Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
24,205 results · page 45 of 485
Sep 11, 2026Subscriber Privilege Escalation in SMS Alert Order Notifications <= 3.9.9 versions.CVE-2026-62106 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Subscriber Privilege Escalation in SMS Alert Order Notifications <= 3.9.9 versions.
- Affected
- up to 3.9.9
- What to do
- Affects up to 3.9.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 11, 2026Unauthenticated PHP Object Injection in ThemeREX Addons < 2.45.0 versions.CVE-2026-62105 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in ThemeREX Addons < 2.45.0 versions.
- What to do
- Update the plugin to the newest version.
Sep 11, 2026Unauthenticated PHP Object Injection in Everest Forms <= 3.6.0 versions.CVE-2026-62103 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in Everest Forms <= 3.6.0 versions.
- Affected
- up to 3.6.0
- What to do
- Affects up to 3.6.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 11, 2026Subscriber Privilege Escalation in Gato GraphQL <= 19.2.3 versions.CVE-2026-62102 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Subscriber Privilege Escalation in Gato GraphQL <= 19.2.3 versions.
- Affected
- up to 19.2.3
- What to do
- Affects up to 19.2.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 11, 2026Master Addons for Elementor: Missing AuthorizationCVE-2026-62089 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Missing Authorization vulnerability in Pixar Labs Master Addons for Elementor allows Privilege Abuse. This issue affects Master Addons for Elementor: from n/a through 3.2.2.
- Product
- Master Addons for Elementor
- Affected
- up to 3.2.2
- What to do
- Affects up to 3.2.2. Update Master Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 11, 2026ElasticPress: Insertion of Sensitive Information Into Sent DataCVE-2026-62088 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Insertion of Sensitive Information Into Sent Data vulnerability in 10up ElasticPress allows Retrieve Embedded Sensitive Data. This issue affects ElasticPress: from n/a through 5.3.4.
- Product
- ElasticPress
- Affected
- up to 5.3.4
- What to do
- Affects up to 5.3.4. Update ElasticPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 11, 2026Unauthenticated Broken Access Control in Deposits and Partial Payments for WooCommerce <= 3.1.0 versions.CVE-2026-27378 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Broken Access Control in Deposits and Partial Payments for WooCommerce <= 3.1.0 versions.
- Affected
- up to 3.1.0
- What to do
- Affects up to 3.1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 11, 2026GamiPress: Authenticated (Subscriber+) SQL InjectionCVE-2026-15439 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The GamiPress plugin for WordPress is vulnerable to authenticated (Subscriber+) SQL Injection via the 'q' parameter of the wpForo integration AJAX selector (action gamipress_wpforo_get_posts) in versions up to, and including, 7.9.7. The value is passed only through $wpdb->esc_like() and interpolated directly into a single-quoted LIKE clause with no %s placeholder. Because esc_like() runs after WordPress core magic quotes, it doubles the injected backslash (\' -> \\'), which MySQL reads as one literal backslash followed by a live closing quote, allowing the attacker to break out of the string and inject boolean-based SQL. The wpForo plugin only needs to be active to register the callback; no wpForo vulnerability is used. Requires a Subscriber account, which can read the gamipress_admin nonce (exposed on every admin page, e.g. /wp-admin/profile.php). Note: the researcher's Simple:Press vectors (PoC 2 & 3) do not reproduce in current code, which uses $wpdb->prepare() with %s placeholders; only the wpForo selector is confirmed.
- Product
- GamiPress
- Affected
- up to 7.9.7
- What to do
- Affects up to 7.9.7. Update GamiPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 11, 2026MetForm: Does not properly neutralize newline characters in user-submitted values that are placed into notification email headersCVE-2026-86813 · WordPress plugins & themes · reported by WPScanMedium 4.8
The MetForm WordPress plugin before 4.1.9 does not properly neutralize newline characters in user-submitted values that are placed into notification email headers, allowing unauthenticated attackers to inject additional email headers, such as Bcc, into the emails the site sends when a submitted field value is configured to populate a header.
- Product
- MetForm
- Fixed in
- 4.1.9
- What to do
- Update MetForm to 4.1.9 or newer.
Sep 11, 2026The Payment Gateway PayPay for WooCommerce WordPress plugin from 0.5 to 0.9.3 does not verify the authenticity of the payment notifications it receives before aCVE-2026-82215 · WordPress plugins & themes · reported by WPScanMedium 5.9
The Payment Gateway PayPay for WooCommerce WordPress plugin from 0.5 to 0.9.3 does not verify the authenticity of the payment notifications it receives before acting on them, allowing unauthenticated attackers who know the store's merchant identifier to mark arbitrary orders as paid, or to cancel or fail them.
