Updated 23 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

36added in the last 30 days

479new WordPress flaws this week

390,525entries in the database

928 results · page 4 of 19

Sep 23, 2026zportals: Does not perform any capability or nonce check on several of its AJAX actionsCVE-2026-18364 · WordPress plugins & themes · reported by WPScanMedium 4.3
The zportals WordPress plugin before 6.4.2 does not perform any capability or nonce check on several of its AJAX actions, allowing users with a subscriber-level account to modify the zportals WordPress plugin before 6.4.2's stored integration settings.
Product
zportals
Fixed in
6.4.2
What to do
Update zportals to 6.4.2 or newer.
Full record and what to do →NVD record wpscan.com
Sep 21, 2026KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge.CVE-2026-62369 · Other software · kubeedge · reported by GitHubHigh 8.1
KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. From 1.16.0 until 1.21.2, 1.22.2, and 1.23.1, the DecompressTarGz function in keadm/cmd/keadm/app/cmd/util/common.go joins archive entry names to the extraction destination without sufficient validation. During keadm join or installation on Windows edge nodes, an archive influenced through a compromised, replaced, or untrusted download source can contain parent-directory components, Windows-style backslashes, absolute paths, or drive-prefixed paths that escape the intended directory. The affected keadm process can consequently write or overwrite files with its own privileges, potentially modifying configuration, executable, or service files and enabling persistent system modification or code execution. This issue is fixed in versions 1.21.2, 1.22.2, and 1.23.1.
Product
kubeedge
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Sep 21, 2026KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge.CVE-2026-62182 · Other software · kubeedge · reported by GitHubHigh 8.8
KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. From 1.21.0 until 1.21.2, 1.22.2, and 1.23.1, ConfigUpdateJob processing in edge/pkg/taskmanager/actions/configupdatejob.go concatenates authenticated user-controlled updateFields values into the keadm config-update command and executes it through a system shell. A user with permission to create or modify ConfigUpdateJob resources can include shell metacharacters in the complete --set value and cause arbitrary commands to execute on an enrolled target edge node with the privileges of the KubeEdge process handling the job. This issue is fixed in versions 1.21.2, 1.22.2, and 1.23.1.
Product
kubeedge
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Sep 21, 2026KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge.CVE-2026-62371 · Other software · kubeedge · reported by GitHubHigh 8.8
KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. From 1.12.0 until 1.21.2, 1.22.2, and 1.23.1, the v1alpha2 NodeUpgradeJob handler in edge/pkg/taskmanager/actions/nodeupgradejob.go concatenates authenticated user-controlled spec.version and spec.image values into the keadm upgrade edge shell command. A user with permission to create or update NodeUpgradeJob resources can supply shell metacharacters in either field, causing arbitrary commands to execute on targeted edge nodes with the privileges of the upgrade process and compromising node confidentiality, integrity, and availability. This issue is fixed in versions 1.21.2, 1.22.2, and 1.23.1.
Product
kubeedge
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Sep 21, 2026KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge.CVE-2026-62370 · Other software · kubeedge · reported by GitHubMedium 6.5
KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. From 1.0.0 until 1.21.2, 1.22.2, and 1.23.1, Reader.Read in pkg/viaduct/pkg/packer trusts the 32-bit PackageHeader.PayloadLen received through the CloudHub viaduct message-processing path and allocates that amount of memory before validating an upper bound. An authenticated malicious or compromised edge peer can repeatedly send crafted headers with excessive declared lengths, causing memory exhaustion, CloudHub process termination or restart loops, and temporary disruption of cloud-edge communication. This issue does not provide unauthenticated access or direct code execution. This issue is fixed in versions 1.21.2, 1.22.2, and 1.23.1.
Product
kubeedge
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Sep 20, 2026Import and export users and customers: Does not enforce the promote_users capability in its front-end import functionalityCVE-2026-92541 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Import and export users and customers WordPress plugin before 2.5.2 does not enforce the promote_users capability in its front-end import functionality, allowing users with only the create_users capability to change the role of existing users, including promoting them to administrator.
Product
Import and export users and customers
Fixed in
2.5.2
What to do
Update Import and export users and customers to 2.5.2 or newer.
