Updated 2 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

36added in the last 30 days

479new WordPress flaws this week

390,525entries in the database

22,029 results · page 4 of 441

Oct 28, 2026Avada (Fusion) Builder: Stored Cross-Site ScriptingCVE-2026-104729 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Avada (Fusion) Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tab_index, empty_notice' parameter in all versions up to, and including, 3.16.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. wp_kses_post does not strip the payload on save because the dangerous characters reside within shortcode attribute text between square brackets, which kses treats as plain text rather than HTML markup.
Product
Avada (Fusion) Builder
Affected
up to 3.16.2
What to do
Affects up to 3.16.2. Update Avada (Fusion) Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record avada.com wordfence.com
Oct 28, 2026If-So Dynamic Content – Elementor & All Page Builders Personalization: Stored Cross-Site ScriptingCVE-2026-103996 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The If-So Dynamic Content – Elementor & All Page Builders Personalization plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'url' parameter in all versions up to, and including, 1.10.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected script executes specifically in the administrator's browser session, as the vulnerable branch only renders when an administrator previews or opens the post containing the crafted shortcode.
Product
If-So Dynamic Content – Elementor & All Page Builders Personalization
Affected
up to 1.10.2
What to do
Affects up to 1.10.2. Update If-So Dynamic Content – Elementor & All Page Builders Personalization to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 28, 2026Awesome Support – WordPress HelpDesk & Support: Stored Cross-Site ScriptingCVE-2026-103370 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Awesome Support – WordPress HelpDesk & Support Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpas_files' parameter in all versions up to, and including, 6.4.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with custom-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability is only exploitable when the "Enable drag-n-drop uploader for ticket form" setting is enabled, as it is disabled by default.
Product
Awesome Support – WordPress HelpDesk & Support
Affected
up to 6.4.1
What to do
Affects up to 6.4.1. Update Awesome Support – WordPress HelpDesk & Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 28, 2026Postie: Stored Cross-Site ScriptingCVE-2026-100175 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Postie plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Email Body URL Autolink in all versions up to, and including, 1.9.87 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is possible because the ?postie=get-mail endpoint is reachable by unauthenticated users with no capability check, and the email processing path removes WordPress's kses output filters before saving raw markup, allowing the unescaped href attribute value to be stored as post content.
Product
Postie
Affected
up to 1.9.87
What to do
Affects up to 1.9.87. Update Postie to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 28, 2026Recipe Card Blocks Lite: Does not sanitize and cast a block and shortcode attribute before concatenating it into SQL queriesCVE-2026-115281 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Recipe Card Blocks Lite WordPress plugin before 3.6.4 does not sanitize and cast a block and shortcode attribute before concatenating it into SQL queries, allowing authenticated users with Contributor-level access or above to perform SQL injection attacks.
Product
Recipe Card Blocks Lite
Fixed in
3.6.4
What to do
Update Recipe Card Blocks Lite to 3.6.4 or newer.
Full record and what to do →NVD record wpscan.com
Oct 28, 2026Customer Engagement System: Does not restrict access to its MailChimp interest-group lookup or validate the API key supplied to itCVE-2026-115225 · WordPress plugins & themes · reported by WPScanMedium 5.8
The Customer Engagement System WordPress plugin before 2.0.2 does not restrict access to its MailChimp interest-group lookup or validate the API key supplied to it, allowing unauthenticated users to make the server open connections to arbitrary internal hosts and ports and infer from response timing which ones are reachable.
Product
Customer Engagement System
Fixed in
2.0.2
What to do
Update Customer Engagement System to 2.0.2 or newer.
Full record and what to do →NVD record wpscan.com
Oct 28, 2026Customer Engagement System: Does not safely build the SQL statements that store a popup's page and category visibility rulesCVE-2026-115224 · WordPress plugins & themes · reported by WPScanMedium 4.1
The Customer Engagement System WordPress plugin before 2.0.2 does not safely build the SQL statements that store a popup's page and category visibility rules, concatenating request-supplied ID values directly into an INSERT statement with no parameter binding or integer cast, allowing an authenticated administrator to inject arbitrary SQL and read the contents of the WordPress database.
