Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
11,480 results · page 44 of 230
Sep 23, 2026Directorist: AI-Powered Business Directory, Listings & Classified Ads: Does not verify that the target user of a REST route matches the authenticated caller before reading and modifying that user's saved favoritesCVE-2026-84150 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not verify that the target user of a REST route matches the authenticated caller before reading and modifying that user's saved favorites, allowing any authenticated user with subscriber-level access to view and alter another user's favorites.
- Product
- Directorist: AI-Powered Business Directory, Listings & Classified Ads
- Fixed in
- 8.9.5
- What to do
- Update Directorist: AI-Powered Business Directory, Listings & Classified Ads to 8.9.5 or newer.
Sep 23, 2026Directorist: AI-Powered Business Directory, Listings & Classified Ads: Does not properly verify a listing's ownership before deleting itCVE-2026-84098 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not properly verify a listing's ownership before deleting it, allowing authenticated attackers with Subscriber-level access and above to delete arbitrary listings, including ones belonging to other users. This is an incomplete fix of CVE-2023-1889 / CVE-2023-35052: a separate, unaddressed listing-deletion path allows the same impact, from at least version 3.1.0 through the current release.
- Product
- Directorist: AI-Powered Business Directory, Listings & Classified Ads
- Fixed in
- 8.9.5
- What to do
- Update Directorist: AI-Powered Business Directory, Listings & Classified Ads to 8.9.5 or newer.
Sep 23, 2026Directorist: AI-Powered Business Directory, Listings & Classified Ads: Does not validate a user-supplied URL before fetching it server-sideCVE-2026-84046 · WordPress plugins & themes · reported by WPScanMedium 5
The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not validate a user-supplied URL before fetching it server-side, allowing users with the subscriber role and above to make the server issue requests to internal addresses.
- Product
- Directorist: AI-Powered Business Directory, Listings & Classified Ads
- Fixed in
- 8.9.5
- What to do
- Update Directorist: AI-Powered Business Directory, Listings & Classified Ads to 8.9.5 or newer.
Sep 23, 2026Directorist: AI-Powered Business Directory, Listings & Classified Ads: Does not check user capabilitiesCVE-2026-84027 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not check user capabilities when creating orders through its REST API, allowing users with the subscriber role and above to create paid order and payment records with arbitrary amounts and attribute them to other users.
- Product
- Directorist: AI-Powered Business Directory, Listings & Classified Ads
- Fixed in
- 8.9.5
- What to do
- Update Directorist: AI-Powered Business Directory, Listings & Classified Ads to 8.9.5 or newer.
Sep 23, 2026Directorist: AI-Powered Business Directory, Listings & Classified Ads: Does not restrict access to a REST endpoint that returns user recordsCVE-2026-84026 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not restrict access to a REST endpoint that returns user records, allowing unauthenticated attackers to read registered users' private contact details.
- Product
- Directorist: AI-Powered Business Directory, Listings & Classified Ads
- Fixed in
- 8.9.5
- What to do
- Update Directorist: AI-Powered Business Directory, Listings & Classified Ads to 8.9.5 or newer.
Sep 23, 2026Email Subscribers & Newsletters: Does not verify the per-subscriber management token before changing a subscriber's subscription statusCVE-2026-83555 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Email Subscribers & Newsletters WordPress plugin before 5.9.35 does not verify the per-subscriber management token before changing a subscriber's subscription status, allowing unauthenticated users to force-unsubscribe or force-confirm an arbitrary subscriber whose email address they know.
- Product
- Email Subscribers & Newsletters
- Fixed in
- 5.9.35
- What to do
- Update Email Subscribers & Newsletters to 5.9.35 or newer.
Sep 23, 2026WP OAuth Server ( Login with WordPress ): Does not bind the OpenID Connect identity assertion it issues to the authorization grant being exchangedCVE-2026-82843 · WordPress plugins & themes · reported by WPScanCritical 9
The WP OAuth Server ( Login with WordPress ) WordPress plugin before 6.4.0 does not bind the OpenID Connect identity assertion it issues to the authorization grant being exchanged, returning instead the assertion belonging to whichever user authenticated most recently, which allows users with the Subscriber role and above to obtain a validly signed identity assertion for another user, including an administrator, and authenticate as them at any application that uses the site for single sign-on.