Full record and what to do →NVD record wpscan.com
Sep 20, 2026Import and export users and customers: Does not correctly enforce the promote_users capabilityCVE-2026-92540 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Import and export users and customers WordPress plugin before 2.5.2 does not correctly enforce the promote_users capability when assigning roles during a CSV import, allowing users with only the create_users capability to create new administrator accounts or promote existing users to administrator.
Product
Import and export users and customers
Fixed in
2.5.2
What to do
Update Import and export users and customers to 2.5.2 or newer.
Full record and what to do →NVD record wpscan.com
Sep 20, 2026Meow Gallery: Does not perform a proper capability check or restrict results to the requesting user's own posts before returning post dataCVE-2026-92423 · WordPress plugins & themes · reported by WPScanLow 2.7
The Meow Gallery WordPress plugin before 5.5.5 does not perform a proper capability check or restrict results to the requesting user's own posts before returning post data, allowing authenticated users with Author-level access and above to disclose the titles, authors, dates and statuses of other users' draft and private posts.
Product
Meow Gallery
Fixed in
5.5.5
What to do
Update Meow Gallery to 5.5.5 or newer.
Full record and what to do →NVD record wpscan.com
Sep 20, 2026Tripzzy: Does not perform any capability or ownership checks on its administrative booking-management actionsCVE-2026-87840 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Tripzzy WordPress plugin before 1.5.1 does not perform any capability or ownership checks on its administrative booking-management actions, which are additionally exposed to unauthenticated users and gated only by a token the Tripzzy WordPress plugin before 1.5.1 issues to any anonymous visitor on request, allowing unauthenticated attackers to alter the contents, stored totals and notes of arbitrary bookings.
Product
Tripzzy
Fixed in
1.5.1
What to do
Update Tripzzy to 1.5.1 or newer.
Full record and what to do →NVD record wpscan.com
Sep 20, 2026Unlimited Elements For Elementor: Does not perform a capability check on an AJAX action and deserializes attacker-controlled stored data through itCVE-2026-85017 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Unlimited Elements For Elementor WordPress plugin before 2.0.20 does not perform a capability check on an AJAX action and deserializes attacker-controlled stored data through it, which makes it possible for authenticated attackers with subscriber-level access to inject arbitrary PHP objects. A partial fix in the 2.0.18 to 2.0.19 releases raised the privilege required to reach the vulnerable action to editor-level, and the issue was fully resolved in 2.0.20.
Product
Unlimited Elements For Elementor
Fixed in
2.0.20
What to do
Update Unlimited Elements For Elementor to 2.0.20 or newer.
Full record and what to do →NVD record wpscan.com
Sep 20, 2026Photo Gallery, Sliders, Proofing and: Does not check that a user holds its options capability before saving image sizing settingsCVE-2026-81654 · WordPress plugins & themes · reported by WPScanLow 3.1
The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not check that a user holds its options capability before saving image sizing settings, allowing users granted only its gallery-management capability by an administrator to change settings that apply across the whole site.
Product
Photo Gallery, Sliders, Proofing and
Fixed in
4.5.0
What to do
Update Photo Gallery, Sliders, Proofing and to 4.5.0 or newer.
Full record and what to do →NVD record wpscan.com
Sep 19, 2026Mailchimp for WooCommerce: Does not verify that the requesting user holds the required capability in the permission callback for several of its REST API routesCVE-2026-92435 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Mailchimp for WooCommerce WordPress plugin before 6.1.1 does not verify that the requesting user holds the required capability in the permission callback for several of its REST API routes, allowing unauthenticated users to reach administrator-oriented endpoints and trigger a persistent state change.
Product
Mailchimp for WooCommerce
Fixed in
6.1.1
What to do
Update Mailchimp for WooCommerce to 6.1.1 or newer.
Full record and what to do →NVD record wpscan.com
Sep 18, 2026Bookit — Booking & Appointment Calendar: Does not perform a capability check in one of its appointment-deletion functionsCVE-2026-89007 · WordPress plugins & themes · reported by WPScanLow 2.7
The Bookit — Booking & Appointment Calendar WordPress plugin before 2.6.0.5 does not perform a capability check in one of its appointment-deletion functions, allowing users with its low-privileged custom Staff role to delete arbitrary appointments.
Product
Bookit — Booking & Appointment Calendar
Fixed in
2.6.0.5
What to do
Update Bookit — Booking & Appointment Calendar to 2.6.0.5 or newer.
