full site compromise. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.
Affected
up to 1.0.11
What to do
Affects up to 1.0.11. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record github.com patchstack.com
Oct 2, 2026ThimPress LearnPress learnpress: Missing AuthorizationCVE-2026-39717 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LearnPress: from n/a through 4.4.10.
Product
ThimPress LearnPress learnpress
Affected
up to 4.4.10
What to do
Affects up to 4.4.10. Update ThimPress LearnPress learnpress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record patchstack.com
Oct 2, 2026WPdevelop Booking Calendar booking: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')CVE-2026-39601 · WordPress plugins & themes · reported by PatchstackLow 3.7
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in WPdevelop Booking Calendar booking allows Leveraging Race Conditions.This issue affects Booking Calendar: from n/a through 11.8.4.
Product
WPdevelop Booking Calendar booking
Affected
up to 11.8.4
What to do
Affects up to 11.8.4. Update WPdevelop Booking Calendar booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record patchstack.com
Oct 2, 2026Mehul Gohil Aculect AI Companion aculect-ai-companion: URL Redirection to Untrusted Site ('Open Redirect')CVE-2026-39600 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Mehul Gohil Aculect AI Companion aculect-ai-companion allows Phishing.This issue affects Aculect AI Companion: from n/a through 0.8.2.
Product
Mehul Gohil Aculect AI Companion aculect-ai-companion
Affected
up to 0.8.2
What to do
Affects up to 0.8.2. Update Mehul Gohil Aculect AI Companion aculect-ai-companion to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record patchstack.com
Oct 2, 2026PublishPress PublishPress Series organize-series: Authorization Bypass Through User-Controlled KeyCVE-2026-39444 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Authorization Bypass Through User-Controlled Key vulnerability in PublishPress PublishPress Series organize-series allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PublishPress Series: from n/a through 3.1.3.
Product
PublishPress PublishPress Series organize-series
Affected
up to 3.1.3
What to do
Affects up to 3.1.3. Update PublishPress PublishPress Series organize-series to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record patchstack.com
Oct 2, 2026Kiera Howe WebSamurai websamurai: Missing AuthorizationCVE-2026-39439 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Kiera Howe WebSamurai websamurai allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WebSamurai: from n/a through 1.0.7.
Product
Kiera Howe WebSamurai websamurai
Affected
up to 1.0.7
What to do
Affects up to 1.0.7. Update Kiera Howe WebSamurai websamurai to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record patchstack.com
Oct 2, 2026airano Airano MCP Bridge airano-mcp-bridge: Missing AuthorizationCVE-2026-32585 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in airano Airano MCP Bridge airano-mcp-bridge allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Airano MCP Bridge: from n/a through 2.11.0.
Product
airano Airano MCP Bridge airano-mcp-bridge
Affected
up to 2.11.0
What to do
Affects up to 2.11.0. Update airano Airano MCP Bridge airano-mcp-bridge to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record patchstack.com
Oct 2, 2026Chiranjit Hazarika Smart One Click Setup – Complete Demo Import & Export smart-one-click-setup: Insertion of Sensitive Information Into Sent DataCVE-2026-32584 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Insertion of Sensitive Information Into Sent Data vulnerability in Chiranjit Hazarika Smart One Click Setup – Complete Demo Import & Export smart-one-click-setup allows Retrieve Embedded Sensitive Data.This issue affects Smart One Click Setup – Complete Demo Import & Export: from n/a through 1.4.3.
Product
Chiranjit Hazarika Smart One Click Setup – Complete Demo Import & Export smart-one-click-setup
Affected
up to 1.4.3
What to do
Affects up to 1.4.3. Update Chiranjit Hazarika Smart One Click Setup – Complete Demo Import & Export smart-one-click-setup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record patchstack.com
Oct 2, 2026JetAppointment: Stored Cross-Site ScriptingCVE-2026-93875 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The JetAppointment plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'friendlyTime' parameter in all versions up to, and including, 2.5.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload is stored in the wp_jet_appointments_meta table via the unauthenticated jet_engine_form_booking_submit endpoint and executes in the administrator's browser when the appointment details popup is opened in the WordPress admin panel.
