Updated 11 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,756exploited flaws on CISA’s list

35added in the last 30 days

277new WordPress flaws this week

13,949entries in the database

11,441 results · page 37 of 229

Sep 30, 2026Unauthenticated Broken Access Control in Bookly <= 28.2 versions.CVE-2026-96348 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in Bookly <= 28.2 versions.
What to do
Update the plugin to the newest version.
NVD record patchstack.com
Sep 30, 2026Subscriber Insecure Direct Object References (IDOR) in Bookly <= 28.2 versions.CVE-2026-96347 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Subscriber Insecure Direct Object References (IDOR) in Bookly <= 28.2 versions.
What to do
Update the plugin to the newest version.
NVD record patchstack.com
Sep 30, 2026Author SQL Injection in WP ERP <= 1.17.9 versions.CVE-2026-96346 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Author SQL Injection in WP ERP <= 1.17.9 versions.
What to do
Update the plugin to the newest version.
NVD record patchstack.com
Sep 30, 2026Administrator SQL Injection in Estatik <= 4.3.5 versions.CVE-2026-96345 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Administrator SQL Injection in Estatik <= 4.3.5 versions.
What to do
Update the plugin to the newest version.
NVD record patchstack.com
Sep 30, 2026Custom role PHP Object Injection in eCommerce Product Catalog <= 3.6.0 versions.CVE-2026-96344 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Custom role PHP Object Injection in eCommerce Product Catalog <= 3.6.0 versions.
What to do
Update the plugin to the newest version.
NVD record patchstack.com
Sep 30, 2026Custom role PHP Object Injection in WP ERP <= 1.17.9 versions.CVE-2026-96343 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Custom role PHP Object Injection in WP ERP <= 1.17.9 versions.
What to do
Update the plugin to the newest version.
NVD record patchstack.com
Sep 30, 2026Subscriber Cross Site Scripting (XSS) in Profile Builder <= 4.0.2 versions.CVE-2026-96338 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Subscriber Cross Site Scripting (XSS) in Profile Builder <= 4.0.2 versions.
What to do
Update the plugin to the newest version.
NVD record patchstack.com
Sep 30, 2026Unauthenticated Broken Access Control in Hostinger Migrator <= 1.0 versions.CVE-2026-95587 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in Hostinger Migrator <= 1.0 versions.
What to do
Update the plugin to the newest version.
NVD record patchstack.com
Sep 30, 2026Subscriber PHP Object Injection in Conversational Forms for ChatBot <= 1.5.0 versions.CVE-2026-95531 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Subscriber PHP Object Injection in Conversational Forms for ChatBot <= 1.5.0 versions.
What to do
Update the plugin to the newest version.
NVD record patchstack.com
Sep 30, 2026Contributor PHP Object Injection in DesignSetGo <= 2.8.0 versions.CVE-2026-94683 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Contributor PHP Object Injection in DesignSetGo <= 2.8.0 versions.
What to do
Update the plugin to the newest version.
NVD record patchstack.com
Sep 30, 2026Unauthenticated Denial of Service Attack in WP Store Locator < 3.0.0 versions.CVE-2026-94681 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Unauthenticated Denial of Service Attack in WP Store Locator < 3.0.0 versions.
What to do
Update the plugin to the newest version.
NVD record patchstack.com
Sep 30, 2026Contributor PHP Object Injection in Go Live Update Urls <= 7.0.8 versions.CVE-2026-94678 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Contributor PHP Object Injection in Go Live Update Urls <= 7.0.8 versions.
What to do
Update the plugin to the newest version.
NVD record patchstack.com
Sep 30, 2026Shop manager PHP Object Injection in Kadence WooCommerce Email Designer <= 1.5.19.1 versions.CVE-2026-94677 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Shop manager PHP Object Injection in Kadence WooCommerce Email Designer <= 1.5.19.1 versions.
What to do
Update the plugin to the newest version.
NVD record patchstack.com