Full record and what to do →NVD record wpscan.com
Sep 18, 2026King Addons for Elementor: Does not perform any capabilityCVE-2026-84903 · WordPress plugins & themes · reported by WPScanLow 2.7
The King Addons for Elementor WordPress plugin before 51.1.81 does not perform any capability, post-status, or password check before rendering the content of a user-supplied post, allowing users with Contributor-level access and above to read the content of private, draft, pending, and password-protected posts they are not authorized to access.
Product
King Addons for Elementor
Fixed in
51.1.81
What to do
Update King Addons for Elementor to 51.1.81 or newer.
Full record and what to do →NVD record wpscan.com
Sep 18, 2026All-in-One WP Migration and Backup: Does not perform any capability check on several of its AJAX actionsCVE-2026-81810 · WordPress plugins & themes · reported by WPScanHigh 7.2
The All-in-One WP Migration and Backup WordPress plugin before 7.111 does not perform any capability check on several of its AJAX actions, gating them only on an installation-wide secret which it discloses to any user permitted to export the site, allowing such a user to import an arbitrary site archive and gain administrator access. Exploitation requires an administrator to have granted the export capability to a role that does not hold the All-in-One WP Migration and Backup WordPress plugin before 7.111's own import capability, which is not a default configuration.
Product
All-in-One WP Migration and Backup
Fixed in
7.111
What to do
Update All-in-One WP Migration and Backup to 7.111 or newer.
Full record and what to do →NVD record wpscan.com
Sep 18, 2026MasterStudy LMS: Does not perform per-object ownership or capability checksCVE-2026-81340 · WordPress plugins & themes · reported by WPScanLow 3.8
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not perform per-object ownership or capability checks when updating orders through its REST API, allowing users with the Instructor role to modify any order on the site, granting free course enrolment, revoking other users' paid enrolments, and tampering with order notes.
Product
MasterStudy LMS
Fixed in
3.7.50
What to do
Update MasterStudy LMS to 3.7.50 or newer.
Full record and what to do →NVD record wpscan.com
Sep 17, 2026Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms: Does not check the user's capabilities in its message deletion AJAX actionCVE-2026-91010 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms WordPress plugin before 5.1.1 does not check the user's capabilities in its message deletion AJAX action, and only tests that a nonce parameter is present rather than validating it, allowing any authenticated user, such as a subscriber, to permanently delete every form submission the Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms WordPress plugin before 5.1.1 has stored.
Product
Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms
Fixed in
5.1.1
What to do
Update Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms to 5.1.1 or newer.
Full record and what to do →NVD record wpscan.com
Sep 16, 2026Appointment Hour Booking: Does not check every appointment in a booking submission against the capacity configured for its own slotCVE-2026-86475 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Appointment Hour Booking WordPress plugin before 1.5.95 does not check every appointment in a booking submission against the capacity configured for its own slot, allowing unauthenticated visitors to take slots that are already fully booked.
Product
Appointment Hour Booking
Fixed in
1.5.95
What to do
Update Appointment Hour Booking to 1.5.95 or newer.
Full record and what to do →NVD record wpscan.com
Sep 16, 2026WPBot: Does not perform a capability check on the AJAX action that saves its Claude AI provider settingsCVE-2026-87959 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WPBot WordPress plugin before 8.7.6 does not perform a capability check on the AJAX action that saves its Claude AI provider settings, allowing users with subscriber-level access to overwrite those settings, including the API key used for the WPBot WordPress plugin before 8.7.6's outgoing AI requests.
Product
WPBot
Fixed in
8.7.6
What to do
Update WPBot to 8.7.6 or newer.
Full record and what to do →NVD record wpscan.com
Sep 16, 2026Seraphinite Accelerator: Does not perform a capability check on one of its state-update AJAX actionsCVE-2026-87828 · WordPress plugins & themes · reported by WPScanMedium 5.7
The Seraphinite Accelerator WordPress plugin before 2.29.24 does not perform a capability check on one of its state-update AJAX actions, allowing authenticated users such as subscribers to write a malformed value that causes an uncaught error on every subsequent admin page load, making the entire admin area inaccessible to all administrators (denial of service).
Product
Seraphinite Accelerator
Fixed in
2.29.24
What to do
Update Seraphinite Accelerator to 2.29.24 or newer.
