Updated 16 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

474new WordPress flaws this week

390,714entries in the database

62,227 results · page 4 of 1245

Oct 28, 2026Prime Slider – Hero Slider, Carousel, WooCommerce & Post Slider Elementor Addons: Stored Cross-Site ScriptingCVE-2026-111111 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Prime Slider – Hero Slider, Carousel, WooCommerce & Post Slider Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 4.7.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is possible because core wp_filter_kses leaves the submitted markup inert, but the plugin's subsequent regex fallback consumes closing quotes of allowed attribute values containing 'bdt-', promoting previously inert bytes — such as event handlers like onfocus — into real HTML attributes that are then written to the database and rendered without further sanitization.
Product
Prime Slider – Hero Slider, Carousel, WooCommerce & Post Slider Elementor Addons
Affected
up to 4.7.2
What to do
Affects up to 4.7.2. Update Prime Slider – Hero Slider, Carousel, WooCommerce & Post Slider Elementor Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 28, 2026DesignSetGo: Stored Cross-Site ScriptingCVE-2026-111068 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The DesignSetGo plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tagName' parameter in all versions up to, and including, 2.11.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires an administrator to run the plugin's block-conversion migration ("Scan & Convert Blocks" during deactivation), which triggers the vulnerable build_group_block() function and promotes the dormant payload from a block delimiter comment into live post_content HTML. Successful exploitation additionally requires an action by an administrator — the attacker cannot trigger the vulnerability on their own.
Product
DesignSetGo
Affected
up to 2.11.0
What to do
Affects up to 2.11.0. Update DesignSetGo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Oct 28, 2026MxChat – AI Chatbot & Content Generation for: Stored DOM-Based Cross-Site ScriptingCVE-2026-110662 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The MxChat – AI Chatbot & Content Generation for WordPress plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'feedback' parameter in all versions up to, and including, 3.2.25 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The stored payload is written by any unauthenticated visitor via a single POST to admin-ajax.php and detonates automatically when any administrator next loads the Transcripts page.
Product
MxChat – AI Chatbot & Content Generation for
Affected
up to 3.2.25
What to do
Affects up to 3.2.25. Update MxChat – AI Chatbot & Content Generation for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 28, 2026Mang Board: Stored Cross-Site ScriptingCVE-2026-110071 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Mang Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'align' parameter in all versions up to, and including, 2.4.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Because the payload contains no angle brackets, wp_kses_post leaves the shortcode intact on save, allowing the malicious attribute value to survive post submission and fire in any viewer's browser — including an administrator previewing a pending post.
Product
Mang Board
Affected
up to 2.4.5
What to do
Affects up to 2.4.5. Update Mang Board to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 28, 2026Product Addons for Woocommerce – Product Options with Custom Fields: Stored Cross-Site ScriptingCVE-2026-109988 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Product Addons for Woocommerce – Product Options with Custom Fields plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'fields[section][fields][row][col][type]' parameter in all versions up to, and including, 3.1.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with shop manager-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Product Addons for Woocommerce – Product Options with Custom Fields
Affected
up to 3.1.8
What to do
Affects up to 3.1.8. Update Product Addons for Woocommerce – Product Options with Custom Fields to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 28, 2026Cozy Blocks – Website Builder for WordPress Block Editor | Gutenberg Blocks, Patterns & Templates: Stored Cross-Site ScriptingCVE-2026-109978 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Cozy Blocks – Website Builder for WordPress Block Editor | Gutenberg Blocks, Patterns & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'productRating.iconColor' parameter in all versions up to, and including, 2.2.27 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerable code path is only reached when the productRating option is enabled and the associated WooCommerce product has a non-zero rating.
Product
Cozy Blocks – Website Builder for WordPress Block Editor | Gutenberg Blocks, Patterns & Templates
Affected
up to 2.2.27
What to do
Affects up to 2.2.27. Update Cozy Blocks – Website Builder for WordPress Block Editor | Gutenberg Blocks, Patterns & Templates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 28, 2026Cozy Blocks – Website Builder for WordPress Block Editor | Gutenberg Blocks, Patterns & Templates: Stored Cross-Site ScriptingCVE-2026-109975 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Cozy Blocks – Website Builder for WordPress Block Editor | Gutenberg Blocks, Patterns & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content (block attribute icon.view / icon.layout / icon.gap)' parameter in all versions up to, and including, 2.2.27 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Although wp_kses_post is applied on save, it does not neutralize a quote-only attribute-breakout payload containing no '<' character, leaving the block comment and its decoded JSON attributes intact and exploitable at render time.
