Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
11,441 results · page 35 of 229
Oct 1, 2026BackupSheep WordPress Backup: Does not properly validate its integration keyCVE-2026-101148 · WordPress plugins & themes · reported by WPScanCritical 10
The BackupSheep WordPress Backup Plugin WordPress plugin through 1.8 does not properly validate its integration key, treating an unset or blank key as valid, which allows unauthenticated attackers to create and download full site backups, including the database with user password hashes, and to delete arbitrary files on the server, leading to sensitive data disclosure and site takeover. The BackupSheep WordPress Backup Plugin WordPress plugin through 1.8 has been closed on WordPress.org since July 2024 and no fixed version is available. Remove it from any site where it is installed.
- Product
- BackupSheep WordPress Backup
- Affected
- up to 1.8
- What to do
- Affects up to 1.8. Update BackupSheep WordPress Backup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 1, 2026Featured Image from URL (FIFU) WordPress plugin before 6.0.8, Featured Image from URL (FIFU) Premium: Do not correctly enforce the REST API nonceCVE-2026-101147 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Featured Image from URL (FIFU) WordPress plugin before 6.0.8, Featured Image from URL (FIFU) Premium WordPress plugin before 8.2.8 do not correctly enforce the REST API nonce, disabling the check for the whole request when a crafted URL is used, which could allow attackers to make a logged-in administrator perform any REST API action, such as creating a new administrator account, via a CSRF attack.
- Product
- Featured Image from URL (FIFU) WordPress plugin before 6.0.8, Featured Image from URL (FIFU) Premium
- Fixed in
- 6.0.8
- What to do
- Update Featured Image from URL (FIFU) WordPress plugin before 6.0.8, Featured Image from URL (FIFU) Premium to 6.0.8 or newer.
Oct 1, 2026The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress: Arbitrary shortcode executionCVE-2026-92966 · WordPress plugins & themes · reported by WordfenceCritical 9.1
The The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.7.0. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. The payload is planted during the unauthenticated booking flow and triggered when the Customer Cabinet block rendered by render_customer_dashboard() outputs the stored name into the content stream, where WordPress core's do_shortcode filter at priority 11 re-parses and executes it.
- Product
- The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress
- Affected
- up to 5.7.0
- What to do
- Affects up to 5.7.0. Update The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 1, 2026WP Popular Posts: Sensitive Information ExposureCVE-2026-92548 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WP Popular Posts plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.4.2 via the 'context' parameter. This makes it possible for unauthenticated attackers to extract sensitive edit-context fields — including raw title, raw content body, password, meta, status, and guid — from non-public post objects such as wp_block synced patterns that WordPress core itself refuses to expose to unauthenticated callers. This is possible because the plugin's REST route is registered with a permission_callback of __return_true and passes the caller-supplied context parameter (e.g., context=edit) directly to WP_REST_Posts_Controller::prepare_item_for_response() without invoking get_item_permissions_check() or check_read_permission(), while the underlying query accepts an arbitrary post_type value without enforcing public or show_in_rest visibility flags.
- Product
- WP Popular Posts
- Affected
- up to 7.4.2
- What to do
- Affects up to 7.4.2. Update WP Popular Posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 1, 2026Advanced Woo Labels – Product Labels & Badges for WooCommerce: Unauthorized modification of dataCVE-2026-12241 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Advanced Woo Labels – Product Labels & Badges for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to an improperly secure capability check on the 'save_meta_boxes' function in all versions up to, and including, 2.51. This makes it possible for authenticated attackers, with Contributor-level access and above, to create AWS labels that are rendered without proper escaping. The vulnerability was partially patched in version 2.46.