Full record and what to do →NVD record wpscan.com
Sep 16, 2026LearnPress: Does not check the user's capabilities before applying a user supplied post status filter in one of its REST routesCVE-2026-86449 · WordPress plugins & themes · reported by WPScanMedium 5.3
The LearnPress WordPress plugin before 4.4.7 does not check the user's capabilities before applying a user supplied post status filter in one of its REST routes, allowing unauthenticated attackers to list courses that are not published, including draft, pending, private, scheduled and trashed ones.
Product
LearnPress
Fixed in
4.4.7
What to do
Update LearnPress to 4.4.7 or newer.
Full record and what to do →NVD record wpscan.com
Sep 16, 2026LearnPress: Does not check the user's capabilities in one of its administrative course toolsCVE-2026-86447 · WordPress plugins & themes · reported by WPScanMedium 5.3
The LearnPress WordPress plugin before 4.4.7 does not check the user's capabilities in one of its administrative course tools, allowing unauthenticated attackers to list every enrolled student's display name and user identifier against the course they are enrolled on, and to recover their email addresses through the same handler's search filter.
Product
LearnPress
Fixed in
4.4.7
What to do
Update LearnPress to 4.4.7 or newer.
Full record and what to do →NVD record wpscan.com
Sep 16, 2026LearnPress: Does not check the user's capabilities in one of its administrative template handlersCVE-2026-86445 · WordPress plugins & themes · reported by WPScanMedium 5.3
The LearnPress WordPress plugin before 4.4.7 does not check the user's capabilities in one of its administrative template handlers, allowing unauthenticated attackers to retrieve the text, identifier and type of every published quiz question on the site, along with a keyword search over them, which is content the LearnPress WordPress plugin before 4.4.7 otherwise keeps non-public.
Product
LearnPress
Fixed in
4.4.7
What to do
Update LearnPress to 4.4.7 or newer.
Full record and what to do →NVD record wpscan.com
Sep 16, 2026WPLP Cookie Consent: Does not perform CSRF or capability checksCVE-2026-85131 · WordPress plugins & themes · reported by WPScanMedium 6.5
The WPLP Cookie Consent WordPress plugin before 4.4.4 does not perform CSRF or capability checks when processing bulk actions on its administration screens, and does not restrict the targeted items to its own records, allowing attackers to make a logged in admin permanently delete arbitrary posts and pages via a crafted request.
Product
WPLP Cookie Consent
Fixed in
4.4.4
What to do
Update WPLP Cookie Consent to 4.4.4 or newer.
Full record and what to do →NVD record wpscan.com
Sep 16, 2026Eventin: Does not verify a user's capability to create accountsCVE-2026-84905 · WordPress plugins & themes · reported by WPScanLow 2.7
The Eventin WordPress plugin before 4.1.24 does not verify a user's capability to create accounts when adding a speaker, allowing users with contributor-level access and above to create new WordPress user accounts that carry capabilities beyond their own, including publishing content and uploading files, and, by supplying an email address they control, to obtain a working login to the created account.
Product
Eventin
Fixed in
4.1.24
What to do
Update Eventin to 4.1.24 or newer.
Full record and what to do →NVD record wpscan.com
Sep 15, 2026mcp-searxng is a Model Context Protocol server that gives AI assistants web search and URL-reading capabilities through SearXNG.CVE-2026-58485 · Other software · ihor-sokoliuk · reported by GitHubHigh 7.1
mcp-searxng is a Model Context Protocol server that gives AI assistants web search and URL-reading capabilities through SearXNG. Prior to 1.7.1, web_url_read receives its caller-controlled URL through src/index.ts and validates only the literal hostname in assertUrlAllowed() within src/url-reader.ts before undiciFetch() performs operating-system DNS resolution. A public-looking attacker-controlled hostname that resolves to a private, loopback, link-local, or cloud-metadata address therefore passes the lexical check and causes the MCP server to connect to the internal destination. In the default HTTP configuration, an unauthenticated network client can use this path to read internal services, expose credentials or service tokens, and enumerate reachable internal hosts; in STDIO deployments, prompt-influenced tool selection can provide the malicious URL. Direct private IP literals are blocked, and MCP_HTTP_ALLOW_PRIVATE_URLS remains an explicit opt-out. This issue is fixed in version 1.7.1.