Product
Customer Engagement System
Fixed in
2.0.2
What to do
Update Customer Engagement System to 2.0.2 or newer.
Full record and what to do →NVD record wpscan.com
Oct 28, 2026GeoDirectory: Does not properly escape a post badge shortcode attribute for a JavaScript context before placing it in an inline event handlerCVE-2026-113488 · WordPress plugins & themes · reported by WPScanMedium 6.8
The GeoDirectory WordPress plugin before 2.8.196 does not properly escape a post badge shortcode attribute for a JavaScript context before placing it in an inline event handler, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks against anyone who clicks the badge, including administrators.
Product
GeoDirectory
Fixed in
2.8.196
What to do
Update GeoDirectory to 2.8.196 or newer.
Full record and what to do →NVD record wpscan.com
Oct 28, 2026GeoDirectory: Does not properly sanitise or escape a post badge click-through link value before outputting it in an anchor element on a listingCVE-2026-113487 · WordPress plugins & themes · reported by WPScanMedium 6.8
The GeoDirectory WordPress plugin before 2.8.196 does not properly sanitise or escape a post badge click-through link value before outputting it in an anchor element on a listing, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks against higher-privileged users who view the listing, including an administrator reviewing moderated content.
Product
GeoDirectory
Fixed in
2.8.196
What to do
Update GeoDirectory to 2.8.196 or newer.
Full record and what to do →NVD record wpscan.com
Oct 28, 2026MP3 Audio Player: Does not escape one of its audio player shortcode attributes before outputting it into an HTML attributeCVE-2026-111967 · WordPress plugins & themes · reported by WPScanMedium 6.8
The MP3 Audio Player WordPress plugin before 5.16 does not escape one of its audio player shortcode attributes before outputting it into an HTML attribute, allowing users with Contributor-level access and above to inject arbitrary JavaScript that executes when another user, such as an administrator previewing a pending post, views the content.
Product
MP3 Audio Player
Fixed in
5.16
What to do
Update MP3 Audio Player to 5.16 or newer.
Full record and what to do →NVD record wpscan.com
Oct 28, 2026Royal MCP: Does not perform an object-level permission check before duplicating a requested pageCVE-2026-111961 · WordPress plugins & themes · reported by WPScanLow 3.8
The Royal MCP WordPress plugin before 1.5.10 does not perform an object-level permission check before duplicating a requested page, relying on a generic capability, which allows users with contributor-level access to read the full content of any private or draft page and to publish it without holding the publish capability.
Product
Royal MCP
Fixed in
1.5.10
What to do
Update Royal MCP to 1.5.10 or newer.
Full record and what to do →NVD record wpscan.com
Oct 28, 2026GoSMTP: Does not perform a settings-management authorization check on its SMTP configuration pageCVE-2026-111577 · WordPress plugins & themes · reported by WPScanHigh 7.2
The GoSMTP WordPress plugin before 1.2.5 does not perform a settings-management authorization check on its SMTP configuration page, which is gated only on the GoSMTP WordPress plugin before 1.2.5-activation capability, allowing users with a delegated role below administrator to change outbound mail delivery and achieve administrator account takeover.
Product
GoSMTP
Fixed in
1.2.5
What to do
Update GoSMTP to 1.2.5 or newer.
Full record and what to do →NVD record wpscan.com
Oct 28, 2026Welcart e-Commerce: Does not properly verify authorization against the targeted product before processing SKU changesCVE-2026-111032 · WordPress plugins & themes · reported by WPScanLow 3.8
The Welcart e-Commerce WordPress plugin before 2.12.6 does not properly verify authorization against the targeted product before processing SKU changes, because its capability check is not tied to the product being edited, allowing any authenticated user with Author-level access or higher to read, modify, create, delete and re-order the SKU data (including prices, confidential cost prices and stock levels) of any product, including those belonging to other users.
Product
Welcart e-Commerce
Fixed in
2.12.6
What to do
Update Welcart e-Commerce to 2.12.6 or newer.
Full record and what to do →NVD record wpscan.com
Oct 28, 2026Welcart e-Commerce: Does not validate a user-supplied URL before using it in a redirectCVE-2026-111031 · WordPress plugins & themes · reported by WPScanMedium 4.7
The Welcart e-Commerce WordPress plugin before 2.12.6 does not validate a user-supplied URL before using it in a redirect, allowing unauthenticated attackers to redirect users to arbitrary external websites.