- Product
- Advanced Woo Labels – Product Labels & Badges for WooCommerce
- Affected
- up to 2.51
- What to do
- Affects up to 2.51. Update Advanced Woo Labels – Product Labels & Badges for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 1, 2026AI Engine – The Chatbot, AI Framework & MCP for WordPress: Stored Cross-Site ScriptingCVE-2026-96561 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.8.0 This is due to a chain of missing input neutralization and output escaping across the /mwai-ui/v1/chats/submit REST endpoint, the PHP error-log parser (MeowKit_MWAI_Helpers::php_error_logs), the Advisor task (Meow_MWAI_Modules_Advisor::run_advisor), and the Advisor dashboard widget (advisor_metabox): the server-parameter denylist in chat_submit strips only exact key names such as 'model' while convert_keys() later canonicalizes 'model_' back to 'model', allowing an unauthenticated caller to place an attacker-controlled string (including CR/LF) into $query->model; final_checks() throws an Exception whose message embeds that raw string, and the non-streaming, non-admin catch branch writes it to the PHP error log unmodified — creating a forged log line that the plugin's own parser subsequently returns as recent PHP-error content; run_advisor() then appends that content verbatim to the AI prompt (indirect prompt injection — CWE-1427), the returned JSON is stored in the mwai_advisor_data option with no schema validation o
- Product
- AI Engine – The Chatbot, AI Framework & MCP for WordPress
- Affected
- up to 3.8.0
- What to do
- Affects up to 3.8.0. Update AI Engine – The Chatbot, AI Framework & MCP for WordPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 1, 2026Simply Schedule Appointments: Sensitive Information ExposureCVE-2026-92245 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Simply Schedule Appointments plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.6.12.32 via the 'recursive' parameter. This makes it possible for unauthenticated attackers to extract customer PII — including names, email addresses, phone numbers, and custom form field data — stored in appointment records, as well as per-appointment public_token values. The leaked per-appointment public_token values also enable unauthenticated attackers to delete arbitrary appointments via the DELETE /wp-json/ssa/v1/appointments/{id} endpoint, which accepts the token as sole authorization.
- Product
- Simply Schedule Appointments
- Affected
- up to 1.6.12.32
- What to do
- Affects up to 1.6.12.32. Update Simply Schedule Appointments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 1, 2026Simply Schedule Appointments: Insecure Direct Object ReferenceCVE-2026-91109 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Simply Schedule Appointments plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.6.12.31 via the 'complete_group' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with subscriber-level access and above, to disclose every co-booker's private per-appointment id_token (exposed as public_token) alongside their PII (name and email address), then use each leaked token to read, overwrite arbitrary appointment meta on, or cancel the co-booker's appointment via the same REST controller. Exploitation requires the attacker to possess a valid id_token for any single appointment within the targeted group booking.
- Product
- Simply Schedule Appointments
- Affected
- up to 1.6.12.31
- What to do
- Affects up to 1.6.12.31. Update Simply Schedule Appointments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 30, 2026Newsletter – Send awesome emails from WordPress: Insufficiently Protected CredentialsCVE-2026-92537 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Newsletter – Send awesome emails from WordPress plugin for WordPress is vulnerable to Insufficiently Protected Credentials in all versions up to, and including, 9.3.9 The plugin's public click-tracking REST route `/tnp/l/` is registered with `permission_callback => '__return_true'` and, upon receiving a valid keyed-MD5 signature, calls `set_user_cookie()`, which emits a `Set-Cookie: newsletter=<id>-<raw_token>` response header to the requester because the subscriber object loaded via `get_user()` lacks the `_trusted` property, causing `get_user_key()` to return the raw token column value instead of its MD5-masked variant. This makes it possible for unauthenticated attackers who obtain any signed click-tracking URL for a target subscriber to receive that subscriber's permanent raw authentication cookie, which they can then use to export the subscriber's full PII record via the JSON profile-export endpoint (`?na=px`), rewrite the subscriber's stored profile (`?na=ps`), and silently unsubscribe the subscriber via the RFC-8058 one-click endpoint (`?na=ocu`), none of which require a nonce, password, or email challenge. Signed tracking URLs are embedded in every external link of ever
- Product
- Newsletter – Send awesome emails from WordPress
- Affected
- up to 9.3.9
- What to do
- Affects up to 9.3.9. Update Newsletter – Send awesome emails from WordPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 30, 2026Contributor PHP Object Injection in Schema & Structured Data for WP & AMP <= 1.66 versions.CVE-2026-97291 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Contributor PHP Object Injection in Schema & Structured Data for WP & AMP <= 1.66 versions.
- What to do
- Update the plugin to the newest version.
