Updated 3 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,756exploited flaws on CISA’s list

35added in the last 30 days

310new WordPress flaws this week

13,989entries in the database

11,480 results · page 41 of 230

Sep 25, 2026Modula Image Gallery – Photo Grid & Video Gallery: Unauthorized disclosure of private gallery contentsCVE-2026-89406 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Modula Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to unauthorized disclosure of private gallery contents in versions up to, and including, 3.0.1. This is due to the Modula_Meta::add_metas() function being hooked to wp_head on every frontend request and looking up any post via get_post( $_GET['modula_gallery_id'] ) without verifying the gallery's post_status or the requester's capability to read it — the gallery-side input guard is bugged (empty('modula_gallery_id') tests a nonempty string literal instead of the GET parameter, so it is always false), the only object validation is a post_type === 'modula-gallery' check, and no is_user_logged_in()/current_user_can('read_post', $gallery_id) check is performed. This makes it possible for unauthenticated attackers to enumerate private modula-gallery posts and their member attachments and recover the image's title, description, dimensions, and original upload URL via Open Graph/Twitter meta tags emitted in the response, which then allows direct unauthenticated download of the original private image bytes.
Product
Modula Image Gallery – Photo Grid & Video Gallery
Affected
up to 3.0.1
What to do
Affects up to 3.0.1. Update Modula Image Gallery – Photo Grid & Video Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 25, 2026WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More: Reflected Cross-Site ScriptingCVE-2026-88996 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'page_title' POST Parameter via {page_title} Smart Tag in all versions up to, and including, 2.0.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. This is only exploitable on forms whose admin-authored confirmation message places the {page_title} Smart Tag inside an HTML attribute context.
Product
WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More
Affected
up to 2.0.2
What to do
Affects up to 2.0.2. Update WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 25, 2026Fancy Product Designer: Stored Cross-Site ScriptingCVE-2026-84280 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Fancy Product Designer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Order 'elements[].title' Parameter in all versions up to, and including, 6.5.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload is written to the DOM via innerHTML within the beforeElementAdd JavaScript event handler when processing the elements[].title field from the stored order JSON, meaning execution occurs specifically when an administrator reviews shortcode orders in the WordPress admin panel.
Product
Fancy Product Designer
Affected
up to 6.5.2
What to do
Affects up to 6.5.2. Update Fancy Product Designer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record fancyproductdesigner.com wordfence.com
Sep 25, 2026s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions: Remote Code ExecutionCVE-2026-19804 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 260814 via the 'first_name' parameter parameter. This is due to insufficient sanitization of the first_name parameter via esc_refs(), which strips only regex backreferences and not PHP tags, before substitution into the eval'd Signup Tracking Codes template, combined with disclosure of the site-global proxy verification key that allows PayPal postback verification to be bypassed. This makes it possible for unauthenticated attackers to execute code on the server. Successful exploitation requires that the site administrator has configured a Signup Tracking Codes template containing the %%first_name%% placeholder (a documented, GUI-supported feature) and that the attacker has obtained the site-global proxy verification key, which is exposed in plaintext in the JSON response of any PayPal Checkout AJAX request on the target site.
Product
s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions
Affected
up to 260814
What to do
Affects up to 260814. Update s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 25, 2026SSL Zen — SSL Certificate Installer & HTTPS Redirects: Directory TraversalCVE-2026-17602 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The SSL Zen — SSL Certificate Installer & HTTPS Redirects plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.7.42 via the 'file_name' parameter parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.
Product
SSL Zen — SSL Certificate Installer & HTTPS Redirects
Affected
up to 4.7.42
What to do
Affects up to 4.7.42. Update SSL Zen — SSL Certificate Installer & HTTPS Redirects to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 25, 2026SSL Zen: Reflected Cross-Site ScriptingCVE-2026-17577 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The SSL Zen plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'uri' (and 'host') parameters in versions up to, and including, 4.7.42. The ssl_zen_messages::getMessages() function builds the 'token_missmatch' message using base64_decode(sanitize_text_field($_REQUEST['uri'])) and (optionally) base64_decode(sanitize_text_field($_REQUEST['host'])). sanitize_text_field() cannot strip HTML/JavaScript that is hidden inside a base64-encoded blob, and the resulting decoded raw HTML is echoed unescaped by showMessage() . This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a specially crafted link.