- Product
- WP OAuth Server ( Login with WordPress )
- Fixed in
- 6.4.0
- What to do
- Update WP OAuth Server ( Login with WordPress ) to 6.4.0 or newer.
Sep 23, 2026MasterStudy LMS: Does not perform a per-object ownership checkCVE-2026-81339 · WordPress plugins & themes · reported by WPScanMedium 4.3
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not perform a per-object ownership check when returning a quiz attempt result, allowing any authenticated user with a minimal (subscriber) role to read other students' quiz grades, pass/fail status and attempt timestamps by referencing an attempt identifier belonging to another user.
- Product
- MasterStudy LMS
- Fixed in
- 3.7.50
- What to do
- Update MasterStudy LMS to 3.7.50 or newer.
Sep 23, 2026MasterStudy LMS: Does not properly sanitise and restrict HTML in user-submitted content before storing it and rendering it to other usersCVE-2026-81338 · WordPress plugins & themes · reported by WPScanMedium 4.6
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not properly sanitise and restrict HTML in user-submitted content before storing it and rendering it to other users, allowing users with subscriber-level accounts and above to perform stored HTML injection, such as embedding iframes, that can be leveraged for phishing and content spoofing against other users viewing the content.
- Product
- MasterStudy LMS
- Fixed in
- 3.7.50
- What to do
- Update MasterStudy LMS to 3.7.50 or newer.
Sep 23, 2026Payment Plugins for PayPal WooCommerce: Does not verify that a PayPal order supplied in a payment request belongs to the WooCommerce order being paid unless that PayPal order has already been completedCVE-2026-80342 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Payment Plugins for PayPal WooCommerce WordPress plugin before 2.0.27 does not verify that a PayPal order supplied in a payment request belongs to the WooCommerce order being paid unless that PayPal order has already been completed, allowing unauthenticated attackers to have another buyer's approved but uncaptured payment captured against an order of their own.
- Product
- Payment Plugins for PayPal WooCommerce
- Fixed in
- 2.0.27
- What to do
- Update Payment Plugins for PayPal WooCommerce to 2.0.27 or newer.
Sep 23, 2026Directorist: AI-Powered Business Directory, Listings & Classified Ads: Does not scope one of its REST collection endpoints to the requesting userCVE-2026-77766 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not scope one of its REST collection endpoints to the requesting user, allowing users with a subscriber-level account to read every customer's order and payment records. Versions 8.8.1 to 8.9 are not affected. The endpoint was scoped correctly in 8.8.1 and the unscoped behaviour was reintroduced in 8.9.1.
- Product
- Directorist: AI-Powered Business Directory, Listings & Classified Ads
- Fixed in
- 8.9.5
- What to do
- Update Directorist: AI-Powered Business Directory, Listings & Classified Ads to 8.9.5 or newer.
Sep 23, 2026Better Payment: Does not validate the submitted payment amount server-side against the merchant's configured fixed price before building the gateway chargeCVE-2026-77765 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Better Payment WordPress plugin before 2.3.4 does not validate the submitted payment amount server-side against the merchant's configured fixed price before building the gateway charge, allowing unauthenticated users to pay an arbitrary reduced amount for a fixed-price item.
- Product
- Better Payment
- Fixed in
- 2.3.4
- What to do
- Update Better Payment to 2.3.4 or newer.
Sep 23, 2026YAHMAN Add-ons: Does not validate the type of the remote files it caches in a publicly accessible directoryCVE-2026-75799 · WordPress plugins & themes · reported by WPScanCritical 9
The YAHMAN Add-ons WordPress plugin before 0.9.31 does not validate the type of the remote files it caches in a publicly accessible directory, allowing unauthenticated attackers to write arbitrary PHP files on the server and achieve RCE when the relevant feature is enabled.
- Product
- YAHMAN Add-ons
- Fixed in
- 0.9.31
- What to do
- Update YAHMAN Add-ons to 0.9.31 or newer.
Sep 23, 2026zportals: Does not perform any capability or nonce check on one of its AJAX actionsCVE-2026-18365 · WordPress plugins & themes · reported by WPScanMedium 4.3
The zportals WordPress plugin before 6.4.2 does not perform any capability or nonce check on one of its AJAX actions, allowing users with a subscriber-level account to disclose the display name and email address of every registered user, including administrators.
- Product
- zportals
- Fixed in
- 6.4.2
- What to do
- Update zportals to 6.4.2 or newer.