Sep 30, 2026Unauthenticated Cross Site Scripting (XSS) in Photonic Gallery & Lightbox for Flickr, SmugMug & Others <= 3.36 versions.CVE-2026-97290 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Photonic Gallery & Lightbox for Flickr, SmugMug & Others <= 3.36 versions.
- What to do
- Update the plugin to the newest version.
Sep 30, 2026Crocoblock: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-97265 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock. Jetimpex Inc. JetEngine allows Stored XSS. This issue affects JetEngine: from n/a through 3.8.15.3.
- Product
- Crocoblock
- Affected
- up to 3.8.15.3
- What to do
- Affects up to 3.8.15.3. Update Crocoblock to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 30, 2026Editor PHP Object Injection in Page Builder by SiteOrigin <= 2.36.0 versions.CVE-2026-97256 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Editor PHP Object Injection in Page Builder by SiteOrigin <= 2.36.0 versions.
- What to do
- Update the plugin to the newest version.
Sep 30, 2026VillaTheme CURCY woo-multi-currency: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-94171 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VillaTheme CURCY woo-multi-currency allows DOM-Based XSS.This issue affects CURCY: 2.2.18.
- Product
- VillaTheme CURCY woo-multi-currency
- What to do
- Update VillaTheme CURCY woo-multi-currency to the newest version.
Sep 30, 2026Unauthenticated Broken Access Control in Ultimate Maps by Supsystic <= 1.5.5 versions.CVE-2026-102397 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Broken Access Control in Ultimate Maps by Supsystic <= 1.5.5 versions.
- What to do
- Update the plugin to the newest version.
Sep 30, 2026Shop manager PHP Object Injection in Extra Product Options For WooCommerce | Custom Product Addons and Fields <= 3.3.8 versions.CVE-2026-102392 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Shop manager PHP Object Injection in Extra Product Options For WooCommerce | Custom Product Addons and Fields <= 3.3.8 versions.
- What to do
- Update the plugin to the newest version.
Sep 30, 2026Unauthenticated Cross Site Scripting (XSS) in JetFormBuilder <= 3.6.5.4 versions.CVE-2026-102391 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in JetFormBuilder <= 3.6.5.4 versions.
- What to do
- Update the plugin to the newest version.
Sep 30, 2026Contributor PHP Object Injection in Photo Gallery by 10Web <= 1.8.46 versions.CVE-2026-102377 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Contributor PHP Object Injection in Photo Gallery by 10Web <= 1.8.46 versions.
- What to do
- Update the plugin to the newest version.
Sep 30, 2026Subscriber Cross Site Scripting (XSS) in Branda <= 3.4.32 versions.CVE-2026-102376 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Subscriber Cross Site Scripting (XSS) in Branda <= 3.4.32 versions.
- What to do
- Update the plugin to the newest version.
Sep 30, 2026Optimole Optimole optimole-wp: Missing AuthorizationCVE-2026-102375 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Optimole Optimole optimole-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Optimole: from n/a through 4.2.14.
- Product
- Optimole Optimole optimole-wp
- Affected
- up to 4.2.14
- What to do
- Affects up to 4.2.14. Update Optimole Optimole optimole-wp to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 30, 2026Contributor PHP Object Injection in Nested Pages <= 3.3.2 versions.CVE-2026-100512 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Contributor PHP Object Injection in Nested Pages <= 3.3.2 versions.
- What to do
- Update the plugin to the newest version.
Sep 30, 2026Unauthenticated Cross Site Scripting (XSS) in Post and Page Builder by BoldGrid <= 1.27.14 versions.CVE-2026-100510 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Post and Page Builder by BoldGrid <= 1.27.14 versions.
- What to do
- Update the plugin to the newest version.
Sep 30, 2026WP Hosting AS Pay with Vipps for WooCommerce: Authorization Bypass Through User-Controlled KeyCVE-2026-97259 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Authorization Bypass Through User-Controlled Key vulnerability in WP Hosting AS Pay with Vipps for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Pay with Vipps for WooCommerce: from n/a through 6.2.4.
- Product
- WP Hosting AS Pay with Vipps for WooCommerce
- Affected
- up to 6.2.4
- What to do
- Affects up to 6.2.4. Update WP Hosting AS Pay with Vipps for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 30, 2026WPTasty Business Directory business-directory-plugin: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-62097 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPTasty Business Directory business-directory-plugin allows Blind SQL Injection.This issue affects Business Directory: from n/a through 6.4.27.