Product
SSL Zen
Affected
up to 4.7.42
What to do
Affects up to 4.7.42. Update SSL Zen to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 25, 2026WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters: Local File InclusionCVE-2026-13456 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.9.8 via the 'page' parameter parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.
Product
WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters
Affected
up to 4.9.8
What to do
Affects up to 4.9.8. Update WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 25, 2026WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters: Stored Cross-Site ScriptingCVE-2026-13179 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shapes_values Parameter in all versions up to, and including, 4.9.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The fc-call-nonce nonce required by the endpoint is exposed to all frontend visitors who view a map page via window.wpgmp_local.nonce, enabling any authenticated subscriber to read the nonce and craft a valid request; additionally, the secondary _wpnonce check in the drawing handler can be bypassed by simply omitting the _wpnonce parameter from the request.
Product
WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters
Affected
up to 4.9.8
What to do
Affects up to 4.9.8. Update WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 25, 2026Asset CleanUp: Page Speed Booster: Server-Side Request ForgeryCVE-2026-12037 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The Asset CleanUp: Page Speed Booster plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.4.0.5 via the 'page_url' parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. This vulnerability is only reachable when the plugin's dom_get_type setting has been configured to 'wp_remote_post' by an administrator.
Product
Asset CleanUp: Page Speed Booster
Affected
up to 1.4.0.5
What to do
Affects up to 1.4.0.5. Update Asset CleanUp: Page Speed Booster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 25, 2026GeoDirectory – WP Business Directory Plugin and Classified Listings Directory: Stored Cross-Site ScriptingCVE-2026-96766 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'business_hours' parameter in all versions up to, and including, 2.8.183 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is possible because the AJAX save handler validates only post authorship and a nonce with no additional capability check, allowing any subscriber-level user who owns a listing to exploit this vulnerability.
Product
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory
Affected
up to 2.8.183
What to do
Affects up to 2.8.183. Update GeoDirectory – WP Business Directory Plugin and Classified Listings Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 25, 2026BA Book Everything: Stored Cross-Site ScriptingCVE-2026-96039 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The BA Book Everything plugin for WordPress is vulnerable to Stored Cross-Site Scripting via first_name Parameter in all versions up to, and including, 1.8.27 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. An unauthenticated attacker can obtain the valid order_id, order_num, and order_hash credentials required to reach the vulnerable action_to_pay() handler simply by placing a guest booking through the public [babe-booking-form] shortcode, making the full exploit chain reachable without any account.
Product
BA Book Everything
Affected
up to 1.8.27
What to do
Affects up to 1.8.27. Update BA Book Everything to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 25, 2026Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots: Stored DOM-Based Cross-Site ScriptingCVE-2026-94376 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via User Display Name in all versions up to, and including, 3.0.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable by Subscriber-level users because WordPress core's sanitize_text_field() preserves HTML-entity-encoded payloads (e.g., an iframe srcdoc attribute), allowing the encoded string to be stored as a display name without requiring the unfiltered_html capability, and the plugin subsequently decodes it server-side before rendering.
Product
Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots
Affected
up to 3.0.4
What to do
Affects up to 3.0.4. Update Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 25, 2026Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots: Generic SQL InjectionCVE-2026-93899 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to generic SQL Injection via 'group_id' Message Meta Parameter in all versions up to, and including, 3.0.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Exploitation requires the BuddyBoss Platform plugin to be installed with its Social Groups component disabled, a state that persists on any site that has previously toggled the Groups component off since BuddyBoss does not drop the wp_bp_groups table upon deactivation.