Sep 23, 2026zportals: Does not perform any capability or nonce check on several of its AJAX actionsCVE-2026-18364 · WordPress plugins & themes · reported by WPScanMedium 4.3
The zportals WordPress plugin before 6.4.2 does not perform any capability or nonce check on several of its AJAX actions, allowing users with a subscriber-level account to modify the zportals WordPress plugin before 6.4.2's stored integration settings.
- Product
- zportals
- Fixed in
- 6.4.2
- What to do
- Update zportals to 6.4.2 or newer.
Sep 23, 2026Newsletters: Does not perform an ownership check on some of its subscriber management actionsCVE-2026-16264 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Newsletters WordPress plugin before 4.18.1 does not perform an ownership check on some of its subscriber management actions, and issues a management session to unauthenticated visitors on request, allowing attackers to read any subscriber's personal data and overwrite any subscriber's record including their email address.
- Product
- Newsletters
- Fixed in
- 4.18.1
- What to do
- Update Newsletters to 4.18.1 or newer.
Sep 23, 2026divi-dash: Does not validate the source of the client IP address it uses for rate limiting and banningCVE-2026-14321 · WordPress plugins & themes · reported by WPScanHigh 8.2
The divi-dash WordPress plugin before 1.0.7 does not validate the source of the client IP address it uses for rate limiting and banning, allowing unauthenticated attackers to spoof arbitrary IP addresses in order to bypass rate limiting, ban chosen addresses from the feature, and grow a stored option without bound, resulting in denial of service.
- Product
- divi-dash
- Fixed in
- 1.0.7
- What to do
- Update divi-dash to 1.0.7 or newer.
Sep 23, 2026Real3D Flipbook: Does not sanitize or escape several flipbook editor fields before rendering them back in the admin editorCVE-2025-15696 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Real3D Flipbook WordPress plugin before 5.4 does not sanitize or escape several flipbook editor fields before rendering them back in the admin editor, allowing users with the Author role and above to inject arbitrary web scripts that execute in the browser of any user who later opens the affected flipbook for editing, including administrators.
- Product
- Real3D Flipbook
- Fixed in
- 5.4
- What to do
- Update Real3D Flipbook to 5.4 or newer.
Sep 23, 2026jet-form-builder-stripe-gateway: Does not sanitise and escape a payment token before using it in a SQL statementCVE-2022-4997 · WordPress plugins & themes · reported by WPScanHigh 8.6
The jet-form-builder-stripe-gateway WordPress plugin before 1.1.0 does not sanitise and escape a payment token before using it in a SQL statement, allowing unauthenticated users to extract arbitrary data from the database, including password hashes.
- Product
- jet-form-builder-stripe-gateway
- Fixed in
- 1.1.0
- What to do
- Update jet-form-builder-stripe-gateway to 1.1.0 or newer.
Sep 22, 2026MarketKing: Missing authorizationCVE-2026-93344 · WordPress plugins & themes · reported by VulnCheckHigh 7.1
MarketKing plugin for WordPress before 2.1.72 contains a missing authorization vulnerability in the marketking_get_page_content AJAX action that allows authenticated attackers with subscriber-level access or higher to access arbitrary vendor administrator panel pages by supplying an arbitrary vendor user ID. Attackers can bypass authorization controls by submitting a target vendor ID in the request to access payout pages, financial reports, and vendor dashboard content belonging to any vendor in the marketplace.
- Product
- MarketKing
- Fixed in
- 2.1.72
- What to do
- Update MarketKing to 2.1.72 or newer.
Sep 22, 2026MarketKing: Missing authorizationCVE-2026-93343 · WordPress plugins & themes · reported by VulnCheckHigh 7.1
MarketKing plugin for WordPress before 2.1.72 contains a missing authorization vulnerability in the marketking_admin_vendors_ajax AJAX action that allows authenticated attackers with subscriber-level access or higher to retrieve the complete vendor directory by sending a crafted AJAX request. Attackers can exploit the absence of capability checks in the vendor management action to retrieve internal user IDs, usernames, and email addresses of all registered vendors, exposing personally identifiable information to any logged-in user regardless of role.
- Product
- MarketKing
- Fixed in
- 2.1.72
- What to do
- Update MarketKing to 2.1.72 or newer.