Product
Cozy Blocks – Website Builder for WordPress Block Editor | Gutenberg Blocks, Patterns & Templates
Affected
up to 2.2.27
What to do
Affects up to 2.2.27. Update Cozy Blocks – Website Builder for WordPress Block Editor | Gutenberg Blocks, Patterns & Templates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 28, 2026s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions: Stored Cross-Site ScriptingCVE-2026-109972 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'date_format' parameter in all versions up to, and including, <= 261011 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload bypasses wp_kses_post() on save because it contains no literal angle brackets — only backslash-escaped sequences that PHP's date() materializes into HTML tag characters at render time after WordPress's shortcode_parse_atts() applies stripcslashes() to the attribute value.
Product
s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions
Affected
up to 261011
What to do
Affects up to 261011. Update s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 28, 2026Tour Booking Manager: Stored Cross-Site ScriptingCVE-2026-109590 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Tour Booking Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'width', 'height' and 'zoom' shortcode attributes of the [ttbm-hotel-map] shortcode in versions up to, and including, 2.3.6 This is due to insufficient input sanitization and output escaping on user supplied attributes in the ttbm_hotel_map_shortcode() function, which concatenates the raw attribute values into double-quoted HTML attributes of an <iframe> tag. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Tour Booking Manager
Affected
up to 2.3.6
What to do
Affects up to 2.3.6. Update Tour Booking Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Oct 28, 2026UiChemy – Convert Figma, Prompts and AI Builds to Elementor, Gutenberg and Bricks: Stored Cross-Site ScriptingCVE-2026-109385 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The UiChemy – Convert Figma, Prompts and AI Builds to Elementor, Gutenberg and Bricks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'actions[save_builder][data][elements][...][settings][slot_{N}_link][url]' parameter in all versions up to, and including, 5.3.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected javascript: payload fires on click rather than on page load, making exploitation contingent on a privileged user such as an Editor or Administrator clicking the attacker-crafted link while reviewing or previewing the Contributor's post.
Product
UiChemy – Convert Figma, Prompts and AI Builds to Elementor, Gutenberg and Bricks
Affected
up to 5.3.0
What to do
Affects up to 5.3.0. Update UiChemy – Convert Figma, Prompts and AI Builds to Elementor, Gutenberg and Bricks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 28, 2026Document Embedder – let visitors read files without downloading: Stored DOM-Based Cross-Site ScriptingCVE-2026-109370 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Document Embedder – let visitors read files without downloading plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'content (post_content containing block JSON documentSource.doc)' parameter in all versions up to, and including, 2.4.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload is triggered specifically when the victim clicks the embedded document's Download button, which causes the de_track_download AJAX fallback path to programmatically create an anchor with the attacker-controlled href and call .click() — a condition reached because supplying docId=0 causes can_read_document() to return false, bypassing the normal download flow.
Product
Document Embedder – let visitors read files without downloading
Affected
up to 2.4.0
What to do
Affects up to 2.4.0. Update Document Embedder – let visitors read files without downloading to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 28, 2026easy.jobs – AI powered Job Listing, Job Board, Career Page, Recruitment & Hiring Solution: Authenticated (Contributor+) Stored Cross-Site ScriptingCVE-2026-108366 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The easy.jobs – AI powered Job Listing, Job Board, Career Page, Recruitment & Hiring Solution plugin for WordPress is vulnerable to Authenticated (Contributor+) Stored Cross-Site Scripting via the 'icon' attribute of the easyjobs/job-list Gutenberg block in all versions up to, and including, 2.8.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
easy.jobs – AI powered Job Listing, Job Board, Career Page, Recruitment & Hiring Solution
Affected
up to 2.8.2
What to do
Affects up to 2.8.2. Update easy.jobs – AI powered Job Listing, Job Board, Career Page, Recruitment & Hiring Solution to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 28, 2026Hustle – Email Marketing, Lead Generation, Optins, Popups: Stored Cross-Site ScriptingCVE-2026-107710 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content[title]' parameter in all versions up to, and including, 7.8.14.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with custom-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that an administrator has explicitly granted the 'Create and Update Modules' (hustle_create / hustle_edit_module) capability to the attacker's role via the plugin's own Settings → Permissions feature; this delegation is not enabled by default.