Product
Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots
Affected
up to 3.0.4
What to do
Affects up to 3.0.4. Update Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 25, 2026GeoDirectory – WP Business Directory Plugin and Classified Listings Directory: Stored Cross-Site ScriptingCVE-2026-93897 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Text-type Custom Field (e.g., 'phone') in all versions up to, and including, 2.8.181 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload must be stored in a text-type custom field (such as a phone field) via the AJAX geodir_save_post endpoint, using entity-encoded angle brackets (e.g., <img src=x onerror=alert(1)>) to bypass the strpos()-gated tag-stripping check.
Product
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory
Affected
up to 2.8.181
What to do
Affects up to 2.8.181. Update GeoDirectory – WP Business Directory Plugin and Classified Listings Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 25, 2026Bookly: Insecure Direct Object ReferenceCVE-2026-93399 · WordPress plugins & themes · reported by WordfenceCritical 9.1
The Bookly plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 28.2 via the 'bookly_get_form_id', 'bookly_render_complete', 'bookly_add_to_calendar' and 'bookly_rollback_order' AJAX actions. This is due to the 'bookly_get_form_id' handler blindly storing the attacker-controlled 'order_id' from the submitted form_data into a new booking session, which the 'bookly_render_complete' handler then trusts to look up and return the corresponding Order's secret token without verifying that the current session created that order. This makes it possible for unauthenticated attackers to enumerate sequential order IDs, disclose other customers' order tokens, retrieve calendar/appointment information via 'bookly_add_to_calendar' and permanently delete arbitrary non-completed bookings via 'bookly_rollback_order', which cascade-deletes the customer_appointment and (when no other customers are attached) the underlying appointment.
Product
Bookly
Affected
up to 28.2
What to do
Affects up to 28.2. Update Bookly to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 25, 2026HT Contact Form – Drag & Drop Form Builder for WordPress: Stored DOM-Based Cross-Site ScriptingCVE-2026-93303 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The HT Contact Form – Drag & Drop Form Builder for WordPress plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via 'form_data' Rich Text Field via Draft Save/Resume in all versions up to, and including, 2.10.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires tricking a user into clicking an attacker-supplied draft resume URL, which the attacker constructs using the draft_key and access_token returned directly in the save response.
Product
HT Contact Form – Drag & Drop Form Builder for WordPress
Affected
up to 2.10.1
What to do
Affects up to 2.10.1. Update HT Contact Form – Drag & Drop Form Builder for WordPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 25, 2026Blog2Social: Social Media Auto Post & Scheduler: Authorization bypassCVE-2026-92829 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 9.1.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to view, modify, or delete other users' Blog2Social records, including disclosing another user's network authentication IDs and scheduled post content, overwriting Open Graph and Twitter Card post metadata on posts they do not own, rebinding another user's social-network authorization, and mass-hiding all users' scheduled posts sitewide. The plugin's b2s_security_nonce is emitted on the post-edit meta box, which Contributors can render, making the nonce available to any authenticated user at that role level or above.
Product
Blog2Social: Social Media Auto Post & Scheduler
Affected
up to 9.1.0
What to do
Affects up to 9.1.0. Update Blog2Social: Social Media Auto Post & Scheduler to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 25, 2026Online Scheduling and Appointment Booking System – Bookly: Authorization BypassCVE-2026-92799 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to Authorization Bypass via PHP Type Juggling in all versions up to, and including, 28.2. This is due to the `postValidateCustomer()` function using a loose PHP inequality operator (`!=`) to compare the session-stored one-time verification code against the attacker-supplied `verification_code` parameter — a flaw that is further exposed by the booking AJAX controller registering all its methods as `wp_ajax_nopriv_` handlers and unconditionally overriding `csrfTokenValid()` to return true, leaving the endpoint both unauthenticated and CSRF-unprotected. This makes it possible for unauthenticated attackers to bypass the phone/email ownership verification step and overwrite the name, email, phone, and address fields of any arbitrary existing Bookly customer record, redirecting that customer's booking notifications to attacker-controlled contact details. The bypass is achievable because the `json_data` input channel decodes input via `json_decode()`, which preserves real PHP types and causes the `wp_kses` filter to leave non-string values such as the JSON boolean `true` untouched; submitting
Product
Online Scheduling and Appointment Booking System – Bookly
Affected
up to 28.2
What to do
Affects up to 28.2. Update Online Scheduling and Appointment Booking System – Bookly to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 25, 2026Gutenverse – WordPress Blocks, Page Builder & Site Editor: Stored Cross-Site ScriptingCVE-2026-92746 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Gutenverse – WordPress Blocks, Page Builder & Site Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Post Comment Block 'suffixMain' Attribute in all versions up to, and including, 4.0.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. WordPress core wp_kses_post sanitization does not mitigate this vulnerability because the payload is stored inside a Gutenberg block delimiter comment rather than as a raw HTML tag, and is only rendered as exploitable HTML at the PHP render stage.