Sep 22, 2026MarketKing: Missing authorizationCVE-2026-93342 · WordPress plugins & themes · reported by VulnCheckMedium 5.3
MarketKing plugin for WordPress before 2.1.72 contains a missing authorization vulnerability in the marketking_duplicate_product AJAX action that allows authenticated attackers with subscriber-level access or higher to duplicate any vendor's product by supplying an arbitrary product ID. Attackers can bypass ownership verification to copy any vendor's product listings, including private product metadata, and assign the duplicated copy to their own vendor account without the victim's knowledge or consent.
- Product
- MarketKing
- Fixed in
- 2.1.72
- What to do
- Update MarketKing to 2.1.72 or newer.
Sep 22, 2026MarketKing: Missing authorizationCVE-2026-93341 · WordPress plugins & themes · reported by VulnCheckMedium 5.3
MarketKing plugin for WordPress before 2.1.72 contains a missing authorization vulnerability in the marketking_send_refund AJAX action that allows authenticated attackers with subscriber-level access or higher to create refund requests against any order by supplying an arbitrary order ID. Attackers can submit crafted AJAX requests targeting any order ID to create fraudulent refund requests against orders they did not place, enabling marketplace disruption and unauthorized interference with other users' orders.
- Product
- MarketKing
- Fixed in
- 2.1.72
- What to do
- Update MarketKing to 2.1.72 or newer.
Sep 22, 2026DevItems HashBar – WordPress Notification Bar: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-94117 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in DevItems HashBar – WordPress Notification Bar allows Blind SQL Injection. This issue affects HashBar – WordPress Notification Bar: from n/a through 2.0.3.
- Product
- DevItems HashBar – WordPress Notification Bar
- Affected
- up to 2.0.3
- What to do
- Affects up to 2.0.3. Update DevItems HashBar – WordPress Notification Bar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2026WP Travel Engine – Tour Booking Plugin – Tour Operator Software: Local File InclusionCVE-2026-9231 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 6.8.0 via the wte_get_template function. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.
- Product
- WP Travel Engine – Tour Booking Plugin – Tour Operator Software
- Affected
- up to 6.8.0
- What to do
- Affects up to 6.8.0. Update WP Travel Engine – Tour Booking Plugin – Tour Operator Software to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 22, 2026Magepeople inc: Authentication Bypass Using an Alternate Path or ChannelCVE-2026-93928 · WordPress plugins & themes · reported by PatchstackHigh 7.3
Authentication Bypass Using an Alternate Path or Channel vulnerability in Magepeople inc. Taxi Booking Manager for WooCommerce allows Authentication Bypass. This issue affects Taxi Booking Manager for WooCommerce: from n/a before 2.0.8.
- Product
- Magepeople inc
- Fixed in
- 2.0.8
- What to do
- Update Magepeople inc to 2.0.8 or newer.
Sep 22, 2026Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping & Social Channels: Directory TraversalCVE-2026-15095 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping & Social Channels plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.6.43 via the 'provider' parameter. This makes it possible for authenticated attackers, with shop manager-level access and above, to delete arbitrary files on the server, which can lead to remote code execution when critical files are deleted. Exploitation requires two sequential REST API calls: first to /wp-json/ctxfeed/v1/make_feed/save_feed_config to persist the traversal payload in wp_options, then to /wp-json/ctxfeed/v1/manage_feeds/delete_feed to trigger the unlink(); deletion is further constrained to files whose extensions match the plugin's validated whitelist (csv, xml, tsv, xls, xlsx, json, txt).
- Product
- Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping & Social Channels
- Affected
- up to 6.6.43
- What to do
- Affects up to 6.6.43. Update Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping & Social Channels to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 22, 2026WP-CRM System – Manage Clients and Projects: Sensitive Information ExposureCVE-2026-9004 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP-CRM System – Manage Clients and Projects plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.4.6 via the 'contact_id' parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to extract full names, email addresses, phone numbers, mobile numbers, fax numbers, and physical address information of arbitrary CRM contact records by enumerating the contact_id parameter.
- Product
- WP-CRM System – Manage Clients and Projects
- Affected
- up to 3.4.6
- What to do
- Affects up to 3.4.6. Update WP-CRM System – Manage Clients and Projects to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 22, 2026WPC Product Bundles for WooCommerce: Stored Cross-Site ScriptingCVE-2026-93836 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The WPC Product Bundles for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'qty' parameter in all versions up to, and including, 8.6.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The float cast used during quantity validation allows a numeric-prefixed payload such as '1<img src=x onerror=...>' to pass validation while retaining its malicious HTML, which is then stored verbatim in order item metadata under the '_woosb_ids' key.