Product
Welcart e-Commerce
Fixed in
2.12.6
What to do
Update Welcart e-Commerce to 2.12.6 or newer.
Full record and what to do →NVD record wpscan.com
Oct 28, 2026Welcart e-Commerce: Does not properly sanitise and escape a parameter before using it in a SQL queryCVE-2026-111027 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Welcart e-Commerce WordPress plugin before 2.12.6 does not properly sanitise and escape a parameter before using it in a SQL query, and strips the escaping it had applied before running the query, allowing users with the Editor role or higher to perform SQL injection attacks.
Product
Welcart e-Commerce
Fixed in
2.12.6
What to do
Update Welcart e-Commerce to 2.12.6 or newer.
Full record and what to do →NVD record wpscan.com
Oct 28, 2026افزونه پیامک ووکامرس | Persian WooCommerce SMS: Does not sanitise and escape a parameter before reflecting it back into an HTML attributeCVE-2026-111021 · WordPress plugins & themes · reported by WPScanHigh 7.1
The افزونه پیامک ووکامرس | Persian WooCommerce SMS WordPress plugin before 7.3.2 does not sanitise and escape a parameter before reflecting it back into an HTML attribute, leading to Reflected Cross-Site Scripting that is executed in the browser session of a logged-in privileged user who is tricked into submitting a crafted cross-site request.
Product
افزونه پیامک ووکامرس | Persian WooCommerce SMS
Fixed in
7.3.2
What to do
Update افزونه پیامک ووکامرس | Persian WooCommerce SMS to 7.3.2 or newer.
Full record and what to do →NVD record wpscan.com
Oct 28, 2026WPOrLogin: Does not perform a capability check or validate a nonce before updating its hidden-login URL settingsCVE-2026-110691 · WordPress plugins & themes · reported by WPScanMedium 6.5
The WPOrLogin WordPress plugin before 3.1.0 does not perform a capability check or validate a nonce before updating its hidden-login URL settings, which could allow unauthenticated attackers to reassign the login, registration and password-recovery slugs and lock the administrator out of the login interface.
Product
WPOrLogin
Fixed in
3.1.0
What to do
Update WPOrLogin to 3.1.0 or newer.
Full record and what to do →NVD record wpscan.com
Oct 28, 2026Copy Anything to Clipboard for WordPress: Does not sanitize and escape a shortcode attribute before storing it and writing it back into the page through a client-side scriptCVE-2026-110524 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Copy Anything to Clipboard for WordPress WordPress plugin before 5.5.5 does not sanitize and escape a shortcode attribute before storing it and writing it back into the page through a client-side script, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks against higher-privileged users who view and interact with the content.
Product
Copy Anything to Clipboard for WordPress
Fixed in
5.5.5
What to do
Update Copy Anything to Clipboard for WordPress to 5.5.5 or newer.
Full record and what to do →NVD record wpscan.com
Oct 28, 2026Page Builder by SiteOrigin: Does not sanitize or escape a widget property before storing it and outputting it in the page builder interfaceCVE-2026-110506 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Page Builder by SiteOrigin WordPress plugin before 2.38.0 does not sanitize or escape a widget property before storing it and outputting it in the page builder interface, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks against higher-privileged users who open the affected post in the editor.
Product
Page Builder by SiteOrigin
Fixed in
2.38.0
What to do
Update Page Builder by SiteOrigin to 2.38.0 or newer.
Full record and what to do →NVD record wpscan.com
Oct 28, 2026Royal Addons for Elementor: Does not verify that a requested post is publicly viewable before returning its content via an unauthenticated AJAX actionCVE-2026-107100 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Royal Addons for Elementor WordPress plugin before 1.7.1070 does not verify that a requested post is publicly viewable before returning its content via an unauthenticated AJAX action, relying only on the published status and not on the post type's visibility, allowing unauthenticated users to disclose the content of posts stored in non-public post types, for example captured contact-form submissions containing names, email addresses and messages.