- Product
- WPTasty Business Directory business-directory-plugin
- Affected
- up to 6.4.27
- What to do
- Affects up to 6.4.27. Update WPTasty Business Directory business-directory-plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 30, 2026Jeff Starr User Submitted Posts: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-62084 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jeff Starr User Submitted Posts allows Stored XSS. This issue affects User Submitted Posts: from n/a through 20260810.
- Product
- Jeff Starr User Submitted Posts
- Affected
- up to 20260810
- What to do
- Affects up to 20260810. Update Jeff Starr User Submitted Posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 30, 2026Unauthenticated Sensitive Data Exposure in MPG <= 4.2.3 versions.CVE-2026-97302 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Sensitive Data Exposure in MPG <= 4.2.3 versions.
- What to do
- Update the plugin to the newest version.
Sep 30, 2026Contributor Cross Site Scripting (XSS) in Cool Formkit Lite <= 2.7.8 versions.CVE-2026-97301 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Cross Site Scripting (XSS) in Cool Formkit Lite <= 2.7.8 versions.
- What to do
- Update the plugin to the newest version.
Sep 30, 2026Unauthenticated Cross Site Request Forgery (CSRF) in Razorpay Payment Links for WooCommerce <= 2.1.5 versions.CVE-2026-97299 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Unauthenticated Cross Site Request Forgery (CSRF) in Razorpay Payment Links for WooCommerce <= 2.1.5 versions.
- What to do
- Update the plugin to the newest version.
Sep 30, 2026Contributor Cross Site Scripting (XSS) in King Addons for Elementor <= 51.1.86 versions.CVE-2026-97298 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Cross Site Scripting (XSS) in King Addons for Elementor <= 51.1.86 versions.
- What to do
- Update the plugin to the newest version.
Sep 30, 2026Contributor SQL Injection in Media LIbrary Assistant <= 3.41 versions.CVE-2026-97293 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Contributor SQL Injection in Media LIbrary Assistant <= 3.41 versions.
- What to do
- Update the plugin to the newest version.
Sep 30, 2026Author Cross Site Scripting (XSS) in YITH WooCommerce Tab Manager <= 2.15.0 versions.CVE-2026-97292 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Author Cross Site Scripting (XSS) in YITH WooCommerce Tab Manager <= 2.15.0 versions.
- What to do
- Update the plugin to the newest version.
Sep 30, 2026ExpressTech Quiz And Survey Master quiz-master-next: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-97289 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows DOM-Based XSS.This issue affects Quiz And Survey Master: from n/a through 11.2.6.
- Product
- ExpressTech Quiz And Survey Master quiz-master-next
- Affected
- up to 11.2.6
- What to do
- Affects up to 11.2.6. Update ExpressTech Quiz And Survey Master quiz-master-next to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 30, 2026Contributor Cross Site Scripting (XSS) in OAuth Server <= 4.5.1 versions.CVE-2026-97288 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Cross Site Scripting (XSS) in OAuth Server <= 4.5.1 versions.
- What to do
- Update the plugin to the newest version.
Sep 30, 2026Liquid Web / StellarWP Event Tickets event-tickets: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-97287 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Blind SQL Injection. This issue affects Event Tickets: from n/a through 5.29.5.
- Product
- Liquid Web / StellarWP Event Tickets event-tickets
- Affected
- up to 5.29.5
- What to do
- Affects up to 5.29.5. Update Liquid Web / StellarWP Event Tickets event-tickets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 30, 2026WP Chill Strong Testimonials strong-testimonials: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-97286 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Strong Testimonials strong-testimonials allows Stored XSS.This issue affects Strong Testimonials: from n/a through 3.3.11.
- Product
- WP Chill Strong Testimonials strong-testimonials
- Affected
- up to 3.3.11
- What to do
- Affects up to 3.3.11. Update WP Chill Strong Testimonials strong-testimonials to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 30, 2026Contributor Broken Access Control in The Events Calendar <= 6.17.5 versions.CVE-2026-97285 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Contributor Broken Access Control in The Events Calendar <= 6.17.5 versions.
- What to do
- Update the plugin to the newest version.