Sep 30, 2026Contributor Cross Site Scripting (XSS) in Pixel Manager for WooCommerce <= 1.69.0 versions.CVE-2026-94674 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Cross Site Scripting (XSS) in Pixel Manager for WooCommerce <= 1.69.0 versions.
What to do
Update the plugin to the newest version.
NVD record patchstack.com
Sep 30, 2026Unauthenticated Insecure Direct Object References (IDOR) in Simply Schedule Appointments <= 1.6.12.31 versions.CVE-2026-94673 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Insecure Direct Object References (IDOR) in Simply Schedule Appointments <= 1.6.12.31 versions.
What to do
Update the plugin to the newest version.
NVD record patchstack.com
Sep 30, 2026Contributor Insecure Direct Object References (IDOR) in Safe SVG <= 2.5.0 versions.CVE-2026-94672 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Contributor Insecure Direct Object References (IDOR) in Safe SVG <= 2.5.0 versions.
What to do
Update the plugin to the newest version.
NVD record patchstack.com
Sep 30, 2026Subscriber Broken Access Control in FormGent <= 1.12.2 versions.CVE-2026-94499 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Subscriber Broken Access Control in FormGent <= 1.12.2 versions.
What to do
Update the plugin to the newest version.
NVD record patchstack.com
Sep 30, 2026Unauthenticated Remote Code Execution (RCE) in AcyMailing SMTP Newsletter <= 11.0.5 versions.CVE-2026-94389 · WordPress plugins & themes · reported by PatchstackCritical 9
Unauthenticated Remote Code Execution (RCE) in AcyMailing SMTP Newsletter <= 11.0.5 versions.
What to do
Update the plugin to the newest version.
NVD record patchstack.com
Sep 30, 2026Subscriber Privilege Escalation in Import and export users and customers <= 2.5.2 versions.CVE-2026-94178 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Subscriber Privilege Escalation in Import and export users and customers <= 2.5.2 versions.
What to do
Update the plugin to the newest version.
NVD record patchstack.com
Sep 30, 2026Ruben Garcia GamiPress gamipress: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-94177 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ruben Garcia GamiPress gamipress allows Blind SQL Injection.This issue affects GamiPress: from n/a through 8.0.2.
Product
Ruben Garcia GamiPress gamipress
Affected
up to 8.0.2
What to do
Affects up to 8.0.2. Update Ruben Garcia GamiPress gamipress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record patchstack.com
Sep 30, 2026Contributor Insecure Direct Object References (IDOR) in Business Directory <= 6.4.27 versions.CVE-2026-94173 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Contributor Insecure Direct Object References (IDOR) in Business Directory <= 6.4.27 versions.
What to do
Update the plugin to the newest version.
NVD record patchstack.com
Sep 30, 2026Unauthenticated Arbitrary File Download in NextGEN Gallery <= 4.5.0 versions.CVE-2026-94123 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Arbitrary File Download in NextGEN Gallery <= 4.5.0 versions.
What to do
Update the plugin to the newest version.
NVD record patchstack.com
Sep 30, 2026Editor PHP Object Injection in Responsive Slider Gallery <= 1.5.5 versions.CVE-2026-94122 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Editor PHP Object Injection in Responsive Slider Gallery <= 1.5.5 versions.
What to do
Update the plugin to the newest version.
NVD record patchstack.com
Sep 30, 2026Contributor PHP Object Injection in 10Web Booster – Website speed optimization, Cache & Page Speed optimizer <= 2.33.6 versions.CVE-2026-94121 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Contributor PHP Object Injection in 10Web Booster – Website speed optimization, Cache & Page Speed optimizer <= 2.33.6 versions.
What to do
Update the plugin to the newest version.
NVD record patchstack.com
Sep 30, 2026Unauthenticated Broken Access Control in GravityExport Lite for Gravity Forms <= 2.7.2 versions.CVE-2026-94120 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in GravityExport Lite for Gravity Forms <= 2.7.2 versions.
What to do
Update the plugin to the newest version.
NVD record patchstack.com
