Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
394,717 results · page 419 of 7895
Sep 30, 2026A flaw was found in Moodle.CVE-2026-102588 · Other software · Moodle · reported by patrick@puiterwijk.orgMedium 6.5
A flaw was found in Moodle. The XML grade import feature lacks proper Cross-Site Request Forgery (CSRF) token validation. By tricking an authenticated user with grade management permissions into visiting a malicious webpage, an attacker can trigger unauthorized requests on the victim's behalf. This flaw allows a remote attacker to set or overwrite student grades without authorization.
- Product
- Moodle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.moodle.orgaccess.redhat.com
Sep 30, 2026A flaw was found in Moodle.CVE-2026-102587 · Other software · Moodle · reported by patrick@puiterwijk.orgLow 2.7
A flaw was found in Moodle. User list filters do not properly enforce visibility restrictions on user profile fields. An authorized user with manager privileges can filter user lists using profile attributes they are not permitted to view directly, resulting in unauthorized information disclosure by inferring hidden user data.
- Product
- Moodle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.moodle.orgaccess.redhat.com
Sep 30, 2026A flaw was found in Moodle.CVE-2026-102586 · Other software · Moodle · reported by patrick@puiterwijk.orgMedium 4.3
A flaw was found in Moodle. Insufficient sanitization of username input on the password reset page allows a remote attacker to conduct a cross-site scripting (XSS) attack. By convincing an unauthenticated user to access a specially crafted password reset link, an attacker could execute arbitrary script in the victim's browser.
- Product
- Moodle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.moodle.orgaccess.redhat.com
Sep 30, 2026A flaw was found in Moodle.CVE-2026-102585 · Other software · Moodle · reported by patrick@puiterwijk.orgMedium 4.3
A flaw was found in Moodle. When enrolling a user into a course while assigning them to a group, the application does not verify whether the selected group actually belongs to that course. An authenticated user with teacher privileges could exploit this flaw to add users to groups within courses they do not have authorization to access.
- Product
- Moodle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.moodle.orgaccess.redhat.com
Sep 30, 2026A flaw was found in Moodle.CVE-2026-102584 · Other software · Moodle · reported by patrick@puiterwijk.orgMedium 4.3
A flaw was found in Moodle. Due to a missing capability check, a low-privileged authenticated user can trigger the recalculation of grade penalties without holding the required permissions. This issue allows unauthorized users to modify grade penalty records, potentially altering student assessment scores.
- Product
- Moodle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.moodle.orgaccess.redhat.com
Sep 30, 2026A flaw was found in Moodle.CVE-2026-102583 · Other software · Moodle · reported by patrick@puiterwijk.orgLow 2.7
A flaw was found in Moodle. An incorrect capability check in the artificial intelligence (AI) editor placement's image generation web service allows an authenticated user to invoke the feature without holding the required capability. This flaw permits unauthorized users to access and utilize the AI image generation functionality.
- Product
- Moodle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.moodle.orgaccess.redhat.com
Sep 30, 2026A flaw was found in Moodle.CVE-2026-102582 · Other software · Moodle · reported by patrick@puiterwijk.orgLow 2.2
A flaw was found in Moodle. The manual enrolment management page did not properly check whether the manual enrolment plugin was disabled, allowing users with enrolment permissions to access the page directly by navigating to its URL. Consequently, an authorized user could manage manual enrolments even after an administrator disabled the feature in the user interface.
- Product
- Moodle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.moodle.orgaccess.redhat.com
Sep 30, 2026A flaw was found in Moodle.CVE-2026-102581 · Other software · Moodle · reported by patrick@puiterwijk.orgMedium 4.6
A flaw was found in Moodle. Insufficient output escaping in templates used to display forum posts enables a stored cross-site scripting (XSS) vulnerability. An attacker can inject malicious content into a forum post, which then executes arbitrary script code in the browser of another user viewing the affected post.
- Product
- Moodle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.moodle.orgaccess.redhat.com
Sep 30, 2026A flaw was found in Moodle.CVE-2026-102580 · Other software · Moodle · reported by patrick@puiterwijk.orgLow 2.2
A flaw was found in Moodle. An authenticated attacker can supply an improperly validated audience class name to the Report Builder component, allowing arbitrary class instantiation. This vulnerability enables the unauthorized creation of internal program objects, which may result in unexpected application behavior.
