Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
13,989 results · page 45 of 280
Sep 24, 2026MailerLite – Signup forms (official): Unauthorized modification of dataCVE-2026-3253 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The MailerLite – Signup forms (official) plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the forms() method of the AdminController class in all versions up to, and including, 1.7.21. This makes it possible for authenticated attackers, with Contributor-level access and above, to create or delete arbitrary signup forms.
- Product
- MailerLite – Signup forms (official)
- Affected
- up to 1.7.21
- What to do
- Affects up to 1.7.21. Update MailerLite – Signup forms (official) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 24, 2026Spectra Legacy – Gutenberg Blocks: Sensitive Information ExposureCVE-2026-16302 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Spectra Legacy – Gutenberg Blocks plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.20.0 via the editor_assets function, which exposes the uag_insta_linked_accounts option through the uagb_blocks_info object without a capability check. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive data including raw Instagram Graph API access tokens configured by an administrator. Exploitation requires the Spectra Pro plugin to be active with a linked Instagram account.
- Product
- Spectra Legacy – Gutenberg Blocks
- Affected
- up to 2.20.0
- What to do
- Affects up to 2.20.0. Update Spectra Legacy – Gutenberg Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 24, 2026Kirki – Freeform Page Builder, Website Builder & Customizer: Blind Server-Side Request ForgeryCVE-2026-18335 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 6.2.0 via the 'kirki_data' Parameter. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
- Product
- Kirki – Freeform Page Builder, Website Builder & Customizer
- Affected
- up to 6.2.0
- What to do
- Affects up to 6.2.0. Update Kirki – Freeform Page Builder, Website Builder & Customizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 24, 2026WP Multilang – Translation and Multilingual: Stored Cross-Site ScriptingCVE-2026-15731 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP Multilang – Translation and Multilingual Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the post content in all versions up to, and including, 2.4.31 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- WP Multilang – Translation and Multilingual
- Affected
- up to 2.4.31
- What to do
- Affects up to 2.4.31. Update WP Multilang – Translation and Multilingual to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 24, 2026Visual Composer Website Builder: Local File InclusionCVE-2026-12227 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Visual Composer Website Builder plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 45.16.0 via the `vcv-template` parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
- Product
- Visual Composer Website Builder
- Affected
- up to 45.16.0
- What to do
- Affects up to 45.16.0. Update Visual Composer Website Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 24, 2026YOP Poll: Origin Validation ErrorCVE-2026-85682 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The YOP Poll plugin for WordPress is vulnerable to Origin Validation Error in all versions up to, and including, 7.0.10. This is due to the plugin transmitting a wp_rest nonce to window.opener via postMessage() with a wildcard targetOrigin. This makes it possible for unauthenticated attackers to steal a REST nonce scoped to a logged-in Administrator and use it to change the Administrator's email address and password, resulting in full account takeover. The Administrator must open an attacker-controlled page in order to exploit this vulnerability.
- Product
- YOP Poll
- Affected
- up to 7.0.10
- What to do
- Affects up to 7.0.10. Update YOP Poll to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 24, 2026eesy_ID2WP – Publish InDesign HTML5: Path TraversalCVE-2026-77193 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The eesy_ID2WP – Publish InDesign HTML5 plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.0.3 via the `id2wp_path` parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information.
- Product
- eesy_ID2WP – Publish InDesign HTML5
- Affected
- up to 1.0.3
- What to do
- Affects up to 1.0.3. Update eesy_ID2WP – Publish InDesign HTML5 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 24, 2026Events Manager: Does not force the scope of its logged-in event and location searchCVE-2026-93662 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Events Manager WordPress plugin before 7.4.5 does not force the scope of its logged-in event and location search when a caller supplies their own owner value, letting a low-privileged user read other accounts' unpublished, pending or trashed event and venue content, including full street addresses.
- Product
- Events Manager
- Fixed in
- 7.4.5
- What to do
- Update Events Manager to 7.4.5 or newer.
Sep 24, 2026Events Manager: Does not stop a ticket-update request from replacing the identifiers of the ticket it was authorized againstCVE-2026-93661 · WordPress plugins & themes · reported by WPScanLow 2.7
The Events Manager WordPress plugin before 7.4.5 does not stop a ticket-update request from replacing the identifiers of the ticket it was authorized against, letting a user who can manage one event's tickets overwrite and reassign any ticket on the site to their own event.
- Product
- Events Manager
- Fixed in
- 7.4.5
- What to do
- Update Events Manager to 7.4.5 or newer.
Sep 24, 2026WPeMatico RSS Feed Fetcher: Does not sanitise and escape one of its campaign configuration fieldsCVE-2026-89005 · WordPress plugins & themes · reported by WPScanMedium 6.8
The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.26 does not sanitise and escape one of its campaign configuration fields when a certain feature is enabled, which allows users with the Contributor role and above to perform Stored Cross-Site Scripting attacks that execute in the session of any higher-privileged user who later views the campaign.