Product
Hustle – Email Marketing, Lead Generation, Optins, Popups
Affected
up to 7.8.14.3
What to do
Affects up to 7.8.14.3. Update Hustle – Email Marketing, Lead Generation, Optins, Popups to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 28, 2026If-So Dynamic Content – Elementor & All Page Builders Personalization: Stored Cross-Site ScriptingCVE-2026-104740 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The If-So Dynamic Content – Elementor & All Page Builders Personalization plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'conversion' Shortcode Attribute in all versions up to, and including, 1.10.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
If-So Dynamic Content – Elementor & All Page Builders Personalization
Affected
up to 1.10.2
What to do
Affects up to 1.10.2. Update If-So Dynamic Content – Elementor & All Page Builders Personalization to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 28, 2026Avada (Fusion) Builder: Stored Cross-Site ScriptingCVE-2026-104729 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Avada (Fusion) Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tab_index, empty_notice' parameter in all versions up to, and including, 3.16.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. wp_kses_post does not strip the payload on save because the dangerous characters reside within shortcode attribute text between square brackets, which kses treats as plain text rather than HTML markup.
Product
Avada (Fusion) Builder
Affected
up to 3.16.2
What to do
Affects up to 3.16.2. Update Avada (Fusion) Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record avada.com wordfence.com
Oct 28, 2026If-So Dynamic Content – Elementor & All Page Builders Personalization: Stored Cross-Site ScriptingCVE-2026-103996 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The If-So Dynamic Content – Elementor & All Page Builders Personalization plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'url' parameter in all versions up to, and including, 1.10.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected script executes specifically in the administrator's browser session, as the vulnerable branch only renders when an administrator previews or opens the post containing the crafted shortcode.
Product
If-So Dynamic Content – Elementor & All Page Builders Personalization
Affected
up to 1.10.2
What to do
Affects up to 1.10.2. Update If-So Dynamic Content – Elementor & All Page Builders Personalization to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 28, 2026Awesome Support – WordPress HelpDesk & Support: Stored Cross-Site ScriptingCVE-2026-103370 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Awesome Support – WordPress HelpDesk & Support Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpas_files' parameter in all versions up to, and including, 6.4.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with custom-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability is only exploitable when the "Enable drag-n-drop uploader for ticket form" setting is enabled, as it is disabled by default.
Product
Awesome Support – WordPress HelpDesk & Support
Affected
up to 6.4.1
What to do
Affects up to 6.4.1. Update Awesome Support – WordPress HelpDesk & Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 28, 2026Postie: Stored Cross-Site ScriptingCVE-2026-100175 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Postie plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Email Body URL Autolink in all versions up to, and including, 1.9.87 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is possible because the ?postie=get-mail endpoint is reachable by unauthenticated users with no capability check, and the email processing path removes WordPress's kses output filters before saving raw markup, allowing the unescaped href attribute value to be stored as post content.
Product
Postie
Affected
up to 1.9.87
What to do
Affects up to 1.9.87. Update Postie to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 28, 2026WP Roster: Does not perform any capability or nonce checks on one of its AJAX actionsCVE-2026-115255 · WordPress plugins & themes · reported by WPScanMedium 5.3
The WP Roster WordPress plugin before 2.35 does not perform any capability or nonce checks on one of its AJAX actions, allowing unauthenticated attackers to delete the WordPress user accounts of roster members.
Product
WP Roster
Fixed in
2.35
What to do
Update WP Roster to 2.35 or newer.
Full record and what to do →NVD record wpscan.com
Oct 28, 2026Appointment Booking Calendar: Stored Cross-Site ScriptingCVE-2026-111727 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Appointment Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'vs_text_submitbtn' parameter in all versions up to, and including, 1.4.05 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the attacker to be assigned as a calendar owner, a per-user grant that any administrator can extend to users as low as Subscriber level through the plugin's calendar list screen. Exploitation by attackers with subscriber-level access and above requires that an administrator has assigned the attacker's account as owner (`conwer`) of a calendar via the plugin's calendar list screen; the plugin's UI lists all registered users regardless of role, so a Subscriber can be assigned. On a default installation, where that is not configured, the vulnerability requires attackers with editor-level access and above.