- Product
- Moodle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.moodle.orgaccess.redhat.com
Sep 30, 2026A flaw was found in Moodle.CVE-2026-102579 · Other software · Moodle · reported by patrick@puiterwijk.orgMedium 4.3
A flaw was found in Moodle. An incorrect capability check in the grade web service allows an authenticated student to access profile information of other students enrolled in the same course that they should not have permission to view. This issue leads to unauthorized information disclosure.
- Product
- Moodle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.moodle.orgaccess.redhat.com
Sep 30, 2026A flaw was found in Moodle.CVE-2026-102578 · Other software · Moodle · reported by patrick@puiterwijk.orgMedium 5.5
A flaw was found in Moodle. An authenticated attacker with access to the question bank web service can submit unsanitized input directly into database queries, resulting in a SQL (Structured Query Language) injection vulnerability. This issue could allow an attacker to view, alter, or delete sensitive data stored in the underlying database.
- Product
- Moodle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.moodle.orgaccess.redhat.com
Sep 30, 2026A flaw was found in Moodle.CVE-2026-102577 · Other software · Moodle · reported by patrick@puiterwijk.orgMedium 4.3
A flaw was found in Moodle. Incorrect handling of IPv4-mapped IPv6 addresses within the URL downloader's host-blocking logic allows an authenticated remote user to bypass blocked-host restrictions. By supplying a crafted URL, an attacker can induce the server to make requests to restricted destinations, leading to Server-Side Request Forgery (SSRF).
- Product
- Moodle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.moodle.orgaccess.redhat.com
Sep 30, 2026Improper Verification of Source of a Communication Channel in the ADS discovery of the Go implementation of Apache PLC4X (PLC4Go) allows an attacker able to senCVE-2026-102511 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 8.5
Improper Verification of Source of a Communication Channel in the ADS discovery of the Go implementation of Apache PLC4X (PLC4Go) allows an attacker able to send UDP datagrams to the discovering host to redirect subsequent connections to an arbitrary, attacker-chosen address. The discovery result's connection address was derived from the AmsNetId claimed in the response body rather than from the datagram's actual source address. One spoofed discovery response can therefore insert an inventory entry pointing at any host, including hosts outside the local network, and an application that connects to discovered devices will open its ADS session, including any configured route credentials, to that host. Additionally, discovery listeners in both implementations can be disabled by a single malformed datagram: - In PLC4Go ADS discovery, a short version block causes a panic that ends the listener for the rest of the discovery call, so legitimate devices answering afterwards are not reported. - In PLC4J, the ADS and EtherNet/IP discoverers stop on an unhandled exception from a malformed response. - The PLC4J Modbus discoverer can be made to spin indefinitely, consuming a CPU core, by a sc
- Product
- Apache PLC4X
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orgopenwall.com
Sep 30, 2026Integer Overflow, Improper Validation of Array Index, Uncontrolled Recursion and Memory Allocation with Excessive Size Value in the Go implementation of Apache CVE-2026-102510 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 8.7
Integer Overflow, Improper Validation of Array Index, Uncontrolled Recursion and Memory Allocation with Excessive Size Value in the Go implementation of Apache PLC4X (PLC4Go) allow a malicious device, or an attacker able to inject network traffic, to crash or exhaust the memory of the client application, causing a denial of service. The individual defects are: - Generated parsers pre-allocate arrays with the element count claimed on the wire (0.13.0 through 0.13.1). - Transport read helpers allocate buffers of the size claimed on the wire without an upper bound. - ADS and KNXnet/IP response handling indexes into received data without checking its length, causing a panic. - ADS and EIP frame-length handling accepts, or arithmetically wraps to, a length of zero, breaking message framing. - Recursive protocol types are parsed without a nesting-depth limit. The same defect in the Java implementation is covered by CVE-2026-102509 https://cveprocess.apache.org/cve5/CVE-2026-102509 . Additionally, length and position arithmetic in generated serializers was performed in 16-bit integers. If an application forwards attacker-influenced payloads larger than 8 KB, the length field wraps, and
- Product
- Apache PLC4X
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2026Memory Allocation with Excessive Size Value, Allocation of Resources Without Limits, and Uncontrolled Recursion in the Java implementation of Apache PLC4X (PLC4CVE-2026-102509 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 8.7