Product
Gutenverse – WordPress Blocks, Page Builder & Site Editor
Affected
up to 4.0.8
What to do
Affects up to 4.0.8. Update Gutenverse – WordPress Blocks, Page Builder & Site Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 25, 2026JetFormBuilder — Dynamic Blocks Form Builder: Reflected Cross-Site ScriptingCVE-2026-92212 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'jfb_xss' (URL Query Variable) Parameter via Calculated Field in all versions up to, and including, 3.6.5.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Exploitation requires the targeted page to host a form configured with both a URL Query Variable preset field and a Calculated Field that references it, which are standard plugin features.
Product
JetFormBuilder — Dynamic Blocks Form Builder
Affected
up to 3.6.5.3
What to do
Affects up to 3.6.5.3. Update JetFormBuilder — Dynamic Blocks Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 25, 2026Customer Reviews for WooCommerce: Authorization bypassCVE-2026-89055 · WordPress plugins & themes · reported by WordfenceCritical 9.1
The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.120.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to permanently delete arbitrary attachments from the Media Library — including administrator-owned product images, logos, and documents — by injecting their IDs into a review that is later trashed and purged. Exploitation requires a public review-form link (a 13-hex formId distributed to customers via e-mail), which exposes the nonce needed to reach the handler without any WordPress account or session.
Product
Customer Reviews for WooCommerce
Affected
up to 5.120.0
What to do
Affects up to 5.120.0. Update Customer Reviews for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 25, 2026Fancy Product Designer: Stored Cross-Site ScriptingCVE-2026-84281 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Fancy Product Designer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'productTitle' in '_fpd_data' Order Item Meta in all versions up to, and including, 6.5.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The fpd_save_order AJAX action is registered for unauthenticated users via wp_ajax_nopriv_fpd_save_order with no nonce or capability check, and the strip_tags() sanitization applied at save time is bypassed by submitting JSON unicode escape sequences (e.g. \u003c, \u003e), which json_decode() silently converts back to literal angle brackets when the order is rendered in the admin view.
Product
Fancy Product Designer
Affected
up to 6.5.2
What to do
Affects up to 6.5.2. Update Fancy Product Designer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record fancyproductdesigner.com wordfence.com
Sep 25, 2026Fancy Product Designer: Stored Cross-Site ScriptingCVE-2026-84279 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Fancy Product Designer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'output_format' parameter in all versions up to, and including, 6.5.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the Pro Export/Genius feature to be enabled on the site, as the vulnerable fpd_pr_export AJAX action is only registered when that feature is active.
Product
Fancy Product Designer
Affected
up to 6.5.2
What to do
Affects up to 6.5.2. Update Fancy Product Designer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record fancyproductdesigner.com wordfence.com
Sep 25, 2026AMP for WP – Accelerated Mobile Pages: Stored Cross-Site ScriptingCVE-2026-83591 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Regex Transformation in all versions up to, and including, 1.1.16 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The crafted payload uses only WordPress-permitted comment tags and attributes (an anchor with href and title), and the AMP sanitizer pipeline omits javascript: protocol blocking, meaning neither the comment save filter nor the AMP output stage removes the malicious URI introduced by the transformation.