Product
Appointment Booking Calendar
Affected
up to 1.4.05
What to do
Affects up to 1.4.05. Update Appointment Booking Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 27, 2026AMP for WP – Accelerated Mobile Pages: Stored Cross-Site ScriptingCVE-2026-97019 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'headline-*' Shortcode Attribute in all versions up to, and including, 1.1.17 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. A Subscriber-level user can store a malicious shortcode in their biographical info field; because WordPress core's wp_filter_kses() only strips HTML tags and not shortcode syntax, and because AMP content sanitizers run before do_shortcode() processes the archive description, the synthesized markup is never post-sanitized.
Product
AMP for WP – Accelerated Mobile Pages
Affected
up to 1.1.17
What to do
Affects up to 1.1.17. Update AMP for WP – Accelerated Mobile Pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 27, 2026nopCommerce before 5.00.0 contains a missing authorization vulnerability in the admin ProductController RelatedProductAddPopup, CrossSellProductAddPopup and AssCVE-2026-117605 · Websites & servers · nopSolutions · reported by VulnCheckMedium 5.3
nopCommerce before 5.00.0 contains a missing authorization vulnerability in the admin ProductController RelatedProductAddPopup, CrossSellProductAddPopup and AssociatedProductAddPopup handlers that fail to verify parent product ownership. Authenticated vendors can submit another vendor's product id as model.ProductId to inject their products into the victim's related-products, cross-sell and grouped-product listings.
Product
nopCommerce
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Oct 27, 2026affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display: Stored Cross-Site ScriptingCVE-2026-111314 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'atkp_product_producturl' parameter in all versions up to, and including, 3.9.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation by unauthenticated attackers requires that the plugin's AJAX loading / AJAX handler option is enabled (atkp_options::get_ajax_loading_enabled() || get_ajax_handler_enabled()) and the attacker knows a product id to render. On a default installation, where that is not configured, the vulnerability requires attackers with contributor-level access and above.
Product
affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display
Affected
up to 3.9.2
What to do
Affects up to 3.9.2. Update affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 27, 2026All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos: Stored Cross-Site ScriptingCVE-2026-109974 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'more_link' parameter in all versions up to, and including, 4.9.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos
Affected
up to 4.9.7
What to do
Affects up to 4.9.7. Update All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 27, 2026All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos: Stored Cross-Site ScriptingCVE-2026-109209 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'custom_fields[embedcode]' parameter in all versions up to, and including, 4.9.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The sanitization bypass is possible because the save_meta_data() handler returns early when $_POST['post_type'] is absent — a condition always true during XML-RPC requests — and the plugin unconditionally grants Subscribers the publish_aiovg_videos capability, making this exploitable by any authenticated user via a single wp.newPost XML-RPC call.
Product
All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos
Affected
up to 4.9.7
What to do
Affects up to 4.9.7. Update All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 27, 2026Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership: Stored Cross-Site ScriptingCVE-2026-107625 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'user_url' parameter in all versions up to, and including, 2.14.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires a visitor to click the attacker's Website URL link on their public Ultimate Member profile, a condition that is trivially met since the redirect-confirmation onclick handler is enabled by default on all new installations.
Product
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership
Affected
up to 2.14.0
What to do
Affects up to 2.14.0. Update Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Oct 27, 2026CrushFTP before 7.3.0 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions because CSRF protection is disCVE-2015-20129 · Other software · CrushFTP · reported by VulnCheckHigh 8.6
CrushFTP before 7.3.0 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions because CSRF protection is disabled by default. Attackers can lure an authenticated administrator to a malicious page that submits POST requests to commands like setUserItem, creating root-access users or changing server configuration.