- Product
- WPeMatico RSS Feed Fetcher
- Fixed in
- 2.8.26
- What to do
- Update WPeMatico RSS Feed Fetcher to 2.8.26 or newer.
Sep 24, 2026WPeMatico RSS Feed Fetcher: Does not verify ownership or authorization before returning a campaign's stored configuration and run logCVE-2026-89004 · WordPress plugins & themes · reported by WPScanLow 2.7
The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.26 does not verify ownership or authorization before returning a campaign's stored configuration and run log, allowing users with contributor-level access and above to read the configuration and execution logs of campaigns created by other users, including administrators.
- Product
- WPeMatico RSS Feed Fetcher
- Fixed in
- 2.8.26
- What to do
- Update WPeMatico RSS Feed Fetcher to 2.8.26 or newer.
Sep 24, 2026WPeMatico RSS Feed Fetcher: Does not sanitize and escape content it retrieves from a user-supplied source before rendering itCVE-2026-89002 · WordPress plugins & themes · reported by WPScanMedium 6.8
The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.26 does not sanitize and escape content it retrieves from a user-supplied source before rendering it, which could allow users such as contributors to perform Stored Cross-Site Scripting attacks against higher-privileged users who review the campaign.
- Product
- WPeMatico RSS Feed Fetcher
- Fixed in
- 2.8.26
- What to do
- Update WPeMatico RSS Feed Fetcher to 2.8.26 or newer.
Sep 24, 2026MasterStudy LMS: Does not verify that a user is enrolled in a course before recording lesson completions against itCVE-2026-88847 · WordPress plugins & themes · reported by WPScanMedium 4.3
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not verify that a user is enrolled in a course before recording lesson completions against it, allowing any authenticated user, such as a subscriber, to create course progress records for courses they have no access to.
- Product
- MasterStudy LMS
- Fixed in
- 3.7.50
- What to do
- Update MasterStudy LMS to 3.7.50 or newer.
Sep 24, 2026MasterStudy LMS: Does not check whether user registration is enabled on the site before creating an account through one of its front-end registration flowsCVE-2026-88846 · WordPress plugins & themes · reported by WPScanMedium 5.3
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not check whether user registration is enabled on the site before creating an account through one of its front-end registration flows, allowing unauthenticated users to create accounts, and be logged into them, on sites where registration has been deliberately disabled.
- Product
- MasterStudy LMS
- Fixed in
- 3.7.50
- What to do
- Update MasterStudy LMS to 3.7.50 or newer.
Sep 24, 2026MasterStudy LMS: Does not perform any capability or nonce checks on an administrative maintenance actionCVE-2026-88845 · WordPress plugins & themes · reported by WPScanMedium 4.3
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not perform any capability or nonce checks on an administrative maintenance action, allowing any authenticated user, such as a subscriber, to trigger it and create published content on the site attributed to their own account.
- Product
- MasterStudy LMS
- Fixed in
- 3.7.50
- What to do
- Update MasterStudy LMS to 3.7.50 or newer.
Sep 24, 2026MasterStudy LMS: Does not validate one of its display-style settings before using it to build a template pathCVE-2026-88843 · WordPress plugins & themes · reported by WPScanHigh 7.2
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not validate one of its display-style settings before using it to build a template path, allowing users with the Contributor role and above to include and execute arbitrary local PHP files on the server. An equivalent path was corrected in an earlier release and this one was not, so the issue persists in versions the earlier advisory reports as fixed.
- Product
- MasterStudy LMS
- Fixed in
- 3.7.50
- What to do
- Update MasterStudy LMS to 3.7.50 or newer.
Sep 24, 2026Post Grid: Does not limit an expansion of the WordPress allowed-HTML list to its own markup and applies it site-wideCVE-2026-84151 · WordPress plugins & themes · reported by WPScanLow 3.5
The Post Grid WordPress plugin before 7.9.5 does not limit an expansion of the WordPress allowed-HTML list to its own markup and applies it site-wide, allowing users with the Contributor role and above to store iframe, style and input elements that are normally stripped from their content, leading to HTML injection (phishing frames, CSS defacement and spoofed input forms) that renders to any visitor and to administrators reviewing the content.
- Product
- Post Grid
- Fixed in
- 7.9.5
- What to do
- Update Post Grid to 7.9.5 or newer.
Sep 24, 2026Masteriyo LMS: Does not restrict access to quiz answer keysCVE-2026-82850 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Masteriyo LMS WordPress plugin before 3.4.2 does not restrict access to quiz answer keys, allowing any authenticated user, such as a student, to retrieve the correct answers for any quiz on the site, including quizzes in courses they are not enrolled in. The redaction that hides them is applied only to a fixed list of question types, so the answers to every other type are returned in full to anyone able to view the questions.