- Product
- WPC Product Bundles for WooCommerce
- Affected
- up to 8.6.6
- What to do
- Affects up to 8.6.6. Update WPC Product Bundles for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 22, 2026WP Yelp Review Slider: Stored Cross-Site ScriptingCVE-2026-93778 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The WP Yelp Review Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Yelp Review Text (imported via wpyelp_download_source) in all versions up to, and including, 9.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The malicious payload originates from an anonymous Yelp reviewer on a public platform and requires no WordPress account; it is introduced into the database during the site administrator's ordinary use of the plugin's Download Reviews feature, making the effective attacker unauthenticated.
- Product
- WP Yelp Review Slider
- Affected
- up to 9.2
- What to do
- Affects up to 9.2. Update WP Yelp Review Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 22, 2026HUSKY – Products Filter for WooCommerce Professional: Local File InclusionCVE-2026-92969 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The HUSKY – Products Filter for WooCommerce Professional plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.4.4 via the 'shortcode' parameter parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. This vulnerability is exploitable by unauthenticated users because the only access control is a nonce check against woof_front_nonce, which is publicly emitted into inline JavaScript on every front-end page and is therefore obtainable by any site visitor without authentication.
- Product
- HUSKY – Products Filter for WooCommerce Professional
- Affected
- up to 1.4.4
- What to do
- Affects up to 1.4.4. Update HUSKY – Products Filter for WooCommerce Professional to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 22, 2026The WP Ultimate Review: Arbitrary shortcode executionCVE-2026-92235 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The The WP Ultimate Review plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.4.2. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for authenticated attackers, with subscriber-level access and above, to execute arbitrary shortcodes.
- Product
- The WP Ultimate Review
- Affected
- up to 2.4.2
- What to do
- Affects up to 2.4.2. Update The WP Ultimate Review to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 22, 2026wpForo Forum: Authorization bypassCVE-2026-91092 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The wpForo Forum plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.1.5. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to take over another guest author's forum post and modify its title, body, author name, and stored owner email address. This requires that guest posting and editing are enabled on the forum, and that the attacker knows the target guest author's email address.
- Product
- wpForo Forum
- Affected
- up to 3.1.5
- What to do
- Affects up to 3.1.5. Update wpForo Forum to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 22, 2026ThumbPress: Unauthorized accessCVE-2026-7622 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The ThumbPress plugin for WordPress is vulnerable to unauthorized access in versions up to and including 6.2.1. This is due to missing capability checks and nonce verification in the send_deactivation_survey() function registered via the wp_ajax_pl-plugin-deactivation AJAX action. This makes it possible for authenticated attackers, with Subscriber-level access and above, to deactivate the ThumbPress plugin on the affected site by sending a crafted POST request to admin-ajax.
- Product
- ThumbPress
- Affected
- up to 6.2.1
- What to do
- Affects up to 6.2.1. Update ThumbPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 22, 2026WP Table Builder – Drag & Drop Table Builder: Incorrect AuthorizationCVE-2026-6922 · WordPress plugins & themes · reported by WordfenceHigh 7.1
The WP Table Builder – Drag & Drop Table Builder plugin for WordPress is vulnerable to Incorrect Authorization in all versions up to, and including, 2.2.1. This is due to an operator precedence bug in the post-type guard within the trash_table_bulk() and restore_table_bulk() functions that causes the guard to never fire, combined with a permission callback that only verifies plugin role membership without per-post-type or ownership checks. This makes it possible for authenticated attackers, with subscriber-level access and above, to trash or restore any post, page, or custom post type on the site by supplying arbitrary post IDs.
- Product
- WP Table Builder – Drag & Drop Table Builder
- Affected
- up to 2.2.1
- What to do
- Affects up to 2.2.1. Update WP Table Builder – Drag & Drop Table Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 22, 2026RW Elephant Rental Inventory: Missing AuthorizationCVE-2026-4123 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The RW Elephant Rental Inventory plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including 2.3.13. This is due to a missing capability check on the toggle_cache() function which is hooked to the wp_ajax_toggle_cache AJAX action. The function also lacks nonce verification. This makes it possible for authenticated attackers, with Subscriber-level access and above, to toggle the plugin's cache setting on or off by sending a POST request to admin-ajax.