Product
CrushFTP
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record crushftp.com exploit-db.com
Oct 27, 2026Linksys WAG200G through 1.01.06 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject scripts via the policy_name pCVE-2013-20009 · Network & remote access · Linksys · reported by VulnCheckMedium 4.8
Linksys WAG200G through 1.01.06 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject scripts via the policy_name parameter in setup.cgi. Attackers can save a malicious policy name from the AccessRes.htm page that executes in administrators' browsers when viewing the Status > Wireless page.
Product
WAG200G
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exploit-db.com s3cur1ty.de
Oct 27, 2026Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.CVE-2026-62765 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
Product
Microsoft Edge (Chromium-based)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com
Oct 27, 2026Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.CVE-2026-85898 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
Product
Microsoft Edge (Chromium-based)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com
Oct 27, 2026Double free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.CVE-2026-83831 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Double free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
Product
Microsoft Edge (Chromium-based)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com
Oct 27, 2026NextChat version 2.16.1 contains a client‑side cross‑site scripting (XSS) vulnerability in the Plugin Editor due to unsafe rendering of externally supplied OpenCVE-2026-118132 · Other software · NextChat · reported by cret@cert.org
NextChat version 2.16.1 contains a client‑side cross‑site scripting (XSS) vulnerability in the Plugin Editor due to unsafe rendering of externally supplied OpenAPI plugin schema content. When a plugin schema is loaded from a remote URL, the returned content is stored in plugin.content and later rendered using React’s dangerouslySetInnerHTML without proper sanitization. An attacker can host a malicious OpenAPI schema containing HTML or JavaScript markup and trick a user into loading it through the Plugin Editor, resulting in arbitrary JavaScript execution in the NextChat origin. Successful exploitation allows access to JavaScript‑readable cookies and other client‑side data associated with the NextChat application.
Product
NextChat
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com
Oct 27, 2026Knative pkg provides common packages shared across Knative repositories.CVE-2026-54462 · Other software · knative · reported by GitHubMedium 6.5
Knative pkg provides common packages shared across Knative repositories. Prior to 0.0.0-20260531000007-52dbd5ece63f, the knative.dev/pkg/webhook admissionHandler in webhook/admission.go decodes an attacker-supplied AdmissionReview through json.NewDecoder(io.TeeReader(r.Body, &bodyBuffer)) under an http.HandlerFunc without an http.MaxBytesReader or equivalent body-size limit. A pod-network client can send one oversized POST to an admission webhook, causing the decoder and bodyBuffer to retain amplified copies of the request until the controller pod exhausts memory and is OOM-killed. Every downstream consumer using the shared webhook server inherits the vulnerable behavior, including Knative, Tekton, KEDA, Sigstore policy-controller, and Kpack. For consumers configured with failurePolicy=Fail, loss of the controller can interrupt admission; with failurePolicy=Ignore, the affected webhook is unavailable while other admissions continue. This issue is fixed in version 0.0.0-20260531000007-52dbd5ece63f.
Product
pkg
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Oct 27, 2026GFI KerioConnect (Kerio Connect) before 10.0.8 Patch 2 contains a stored cross-site scripting vulnerability in the Webmail component that allows a remote attackCVE-2026-112353 · Other software · GFI USA, LLC · reported by VulnCheckMedium 6.2
GFI KerioConnect (Kerio Connect) before 10.0.8 Patch 2 contains a stored cross-site scripting vulnerability in the Webmail component that allows a remote attacker to run JavaScript in a victim's authenticated Webmail session by uploading a crafted SVG email attachment that bypasses sanitization of event-handler attributes. Attackers can exploit the temporary-download endpoint's insufficient Content-Security-Policy sandbox to execute scripts when the attachment is opened, enabling theft of the victim's credentials and mailbox contents. Proofpoint Threat Research has observed exploitation in the wild as a credential and mailbox stealer.
Product
GFI KerioConnect
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gfi.ai vulncheck.com
Oct 27, 2026A vulnerability allowing an unauthenticated attacker to bypass REST API authentication with a forged federation token and receive responses from REST API endpoiCVE-2026-106078 · Other software · Veeam · reported by support@hackerone.comMedium 6.9
A vulnerability allowing an unauthenticated attacker to bypass REST API authentication with a forged federation token and receive responses from REST API endpoints that do not call the Veeam Backup for Microsoft 365 backup service.