Product
Royal Addons for Elementor
Fixed in
1.7.1070
What to do
Update Royal Addons for Elementor to 1.7.1070 or newer.
Full record and what to do →NVD record wpscan.com
Oct 28, 2026Royal Addons for Elementor: Does not sanitise and escape one of its map widget's size settings before concatenating it into an HTML attributeCVE-2026-107098 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Royal Addons for Elementor WordPress plugin before 1.7.1070 does not sanitise and escape one of its map widget's size settings before concatenating it into an HTML attribute, allowing users with the Contributor role or above to inject JavaScript that runs in the browser of any user who views the page, including an administrator reviewing a pending submission.
Product
Royal Addons for Elementor
Fixed in
1.7.1070
What to do
Update Royal Addons for Elementor to 1.7.1070 or newer.
Full record and what to do →NVD record wpscan.com
Oct 28, 2026Royal Addons for Elementor: Does not perform any authorization check before using the site owner's stored Mailchimp credential to add subscriber records to an audience chosen by the requestCVE-2026-107097 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Royal Addons for Elementor WordPress plugin before 1.7.1070 does not perform any authorization check before using the site owner's stored Mailchimp credential to add subscriber records to an audience chosen by the request, allowing unauthenticated attackers to inject arbitrary email addresses and contact details into the site owner's Mailchimp account as confirmed subscribers.
Product
Royal Addons for Elementor
Fixed in
1.7.1070
What to do
Update Royal Addons for Elementor to 1.7.1070 or newer.
Full record and what to do →NVD record wpscan.com
Oct 28, 2026Court Reservation: Does not perform any authorisation or nonce verification on one of its challenge-management actionsCVE-2026-106002 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Court Reservation WordPress plugin before 1.12.4 does not perform any authorisation or nonce verification on one of its challenge-management actions, allowing unauthenticated users to delete arbitrary tournament-ladder challenge records, along with the linked court-booking event when one was scheduled.
Product
Court Reservation
Fixed in
1.12.4
What to do
Update Court Reservation to 1.12.4 or newer.
Full record and what to do →NVD record wpscan.com
Oct 28, 2026Booking Package: Does not restrict who can trigger its booking verification-code emails nor bind the recipient to server-side stateCVE-2026-105997 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Booking Package WordPress plugin before 1.7.33 does not restrict who can trigger its booking verification-code emails nor bind the recipient to server-side state, allowing unauthenticated users to make the site send templated verification-code emails to arbitrary recipients.
Product
Booking Package
Fixed in
1.7.33
What to do
Update Booking Package to 1.7.33 or newer.
Full record and what to do →NVD record wpscan.com
Oct 28, 2026Menu Cart for WooCommerce: Does not sanitise and escape cart item variation data before outputting it in its cart slide-outCVE-2026-105972 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Menu Cart for WooCommerce WordPress plugin before 3.2.1 does not sanitise and escape cart item variation data before outputting it in its cart slide-out, allowing unauthenticated users to store a Cross-Site Scripting payload that can be delivered to and executed in the session of another user, including a logged-in administrator.
Product
Menu Cart for WooCommerce
Fixed in
3.2.1
What to do
Update Menu Cart for WooCommerce to 3.2.1 or newer.
Full record and what to do →NVD record wpscan.com
Oct 28, 2026Thrive Automator: Does not properly sanitize and escape a parameter's array key before using it in a SQL queryCVE-2026-104694 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Thrive Automator WordPress plugin before 11.2 does not properly sanitize and escape a parameter's array key before using it in a SQL query, allowing authenticated attackers with editor-level access to perform blind SQL injection attacks.
Product
Thrive Automator
Fixed in
11.2
What to do
Update Thrive Automator to 11.2 or newer.
Full record and what to do →NVD record wpscan.com
Oct 28, 2026Casso Flow: Does not properly authenticate incoming bank-transfer payment notificationsCVE-2026-103382 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Casso Flow WordPress plugin before 4.2.0 does not properly authenticate incoming bank-transfer payment notifications, as the token used to verify them is empty on a default installation, allowing unauthenticated attackers to forge a notification and mark any pending WooCommerce order as paid, regardless of its payment method.