- What to do
- Update the plugin to the newest version.
Sep 11, 2026WPCafe: Does not correctly restrict access to a set of order-management REST endpoints because their permission callbacks return an incorrect type on failureCVE-2026-86812 · WordPress plugins & themes · reported by WPScanMedium 6.5
The WPCafe WordPress plugin before 3.0.18 does not correctly restrict access to a set of order-management REST endpoints because their permission callbacks return an incorrect type on failure, allowing unauthenticated users to disclose guest order information and to change the status of, or trash, any order.
- Product
- WPCafe
- Fixed in
- 3.0.18
- What to do
- Update WPCafe to 3.0.18 or newer.
Sep 11, 2026Visualizer: Does not properly authorise access to its chart-building actionsCVE-2026-86782 · WordPress plugins & themes · reported by WPScanMedium 5.5
The Visualizer WordPress plugin before 4.0.6 does not properly authorise access to its chart-building actions, allowing users with the Contributor role and above to publish, rename, and overwrite the content of posts and pages they do not own, including other users' private drafts.
- Product
- Visualizer
- Fixed in
- 4.0.6
- What to do
- Update Visualizer to 4.0.6 or newer.
Sep 11, 2026Visualizer: Does not properly authorise chart-deletion requestsCVE-2026-86779 · WordPress plugins & themes · reported by WPScanLow 2.7
The Visualizer WordPress plugin before 4.0.6 does not properly authorise chart-deletion requests, performing only a site-wide capability check with no per-object ownership verification, allowing users with the Contributor role and above to permanently delete any chart on the site, including charts created by other users such as administrators.
- Product
- Visualizer
- Fixed in
- 4.0.6
- What to do
- Update Visualizer to 4.0.6 or newer.
Sep 11, 2026advanced-customized-prompts: Does not verify the password before issuing an authenticated session for a supplied email address in an unauthenticated actionCVE-2026-14563 · WordPress plugins & themes · reported by WPScanCritical 9.8
The advanced-customized-prompts WordPress plugin through 1.0.1 does not verify the password before issuing an authenticated session for a supplied email address in an unauthenticated action, allowing unauthenticated attackers to log in as any registered user, including administrators, or to create arbitrary new accounts.
- Product
- advanced-customized-prompts
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update advanced-customized-prompts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 11, 2026teddy-bear-customize-addon: Does not perform any authorization or ownership checks before returning WooCommerce order metadata and the URLs of customer-uploaded attachmentsCVE-2026-14562 · WordPress plugins & themes · reported by WPScanMedium 5.3
The teddy-bear-customize-addon WordPress plugin through 1.0.5 does not perform any authorization or ownership checks before returning WooCommerce order metadata and the URLs of customer-uploaded attachments, allowing unauthenticated attackers to disclose other customers' order and attachment data.
- Product
- teddy-bear-customize-addon
- Affected
- up to 1.0.5
- What to do
- Affects up to 1.0.5. Update teddy-bear-customize-addon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 11, 2026UsersWP: Arbitrary File DeletionCVE-2026-19991 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The UsersWP plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 1.2.70 via the upload_file_remove() AJAX handler. The plugin stores the value of an account 'file' form field taken directly from $_POST when no real $_FILES upload is provided (process_account() calls uwp_validate_fields() and array_merges the result with the empty output of UsersWP_Files::validate_uploads()). At storage time the value is only checked with validate_file(), which passes any string that does not contain a literal '../'. When the value is later processed by upload_file_remove(), it is again gated with validate_file() and then normalized through uwp_get_file_relative_url(); that helper performs a global str_replace() of the uploads base URL against the stored URL, allowing a crafted URL containing embedded '..<uploads-baseurl>' tokens to collapse into '../../' traversal sequences after the last validation. The transformed value is then appended to the uploads base directory and passed to wp_delete_file() without any canonical containment check. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files o
- Product
- UsersWP
- Affected
- up to 1.2.70
- What to do
- Affects up to 1.2.70. Update UsersWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 11, 2026HUSKY – Products Filter Professional for WooCommerce: Reflected Cross-Site ScriptingCVE-2026-18562 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via SEO-friendly permalink filter URL segments in versions up to, and including, 1.4.3. This is due to insufficient input sanitization and output escaping in the wp_load_js() function, which reads filter values from the URL path via the url_request extension's parse_url_query() and embeds them into an inline JavaScript string using json_encode() without escaping single quotes. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a specially crafted link.