Product
AMP for WP – Accelerated Mobile Pages
Affected
up to 1.1.16
What to do
Affects up to 1.1.16. Update AMP for WP – Accelerated Mobile Pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 25, 2026Link Library: Does not validate the destination of a user-supplied URL before falling back to an unprotected fetchCVE-2026-78397 · WordPress plugins & themes · reported by WPScanMedium 4
The Link Library WordPress plugin before 7.9.6 does not validate the destination of a user-supplied URL before falling back to an unprotected fetch when its safe request is rejected, allowing unauthenticated visitors to make the site issue requests to hosts on its internal network and to learn from the response whether an internal service answered. Versions below 7.8.8 are covered by CVE-2025-68600; this entry covers 7.8.8 through 7.9.5, where that fix was incomplete. Exploitation requires the site owner to have published the Link Library WordPress plugin before 7.9.6's public link submission form with reciprocal-link validation enabled.
Product
Link Library
Affected
up to 7.9.5
Fixed in
7.9.6
What to do
Update Link Library to 7.9.6 or newer.
NVD record wpscan.com
Sep 25, 2026Link Library: Does not sanitize a user-supplied destination folder before writing a generated image to diskCVE-2026-78394 · WordPress plugins & themes · reported by WPScanMedium 4.1
The Link Library WordPress plugin before 7.9.6 does not sanitize a user-supplied destination folder before writing a generated image to disk, allowing users with the Contributor role and above to create directories and write or overwrite image files anywhere the web server can write, including outside the site's document root. The written file name is always numeric with a fixed image extension, so executable code cannot be planted this way.
Product
Link Library
Fixed in
7.9.6
What to do
Update Link Library to 7.9.6 or newer.
NVD record wpscan.com
Sep 25, 2026Link Library: Does not properly escape some parameters before outputting them in the addresses of links it generates on its front-end directory pagesCVE-2026-78393 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Link Library WordPress plugin before 7.9.6 does not properly escape some parameters before outputting them in the addresses of links it generates on its front-end directory pages, leading to Reflected Cross-Site Scripting which could be used against any visitor, including logged-in administrators.
Product
Link Library
Fixed in
7.9.6
What to do
Update Link Library to 7.9.6 or newer.
NVD record wpscan.com
Sep 25, 2026Elementor Website Builder: Cross-Site Request Forgery (CSRF)CVE-2026-62062 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Cross-Site Request Forgery (CSRF) vulnerability in Elementor Website Builder allows Cross Site Request Forgery. This issue affects Elementor Website Builder: from n/a through 4.3.1.
Product
Elementor Website Builder
Affected
up to 4.3.1
What to do
Affects up to 4.3.1. Update Elementor Website Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record patchstack.com
Sep 25, 2026OpenStation — Desktop Windows, Dock & Virtual Desktops for WP Admin: Authorization bypassCVE-2026-19775 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The OpenStation — Desktop Windows, Dock & Virtual Desktops for WP Admin plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.1.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with custom-level access and above, to read the title, status, date, permalink, and a 300-character content excerpt of any private, draft, pending, or future post, as well as the content and AI-moderation verdicts of unapproved and spam comments. Any authenticated user with the 'read' capability can self-enable the required AI feature by visiting the /openstation/ portal and toggling their own ai.enabled setting via the POST /desktop-mode/v1/os-settings endpoint, removing any practical barrier to exploitation.
Product
OpenStation — Desktop Windows, Dock & Virtual Desktops for WP Admin
Affected
up to 1.1.7
What to do
Affects up to 1.1.7. Update OpenStation — Desktop Windows, Dock & Virtual Desktops for WP Admin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 25, 2026Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code: Privilege EscalationCVE-2026-14281 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.8.6. This is due to missing permission enforcement on the publicly accessible REST route `POST /wp-json/wawp/v1/signup/<op>` and the absence of a key allowlist in the `finish_registration_logic` function, which copies the attacker-controlled `wawp_custom_fields` parameter directly into `update_user_meta()` — allowing sensitive meta keys such as `wp_capabilities` and `wp_user_level` to be set by the caller. This makes it possible for unauthenticated attackers to register a new account with the administrator role and gain full administrative access to the site. When OTP verification is enabled at signup, the OTP session token (`otp_transient`) is returned in plaintext in the HTTP response body, and the `handle_magic_link_request()` handler marks that token as verified on any unauthenticated GET request containing it without ever checking the OTP code value — making the OTP step trivially bypassable with no inbox or SMS access required.