Product
JetAppointment
Affected
up to 2.5.2.1
What to do
Affects up to 2.5.2.1. Update JetAppointment to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record crocoblock.com wordfence.com
Oct 2, 2026Divi Membership: Privilege EscalationCVE-2026-19652 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Divi Membership plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 2.2.0. This is due to the `dmem_form_submit_handler()` function determining the new user's role by iterating all WordPress roles and calling `password_verify()` against an attacker-controlled bcrypt hash supplied in the `form_id` POST parameter, with no validation or whitelist of allowed roles. This makes it possible for unauthenticated attackers to register a new account with the administrator role by submitting a locally computed bcrypt hash of `administrator` as `form_id`, and when `auto_login=on` is submitted, be immediately authenticated as that administrator in the same request, resulting in full site takeover. Exploitation requires a WordPress nonce, but that nonce is publicly emitted on any page rendering the Divi Membership registration form and is therefore obtainable by any unauthenticated visitor.
Product
Divi Membership
Affected
up to 2.2.0
What to do
Affects up to 2.2.0. Update Divi Membership to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record diviengine.com diviengine.com
Oct 2, 2026ThemeREX Group ThemeREX Addons trx_addons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-102798 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeREX Group ThemeREX Addons trx_addons allows Stored XSS.This issue affects ThemeREX Addons: from n/a through 2.46.0.
Product
ThemeREX Group ThemeREX Addons trx_addons
Affected
up to 2.46.0
What to do
Affects up to 2.46.0. Update ThemeREX Group ThemeREX Addons trx_addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record patchstack.com
Oct 2, 2026ThemeREX Group ThemeREX Addons trx_addons: Server-Side Request Forgery (SSRF)CVE-2026-102797 · WordPress plugins & themes · reported by PatchstackMedium 6.4
Server-Side Request Forgery (SSRF) vulnerability in ThemeREX Group ThemeREX Addons trx_addons allows Server Side Request Forgery.This issue affects ThemeREX Addons: from n/a through 2.46.0.
Product
ThemeREX Group ThemeREX Addons trx_addons
Affected
up to 2.46.0
What to do
Affects up to 2.46.0. Update ThemeREX Group ThemeREX Addons trx_addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record patchstack.com
Oct 2, 2026WP Statistics – Simple, privacy-friendly Google Analytics alternative: Reflected Cross-Site ScriptingCVE-2026-97652 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WP Statistics – Simple, privacy-friendly Google Analytics alternative plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via REQUEST_URI Query-Parameter Key in all versions up to, and including, 14.16.14 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
WP Statistics – Simple, privacy-friendly Google Analytics alternative
Affected
up to 14.16.14
What to do
Affects up to 14.16.14. Update WP Statistics – Simple, privacy-friendly Google Analytics alternative to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record github.com plugins.trac.wordpress.org
Oct 2, 2026WPMobile.App – Android and iOS App Builder: Authorization bypassCVE-2026-94541 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The WPMobile.App – Android and iOS App Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 11.82 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to exfiltrate password-reset URLs for arbitrary users, including administrators, mirrored into the push queue by the mail-to-push feature, and use those URLs to take over the targeted accounts. This exploit chain requires the plugin's mail-to-push feature (wpmobile_auto_mail=1) to be enabled, as that setting is what causes outbound WordPress password-reset emails — including the reset URL and key — to be mirrored into the push row queue where they become accessible to the attacker.
Product
WPMobile.App – Android and iOS App Builder
Affected
up to 11.82
What to do
Affects up to 11.82. Update WPMobile.App – Android and iOS App Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 2, 2026Shahjada Download Manager: Authorization Bypass Through User-Controlled KeyCVE-2026-94405 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Authorization Bypass Through User-Controlled Key vulnerability in Shahjada Download Manager allows Retrieve Embedded Sensitive Data. This issue affects Download Manager: from n/a through 3.3.71.
Product
Shahjada Download Manager
Affected
up to 3.3.71
What to do
Affects up to 3.3.71. Update Shahjada Download Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record patchstack.com
Oct 2, 2026Monetizemore Advanced Ads: Authorization Bypass Through User-Controlled KeyCVE-2026-94180 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Authorization Bypass Through User-Controlled Key vulnerability in Monetizemore Advanced Ads allows Retrieve Embedded Sensitive Data. This issue affects Advanced Ads: from n/a through 2.0.26.