- Product
- HUSKY – Products Filter Professional for WooCommerce
- Affected
- up to 1.4.3
- What to do
- Affects up to 1.4.3. Update HUSKY – Products Filter Professional for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 11, 2026Unlimited Elements For Elementor: SQL InjectionCVE-2026-18561 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Unlimited Elements For Elementor plugin for WordPress is vulnerable to SQL Injection via the 'addontype' parameter in versions up to, and including, 2.0.16. This is due to insufficient escaping on the user-supplied parameter and the lack of sufficient preparation on the existing SQL query in the getWhereString() function; when the parameter is supplied as an array, element zero is used verbatim as the SQL comparison operator and concatenated into the WHERE clause without sanitization, while normalizeAjaxInputData() strips WordPress's magic_quotes protection from the value. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- Unlimited Elements For Elementor
- Affected
- up to 2.0.16
- What to do
- Affects up to 2.0.16. Update Unlimited Elements For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 11, 2026Sticky Chat Widget: SQL InjectionCVE-2026-15462 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Sticky Chat Widget plugin for WordPress is vulnerable to SQL Injection via the 'scw_form_fields' parameter array keys of the 'scw_save_form_data' AJAX action in versions up to, and including, 1.4.2. This is due to the save_form_data() function passing attacker-controlled POST array keys unsanitized to $wpdb->insert(), which wraps column identifiers in backticks without escaping them, allowing a backtick in an attacker-supplied key to break out of the column-identifier list into raw SQL; additionally, the use of filter_input() bypasses WordPress's wp_magic_quotes() protection, and the widget_id validation loop is skipped entirely when no valid widget_id is supplied, leaving $isValid at 1. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- Sticky Chat Widget
- Affected
- up to 1.4.2
- What to do
- Affects up to 1.4.2. Update Sticky Chat Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 11, 2026OTP Login & Register Woocommerce: Authentication BypassCVE-2026-12215 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The OTP Login & Register Woocommerce plugin for WordPress is vulnerable to Authentication Bypass via OTP Brute Force in all versions up to, and including, 2.7.2. The vulnerability exists because the OTP rate-limit attempt counter in `process_otp_form` is keyed exclusively on the attacker-controlled `xoo_ml_user_ip_data` cookie's `ip_address` field, allowing unlimited counter resets by simply rotating the cookie, while the OTP itself is generated with PHP's non-cryptographic `rand()` function over a default space of only 9,000 possible values (1000–9999), and both the OTP issuance endpoint (`xoo_ml_login_with_otp`) and verification endpoint (`xoo_ml_otp_form_submit`) are registered as unauthenticated `wp_ajax_nopriv` actions with no nonce or capability checks. This makes it possible for unauthenticated attackers to brute-force the OTP for any registered account and obtain a full WordPress authentication session — including for administrator accounts — via `wp_set_auth_cookie()` in `login_user_with_otp()`. Exploitation requires the attacker to know the target user's registered phone number, which is used to trigger OTP issuance via the unauthenticated `xoo_ml_login_with_otp` endpoint
- Product
- OTP Login & Register Woocommerce
- Affected
- up to 2.7.2
- What to do
- Affects up to 2.7.2. Update OTP Login & Register Woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 11, 2026Booktics – Booking Calendar for Appointments and Service Businesses: Unauthorized modification of dataCVE-2026-11446 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Booktics – Booking Calendar for Appointments and Service Businesses plugin for WordPress is vulnerable to unauthorized modification of data in all versions up to, and including, 1.0.23. This is due to the create_order_permission() permission callback on the POST /wp-json/booktics/v1/orders REST route unconditionally returning true, combined with find_and_update_guest() overwriting an existing customer record's stored name, phone, and wp_user_id whenever the caller-supplied email matches, with no proof of ownership. This makes it possible for unauthenticated attackers to overwrite the contact details (name and phone) of any existing customer whose email address they know, poisoning downstream reminder emails, SMS, calendar invites, and CRM data.
- Product
- Booktics – Booking Calendar for Appointments and Service Businesses
- Affected
- up to 1.0.23
- What to do
- Affects up to 1.0.23. Update Booktics – Booking Calendar for Appointments and Service Businesses to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 10, 2026AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for: Directory TraversalCVE-2026-77807 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 11.0.4 via the `user[name]` Parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. Exploitation requires "Embed images" option in AcyMailing configuration being enabled.
- Product
- AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for
- Affected
- up to 11.0.4
- What to do
- Affects up to 11.0.4. Update AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Sep 10, 2026import_contacts Path Traversal in Groundhogg <= 4.7.1 versions.CVE-2026-85310 · WordPress plugins & themes · reported by PatchstackMedium 6.5
import_contacts Path Traversal in Groundhogg <= 4.7.1 versions.