Memory Allocation with Excessive Size Value, Allocation of Resources Without Limits, and Uncontrolled Recursion in the Java implementation of Apache PLC4X (PLC4J) allow a malicious or impersonated device to exhaust the memory or stack of the client application, causing a denial of service. In the OPC UA driver these defects are reachable before authentication: the offending data is parsed while the secure channel and session are being established, before the server's identity has been bound to it. Configuring a trusted server therefore does not prevent exploitation by an attacker who can impersonate it. The individual defects are: - Length-prefixed byte strings are allocated at the size claimed on the wire before the length is checked against the data actually received (0.10.0 through 0.13.1). - Array fields in generated protocol parsers pre-allocate a list with the element count claimed on the wire, allowing a single count field to trigger a multi-gigabyte allocation. This parser is shared by all PLC4J drivers; the OPC UA driver is the verified pre-authentication path (0.10.0 through 0.13.1). - The OPC UA driver accumulates message chunks without enforcing the negotiated maximu
- Product
- Apache PLC4X
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2026EasyFlow .NET developed by Digiwin has a Reflected Cross-site Scripting vulnerability.CVE-2026-102459 · Other software · DigiWin · reported by twcert@cert.org.twMedium 5.1
EasyFlow .NET developed by Digiwin has a Reflected Cross-site Scripting vulnerability. Unauthenticated remote attackers can execute arbitrary JavaScript codes in user's browser through phishing attacks.
- Product
- EasyFlow .NET
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Sep 30, 2026EasyFlow .NET developed by Digiwin has a Missing Authentication vulnerability.CVE-2026-102458 · Other software · DigiWin · reported by twcert@cert.org.twCritical 9.3
EasyFlow .NET developed by Digiwin has a Missing Authentication vulnerability. Unauthenticated remote attackers can obtain other users' plaintext passwords through a specific API.
- Product
- EasyFlow .NET
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Sep 30, 2026EasyFlow .NET developed by Digiwin has an Arbitrary File Read vulnerability.CVE-2026-102457 · Other software · DigiWin · reported by twcert@cert.org.twHigh 7.1
EasyFlow .NET developed by Digiwin has an Arbitrary File Read vulnerability. Authenticated remote attackers can exploit this vulnerability to download arbitrary system files.
- Product
- EasyFlow .NET
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Sep 30, 2026EasyFlow .NET developed by Digiwin has an SQL Injection vulnerability.CVE-2026-102456 · Other software · DigiWin · reported by twcert@cert.org.twHigh 7.1
EasyFlow .NET developed by Digiwin has an SQL Injection vulnerability. Authenticated remote attackers can inject arbitrary SQL commands to read database contents.
- Product
- EasyFlow .NET
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Sep 30, 2026EasyFlow .NET developed by Digiwin has a Insecure Deserialization vulnerability.CVE-2026-102455 · Other software · DigiWin · reported by twcert@cert.org.twCritical 9.3
EasyFlow .NET developed by Digiwin has a Insecure Deserialization vulnerability. Unauthenticated remote attackers can execute arbitrary code on the server by sending maliciously crafted serialized content.
- Product
- EasyFlow .NET
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Sep 30, 2026EasyFlow .NET developed by Digiwin has an Arbitrary File Upload vulnerability.CVE-2026-102454 · Other software · DigiWin · reported by twcert@cert.org.twHigh 8.6
EasyFlow .NET developed by Digiwin has an Arbitrary File Upload vulnerability. Privileged remote attackers can upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server.
- Product
- EasyFlow .NET
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Sep 30, 2026Viable URL Media Uploader: Stored Cross-Site ScriptingCVE-2025-14564 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Viable URL Media Uploader plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
- Product
- Viable URL Media Uploader
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Viable URL Media Uploader to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Sep 30, 2026When converting baserCMS4-style addons to baserCMS5-style ones, BcAddonMigrator includes "config.php" from the addon, which means the PHP code in the file is eCVE-2026-97150 · Other software · baserCMS Users Community · reported by vultures@jpcert.or.jpHigh 8.6
When converting baserCMS4-style addons to baserCMS5-style ones, BcAddonMigrator includes "config.php" from the addon, which means the PHP code in the file is executed. Arbitrary files on the system may be read or deleted by an administrative user.