- Product
- Masteriyo LMS
- Fixed in
- 3.4.2
- What to do
- Update Masteriyo LMS to 3.4.2 or newer.
Sep 24, 2026Masteriyo LMS: Does not verify that the user making the request owns the course-progress records being returnedCVE-2026-82849 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Masteriyo LMS WordPress plugin before 3.4.2 does not verify that the user making the request owns the course-progress records being returned, allowing any authenticated user, such as a self-registered subscriber, to read another user's learning activity. The ownership check it applies is skipped whenever the requested account is not named with a non-zero value, in which case the records of every learner on the site are returned at once.
- Product
- Masteriyo LMS
- Fixed in
- 3.4.2
- What to do
- Update Masteriyo LMS to 3.4.2 or newer.
Sep 24, 202610Web Booster: Does not restrict access to the routineCVE-2026-82195 · WordPress plugins & themes · reported by WPScanMedium 6.5
The 10Web Booster WordPress plugin before 2.34.0 does not restrict access to the routine which issues the shared secret that authenticates its cloud connection, disclosing that secret to unauthenticated visitors and letting them delete it repeatedly, preventing an administrator from completing a legitimate connection.
- Product
- 10Web Booster
- Fixed in
- 2.34.0
- What to do
- Update 10Web Booster to 2.34.0 or newer.
Sep 24, 2026wpForo Forum: Does not restrictCVE-2026-80513 · WordPress plugins & themes · reported by WPScanHigh 7.5
The wpForo Forum WordPress plugin before 3.1.6 does not restrict which classes may be instantiated when it deserializes a user-supplied profile field value, allowing authenticated users with Subscriber-level access and above to inject a PHP Object. No POP chain is present in the wpForo Forum WordPress plugin before 3.1.6 itself; if one is present via another installed wpForo Forum WordPress plugin before 3.1.6 or , this could lead to remote code execution, arbitrary file operations, or SQL injection. This is an incomplete fix of CVE-2026-49769.
- Product
- wpForo Forum
- Fixed in
- 3.1.6
- What to do
- Update wpForo Forum to 3.1.6 or newer.
Sep 24, 2026CMB2: Does not perform any capability check on one of its AJAX actionsCVE-2026-80338 · WordPress plugins & themes · reported by WPScanMedium 6.8
The CMB2 WordPress plugin before 2.13.0 does not perform any capability check on one of its AJAX actions, allowing users with a role as low as Subscriber to create arbitrary WordPress options and corrupt existing ones, which can break core site settings and take the site offline. Exploitation requires the site's or another CMB2 WordPress plugin before 2.13.0 to have declared an oEmbed field, as the CMB2 WordPress plugin before 2.13.0 registers none of its own. The stored value is never attacker-controlled, so the issue does not lead to privilege escalation.
- Product
- CMB2
- Fixed in
- 2.13.0
- What to do
- Update CMB2 to 2.13.0 or newer.
Sep 24, 2026WPForms: Does not verify that a Stripe payment object supplied during a public form submission belongs to it before acting on itCVE-2026-74991 · WordPress plugins & themes · reported by WPScanMedium 6.8
The WPForms WordPress plugin before 2.0.2 does not verify that a Stripe payment object supplied during a public form submission belongs to it before acting on it, allowing unauthenticated users to trigger a full refund and an immediate subscription cancellation against payments created by other applications on the site owner's Stripe account.
- Product
- WPForms
- Fixed in
- 2.0.2
- What to do
- Update WPForms to 2.0.2 or newer.
Sep 23, 2026Paytium: Mollie payment forms & donations: Privilege EscalationCVE-2026-18467 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Paytium: Mollie payment forms & donations plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 5.0.3. The 5.0.3 patch introduced a wp_hash()/hash_equals() signature gate on the pt-paytium-user-data field, but left a second filter — pt_cf_checkout_meta(), registered on the pt_meta_values hook after the signed builder — that copies every $_POST['pt_form_field'][*] key verbatim into the payment meta array without any signature verification; this allows the pt-user-role value it copies to overwrite the signed path's output, after which paytium_user_data_processing() reads the persisted _pt-user-role post meta and passes it directly as the role argument to wp_insert_user(). This makes it possible for unauthenticated attackers to register a new WordPress account with the administrator role and fully take over the site. Exploitation requires submitting a payment through a publicly-exposed [paytium] shortcode form and completing the resulting payment flow, after which the attacker can seize the new administrator account via the standard lost-password flow on their supplied email address.