Product
Backup for Microsoft 365
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record veeam.com
Oct 27, 2026A vulnerability allowing a user with the Veeam Backup for Microsoft 365 Administrator role to read arbitrary files on the backup server with LocalSystem privileCVE-2026-106077 · Other software · Veeam · reported by support@hackerone.comHigh 8.3
A vulnerability allowing a user with the Veeam Backup for Microsoft 365 Administrator role to read arbitrary files on the backup server with LocalSystem privileges.
Product
Backup for Microsoft 365
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record veeam.com
Oct 27, 2026A vulnerability allowing an authenticated organization-transfer peer to inject SQL into the configuration database of the source Veeam Backup for Microsoft 365 CVE-2026-106076 · Other software · Veeam · reported by support@hackerone.comCritical 9
A vulnerability allowing an authenticated organization-transfer peer to inject SQL into the configuration database of the source Veeam Backup for Microsoft 365 server, leading to cross-tenant read and write of configuration data and remote code execution as the PostgreSQL service account.
Product
Backup for Microsoft 365
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record veeam.com
Oct 27, 2026Adobe Campaign Classic (ACC) is affected by a reflected Cross-Site Scripting (XSS) vulnerability.CVE-2026-104350 · Other software · Adobe · reported by AdobeCritical 9.3
Adobe Campaign Classic (ACC) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this vulnerability to inject malicious scripts into a web page, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed.
Product
Adobe Campaign Classic
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record adobe.com
Oct 27, 2026A maliciously crafted HTML payload in a design name, when displayed after another user opens the manipulated design, can trigger a Stored Cross-site Scripting (CVE-2026-102636 · Other software · Autodesk · reported by psirt@autodesk.comHigh 7.1
A maliciously crafted HTML payload in a design name, when displayed after another user opens the manipulated design, can trigger a Stored Cross-site Scripting (XSS) vulnerability in the Autodesk Fusion desktop application. A malicious actor may leverage this vulnerability to read local files or execute arbitrary code in the context of the current process.
Product
Fusion
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record dl.appstreaming.autodesk.com dl.appstreaming.autodesk.com
Oct 27, 2026A vulnerability allowing a low-privileged local user to write arbitrary files with SYSTEM privileges during the installation of Veeam Backup for Microsoft 365, CVE-2025-64394 · Other software · Veeam · reported by support@hackerone.comMedium 4.3
A vulnerability allowing a low-privileged local user to write arbitrary files with SYSTEM privileges during the installation of Veeam Backup for Microsoft 365, which can lead to privilege escalation or denial of service.
Product
Backup for Microsoft 365
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record veeam.com
Oct 27, 2026Newsletters: Cross-Site Request Forgery (CSRF)CVE-2026-116863 · WordPress plugins & themes · reported by PatchstackCritical 9.6
Cross-Site Request Forgery (CSRF) vulnerability in Tribulant Software Newsletters newsletters-lite allows Cross Site Request Forgery.This issue affects Newsletters: from n/a through 4.18.2.
Product
Newsletters
Affected
up to 4.18.2
What to do
Affects up to 4.18.2. Update Newsletters to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 27, 2026Improper neutralization of input during web page generation ('Cross-site Scripting') in the notifications feature in Devolutions PowerShell Universal 2026.3.0 aCVE-2026-116627 · Other software · Devolutions · reported by security@devolutions.net
Improper neutralization of input during web page generation ('Cross-site Scripting') in the notifications feature in Devolutions PowerShell Universal 2026.3.0 and earlier allows an authenticated user with notification creation permission to execute arbitrary JavaScript in the browser of another user via a crafted notification target URL.
Product
PowerShell Universal
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record devolutions.net
Oct 27, 2026Advanced Views – Display Framework for Gutenberg & Elementor: Stored Cross-Site ScriptingCVE-2026-109995 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Advanced Views – Display Framework for Gutenberg & Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 3.9.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability is exploitable even against pending or unapproved comments, as the plugin's get_comment() lookup applies no approval-status filter, meaning a payload executes for any visitor loading an avf-layout block bound to the attacker's comment ID before the comment is ever reviewed.