Product
Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code
Affected
up to 4.8.6
What to do
Affects up to 4.8.6. Update Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 25, 2026CSS & JavaScript Toolbox: Stored Cross-Site ScriptingCVE-2025-14814 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The CSS & JavaScript Toolbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's cjtoolbox shortcode in all versions up to, and including, 12.0.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
CSS & JavaScript Toolbox
Affected
up to 12.0.6
What to do
Affects up to 12.0.6. Update CSS & JavaScript Toolbox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org wordfence.com
Sep 24, 2026Custom Thank You Page for WooCommerce: Unauthorized access and loss of dataCVE-2026-4806 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Custom Thank You Page for WooCommerce plugin for WordPress is vulnerable to unauthorized access and loss of data due to a missing capability check on the save_option() function in all versions up to, and including, 1.1.2. This makes it possible for unauthenticated attackers to to export or reset(delete) the plugin's settings.
Product
Custom Thank You Page for WooCommerce
Affected
up to 1.1.2
What to do
Affects up to 1.1.2. Update Custom Thank You Page for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org wordfence.com
Sep 24, 2026MailerLite – Signup forms (official): Unauthorized modification of dataCVE-2026-3253 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The MailerLite – Signup forms (official) plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the forms() method of the AdminController class in all versions up to, and including, 1.7.21. This makes it possible for authenticated attackers, with Contributor-level access and above, to create or delete arbitrary signup forms.
Product
MailerLite – Signup forms (official)
Affected
up to 1.7.21
What to do
Affects up to 1.7.21. Update MailerLite – Signup forms (official) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org wordfence.com
Sep 24, 2026Spectra Legacy – Gutenberg Blocks: Sensitive Information ExposureCVE-2026-16302 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Spectra Legacy – Gutenberg Blocks plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.20.0 via the editor_assets function, which exposes the uag_insta_linked_accounts option through the uagb_blocks_info object without a capability check. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive data including raw Instagram Graph API access tokens configured by an administrator. Exploitation requires the Spectra Pro plugin to be active with a linked Instagram account.
Product
Spectra Legacy – Gutenberg Blocks
Affected
up to 2.20.0
What to do
Affects up to 2.20.0. Update Spectra Legacy – Gutenberg Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org wordfence.com
Sep 24, 2026Kirki – Freeform Page Builder, Website Builder & Customizer: Blind Server-Side Request ForgeryCVE-2026-18335 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 6.2.0 via the 'kirki_data' Parameter. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
Product
Kirki – Freeform Page Builder, Website Builder & Customizer
Affected
up to 6.2.0
What to do
Affects up to 6.2.0. Update Kirki – Freeform Page Builder, Website Builder & Customizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org wordfence.com
Sep 24, 2026WP Multilang – Translation and Multilingual: Stored Cross-Site ScriptingCVE-2026-15731 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP Multilang – Translation and Multilingual Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the post content in all versions up to, and including, 2.4.31 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WP Multilang – Translation and Multilingual
Affected
up to 2.4.31
What to do
Affects up to 2.4.31. Update WP Multilang – Translation and Multilingual to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org wordfence.com
Sep 24, 2026Visual Composer Website Builder: Local File InclusionCVE-2026-12227 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Visual Composer Website Builder plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 45.16.0 via the `vcv-template` parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
Product
Visual Composer Website Builder
Affected
up to 45.16.0
What to do
Affects up to 45.16.0. Update Visual Composer Website Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org wordfence.com
Sep 24, 2026YOP Poll: Origin Validation ErrorCVE-2026-85682 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The YOP Poll plugin for WordPress is vulnerable to Origin Validation Error in all versions up to, and including, 7.0.10. This is due to the plugin transmitting a wp_rest nonce to window.opener via postMessage() with a wildcard targetOrigin. This makes it possible for unauthenticated attackers to steal a REST nonce scoped to a logged-in Administrator and use it to change the Administrator's email address and password, resulting in full account takeover. The Administrator must open an attacker-controlled page in order to exploit this vulnerability.