Product
Casso Flow
Fixed in
4.2.0
What to do
Update Casso Flow to 4.2.0 or newer.
Full record and what to do →NVD record wpscan.com
Oct 28, 2026Payconiq: Does not check that a visitor is allowed to see an order before returning its confirmation linkCVE-2026-103372 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Payconiq WordPress plugin through 1.0.4 does not check that a visitor is allowed to see an order before returning its confirmation link, allowing unauthenticated users to obtain any paid order's key and, for recent guest orders, view the customer's personal details.
Product
Payconiq
Affected
up to 1.0.4
What to do
Affects up to 1.0.4. Update Payconiq to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Oct 28, 2026Rank Math SEO – AI SEO Tools to Dominate SEO Rankings: PHP Object InjectionCVE-2026-1928 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.0.276 via deserialization of untrusted input in the updateMeta REST API endpoint. This makes it possible forauthenticated attackers, with Contributor-level access and above, to inject a PHP Object. The additional presence of a POP chain allows attackers to achieve remote code execution by writing a webshell to the uploads directory.
Product
Rank Math SEO – AI SEO Tools to Dominate SEO Rankings
Affected
up to 1.0.276
What to do
Affects up to 1.0.276. Update Rank Math SEO – AI SEO Tools to Dominate SEO Rankings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 28, 2026Appointment Booking Calendar: Stored Cross-Site ScriptingCVE-2026-111727 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Appointment Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'vs_text_submitbtn' parameter in all versions up to, and including, 1.4.05 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the attacker to be assigned as a calendar owner, a per-user grant that any administrator can extend to users as low as Subscriber level through the plugin's calendar list screen. Exploitation by attackers with subscriber-level access and above requires that an administrator has assigned the attacker's account as owner (`conwer`) of a calendar via the plugin's calendar list screen; the plugin's UI lists all registered users regardless of role, so a Subscriber can be assigned. On a default installation, where that is not configured, the vulnerability requires attackers with editor-level access and above.
Product
Appointment Booking Calendar
Affected
up to 1.4.05
What to do
Affects up to 1.4.05. Update Appointment Booking Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 27, 2026AMP for WP – Accelerated Mobile Pages: Stored Cross-Site ScriptingCVE-2026-97019 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'headline-*' Shortcode Attribute in all versions up to, and including, 1.1.17 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. A Subscriber-level user can store a malicious shortcode in their biographical info field; because WordPress core's wp_filter_kses() only strips HTML tags and not shortcode syntax, and because AMP content sanitizers run before do_shortcode() processes the archive description, the synthesized markup is never post-sanitized.
Product
AMP for WP – Accelerated Mobile Pages
Affected
up to 1.1.17
What to do
Affects up to 1.1.17. Update AMP for WP – Accelerated Mobile Pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 27, 2026affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display: Stored Cross-Site ScriptingCVE-2026-111314 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'atkp_product_producturl' parameter in all versions up to, and including, 3.9.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation by unauthenticated attackers requires that the plugin's AJAX loading / AJAX handler option is enabled (atkp_options::get_ajax_loading_enabled() || get_ajax_handler_enabled()) and the attacker knows a product id to render. On a default installation, where that is not configured, the vulnerability requires attackers with contributor-level access and above.
Product
affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display
Affected
up to 3.9.2
What to do
Affects up to 3.9.2. Update affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 27, 2026The AI Marketing Expert — AI Email Marketing, AI Content Generator, SEO Analyzer, AI Workflow Automation, Social Media & Ai Chatbot plugin for WordPress is vulnCVE-2026-109999 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The AI Marketing Expert — AI Email Marketing, AI Content Generator, SEO Analyzer, AI Workflow Automation, Social Media & Ai Chatbot plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'name' parameter in all versions up to, and including, 1.2.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires only that the chatbot module is active with at least one configured bot; the attacker stores the payload via three unauthenticated REST calls, and the JavaScript widget auto-poll then delivers it to any administrator who opens wp-admin/index.php.