- Product
- BcAddonMigrator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbasercms.netgithub.com
Sep 30, 2026A stored cross-site scripting vulnerability via custom content descriptions exists in baserCMS.CVE-2026-93464 · Other software · baserCMS User Community · reported by vultures@jpcert.or.jpMedium 5.1
A stored cross-site scripting vulnerability via custom content descriptions exists in baserCMS. If this vulnerability is exploited, an arbitrary script may be executed in the user's web browser.
- Product
- baserCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2026A cross-site scripting vulnerability via script validation bypass exists in baserCMS.CVE-2026-93463 · Other software · baserCMS User Community · reported by vultures@jpcert.or.jpMedium 5.1
A cross-site scripting vulnerability via script validation bypass exists in baserCMS. If this vulnerability is exploited, an arbitrary script may be executed in the user's web browser.
- Product
- baserCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2026A missing authentication for critical function vulnerability exists in baserCMS.CVE-2026-93462 · Other software · baserCMS User Community · reported by vultures@jpcert.or.jpMedium 6.9
A missing authentication for critical function vulnerability exists in baserCMS. If this vulnerability is exploited, a remote attacker may obtain sensitive information.
- Product
- baserCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2026A stored cross-site scripting vulnerability via appended strings in email form fields exists in baserCMS.CVE-2026-93460 · Other software · baserCMS User Community · reported by vultures@jpcert.or.jpMedium 5.1
A stored cross-site scripting vulnerability via appended strings in email form fields exists in baserCMS. If this vulnerability is exploited, an arbitrary script may be executed in the user's web browser.
- Product
- baserCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2026Pgpool-II contains an incorrect implementation of an authentication algorithm, which may allow an unauthenticated attacker to promote an arbitrary watchdog nodeCVE-2026-92873 · Other software · Pgpool Global Development Group · reported by vultures@jpcert.or.jpMedium 6.9
Pgpool-II contains an incorrect implementation of an authentication algorithm, which may allow an unauthenticated attacker to promote an arbitrary watchdog node to the leader node.
- Product
- Pgpool-II
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2026Pgpool-II inserts sensitive information into log file, which may allow an authenticated attacker to obtain the cluster information.CVE-2026-92872 · Other software · Pgpool Global Development Group · reported by vultures@jpcert.or.jpMedium 5.3
Pgpool-II inserts sensitive information into log file, which may allow an authenticated attacker to obtain the cluster information.
- Product
- Pgpool-II
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2026A NULL pointer dereference vulnerability exists in Pgpool-II, which may allow an unauthenticated attacker to cause abnormal termination of the watchdog process.CVE-2026-92871 · Other software · Pgpool Global Development Group · reported by vultures@jpcert.or.jpHigh 8.7
A NULL pointer dereference vulnerability exists in Pgpool-II, which may allow an unauthenticated attacker to cause abnormal termination of the watchdog process.
- Product
- Pgpool-II
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2026A stack-based buffer overflow vulnerability exists in Pgpool-II, which may allow an unauthenticated attacker to cause abnormal process termination.CVE-2026-92870 · Other software · Pgpool Global Development Group · reported by vultures@jpcert.or.jpHigh 8.7
A stack-based buffer overflow vulnerability exists in Pgpool-II, which may allow an unauthenticated attacker to cause abnormal process termination.
- Product
- Pgpool-II
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2026An out-of-bounds write vulnerability exists in Pgpool-II, which may allow an authenticated attacker to cause abnormal process termination.CVE-2026-92869 · Other software · Pgpool Global Development Group · reported by vultures@jpcert.or.jpHigh 7.1
An out-of-bounds write vulnerability exists in Pgpool-II, which may allow an authenticated attacker to cause abnormal process termination.
- Product
- Pgpool-II
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2026An improper certificate validation vulnerability exists in Pgpool-II, which may allow an unauthenticated attacker to bypass client certificate authentication.CVE-2026-92868 · Other software · Pgpool Global Development Group · reported by vultures@jpcert.or.jpMedium 6.9
An improper certificate validation vulnerability exists in Pgpool-II, which may allow an unauthenticated attacker to bypass client certificate authentication.