Sep 30, 2026Unauthenticated Insecure Direct Object References (IDOR) in Review Schema <= 3.1.0 versions.CVE-2026-97282 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Insecure Direct Object References (IDOR) in Review Schema <= 3.1.0 versions.
- What to do
- Update the plugin to the newest version.
Sep 30, 2026Contributor Cross Site Scripting (XSS) in Polylang <= 3.8.9 versions.CVE-2026-97279 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Cross Site Scripting (XSS) in Polylang <= 3.8.9 versions.
- What to do
- Update the plugin to the newest version.
Sep 30, 2026OAuth Single Sign On – SSO: Unauthenticated BypassCVE-2026-97274 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated Bypass Vulnerability in OAuth Single Sign On – SSO (OAuth Client) <= 7.1.2 versions.
- Product
- OAuth Single Sign On – SSO
- What to do
- Update OAuth Single Sign On – SSO to the newest version.
Sep 30, 2026Unauthenticated Cross Site Scripting (XSS) in Premmerce Permalink Manager for WooCommerce <= 2.3.13 versions.CVE-2026-97272 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Premmerce Permalink Manager for WooCommerce <= 2.3.13 versions.
- What to do
- Update the plugin to the newest version.
Sep 30, 2026Unauthenticated Cross Site Scripting (XSS) in WPFunnels <= 3.13.1 versions.CVE-2026-97271 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in WPFunnels <= 3.13.1 versions.
- What to do
- Update the plugin to the newest version.
Sep 30, 2026Subscriber Cross Site Scripting (XSS) in CMB2 <= 2.13.0 versions.CVE-2026-97270 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Subscriber Cross Site Scripting (XSS) in CMB2 <= 2.13.0 versions.
- What to do
- Update the plugin to the newest version.
Sep 30, 2026Subscriber Broken Access Control in Prevent files / folders access <= 2.6.7 versions.CVE-2026-97267 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Subscriber Broken Access Control in Prevent files / folders access <= 2.6.7 versions.
- What to do
- Update the plugin to the newest version.
Sep 30, 2026Contributor Cross Site Scripting (XSS) in Virtue/Ascend/Pinnacle Toolkit <= 4.9.12.1 versions.CVE-2026-97266 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Cross Site Scripting (XSS) in Virtue/Ascend/Pinnacle Toolkit <= 4.9.12.1 versions.
- What to do
- Update the plugin to the newest version.
Sep 30, 2026Contributor Cross Site Scripting (XSS) in Visual Composer Website Builder <= 45.16.2 versions.CVE-2026-97262 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Cross Site Scripting (XSS) in Visual Composer Website Builder <= 45.16.2 versions.
- What to do
- Update the plugin to the newest version.
Sep 30, 2026Unauthenticated Sensitive Data Exposure in Notivo <= 1.4.2 versions.CVE-2026-97261 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Sensitive Data Exposure in Notivo <= 1.4.2 versions.
- What to do
- Update the plugin to the newest version.
Sep 30, 2026Kreatura LayerSlider: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-97253 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kreatura LayerSlider allows Reflected XSS. This issue affects LayerSlider: from n/a through 8.4.0.
- Product
- Kreatura LayerSlider
- Affected
- up to 8.4.0
- What to do
- Affects up to 8.4.0. Update Kreatura LayerSlider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 30, 2026Unauthenticated Cross Site Scripting (XSS) in Geo Mashup <= 1.13.21 versions.CVE-2026-97250 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Geo Mashup <= 1.13.21 versions.
- What to do
- Update the plugin to the newest version.
Sep 30, 2026Paid Member Subscriptions <= 3: Unauthenticated BypassCVE-2026-97249 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Bypass Vulnerability in Paid Member Subscriptions <= 3.0.9 versions.
- Product
- Paid Member Subscriptions <= 3
- What to do
- Update Paid Member Subscriptions <= 3 to the newest version.
Sep 30, 2026Unauthenticated PHP Object Injection in Booking Activities <= 1.18.7.1 versions.CVE-2026-97248 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in Booking Activities <= 1.18.7.1 versions.
- What to do
- Update the plugin to the newest version.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. The WordPress, CMS and hosting-panel entries come from the National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan and others); we show who. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, a booking system, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.