Affected
up to 1.2.8
What to do
Affects up to 1.2.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 27, 2026All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos: Stored Cross-Site ScriptingCVE-2026-109974 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'more_link' parameter in all versions up to, and including, 4.9.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos
Affected
up to 4.9.7
What to do
Affects up to 4.9.7. Update All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 27, 2026All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos: Stored Cross-Site ScriptingCVE-2026-109209 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'custom_fields[embedcode]' parameter in all versions up to, and including, 4.9.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The sanitization bypass is possible because the save_meta_data() handler returns early when $_POST['post_type'] is absent — a condition always true during XML-RPC requests — and the plugin unconditionally grants Subscribers the publish_aiovg_videos capability, making this exploitable by any authenticated user via a single wp.newPost XML-RPC call.
Product
All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos
Affected
up to 4.9.7
What to do
Affects up to 4.9.7. Update All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 27, 2026AI Engine – The Chatbot, AI Framework & MCP for: Limited media file deletionCVE-2026-107745 · WordPress plugins & themes · reported by WordfenceMedium 4.2
The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to limited media file deletion due to insufficient file path validation in the upload_file function in all versions up to, and including, 3.8.4 This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary media files on the server. This requires the administrator to have enabled the Public API option, and exploitation depends on the hourly cleanup_files task running after the malicious upload.
Product
AI Engine – The Chatbot, AI Framework & MCP for
Affected
up to 3.8.4
What to do
Affects up to 3.8.4. Update AI Engine – The Chatbot, AI Framework & MCP for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 27, 2026Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership: Stored Cross-Site ScriptingCVE-2026-107625 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'user_url' parameter in all versions up to, and including, 2.14.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires a visitor to click the attacker's Website URL link on their public Ultimate Member profile, a condition that is trivially met since the redirect-confirmation onclick handler is enabled by default on all new installations.
Product
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership
Affected
up to 2.14.0
What to do
Affects up to 2.14.0. Update Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Oct 27, 2026Advanced Views – Display Framework for Gutenberg & Elementor: Stored Cross-Site ScriptingCVE-2026-109995 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Advanced Views – Display Framework for Gutenberg & Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 3.9.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability is exploitable even against pending or unapproved comments, as the plugin's get_comment() lookup applies no approval-status filter, meaning a payload executes for any visitor loading an avf-layout block bound to the attacker's comment ID before the comment is ever reviewed.
Product
Advanced Views – Display Framework for Gutenberg & Elementor
Affected
up to 3.9.6
What to do
Affects up to 3.9.6. Update Advanced Views – Display Framework for Gutenberg & Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 27, 2026Qode Membership: Authentication Bypass leading to Account TakeoverCVE-2026-92885 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Qode Membership plugin for WordPress is vulnerable to Authentication Bypass leading to Account Takeover in all versions up to, and including, 2.0.6.2 via the qode_membership_check_facebook_user AJAX action. This is due to a typographic error in the Facebook OAuth token verification guard within the qode_membership_login_user_from_social_network function — the guard condition tests an undefined variable ($check_social_useqoder instead of $check_social_user), causing empty() to always return true and rendering the Graph API token verification branch dead code, leaving wp_set_auth_cookie() reachable with no credential or token validation whatsoever. This makes it possible for unauthenticated attackers to log in as any existing WordPress account — including Administrator-level accounts — by supplying a known or enumerated administrator login name (rather than an email address) in the response[email] parameter, which the fallback path in get_user_by('login', $email) resolves to the matching account. Exploitation does require harvesting a valid qode_validate_facebook_login nonce, but this nonce is rendered on any public front-end page containing the [qode_user_login] or [qode_user_re
Product
Qode Membership
Affected
up to 2.0.6.2
What to do
Affects up to 2.0.6.2. Update Qode Membership to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Oct 27, 2026Jupiter X Core: Stored Cross-Site ScriptingCVE-2026-10511 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Jupiter X Core plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'forget_password_link' parameter in all versions up to, and including, 4.61.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Jupiter X Core
Affected
up to 4.61.0
What to do
Affects up to 4.61.0. Update Jupiter X Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 27, 2026PayDunya WooCommerce Payment Gateway: Does not verify the authenticity of incoming payment notifications andCVE-2026-103359 · WordPress plugins & themes · reported by WPScanMedium 5.3
The PayDunya WooCommerce Payment Gateway WordPress plugin through 1.1.6 does not verify the authenticity of incoming payment notifications and, until the gateway is configured, authenticates them with a value derived from an empty secret that anyone can compute, allowing unauthenticated attackers to mark arbitrary WooCommerce orders as paid and completed.