Sep 30, 2026Contributor SQL Injection in Easy Pricing Tables <= 4.1.2 versions.CVE-2026-94115 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Contributor SQL Injection in Easy Pricing Tables <= 4.1.2 versions.
What to do
Update the plugin to the newest version.
NVD record patchstack.com
Sep 30, 2026Author SQL Injection in Quiz Cat <= 3.1.1 versions.CVE-2026-94082 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Author SQL Injection in Quiz Cat <= 3.1.1 versions.
What to do
Update the plugin to the newest version.
NVD record patchstack.com
Sep 30, 2026Unauthenticated Cross Site Scripting (XSS) in WordPress Persistent Login <= 3.1.3 versions.CVE-2026-94081 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in WordPress Persistent Login <= 3.1.3 versions.
What to do
Update the plugin to the newest version.
NVD record patchstack.com
Sep 30, 2026Unauthenticated Cross Site Scripting (XSS) in Site Reviews <= 8.3.1 versions.CVE-2026-94078 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Site Reviews <= 8.3.1 versions.
What to do
Update the plugin to the newest version.
NVD record patchstack.com
Sep 30, 2026Contributor Cross Site Scripting (XSS) in Safe SVG <= 2.5.0 versions.CVE-2026-94077 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Cross Site Scripting (XSS) in Safe SVG <= 2.5.0 versions.
What to do
Update the plugin to the newest version.
NVD record patchstack.com
Sep 30, 2026Contributor PHP Object Injection in SEO Plugin by Squirrly SEO <= 14.2.5 versions.CVE-2026-94076 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Contributor PHP Object Injection in SEO Plugin by Squirrly SEO <= 14.2.5 versions.
What to do
Update the plugin to the newest version.
NVD record patchstack.com
Sep 30, 2026Unauthenticated Broken Access Control in Simply Schedule Appointments <= 1.6.12.29 versions.CVE-2026-94074 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Broken Access Control in Simply Schedule Appointments <= 1.6.12.29 versions.
What to do
Update the plugin to the newest version.
NVD record patchstack.com
Sep 30, 2026Shop manager PHP Object Injection in Cost of Goods for WooCommerce <= 3.5.2 versions.CVE-2026-93771 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Shop manager PHP Object Injection in Cost of Goods for WooCommerce <= 3.5.2 versions.
What to do
Update the plugin to the newest version.
NVD record patchstack.com
Sep 30, 2026Unauthenticated Cross Site Scripting (XSS) in WP Statistics <= 14.16.13 versions.CVE-2026-93770 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in WP Statistics <= 14.16.13 versions.
What to do
Update the plugin to the newest version.
NVD record patchstack.com
Sep 30, 2026Author PHP Object Injection in Minimum and Maximum Quantity for WooCommerce <= 2.1.2 versions.CVE-2026-93651 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Author PHP Object Injection in Minimum and Maximum Quantity for WooCommerce <= 2.1.2 versions.
What to do
Update the plugin to the newest version.
NVD record patchstack.com
Sep 30, 2026Shop manager PHP Object Injection in Music Player for WooCommerce <= 1.9.1 versions.CVE-2026-93624 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Shop manager PHP Object Injection in Music Player for WooCommerce <= 1.9.1 versions.
What to do
Update the plugin to the newest version.
NVD record patchstack.com
Sep 30, 2026Unauthenticated SQL Injection in WP Data Access <= 5.5.84 versions.CVE-2026-93621 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Unauthenticated SQL Injection in WP Data Access <= 5.5.84 versions.
What to do
Update the plugin to the newest version.
NVD record patchstack.com
Sep 30, 2026Unauthenticated Cross Site Scripting (XSS) in Notification for Telegram <= 3.5.2 versions.CVE-2026-93514 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Notification for Telegram <= 3.5.2 versions.
What to do
Update the plugin to the newest version.
NVD record patchstack.com
Sep 30, 2026Unauthenticated Cross Site Scripting (XSS) in JW Player for WordPress <= 2.3.11 versions.CVE-2026-93512 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in JW Player for WordPress <= 2.3.11 versions.
What to do