Product
Advanced Views – Display Framework for Gutenberg & Elementor
Affected
up to 3.9.6
What to do
Affects up to 3.9.6. Update Advanced Views – Display Framework for Gutenberg & Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 27, 2026Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Kulga Software and Telecommunications Limited Company KulgCVE-2026-105323 · Other software · Kulga Software and Telecommunications Limited Company · reported by iletisim@usom.gov.trMedium 6.1
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Kulga Software and Telecommunications Limited Company Kulga News Software allows Reflected XSS. This issue affects Kulga News Software: from v26.7.4 before v26.10.0.
Product
Kulga News Software
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record siberguvenlik.gov.tr
Oct 27, 2026REDAXO before 5.21.0 contains a reflected cross-site scripting vulnerability in the backend packages API, where the function parameter is concatenated into an eCVE-2026-117538 · Other software · redaxo · reported by VulnCheckLow 2.1
REDAXO before 5.21.0 contains a reflected cross-site scripting vulnerability in the backend packages API, where the function parameter is concatenated into an error message rendered without HTML escaping. Attackers can lure an authenticated backend user to a crafted link containing a valid CSRF token, executing JavaScript that performs same-origin actions or reads DOM data.
Product
core
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com vulncheck.com
Oct 27, 2026REDAXO before 5.21.0 contains a reflected cross-site scripting vulnerability that allows authenticated attackers to inject scripts via the type parameter of theCVE-2026-117537 · Other software · redaxo · reported by VulnCheckLow 2.1
REDAXO before 5.21.0 contains a reflected cross-site scripting vulnerability that allows authenticated attackers to inject scripts via the type parameter of the metainfo_default_fields_create API. Attackers can craft a link with a valid CSRF token and HTML payload that rex_view::message() renders unescaped, executing scripts in a victim's backend session.
Product
core
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com vulncheck.com
Oct 27, 2026REDAXO before 5.21.3 contains a cross-site request forgery vulnerability in the backend user administration page (users/users) because the CSRF token check onlyCVE-2026-117536 · Other software · redaxo · reported by VulnCheckHigh 8.6
REDAXO before 5.21.3 contains a cross-site request forgery vulnerability in the backend user administration page (users/users) because the CSRF token check only runs when the save parameter is set, while the update path triggered by FUNC_UPDATE does not require it. Attackers can lure a logged-in backend user with the users[] permission to a crafted GET link to grant administrator rights, deactivate accounts, or lock out the sole administrator.
Product
core
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com vulncheck.com
Oct 27, 2026REDAXO before 5.21.3 contains a reflected cross-site scripting vulnerability in the backend media pool detail page, where the opener_link parameter is rendered CVE-2026-117535 · Other software · redaxo · reported by VulnCheckMedium 5.1
REDAXO before 5.21.3 contains a reflected cross-site scripting vulnerability in the backend media pool detail page, where the opener_link parameter is rendered without HTML escaping. Unauthenticated attackers can lure logged-in backend users with media permissions into clicking a crafted link. The injected script can then read the CSRF token and perform actions with the victim's permissions, including code execution via template or module edits when the victim is an administrator.
Product
core
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com vulncheck.com
Oct 27, 2026REDAXO before 5.21.3 contains a cross-site request forgery vulnerability in the structure/history plugin that allows attackers to delete history or roll back coCVE-2026-117534 · Other software · redaxo · reported by VulnCheckMedium 5.1
REDAXO before 5.21.3 contains a cross-site request forgery vulnerability in the structure/history plugin that allows attackers to delete history or roll back content via unvalidated GET requests. Attackers can lure logged-in backend users to a page triggering func=clearall or rex_history_function=snap, permanently deleting all article snapshots or reverting articles to earlier states.
Product
core
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com vulncheck.com
Oct 27, 2026REDAXO from 5.18.0 before 5.21.4 contains a stored cross-site scripting vulnerability because rex_media_service moves uploaded SVG files into the public media fCVE-2026-117533 · Other software · redaxo · reported by VulnCheckLow 2.1
REDAXO from 5.18.0 before 5.21.4 contains a stored cross-site scripting vulnerability because rex_media_service moves uploaded SVG files into the public media folder before sanitizing them. Authenticated users with mediapool upload rights can race the sanitizer or exhaust memory limits to leave script-laden SVGs publicly served, executing scripts in victims' backend sessions.
Product
core
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com vulncheck.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.