Product
Monetizemore Advanced Ads
Affected
up to 2.0.26
What to do
Affects up to 2.0.26. Update Monetizemore Advanced Ads to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record patchstack.com
Oct 2, 2026W3 Total Cache: Stored Cross-Site ScriptingCVE-2026-87920 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Output-Buffer Regex Rewrite in all versions up to, and including, 2.10.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability is only exploitable when the 'Remove query strings from static resources' option is enabled in W3 Total Cache, as mutate_url() must strip the '?' delimiter and everything following it — including the closing quote of the outer attribute — to break the attribute boundary.
Product
W3 Total Cache
Affected
up to 2.10.6
What to do
Affects up to 2.10.6. Update W3 Total Cache to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 2, 2026All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights): DOM-Based Cross-Site ScriptingCVE-2026-85492 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) plugin for WordPress is vulnerable to DOM-Based Cross-Site Scripting via URL Pathname in all versions up to, and including, 5.0.1.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user visits a crafted URL. Exploitation requires the victim to hold the aioseo_manage_seo capability and to open the SEO Preview panel in the WordPress admin toolbar while visiting a page with a malicious payload embedded in the URL pathname.
Product
All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights)
Affected
up to 5.0.1.1
What to do
Affects up to 5.0.1.1. Update All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 2, 2026ThimPress LearnPress: Authorization Bypass Through User-Controlled KeyCVE-2026-104403 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Authorization Bypass Through User-Controlled Key vulnerability in ThimPress LearnPress allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects LearnPress: from n/a through 4.4.9.
Product
ThimPress LearnPress
Affected
up to 4.4.9
What to do
Affects up to 4.4.9. Update ThimPress LearnPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record patchstack.com
Oct 2, 2026Customer Reviews for WooCommerce: Stored Cross-Site ScriptingCVE-2026-97663 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Author Name in all versions up to, and including, 5.122.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the image attachment feature (ivole_attach_image) to be enabled, which allows unauthenticated attackers to both submit a review with an entity-encoded malicious author name and upload an attached image via the publicly accessible wp_ajax_nopriv_cr_upload_local_images_frontend endpoint.
Product
Customer Reviews for WooCommerce
Affected
up to 5.122.0
What to do
Affects up to 5.122.0. Update Customer Reviews for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 2, 2026Relevanssi – A Better Search: Stored Cross-Site ScriptingCVE-2026-97641 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Relevanssi – A Better Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to, and including, 4.28.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is only exploitable when the administrator has configured a non-empty value for the "Allowable tags in excerpts" setting, such as the default example value of <p><a><strong>, as the prefix-matching regex must have an allowable tag whose name is a prefix of the injected tag name.
Product
Relevanssi – A Better Search
Affected
up to 4.28.3
What to do
Affects up to 4.28.3. Update Relevanssi – A Better Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record github.com plugins.trac.wordpress.org
Oct 2, 2026JSON API Auth: Authentication BypassCVE-2026-97637 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The JSON API Auth plugin for WordPress is vulnerable to Authentication Bypass via Cached Session Cookie Disclosure in all versions up to, and including, 3.1.2. The vulnerability exists because the required PI-Media/json-api parent plugin caches controller dispatch results in transients keyed solely by URI and query string, ignoring HTTP method and POST body; this causes the `generate_auth_cookie()` endpoint — which embeds a live WordPress `logged_in` cookie produced by `wp_generate_auth_cookie()` directly in its JSON response body — to serve that cached authenticated response to any subsequent unauthenticated GET request to the same URI. This makes it possible for unauthenticated attackers to retrieve a valid Administrator `logged_in` session cookie from the cached response and use it to fully authenticate as the site Administrator, including via the same plugin's `get_currentuserinfo` endpoint and any cookie-authenticated controller action. Exploitation requires the PI-Media/json-api parent plugin to be installed and active with the Auth controller enabled, and a legitimate Administrator must have POSTed to `/api/auth/generate_auth_cookie/` within the preceding 24-hour cache TTL;
Product
JSON API Auth
Affected
up to 3.1.2
What to do
Affects up to 3.1.2. Update JSON API Auth to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 2, 2026Event Tickets and Registration: Generic SQL InjectionCVE-2026-97634 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Event Tickets and Registration plugin for WordPress is vulnerable to generic SQL Injection via the 'orderby' parameter in all versions up to, and including, 5.29.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. A Contributor-level user can reach the vulnerable code path by supplying a post_id they authored, as the can_access_page() gate requires only post authorship rather than the edit_others_posts capability for post owners.