Update the plugin to the newest version.
NVD record patchstack.com
Sep 30, 2026Administrator SQL Injection in WP Activity Log <= 5.6.6 versions.CVE-2026-62085 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Administrator SQL Injection in WP Activity Log <= 5.6.6 versions.
What to do
Update the plugin to the newest version.
NVD record patchstack.com
Sep 30, 2026Subscriber Other Vulnerability Type in Creator LMS <= 1.2.19 versions.CVE-2026-62083 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Subscriber Other Vulnerability Type in Creator LMS <= 1.2.19 versions.
What to do
Update the plugin to the newest version.
NVD record patchstack.com
Sep 30, 2026Contributor Insecure Direct Object References (IDOR) in Flexible PDF Coupons <= 1.14.11 versions.CVE-2026-62081 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Contributor Insecure Direct Object References (IDOR) in Flexible PDF Coupons <= 1.14.11 versions.
What to do
Update the plugin to the newest version.
NVD record patchstack.com
Sep 30, 2026Contributor Cross Site Scripting (XSS) in Happy Addons for Elementor <= 3.23.1 versions.CVE-2026-62080 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Cross Site Scripting (XSS) in Happy Addons for Elementor <= 3.23.1 versions.
What to do
Update the plugin to the newest version.
NVD record patchstack.com
Sep 30, 2026Contributor Cross Site Scripting (XSS) in Qi Addons For Elementor <= 1.11 versions.CVE-2026-62079 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Cross Site Scripting (XSS) in Qi Addons For Elementor <= 1.11 versions.
What to do
Update the plugin to the newest version.
NVD record patchstack.com
Sep 30, 2026Contributor Cross Site Scripting (XSS) in Premium Addons for Elementor <= 4.11.105 versions.CVE-2026-62078 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Cross Site Scripting (XSS) in Premium Addons for Elementor <= 4.11.105 versions.
What to do
Update the plugin to the newest version.
NVD record patchstack.com
Sep 30, 2026Unauthenticated Cross Site Scripting (XSS) in WPFunnels <= 3.13.1 versions.CVE-2026-27371 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in WPFunnels <= 3.13.1 versions.
What to do
Update the plugin to the newest version.
NVD record patchstack.com
Sep 30, 2026Shop manager Content Injection in Astra WordPress Theme <= 4.13.12 versions.CVE-2026-27085 · WordPress plugins & themes · reported by PatchstackLow 2.7
Shop manager Content Injection in Astra WordPress Theme <= 4.13.12 versions.
What to do
Update the plugin to the newest version.
NVD record patchstack.com
Sep 30, 2026Unauthenticated Cross Site Request Forgery (CSRF) in Photo Gallery by Supsystic <= 1.21.0 versions.CVE-2026-102399 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Unauthenticated Cross Site Request Forgery (CSRF) in Photo Gallery by Supsystic <= 1.21.0 versions.
What to do
Update the plugin to the newest version.
NVD record patchstack.com
Sep 30, 2026Unauthenticated Cross Site Scripting (XSS) in Popup by Supsystic <= 1.13.1 versions.CVE-2026-102398 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Popup by Supsystic <= 1.13.1 versions.
What to do
Update the plugin to the newest version.
NVD record patchstack.com
Sep 30, 2026Unauthenticated Cross Site Scripting (XSS) in Ultimate Maps by Supsystic <= 1.5.5 versions.CVE-2026-102396 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Ultimate Maps by Supsystic <= 1.5.5 versions.
What to do
Update the plugin to the newest version.
NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. The WordPress, CMS and hosting-panel entries come from the National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan and others); we show who. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Start a project

Tell us what you're building.

A website, a booking system, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.

01The person who'll build it writes back

02A planning call, then a written plan with the price and the date

03A preview on your phone while it's being built

04Launch night handled: redirects, email, Google

843-331-6339

Not ready to talk yet? Run the free website check and see what Google sees.