- Product
- Pgpool-II
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2026An out-of-bounds write vulnerability exists in Pgpool-II , which may allow an authenticated attacker to cause abnormal process termination or arbitrary code exeCVE-2026-92867 · Other software · Pgpool Global Development Group · reported by vultures@jpcert.or.jpHigh 8.7
An out-of-bounds write vulnerability exists in Pgpool-II , which may allow an authenticated attacker to cause abnormal process termination or arbitrary code execution.
- Product
- Pgpool-II
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2026Bold Page Builder: Stored Cross-Site ScriptingCVE-2026-88037 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `title` attribute of the `bt_bb_service` shortcode in all versions up to, and including, 5.7.2. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Bold Page Builder
- Affected
- up to 5.7.2
- What to do
- Affects up to 5.7.2. Update Bold Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Sep 30, 2026Motors – Car Dealership & Classified Listings: Time-based blind SQL InjectionCVE-2026-6806 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'stm_lat/stm_lng' parameter in all versions up to, and including, 1.4.109 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- Motors – Car Dealership & Classified Listings
- Affected
- up to 1.4.109
- What to do
- Affects up to 1.4.109. Update Motors – Car Dealership & Classified Listings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Sep 30, 2026Bold Page Builder: Stored Cross-Site ScriptingCVE-2026-6173 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'background_image' parameter of the plugin's bt_bb_section shortcode in all versions up to, and including, 5.7.2 due to insufficient input sanitization and output escaping on user-supplied attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Bold Page Builder
- Affected
- up to 5.7.2
- What to do
- Affects up to 5.7.2. Update Bold Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Sep 30, 2026Bold Page Builder: Stored Cross-Site ScriptingCVE-2026-6172 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'caption' parameter of the plugin's bt_bb_image shortcode in all versions up to, and including, 5.7.2 due to insufficient input sanitization and output escaping on user-supplied attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Bold Page Builder
- Affected
- up to 5.7.2
- What to do
- Affects up to 5.7.2. Update Bold Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Sep 30, 2026Bold Page Builder: Stored Cross-Site ScriptingCVE-2026-6171 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'target' parameter of the plugin's bt_bb_icon shortcode in all versions up to, and including, 5.7.2 due to insufficient input sanitization and output escaping on user-supplied attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Bold Page Builder
- Affected
- up to 5.7.2
- What to do
- Affects up to 5.7.2. Update Bold Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Sep 30, 2026Bold Page Builder: Stored Cross-Site ScriptingCVE-2026-6170 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'images' parameter of the plugin's bt_bb_css_image_grid shortcode in all versions up to, and including, 5.7.2 due to insufficient input sanitization and output escaping on user-supplied attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Bold Page Builder
- Affected
- up to 5.7.2
- What to do
- Affects up to 5.7.2. Update Bold Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Sep 30, 2026WP Directory Kit: Generic SQL InjectionCVE-2026-16596 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The WP Directory Kit plugin for WordPress is vulnerable to generic SQL Injection via the 'data_fields_list' parameter in all versions up to, and including, 1.5.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with custom-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- WP Directory Kit
- Affected
- up to 1.5.4
- What to do
- Affects up to 1.5.4. Update WP Directory Kit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Sep 30, 2026Smart Slider 3: Stored Cross-Site ScriptingCVE-2026-14876 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Smart Slider 3 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data-href' parameter in all versions up to, and including, 3.5.1.38 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Smart Slider 3
- Affected
- up to 3.5.1.38
- What to do
- Affects up to 3.5.1.38. Update Smart Slider 3 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Sep 30, 2026HT Mega Addons for Elementor – Elementor Widgets & Template Builder: Stored Cross-Site ScriptingCVE-2026-11895 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The HT Mega Addons for Elementor – Elementor Widgets & Template Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Data Table 'display_options' Setting in all versions up to, and including, 3.1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- HT Mega Addons for Elementor – Elementor Widgets & Template Builder
- Affected
- up to 3.1.1
- What to do