- Affected
- up to 4.7.1
- What to do
- Affects up to 4.7.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 10, 2026Unauthenticated Broken Access Control in WP Fast Total Search <= 1.82.284 versions.CVE-2026-84821 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in WP Fast Total Search <= 1.82.284 versions.
- Affected
- up to 1.82.284
- What to do
- Affects up to 1.82.284. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 10, 2026Unauthenticated Cross Site Scripting (XSS) in WPAdverts <= 2.3.3 versions.CVE-2026-84819 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in WPAdverts <= 2.3.3 versions.
- Affected
- up to 2.3.3
- What to do
- Affects up to 2.3.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 10, 2026Unauthenticated Cross Site Scripting (XSS) in WPCS <= 1.3.2 versions.CVE-2026-84816 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in WPCS <= 1.3.2 versions.
- Affected
- up to 1.3.2
- What to do
- Affects up to 1.3.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 10, 2026Unauthenticated Privilege Escalation in SiteSkite <= 2.1.5 versions.CVE-2026-81805 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Privilege Escalation in SiteSkite <= 2.1.5 versions.
- Affected
- up to 2.1.5
- What to do
- Affects up to 2.1.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 10, 2026Unauthenticated Sensitive Data Exposure in ZHBackup – Backup, Restore & Migration <= 2.4.2 versions.CVE-2026-81804 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Sensitive Data Exposure in ZHBackup – Backup, Restore & Migration <= 2.4.2 versions.
- Affected
- up to 2.4.2
- What to do
- Affects up to 2.4.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 10, 2026Subscriber Remote Code Execution (RCE) in RepairBuddy <= 4.1224 versions.CVE-2026-81803 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Subscriber Remote Code Execution (RCE) in RepairBuddy <= 4.1224 versions.
- Affected
- up to 4.1224
- What to do
- Affects up to 4.1224. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 10, 2026Subscriber Settings Change in WP-Stateless <= 4.4.1 versions.CVE-2026-81801 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Subscriber Settings Change in WP-Stateless <= 4.4.1 versions.
- Affected
- up to 4.4.1
- What to do
- Affects up to 4.4.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 10, 2026Unauthenticated SQL Injection in Verified Reviews (Avis Vérifiés) <= 2.4.6 versions.CVE-2026-81800 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in Verified Reviews (Avis Vérifiés) <= 2.4.6 versions.
- Affected
- up to 2.4.6
- What to do
- Affects up to 2.4.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 10, 2026Unauthenticated Broken Access Control in Return Refund and Exchange For WooCommerce <= 4.6.4 versions.CVE-2026-81799 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in Return Refund and Exchange For WooCommerce <= 4.6.4 versions.
- Affected
- up to 4.6.4
- What to do
- Affects up to 4.6.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 10, 2026WP Travel: Authentication Bypass Using an Alternate Path or ChannelCVE-2026-81796 · WordPress plugins & themes · reported by PatchstackHigh 7.3
Authentication Bypass Using an Alternate Path or Channel vulnerability in WEN Solutions WP Travel wp-travel allows Password Recovery Exploitation.This issue affects WP Travel: from n/a through 12.0.3.
- Product
- WP Travel
- Affected
- up to 12.0.3
- What to do
- Affects up to 12.0.3. Update WP Travel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 10, 2026Unauthenticated Cross Site Scripting (XSS) in Page Visits Counter – Lite <= 1.2.3 versions.CVE-2026-81795 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Page Visits Counter – Lite <= 1.2.3 versions.
- Affected
- up to 1.2.3
- What to do
- Affects up to 1.2.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 10, 2026Unauthenticated Broken Access Control in Shirt Product Designer for WooCommerce 1.0.4 versions.CVE-2026-81794 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in Shirt Product Designer for WooCommerce 1.0.4 versions.
- What to do
- Update the plugin to the newest version.
Sep 10, 2026Salon booking system: Missing AuthorizationCVE-2026-81793 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Dimitri Grassi Salon booking system salon-booking-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Salon booking system: from n/a through 10.31.9.
- Product
- Salon booking system
- Affected
- up to 10.31.9
- What to do
- Affects up to 10.31.9. Update Salon booking system to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 10, 2026Subscriber Cross Site Scripting (XSS) in EventON <= 2.5.7 versions.CVE-2026-81791 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Subscriber Cross Site Scripting (XSS) in EventON <= 2.5.7 versions.
- Affected
- up to 2.5.7
- What to do
- Affects up to 2.5.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 10, 2026Advanced Product Fields Extended for WooCommerce: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2026-81789 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Studio Wombat Advanced Product Fields Extended for WooCommerce allows Path Traversal. This issue affects Advanced Product Fields Extended for WooCommerce: from n/a through 3.1.6.