- Product
- RW Elephant Rental Inventory
- Affected
- up to 2.3.13
- What to do
- Affects up to 2.3.13. Update RW Elephant Rental Inventory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 22, 2026Hostel: Stored Cross-Site ScriptingCVE-2026-1645 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Hostel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'custom_currency' parameter and the 'locale_url' setting in all versions up to, and including, 1.1.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
- Product
- Hostel
- Affected
- up to 1.1.8
- What to do
- Affects up to 1.1.8. Update Hostel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 22, 2026Tutor LMS – eLearning and online course solution: Insecure Direct Object ReferenceCVE-2026-18439 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 4.0.7 via the tutor_quiz_builder_save AJAX action due to missing validation that nested question_id, answer_id, deleted_question_ids[], and deleted_answer_ids[] values in the submitted payload belong to a quiz/topic/course the requester is authorized to manage. The handler only validates the top-level course_id, topic_id, and (when supplied) payload['ID'], but the nested identifiers are passed straight into $wpdb->update/DELETE statements in QuizBuilder::save_questions(), QuizBuilder::save_question_answers(), and QuizBuilder::handle_delete(). This makes it possible for authenticated attackers, with Instructor-level access and above, to overwrite the content and re-parent arbitrary quiz questions/answers belonging to other instructors or administrators, and to delete arbitrary quiz question and answer rows.
- Product
- Tutor LMS – eLearning and online course solution
- Affected
- up to 4.0.7
- What to do
- Affects up to 4.0.7. Update Tutor LMS – eLearning and online course solution to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 22, 2026WP User Manager: Unauthorized modification of dataCVE-2026-18345 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP User Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the Connect::complete() function in versions up to, and including, 2.9.18. The function is registered on the admin_init hook (which fires for every authenticated user that reaches /wp-admin/, including Subscribers) and performs no current_user_can() or nonce verification before fetching Stripe credentials from the external WPUM connect service and writing them (publishable key, secret key, gateway mode, and connected Stripe account ID) into the wpum_settings option via wpum_update_option()/update_option(). This makes it possible for authenticated attackers, with Subscriber-level access and above, to hijack the site's Stripe integration by completing their own Stripe Connect OAuth flow and then invoking the callback on the target site, causing all subsequent Stripe payments to be routed to the attacker's Stripe account.
- Product
- WP User Manager
- Affected
- up to 2.9.18
- What to do
- Affects up to 2.9.18. Update WP User Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 22, 2026Live Composer – Free WordPress Website Builder: Stored Cross-Site ScriptingCVE-2026-16778 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'dslc_module_downloads_output' Shortcode Content in all versions up to, and including, 2.1.21 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The save-time wp_kses_post check is bypassed because the payload is stored as a serialized string containing no HTML tags for kses to tokenize, and the shortcode callback re-emits attacker-controlled values — including view_all_link (href attribute), main_heading_title (h2 body), button_text (anchor body), and button_inline_svg (anchor body) — without any escaping at render time.
- Product
- Live Composer – Free WordPress Website Builder
- Affected
- up to 2.1.21
- What to do
- Affects up to 2.1.21. Update Live Composer – Free WordPress Website Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 22, 2026Custom Field Template: Insecure Direct Object ReferenceCVE-2026-12995 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Custom Field Template plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.7.8 via the edit_meta_value due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with contributor-level access and above, to delete arbitrary media attachments site-wide by supplying any numeric attachment ID in the file-field parameter alongside the corresponding delete flag, causing content loss and broken pages. Exploitation requires that the attacker's post is governed by a Custom Field Template containing at least one file-type field with the mediaRemove option not enabled, which is the default configuration for file fields.
- Product
- Custom Field Template
- Affected
- up to 2.7.8
- What to do
- Affects up to 2.7.8. Update Custom Field Template to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 22, 2026BM Content Builder: Arbitrary file deletionCVE-2025-1281 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The BM Content Builder plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the ux_cb_remove_layout_ajax() and ux_cb_tools_export_ajax() functions in all versions up to, and excluding, 3.17.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
- Product
- BM Content Builder
- What to do
- Update BM Content Builder to the newest version.