Product
YOP Poll
Affected
up to 7.0.10
What to do
Affects up to 7.0.10. Update YOP Poll to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org wordfence.com
Sep 24, 2026eesy_ID2WP – Publish InDesign HTML5: Path TraversalCVE-2026-77193 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The eesy_ID2WP – Publish InDesign HTML5 plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.0.3 via the `id2wp_path` parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information.
Product
eesy_ID2WP – Publish InDesign HTML5
Affected
up to 1.0.3
What to do
Affects up to 1.0.3. Update eesy_ID2WP – Publish InDesign HTML5 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org wordfence.com
Sep 24, 2026Events Manager: Does not force the scope of its logged-in event and location searchCVE-2026-93662 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Events Manager WordPress plugin before 7.4.5 does not force the scope of its logged-in event and location search when a caller supplies their own owner value, letting a low-privileged user read other accounts' unpublished, pending or trashed event and venue content, including full street addresses.
Product
Events Manager
Fixed in
7.4.5
What to do
Update Events Manager to 7.4.5 or newer.
NVD record wpscan.com
Sep 24, 2026Events Manager: Does not stop a ticket-update request from replacing the identifiers of the ticket it was authorized againstCVE-2026-93661 · WordPress plugins & themes · reported by WPScanLow 2.7
The Events Manager WordPress plugin before 7.4.5 does not stop a ticket-update request from replacing the identifiers of the ticket it was authorized against, letting a user who can manage one event's tickets overwrite and reassign any ticket on the site to their own event.
Product
Events Manager
Fixed in
7.4.5
What to do
Update Events Manager to 7.4.5 or newer.
NVD record wpscan.com
Sep 24, 2026WPeMatico RSS Feed Fetcher: Does not sanitise and escape one of its campaign configuration fieldsCVE-2026-89005 · WordPress plugins & themes · reported by WPScanMedium 6.8
The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.26 does not sanitise and escape one of its campaign configuration fields when a certain feature is enabled, which allows users with the Contributor role and above to perform Stored Cross-Site Scripting attacks that execute in the session of any higher-privileged user who later views the campaign.
Product
WPeMatico RSS Feed Fetcher
Fixed in
2.8.26
What to do
Update WPeMatico RSS Feed Fetcher to 2.8.26 or newer.
NVD record wpscan.com
Sep 24, 2026WPeMatico RSS Feed Fetcher: Does not verify ownership or authorization before returning a campaign's stored configuration and run logCVE-2026-89004 · WordPress plugins & themes · reported by WPScanLow 2.7
The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.26 does not verify ownership or authorization before returning a campaign's stored configuration and run log, allowing users with contributor-level access and above to read the configuration and execution logs of campaigns created by other users, including administrators.
Product
WPeMatico RSS Feed Fetcher
Fixed in
2.8.26
What to do
Update WPeMatico RSS Feed Fetcher to 2.8.26 or newer.
NVD record wpscan.com
Sep 24, 2026WPeMatico RSS Feed Fetcher: Does not sanitize and escape content it retrieves from a user-supplied source before rendering itCVE-2026-89002 · WordPress plugins & themes · reported by WPScanMedium 6.8
The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.26 does not sanitize and escape content it retrieves from a user-supplied source before rendering it, which could allow users such as contributors to perform Stored Cross-Site Scripting attacks against higher-privileged users who review the campaign.
Product
WPeMatico RSS Feed Fetcher
Fixed in
2.8.26
What to do
Update WPeMatico RSS Feed Fetcher to 2.8.26 or newer.