Product
PayDunya WooCommerce Payment Gateway
Affected
up to 1.1.6
What to do
Affects up to 1.1.6. Update PayDunya WooCommerce Payment Gateway to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Oct 27, 2026Analytics Insights – Google Analytics Dashboard for: Stored Cross-Site ScriptingCVE-2026-111820 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Analytics Insights – Google Analytics Dashboard for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Page Title in all versions up to, and including, 6.3.12 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Analytics Insights – Google Analytics Dashboard for
Affected
up to 6.3.12
What to do
Affects up to 6.3.12. Update Analytics Insights – Google Analytics Dashboard for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 27, 2026Payex Payment Gateway for Woocommerce: Does not properly verify the authenticity of incoming payment notificationsCVE-2026-103332 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Payex Payment Gateway for Woocommerce WordPress plugin through 1.2.10 does not properly verify the authenticity of incoming payment notifications, relying on a validation secret that is empty by default, allowing unauthenticated attackers to forge a valid payment confirmation and mark any order as paid.
Product
Payex Payment Gateway for Woocommerce
Affected
up to 1.2.10
What to do
Affects up to 1.2.10. Update Payex Payment Gateway for Woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Oct 27, 2026Payment Integration Wompi: Does not verify the authenticity of incoming payment notifications on a stock installCVE-2026-103312 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Payment Integration Wompi WordPress plugin through 4.0.1 does not verify the authenticity of incoming payment notifications on a stock install, because the callback's checksum is keyed on a merchant secret that is empty until it is manually configured, allowing an unauthenticated attacker to forge a notification and mark an arbitrary order as paid.
Product
Payment Integration Wompi
Affected
up to 4.0.1
What to do
Affects up to 4.0.1. Update Payment Integration Wompi to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Oct 26, 2026Gallery PhotoBlocks: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-116408 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Gallery PhotoBlocks photoblocks-grid-gallery allows Stored XSS.This issue affects Gallery PhotoBlocks: from n/a through 1.3.7.
Product
Gallery PhotoBlocks
Affected
up to 1.3.7
What to do
Affects up to 1.3.7. Update Gallery PhotoBlocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 26, 2026Button Block: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-116400 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Button Block button-block allows Stored XSS.This issue affects Button Block: from n/a through 1.2.7.
Product
Button Block
Affected
up to 1.2.7
What to do
Affects up to 1.2.7. Update Button Block to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 26, 2026Content Slider Block: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-116398 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Content Slider Block content-slider-block allows Stored XSS.This issue affects Content Slider Block: from n/a through 3.2.1.
Product
Content Slider Block
Affected
up to 3.2.1
What to do
Affects up to 3.2.1. Update Content Slider Block to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 26, 2026Typing Text – Give your texts many typing effects: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-115966 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Typing Text – Give your texts many typing effects text-typing allows Stored XSS.This issue affects Typing Text – Give your texts many typing effects: from n/a through 2.2.0.
Product
Typing Text – Give your texts many typing effects
Affected
up to 2.2.0
What to do
Affects up to 2.2.0. Update Typing Text – Give your texts many typing effects to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 26, 2026Customer Coupons for WooCommerce: Missing AuthorizationCVE-2026-112839 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in VillaTheme Customer Coupons for WooCommerce woo-customer-coupons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Customer Coupons for WooCommerce: from n/a through 1.3.14.
Product
Customer Coupons for WooCommerce
Affected
up to 1.3.14
What to do
Affects up to 1.3.14. Update Customer Coupons for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 26, 2026Photo Reviews for WooCommerce: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')CVE-2026-111404 · WordPress plugins & themes · reported by PatchstackLow 3.7
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in VillaTheme Photo Reviews for WooCommerce woo-photo-reviews allows Leveraging Race Conditions.This issue affects Photo Reviews for WooCommerce: from n/a through 1.2.31.
Product
Photo Reviews for WooCommerce
Affected
up to 1.2.31
What to do
Affects up to 1.2.31. Update Photo Reviews for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.