- Product
- Advanced Product Fields Extended for WooCommerce
- Affected
- up to 3.1.6
- What to do
- Affects up to 3.1.6. Update Advanced Product Fields Extended for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 10, 2026Subscriber Broken Access Control in IMPress for IDX Broker <= 3.3.0 versions.CVE-2026-81788 · WordPress plugins & themes · reported by PatchstackMedium 6.3
Subscriber Broken Access Control in IMPress for IDX Broker <= 3.3.0 versions.
- Affected
- up to 3.3.0
- What to do
- Affects up to 3.3.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 10, 2026Unauthenticated Broken Authentication in IMPress for IDX Broker <= 3.3.0 versions.CVE-2026-81787 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Broken Authentication in IMPress for IDX Broker <= 3.3.0 versions.
- Affected
- up to 3.3.0
- What to do
- Affects up to 3.3.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 10, 2026Unauthenticated Broken Access Control in Thank You Page Customizer for WooCommerce <= 1.2.2 versions.CVE-2026-81786 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in Thank You Page Customizer for WooCommerce <= 1.2.2 versions.
- Affected
- up to 1.2.2
- What to do
- Affects up to 1.2.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 10, 2026Unauthenticated Broken Access Control in BuddyForms <= 2.9.0 versions.CVE-2026-81785 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Broken Access Control in BuddyForms <= 2.9.0 versions.
- Affected
- up to 2.9.0
- What to do
- Affects up to 2.9.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 10, 2026Wise Chat: Deserialization of Untrusted DataCVE-2026-81784 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Deserialization of Untrusted Data vulnerability in Marcin Wise Chat wise-chat allows Object Injection.This issue affects Wise Chat: from n/a through 3.4.2.
- Product
- Wise Chat
- Affected
- up to 3.4.2
- What to do
- Affects up to 3.4.2. Update Wise Chat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 10, 2026Subscriber Broken Authentication in MailMunch – Grow your Email List <= 3.2.5 versions.CVE-2026-81783 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Subscriber Broken Authentication in MailMunch – Grow your Email List <= 3.2.5 versions.
- Affected
- up to 3.2.5
- What to do
- Affects up to 3.2.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 10, 2026Subscriber Cross Site Scripting (XSS) in WP Docs <= 2.3.1 versions.CVE-2026-81782 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Subscriber Cross Site Scripting (XSS) in WP Docs <= 2.3.1 versions.
- Affected
- up to 2.3.1
- What to do
- Affects up to 2.3.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 10, 2026Subscriber Arbitrary File Download in Youzify <= 1.3.7 versions.CVE-2026-81275 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Subscriber Arbitrary File Download in Youzify <= 1.3.7 versions.
- Affected
- up to 1.3.7
- What to do
- Affects up to 1.3.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 10, 2026Unauthenticated Broken Access Control in Robokassa payment gateway for Woocommerce <= 1.8.9 versions.CVE-2026-78536 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Broken Access Control in Robokassa payment gateway for Woocommerce <= 1.8.9 versions.
- Affected
- up to 1.8.9
- What to do
- Affects up to 1.8.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 10, 2026Unauthenticated Bypass Vulnerability in Simple Cloudflare Turnstile <= 1.42.1 versions.CVE-2026-66674 · WordPress plugins & themes · reported by PatchstackMedium 5.6
Unauthenticated Bypass Vulnerability in Simple Cloudflare Turnstile <= 1.42.1 versions.
- Affected
- up to 1.42.1
- What to do
- Affects up to 1.42.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 10, 2026Unauthenticated Content Injection in Simple Cloudflare Turnstile <= 1.42.1 versions.CVE-2026-66632 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Content Injection in Simple Cloudflare Turnstile <= 1.42.1 versions.
- Affected
- up to 1.42.1
- What to do
- Affects up to 1.42.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 10, 2026Registration Form for WooCommerce: Does not validate that the form referenced during registration is a legitimate registration formCVE-2026-81431 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Registration Form for WooCommerce WordPress plugin before 1.1.3 does not validate that the form referenced during registration is a legitimate registration form, reading the permitted-role allow-list from an arbitrary attacker-controlled post instead. A user able to create a post (Contributor and above) can therefore register a new account with an arbitrary role, including Administrator, leading to full site takeover. This is an incomplete fix of CVE-2026-54807.
- Product
- Registration Form for WooCommerce
- Fixed in
- 1.1.3
- What to do
- Update Registration Form for WooCommerce to 1.1.3 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.