Product
mcp-searxng
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Sep 15, 2026mcp-searxng is a Model Context Protocol server that gives AI assistants web search and URL-reading capabilities through SearXNG.CVE-2026-58483 · Other software · ihor-sokoliuk · reported by GitHubHigh 7.5
mcp-searxng is a Model Context Protocol server that gives AI assistants web search and URL-reading capabilities through SearXNG. Prior to 1.7.1, web_url_read in src/index.ts passes a caller-supplied URL to readUrlContent() in src/url-reader.ts, where checkContentLength() treats a missing Content-Length header as an inconclusive preflight and the normal and error paths then consume the complete body with response.text(). A server that omits Content-Length can therefore bypass URL_READ_MAX_CONTENT_LENGTH_BYTES and force unbounded memory use. The resulting string is also processed by NodeHtmlMarkdown.translate(), increasing CPU consumption and allowing an unauthenticated HTTP client to cause denial of service. This issue is fixed in version 1.7.1.
Product
mcp-searxng
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Sep 15, 2026mcp-searxng is a Model Context Protocol server that gives AI assistants web search and URL-reading capabilities through SearXNG.CVE-2026-54689 · Other software · ihor-sokoliuk · reported by GitHubMedium 6.3
mcp-searxng is a Model Context Protocol server that gives AI assistants web search and URL-reading capabilities through SearXNG. Prior to 1.2.0, the web_url_read URL policy in src/url-reader.ts can be bypassed while MCP_HTTP_HARDEN is enabled and MCP_HTTP_ALLOW_PRIVATE_URLS is not enabled because redirect targets are not revalidated, 0.0.0.0 is not classified as an internal address, and IPv4-mapped IPv6 literals canonicalized to hexadecimal form are not recognized. These inputs allow an attacker-influenced tool call to make the MCP server fetch loopback or internal HTTP resources and return content from local services, private APIs, service-mesh endpoints, or cloud metadata endpoints. The separate hostname-to-private-address case addressed by the earlier partial fix is not part of these residual bypasses. This issue is fixed in version 1.2.0.
Product
mcp-searxng
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Sep 15, 2026mcp-searxng is a Model Context Protocol server that gives AI assistants web search and URL-reading capabilities through SearXNG.CVE-2026-54688 · Other software · ihor-sokoliuk · reported by GitHubMedium 6.5
mcp-searxng is a Model Context Protocol server that gives AI assistants web search and URL-reading capabilities through SearXNG. Prior to 1.2.0, web_url_read passes a caller-supplied URL to the server-side fetch path while assertUrlAllowed() in src/url-reader.ts runs only when MCP_HTTP_HARDEN is enabled, even though MCP_HTTP_HARDEN is disabled by default in src/http-security.ts. In the default configuration, an attacker who influences the URL selected by a user or AI agent can make the server fetch loopback, private-network, or cloud metadata endpoint resources and return their contents into the model context. file:// URLs remain rejected, and the separate DNS-resolution and redirect-validation bypasses are outside this record. This issue is fixed in version 1.2.0.
Product
mcp-searxng
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Sep 15, 2026FreeRDP versions before 3.31.0 contain an integer overflow in WinPR's Stream_EnsureRemainingCapacity function that allows remote attackers to cause denial of seCVE-2026-91960 · Other software · FreeRDP · reported by VulnCheckHigh 7.1
FreeRDP versions before 3.31.0 contain an integer overflow in WinPR's Stream_EnsureRemainingCapacity function that allows remote attackers to cause denial of service. A malicious RD Gateway peer can send a WebSocket Ping frame with a crafted 64-bit extended payload length to trigger integer wraparound, resulting in a double free that crashes the FreeRDP client during connection.
Product
FreeRDP
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com vulncheck.com
Sep 13, 2026User Registration & Membership: Does not check the capability of the user making a membership purchaseCVE-2026-86406 · WordPress plugins & themes · reported by WPScanHigh 7.5
The User Registration & Membership WordPress plugin before 5.2.8 does not check the capability of the user making a membership purchase, and does not validate the payment method or the plan submitted with it, allowing any authenticated user such as a subscriber to be granted the WordPress role attached to a paid plan without paying for it. Where the site owner has mapped a plan to a privileged role, this leads to privilege escalation up to administrator.
Product
User Registration & Membership
Fixed in
5.2.8
What to do
Update User Registration & Membership to 5.2.8 or newer.