Sep 22, 2026BM Content Builder: Directory TraversalCVE-2025-1280 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The BM Content Builder plugin for WordPress is vulnerable to Directory Traversal in all versions up to 3.17.1 (exclusive) via the ux_cb_page_customize_save_layout_ajax() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.
- Product
- BM Content Builder
- What to do
- Update BM Content Builder to the newest version.
Sep 22, 2026Handily: Unauthorized payment settings modificationCVE-2025-14487 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Handily plugin for WordPress is vulnerable to unauthorized payment settings modification due to missing authorization checks in all versions up to, and including, 1.0.3. This makes it possible for unauthenticated attackers to modify Stripe payment configuration settings, including publishable keys, secret keys, email addresses, success URLs, and cancel URLs via the payment settings parameters. This could allow attackers to redirect payments to their own Stripe accounts.
- Product
- Handily
- Affected
- up to 1.0.3
- What to do
- Affects up to 1.0.3. Update Handily to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2026PixelPlay: Unauthorized API key deletionCVE-2025-14486 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The PixelPlay plugin for WordPress is vulnerable to unauthorized API key deletion due to missing authorization checks in all versions up to, and including, 1.0.2. This makes it possible for unauthenticated attackers to delete arbitrary API keys (Pixabay, Unsplash, Pixels, OpenAI) configured by site administrators via the 'clear_api_type' parameter.
- Product
- PixelPlay
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update PixelPlay to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2026Image Buzz: Unauthorized API key modificationCVE-2025-14484 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Image Buzz plugin for WordPress is vulnerable to unauthorized API key modification due to missing authorization checks in all versions up to, and including, 1.0.3. This makes it possible for unauthenticated attackers to modify arbitrary API keys (Pixabay, Unsplash, Pixels) configured by site administrators via the 'pixabay_api', 'unsplash_api', or 'pixels_api' parameters.
- Product
- Image Buzz
- Affected
- up to 1.0.3
- What to do
- Affects up to 1.0.3. Update Image Buzz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2026Ninja Forms 3.15.3 stores an anonymous non-RTE textarea value and renders it without safe HTML encoding in the legacy submission editor.CVE-2026-94504 · WordPress plugins & themes · reported by WordfenceHigh 7.2
Ninja Forms 3.15.3 stores an anonymous non-RTE textarea value and renders it without safe HTML encoding in the legacy submission editor. An attacker can break out of the textarea with stored script. When an Administrator opens the attacker-known direct submission URL, the script runs in the WordPress admin origin.
- What to do
- Update the plugin to the newest version.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 22, 2026The Ninja Forms WordPress plugin 3.15.3 does not escape submitted form field values before outputting them on the submission edit screen in the admin area, whicCVE-2026-92438 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Ninja Forms WordPress plugin 3.15.3 does not escape submitted form field values before outputting them on the submission edit screen in the admin area, which could allow unauthenticated users to submit values through a public form that then execute in the browser of any high-privileged user who reviews the submission.
- What to do
- Update the plugin to the newest version.
Sep 22, 2026The Ninja Forms WordPress plugin 3.15.3 does not prevent user-submitted form field values from being deserialised when an administrator later exports form submiCVE-2026-91827 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Ninja Forms WordPress plugin 3.15.3 does not prevent user-submitted form field values from being deserialised when an administrator later exports form submissions to CSV, allowing unauthenticated attackers to perform PHP Object Injection; if a suitable POP chain is present via another installed plugin or theme, this can lead to actions such as arbitrary file operations or remote code execution.
- What to do
- Update the plugin to the newest version.
Sep 22, 2026TranslatePress – Translate Multilingual sites with AI Translation: Stored Cross-Site ScriptingCVE-2026-89412 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Translation Memory Suggestion Panel (v-html on suggestion.original) in all versions up to, and including, 3.3.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Unauthenticated attackers can seed the translation dictionary's original column with executable HTML because the front-end rendering pipeline decodes entity-encoded payloads via html_entity_decode() before persistence, and the original column is deliberately exempt from kses filtering — meaning no save-time sanitizer neutralizes the stored payload before it is later rendered in an administrator's session.
- Product
- TranslatePress – Translate Multilingual sites with AI Translation
- Affected
- up to 3.3.5
- What to do
- Affects up to 3.3.5. Update TranslatePress – Translate Multilingual sites with AI Translation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. The WordPress, CMS and hosting-panel entries come from the National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan and others); we show who. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, a booking system, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.