- Affects up to 3.1.1. Update HT Mega Addons for Elementor – Elementor Widgets & Template Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Sep 30, 2026Improper Verification of Cryptographic Signature and Improper Certificate Validation in the OPC UA driver of Apache PLC4X (PLC4J) allows an attacker in a networCVE-2026-102508 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.2
Improper Verification of Cryptographic Signature and Improper Certificate Validation in the OPC UA driver of Apache PLC4X (PLC4J) allows an attacker in a network position between client and server to impersonate the OPC UA server and to read, forge or modify secure-channel traffic, including user credential ssent by the client. The defect manifests differently depending on the version: - In 0.9.0 through 0.11.0 a failed message-signature check is only logged and never enforced, and there is no mechanism to verify the server certificate: it is taken from the unauthenticated GetEndpoints discovery response and used to encrypt the user's password. - In 0.12.0 through 0.13.1 the signature check is inverted (valid signatures are rejected, invalid ones accepted), and server certificates are accepted without a trust anchor by default. - In all affected versions the default security policy is None. Starting with 0.12.0 the driver additionally continues silently at a weaker security policy than the one configured, and starting with 0.13.0 endpoint selection prefers the weakest matching endpoint. Users checking only for one of these mechanisms may wrongly conclude they are unaffected. Thi
- Product
- Apache PLC4X
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orgopenwall.com
Sep 30, 2026GiveWP: Improper Validation of Unsafe Equivalence in InputCVE-2026-97196 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Improper Validation of Unsafe Equivalence in Input vulnerability in Liquid Web / StellarWP GiveWP allows Authentication Bypass. This issue affects GiveWP: from n/a through 4.16.9.
- Product
- GiveWP
- Affected
- up to 4.16.9
- What to do
- Affects up to 4.16.9. Update GiveWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 30, 2026Simply Schedule Appointments: Local File InclusionCVE-2026-89294 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Simply Schedule Appointments plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.6.12.27 via the 'ssa_locale' parameter parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. Notably, exploitation does not require authentication in practice, as the locale filter is installed unconditionally on every request during plugins_loaded and the callback performs no nonce or capability check before returning the raw GET parameter value.
- Product
- Simply Schedule Appointments
- Affected
- up to 1.6.12.27
- What to do
- Affects up to 1.6.12.27. Update Simply Schedule Appointments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 30, 2026Broken Link Notifier: Does not re-validate the destination of redirectsCVE-2026-97316 · WordPress plugins & themes · reported by WPScanMedium 5.8
The Broken Link Notifier WordPress plugin before 2.0.0.1 does not re-validate the destination of redirects when checking links, allowing unauthenticated attackers to bypass its internal-address filter and make the server send requests to internal services.
- Product
- Broken Link Notifier
- Fixed in
- 2.0.0.1
- What to do
- Update Broken Link Notifier to 2.0.0.1 or newer.
Sep 30, 2026Course Booking System: Does not restrict access to its booking exportCVE-2026-96886 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Course Booking System WordPress plugin before 7.0.9 does not restrict access to its booking export, allowing unauthenticated users to download the name, email address and billing address of every customer who has booked a course.
- Product
- Course Booking System
- Fixed in
- 7.0.9
- What to do
- Update Course Booking System to 7.0.9 or newer.
Sep 30, 2026Media Library Organizer: Does not verify that the requesting user holds the target taxonomy's management capability before creating a new termCVE-2026-94297 · WordPress plugins & themes · reported by WPScanLow 2.7
The Media Library Organizer WordPress plugin before 2.1.4 does not verify that the requesting user holds the target taxonomy's management capability before creating a new term, allowing users with contributor-level access and above to create publicly visible terms in any taxonomy registered on the site.
- Product
- Media Library Organizer
- Fixed in
- 2.1.4
- What to do
- Update Media Library Organizer to 2.1.4 or newer.
Sep 30, 2026YayReviews: Does not restrict access to an API route that returns individual customer review recordsCVE-2026-94274 · WordPress plugins & themes · reported by WPScanMedium 5.3
The YayReviews WordPress plugin before 1.4.1 does not restrict access to an API route that returns individual customer review records, including reviews still pending moderation, allowing unauthenticated attackers to harvest reviewers' email addresses and other non-public review content.
- Product
- YayReviews
- Fixed in
- 1.4.1
- What to do
- Update YayReviews to 1.4.1 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.