Full record and what to do →NVD record wpscan.com
Sep 13, 2026Contact Form to Chat Apps | Click to Chat to Order: Does not perform any capabilityCVE-2026-77773 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Contact Form to Chat Apps | Click to Chat to Order WordPress plugin before 2.15.8 does not perform any capability, nonce or session check on one of its public AJAX actions, allowing unauthenticated users to read the submitted entries of any form created with a supported third-party form Contact Form to Chat Apps | Click to Chat to Order WordPress plugin before 2.15.8.
Product
Contact Form to Chat Apps | Click to Chat to Order
Fixed in
2.15.8
What to do
Update Contact Form to Chat Apps | Click to Chat to Order to 2.15.8 or newer.
Full record and what to do →NVD record wpscan.com
Sep 12, 2026snappy-java through 1.1.10.8 contains an out-of-bounds write vulnerability in Snappy.uncompress(ByteBuffer, ByteBuffer) because destination buffer capacity is nCVE-2026-90559 · Other software · xerial · reported by VulnCheckHigh 8.7
snappy-java through 1.1.10.8 contains an out-of-bounds write vulnerability in Snappy.uncompress(ByteBuffer, ByteBuffer) because destination buffer capacity is never validated against decompressed size. Attackers can supply valid compressed data that decompresses larger than the destination buffer, causing writes past buffer boundaries and JVM termination.
Product
snappy-java
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Sep 12, 2026WPBot: Does not perform any capability or nonce check on the AJAX action that lists stored chat sessionsCVE-2026-87916 · WordPress plugins & themes · reported by WPScanMedium 5.3
The WPBot WordPress plugin before 8.6.0 does not perform any capability or nonce check on the AJAX action that lists stored chat sessions, allowing unauthenticated attackers to retrieve the name, email address and phone number of every chat visitor by requesting a wide date range.
Product
WPBot
Fixed in
8.6.0
What to do
Update WPBot to 8.6.0 or newer.
Full record and what to do →NVD record wpscan.com
Sep 12, 2026Rox Appointment Booking: Does not perform any capability or authorization checkCVE-2026-87891 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Rox Appointment Booking WordPress plugin before 1.2.0 does not perform any capability or authorization check when saving its holiday schedule, allowing unauthenticated attackers to overwrite the dates the booking system treats as unavailable, which can block legitimate bookings or open dates the site owner intended to keep closed.
Product
Rox Appointment Booking
Fixed in
1.2.0
What to do
Update Rox Appointment Booking to 1.2.0 or newer.
Full record and what to do →NVD record wpscan.com
Sep 12, 2026Zonify: Does not perform any capability or authentication check before returning the site's stored account login tokenCVE-2026-87842 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Zonify WordPress plugin before 1.0.5 does not perform any capability or authentication check before returning the site's stored account login token, allowing unauthenticated attackers to retrieve it and authenticate to the site owner's linked service account.
Product
Zonify
Fixed in
1.0.5
What to do
Update Zonify to 1.0.5 or newer.
Full record and what to do →NVD record wpscan.com
Sep 12, 2026Sprout Invoices: Does not perform a capability or ownership check before allowing a private note to be overwritten through one of its AJAX actionsCVE-2026-87797 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Sprout Invoices WordPress plugin before 20.8.16 does not perform a capability or ownership check before allowing a private note to be overwritten through one of its AJAX actions, allowing any authenticated user such as a subscriber to overwrite private notes on records belonging to other users.
Product
Sprout Invoices
Fixed in
20.8.16
What to do
Update Sprout Invoices to 20.8.16 or newer.
Full record and what to do →NVD record wpscan.com
Sep 12, 2026Add User Autocomplete: Does not perform any capability or nonce check before creating a pending site-membership invitation carrying a caller-supplied roleCVE-2026-87759 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Add User Autocomplete WordPress plugin before 1.2 does not perform any capability or nonce check before creating a pending site-membership invitation carrying a caller-supplied role, allowing any authenticated user, such as a subscriber, to grant themselves the administrator role on a multisite installation.
Product
Add User Autocomplete
Fixed in
1.2
What to do
Update Add User Autocomplete to 1.2 or newer.