Product
Event Tickets and Registration
Affected
up to 5.29.5
What to do
Affects up to 5.29.5. Update Event Tickets and Registration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 2, 2026JetFormBuilder — Dynamic Blocks Form Builder: Stored Cross-Site ScriptingCVE-2026-97342 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'choice' Post Meta via Insert/Update Post Action in all versions up to, and including, 3.6.5.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload is submitted via the unauthenticated wp_ajax_nopriv_jet_form_builder_submit endpoint, stored verbatim into post meta through the Insert/Update Post action, and later rendered unescaped by the Select Field block template when the get_from_db option generator copies raw meta values into option value attributes and label content.
Product
JetFormBuilder — Dynamic Blocks Form Builder
Affected
up to 3.6.5.4
What to do
Affects up to 3.6.5.4. Update JetFormBuilder — Dynamic Blocks Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record github.com plugins.trac.wordpress.org
Oct 2, 2026Download Manager: Stored Cross-Site ScriptingCVE-2026-97338 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Display Name in all versions up to, and including, 3.3.70 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the [wpdm_edit_profile] shortcode to be present on a front-end page accessible to Subscriber-level users, who can then submit a multiply entity-encoded payload via the display name field to bypass sanitization.
Product
Download Manager
Affected
up to 3.3.70
What to do
Affects up to 3.3.70. Update Download Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 2, 2026CMB2: Stored Cross-Site ScriptingCVE-2026-97336 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The CMB2 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'file_list' Field Type in all versions up to, and including, 2.13.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is only exploitable when an integrating plugin or theme registers a file_list field on a publicly accessible front-end form or a user meta box, as CMB2 is a developer library and does not expose these fields by default.
Product
CMB2
Affected
up to 2.13.0
What to do
Affects up to 2.13.0. Update CMB2 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 2, 2026Mang Board: Stored Cross-Site ScriptingCVE-2026-96871 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Mang Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data_type' parameter in all versions up to, and including, 2.4.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable on any board configured with the default write_level=0 (guest posting) and editor_type=N settings, which are the out-of-the-box defaults for newly created boards.
Product
Mang Board
Affected
up to 2.4.2
What to do
Affects up to 2.4.2. Update Mang Board to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 2, 2026Listdom: AI-powered Business Directory with Classifieds Ads Listings: Stored Cross-Site ScriptingCVE-2026-96647 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Listdom: AI-powered Business Directory with Classifieds Ads Listings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'lsd[remark]' Parameter in all versions up to, and including, 6.1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable by Subscriber-level users because the listing-creation branch of the AJAX handler omits a capability check, and the required nonce is publicly emitted on any page containing the [listdom-dashboard] shortcode.
Product
Listdom: AI-powered Business Directory with Classifieds Ads Listings
Affected
up to 6.1.1
What to do
Affects up to 6.1.1. Update Listdom: AI-powered Business Directory with Classifieds Ads Listings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 2, 2026GSpeech TTS – WordPress Text To Speech: Stored Cross-Site ScriptingCVE-2026-96578 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The GSpeech TTS – WordPress Text To Speech Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to, and including, 3.22.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This mXSS-style transform bypasses WordPress comment kses sanitization because the payload is stored using only kses-allowed tags and attributes; the malicious event handlers and style fragments become active only when the plugin's output-buffer callback rewrites the rendered HTML at request time.