NVD record wpscan.com
Sep 24, 2026MasterStudy LMS: Does not verify that a user is enrolled in a course before recording lesson completions against itCVE-2026-88847 · WordPress plugins & themes · reported by WPScanMedium 4.3
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not verify that a user is enrolled in a course before recording lesson completions against it, allowing any authenticated user, such as a subscriber, to create course progress records for courses they have no access to.
Product
MasterStudy LMS
Fixed in
3.7.50
What to do
Update MasterStudy LMS to 3.7.50 or newer.
NVD record wpscan.com
Sep 24, 2026MasterStudy LMS: Does not check whether user registration is enabled on the site before creating an account through one of its front-end registration flowsCVE-2026-88846 · WordPress plugins & themes · reported by WPScanMedium 5.3
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not check whether user registration is enabled on the site before creating an account through one of its front-end registration flows, allowing unauthenticated users to create accounts, and be logged into them, on sites where registration has been deliberately disabled.
Product
MasterStudy LMS
Fixed in
3.7.50
What to do
Update MasterStudy LMS to 3.7.50 or newer.
NVD record wpscan.com
Sep 24, 2026MasterStudy LMS: Does not perform any capability or nonce checks on an administrative maintenance actionCVE-2026-88845 · WordPress plugins & themes · reported by WPScanMedium 4.3
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not perform any capability or nonce checks on an administrative maintenance action, allowing any authenticated user, such as a subscriber, to trigger it and create published content on the site attributed to their own account.
Product
MasterStudy LMS
Fixed in
3.7.50
What to do
Update MasterStudy LMS to 3.7.50 or newer.
NVD record wpscan.com
Sep 24, 2026MasterStudy LMS: Does not validate one of its display-style settings before using it to build a template pathCVE-2026-88843 · WordPress plugins & themes · reported by WPScanHigh 7.2
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not validate one of its display-style settings before using it to build a template path, allowing users with the Contributor role and above to include and execute arbitrary local PHP files on the server. An equivalent path was corrected in an earlier release and this one was not, so the issue persists in versions the earlier advisory reports as fixed.
Product
MasterStudy LMS
Fixed in
3.7.50
What to do
Update MasterStudy LMS to 3.7.50 or newer.
NVD record wpscan.com
Sep 24, 2026Post Grid: Does not limit an expansion of the WordPress allowed-HTML list to its own markup and applies it site-wideCVE-2026-84151 · WordPress plugins & themes · reported by WPScanLow 3.5
The Post Grid WordPress plugin before 7.9.5 does not limit an expansion of the WordPress allowed-HTML list to its own markup and applies it site-wide, allowing users with the Contributor role and above to store iframe, style and input elements that are normally stripped from their content, leading to HTML injection (phishing frames, CSS defacement and spoofed input forms) that renders to any visitor and to administrators reviewing the content.
Product
Post Grid
Fixed in
7.9.5
What to do
Update Post Grid to 7.9.5 or newer.
NVD record wpscan.com
Sep 24, 2026Masteriyo LMS: Does not restrict access to quiz answer keysCVE-2026-82850 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Masteriyo LMS WordPress plugin before 3.4.2 does not restrict access to quiz answer keys, allowing any authenticated user, such as a student, to retrieve the correct answers for any quiz on the site, including quizzes in courses they are not enrolled in. The redaction that hides them is applied only to a fixed list of question types, so the answers to every other type are returned in full to anyone able to view the questions.
Product
Masteriyo LMS
Fixed in
3.4.2
What to do
Update Masteriyo LMS to 3.4.2 or newer.
NVD record wpscan.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. The WordPress, CMS and hosting-panel entries come from the National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan and others); we show who. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Start a project

Tell us what you're building.

A website, a booking system, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.

01The person who'll build it writes back

02A planning call, then a written plan with the price and the date

03A preview on your phone while it's being built

04Launch night handled: redirects, email, Google

843-331-6339

Not ready to talk yet? Run the free website check and see what Google sees.