Full record and what to do →NVD record wpscan.com
Sep 12, 2026WP Component: Does not have any capability or nonce checks on one of the actions it makes available to unauthenticated usersCVE-2026-85681 · WordPress plugins & themes · reported by WPScanCritical 9.8
The WP Component WordPress plugin through 2.2.4 does not have any capability or nonce checks on one of the actions it makes available to unauthenticated users, and it takes both the option name and the option value from the request, allowing unauthenticated attackers to overwrite any of the site's options. On a single site installation this leads to a full takeover, as registration can be enabled with a default role of administrator.
Product
WP Component
Affected
up to 2.2.4
What to do
Affects up to 2.2.4. Update WP Component to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Sep 12, 2026BEAR: Does not verify a CSRF nonce or check user capabilities before updating taxonomy termsCVE-2026-84023 · WordPress plugins & themes · reported by WPScanMedium 6.5
The BEAR WordPress plugin before 1.2.2 does not verify a CSRF nonce or check user capabilities before updating taxonomy terms, allowing an attacker to modify arbitrary terms by tricking a logged-in privileged user into visiting a crafted page.
Product
BEAR
Fixed in
1.2.2
What to do
Update BEAR to 1.2.2 or newer.
Full record and what to do →NVD record wpscan.com
Sep 12, 2026DS Ad Rotator: Does not perform any capability checkCVE-2026-81402 · WordPress plugins & themes · reported by WPScanCritical 9.8
The DS Ad Rotator WordPress plugin through 0.8 does not perform any capability check, nonce verification, or file-type validation on its image upload handler, allowing unauthenticated attackers to upload arbitrary files, including PHP, to a web-accessible directory, which can lead to remote code execution.
Product
DS Ad Rotator
Affected
up to 0.8
What to do
Affects up to 0.8. Update DS Ad Rotator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Sep 11, 2026A deployment mode intended to expose only read access to a bundled packet-analysis component's interface denies a list of write-capable routes by pattern, but tCVE-2026-90454 · Other software · CISA · reported by ics-cert@hq.dhs.govMedium 5.3
A deployment mode intended to expose only read access to a bundled packet-analysis component's interface denies a list of write-capable routes by pattern, but the pattern omits routes that modify tags attached to stored session records, and the proxy configuration otherwise permits the request method those routes use. This allows an authenticated user on a deployment intended to be read-only to add or remove tags on stored session records.
Product
Malcolm
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record raw.githubusercontent.com cisa.gov
Sep 11, 2026In the Linux kernel, the following vulnerability has been resolved: ceph: bound MDSCapAuth path and fs_name decode in handle_session() handle_session() decodeCVE-2026-89651 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Critical 9.8
In the Linux kernel, the following vulnerability has been resolved: ceph: bound MDSCapAuth path and fs_name decode in handle_session() handle_session() decodes the MDSCapAuth records carried by a CEPH_SESSION_OPEN message (msg_version >= 6). For each record the match.path and match.fs_name byte strings are read by first decoding a 32-bit length and then copying that many bytes with the bare ceph_decode_copy(). Unlike the surrounding fields, which all use the _safe decode variants, these two copies are not preceded by a ceph_decode_need() bounds check, and the enclosing MDSCapAuth and MDSCapMatch struct_len fields are skipped rather than enforced as an upper bound. A length larger than the bytes remaining in the message front makes ceph_decode_copy() read past the end of the front buffer. The message front is a dedicated allocation (ceph_msg_new2() -> kvmalloc), so the over-read runs off that object. A malicious or compromised MDS can trigger this with the first post-connect message on mount, with no client-side user interaction; under KASAN it is reported as a slab-out-of-bounds read in handle_session(). Impact: a malicious MDS can force the kernel client to read up to 4 GiB pa
Product
Linux
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record git.kernel.org git.kernel.org
Sep 11, 2026In the Linux kernel, the following vulnerability has been resolved: ACPI: pfr_update: fix stack buffer overflow in query_capability() query_capability() copieCVE-2026-89587 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 7.8
In the Linux kernel, the following vulnerability has been resolved: ACPI: pfr_update: fix stack buffer overflow in query_capability() query_capability() copies four ACPI buffer objects returned by the firmware _DSM into fixed-size u8[16] fields in struct pfru_update_cap_info using memcpy with the firmware-supplied length: memcpy(&cap_hdr->code_type, elements[CAP_CODE_TYPE_IDX].buffer.pointer, elements[CAP_CODE_TYPE_IDX].buffer.length); The same pattern repeats for drv_type, platform_id, and oem_id. If the firmware returns buffer.length > 16 for any of these fields, memcpy writes past the destination array. struct pfru_update_cap_info is stack-allocated in pfru_ioctl(). Confirmed with KASAN on 7.2-rc6: three stack-out-of-bounds reports are generated when a DSM returns 64-byte buffers, with writes reaching 44 bytes past the end of cap_hdr's [64, 156) frame window into adjacent stack redzones. Introduce a helper pointer to out_obj->package.elements and use it to validate each buffer length against its destination field size before copying, returning -EINVAL if the firmware supplies an oversized buffer.