Product
GSpeech TTS – WordPress Text To Speech
Affected
up to 3.22.0
What to do
Affects up to 3.22.0. Update GSpeech TTS – WordPress Text To Speech to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 2, 2026MW WP Form: Stored Cross-Site ScriptingCVE-2026-96567 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The MW WP Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post_id' parameter in all versions up to, and including, 5.1.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The CSRF gate protecting form submission (MW_WP_Form_Csrf) is bypassable by any unauthenticated visitor who first loads the public form page to obtain a valid double-submit cookie, leaving no effective barrier to storing malicious payloads.
Product
MW WP Form
Affected
up to 5.1.7
What to do
Affects up to 5.1.7. Update MW WP Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 2, 2026Newsletter – Send awesome emails from WordPress: Stored Cross-Site ScriptingCVE-2026-96566 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Newsletter – Send awesome emails from WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'np1' Custom Field Parameter in all versions up to, and including, 9.4.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The subscription endpoint (na=sa) requires no nonce, no capability check, and no CAPTCHA, and the payload can be smuggled past email-address validation by embedding the {profile_1} placeholder in the local part of the submitted address, since WordPress's is_email() permits curly braces there.
Product
Newsletter – Send awesome emails from WordPress
Affected
up to 9.4.0
What to do
Affects up to 9.4.0. Update Newsletter – Send awesome emails from WordPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 2, 2026DoFollow Case by Case: Stored Cross-Site ScriptingCVE-2026-95817 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The DoFollow Case by Case plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to, and including, 3.6.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Comment moderation delays but does not prevent exploitation — once an administrator approves the visually innocuous comment, the stored payload executes in the browser of every subsequent visitor to the affected post.
Product
DoFollow Case by Case
Affected
up to 3.6.0
What to do
Affects up to 3.6.0. Update DoFollow Case by Case to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 2, 2026No External Links: Stored Cross-Site ScriptingCVE-2026-95670 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The No External Links plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Log URL via /goto/{base64} Redirect in all versions up to, and including, 5.2.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is only exploitable when the administrator has enabled the 'Link Encoding: Base64' option in the plugin settings.
Product
No External Links
Affected
up to 5.2.0
What to do
Affects up to 5.2.0. Update No External Links to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 2, 2026Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress: Insecure Direct Object ReferenceCVE-2026-94432 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 5.7.1 via the OsPaypalConnectController::create_order_for_transaction() action registered as a public (unauthenticated) route through wp_ajax_nopriv_latepoint_route_call. The handler loads an OsInvoiceModel by a sequential integer 'invoice_id' with no access-key/UUID or ownership check (the sibling Stripe and Razorpay handlers require a 128-bit access-key UUID via OsInvoicesHelper::get_invoice_by_key), and then calls OsTransactionIntentHelper::create_or_update_transaction_intent() which persists a transaction intent tied to the target invoice's customer_id, order_id and charge_amount and regenerates its intent_key before the PayPal-configured guard is reached. This makes it possible for unauthenticated attackers to enumerate invoices belonging to arbitrary customers, create unauthorized transaction-intent rows linked to another customer's data, and overwrite the intent_key of any in-flight NEW-status transaction intent — invalidating the intent_key that legitimate Stripe/Razorpay flows are waiting o
Product
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress
Affected
up to 5.7.1
What to do
Affects up to 5.7.1. Update Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 2, 2026Greenshift – animation and page builder blocks: Reflected Cross-Site ScriptingCVE-2026-93880 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via '{{GET:}}' Dynamic Placeholder in all versions up to, and including, 13.2.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. This requires a site administrator to have configured an element block's Custom JS field to include a {{GET:...}} placeholder and for that JS to contain the token 'import', which routes the substituted value to the unescaped raw echo branch inside a <script type="module"> tag.
Product
Greenshift – animation and page builder blocks
Affected
up to 13.2.0
What to do
Affects up to 13.2.0. Update Greenshift – animation and page builder blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. The WordPress, CMS and hosting-panel entries come from the National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan and others); we show who. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Start a project

Tell us what you're building.

A website, a booking system, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.

01The person who'll build it writes back

02A planning call, then a written plan with the price and the date

03A preview on your phone while it's being built

04Launch night handled: redirects, email, Google

843-331-6339

Not ready to talk yet? Run the free website check and see what Google sees.