Product
Linux
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record git.kernel.org git.kernel.org
Sep 11, 2026SSL Zen — SSL Certificate Installer & HTTPS Redirects: Does not perform capability or nonce checks on a certificate-file download routine that runs early in the WordPress admin request lifecycleCVE-2026-86781 · WordPress plugins & themes · reported by WPScanMedium 5.3
The SSL Zen — SSL Certificate Installer & HTTPS Redirects WordPress plugin before 4.7.40 does not perform capability or nonce checks on a certificate-file download routine that runs early in the WordPress admin request lifecycle, allowing any authenticated user, including Subscribers, to download the site's TLS private key, certificates, and diagnostic logs.
Product
SSL Zen — SSL Certificate Installer & HTTPS Redirects
Fixed in
4.7.40
What to do
Update SSL Zen — SSL Certificate Installer & HTTPS Redirects to 4.7.40 or newer.
Full record and what to do →NVD record wpscan.com
Sep 11, 2026MultiVendorX: Does not restrict who can update its role and capability settingsCVE-2026-74925 · WordPress plugins & themes · reported by WPScanHigh 7.2
The MultiVendorX WordPress plugin before 5.0.16 does not restrict who can update its role and capability settings, allowing users holding its vendor role to grant that role administrator-level capabilities and take over the site.
Product
MultiVendorX
Fixed in
5.0.16
What to do
Update MultiVendorX to 5.0.16 or newer.
Full record and what to do →NVD record wpscan.com
Sep 11, 2026advanced-customized-prompts: Does not perform any capabilityCVE-2026-14566 · WordPress plugins & themes · reported by WPScanMedium 4.3
The advanced-customized-prompts WordPress plugin through 1.0.1 does not perform any capability, ownership, or nonce check before updating WooCommerce order item metadata for a supplied order, allowing any authenticated user such as a subscriber to tamper with the custom metadata of orders belonging to other customers.
Product
advanced-customized-prompts
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update advanced-customized-prompts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Sep 11, 2026advanced-customized-prompts: Does not perform any capabilityCVE-2026-14565 · WordPress plugins & themes · reported by WPScanMedium 5.4
The advanced-customized-prompts WordPress plugin through 1.0.1 does not perform any capability, ownership, or nonce check before saving popup configuration to a product, nor escape the stored values on output, allowing any authenticated user such as a subscriber to store JavaScript that executes in the browser of visitors viewing the affected product.
Product
advanced-customized-prompts
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update advanced-customized-prompts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Sep 10, 2026t-digest versions 3.1 through 3.3 contain a denial of service vulnerability in MergingDigest.fromBytes that fails to validate length and capacity fields from seCVE-2026-87962 · Other software · tdunning · reported by VulnCheckHigh 8.7
t-digest versions 3.1 through 3.3 contain a denial of service vulnerability in MergingDigest.fromBytes that fails to validate length and capacity fields from serialized data. Attackers can supply crafted serialized digests with mismatched header fields to trigger ArrayIndexOutOfBoundsException or NegativeArraySizeException, aborting the parsing thread.
Product
t-digest
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Sep 10, 2026Notiqoo: Does not have capability checks on several of its AJAX actions and builds the name of the option to write from user inputCVE-2026-19840 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Notiqoo WordPress plugin before 1.4.14 does not have capability checks on several of its AJAX actions and builds the name of the option to write from user input, allowing users with a role as low as contributor to modify arbitrary WordPress options, which can be used to deactivate Notiqoo WordPress plugin before 1.4.14 and to lock every administrator out of the site.
Product
Notiqoo
Fixed in
1.4.14
What to do
Update Notiqoo to 1.4.14 or newer.
Full record and what to do →NVD record wpscan.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.