- Product
- Paytium: Mollie payment forms & donations
- Affected
- up to 5.0.3
- What to do
- Affects up to 5.0.3. Update Paytium: Mollie payment forms & donations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 23, 2026Import and export users and customers: Privilege EscalationCVE-2026-86583 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Import and export users and customers plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.4.17 via the plugin's own export and re-import workflow. The vulnerability exists because the exporter writes CSV cells using fputcsv() with a NUL byte (\0) as the escape character, while the importer parses the same file using SplFileObject::fgetcsv() with only a single delimiter argument, causing PHP's default backslash escape character to be applied instead; because the export column layout places display_name immediately before the role column and nickname immediately after, an attacker can store crafted values in those two profile fields — saved by WordPress core via the standard profile page — such that the escape mismatch causes the parser to merge the display_name cell into the role field and rebalance the column count via nickname, yielding administrator as the parsed role for their own row when it reaches the import_user function's add_role function. This makes it possible for authenticated attackers with Subscriber-level access or above to escalate their privileges to Administrator. Exploitation requires a site administrator to trig
- Product
- Import and export users and customers
- Affected
- up to 2.4.17
- What to do
- Affects up to 2.4.17. Update Import and export users and customers to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 23, 2026EthPress – Web3 Login: Authentication BypassCVE-2026-19125 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The EthPress – Web3 Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 2.3.5. This is due to the verify_login() function in app/Login.php containing a missing return statement in the signature verification failure branch — when Signature::verify2() reports a mismatch, the function only assigns a WP_Error to a local variable and continues executing, causing unconditional fall-through to the login block where Address::log_in() calls wp_set_auth_cookie() regardless of whether the submitted signature is valid. This makes it possible for unauthenticated attackers to log in as any WordPress user who has a linked wallet address — including administrators — by submitting that user's public wallet address alongside an arbitrary well-formed signature, enabling full site takeover.
- Product
- EthPress – Web3 Login
- Affected
- up to 2.3.5
- What to do
- Affects up to 2.3.5. Update EthPress – Web3 Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 23, 2026Shazzad Hossain Khan W4 Post List: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-96826 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Shazzad Hossain Khan W4 Post List allows Blind SQL Injection. This issue affects W4 Post List: from n/a through 3.0.6.
- Product
- Shazzad Hossain Khan W4 Post List
- Affected
- up to 3.0.6
- What to do
- Affects up to 3.0.6. Update Shazzad Hossain Khan W4 Post List to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 23, 2026Argument injection in WP Toolkit for cPanel 6.11.2-10794 and earlier allows remote authenticated users to read arbitrary files and execute arbitrary code acrossCVE-2026-87900 · Websites & servers · reported by support@hackerone.comCritical 9.4
Argument injection in WP Toolkit for cPanel 6.11.2-10794 and earlier allows remote authenticated users to read arbitrary files and execute arbitrary code across customer accounts.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2026Execution with unnecessary privileges in cPanel allows remote authenticated users to execute arbitrary code with root privileges.CVE-2026-87899 · Websites & servers · reported by support@hackerone.comCritical 9.4
Execution with unnecessary privileges in cPanel allows remote authenticated users to execute arbitrary code with root privileges.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2026Unauthenticated Broken Access Control in Loops & Logic <= 4.2.4 versions.CVE-2026-95604 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in Loops & Logic <= 4.2.4 versions.
- What to do
- Update the plugin to the newest version.
Sep 23, 2026Shop manager PHP Object Injection in Reycob Product Import Export <= 2.3.0 versions.CVE-2026-95603 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Shop manager PHP Object Injection in Reycob Product Import Export <= 2.3.0 versions.
- What to do
- Update the plugin to the newest version.
Sep 23, 2026YITH YITH WooCommerce Request A Quote: Authorization Bypass Through User-Controlled KeyCVE-2026-95602 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Authorization Bypass Through User-Controlled Key vulnerability in YITH YITH WooCommerce Request A Quote allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects YITH WooCommerce Request A Quote: from n/a before 4.46.1.
- Product
- YITH YITH WooCommerce Request A Quote
- Fixed in
- 4.46.1
- What to do
- Update YITH YITH WooCommerce Request A Quote to 4.46.1 or newer.
Sep 23, 2026Unauthenticated SQL Injection in Product Filter by WBW <= 3.1.7 versions.CVE-2026-95601 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in Product Filter by WBW <= 3.1.7 versions.
- What to do
- Update the plugin to the newest version.
Sep 23, 2026Unauthenticated Sensitive Data Exposure in TrustedLogin Connector <= 2.0.3 versions.CVE-2026-95600 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Sensitive Data Exposure in TrustedLogin Connector <= 2.0.3 versions.
- What to do
- Update the plugin to the newest version.
Sep 23, 2026Editor SQL Injection in Ultimeter <= 3.0.8 versions.CVE-2026-95593 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Editor SQL Injection in Ultimeter <= 3.0.8 versions.
- What to do
- Update the plugin to the newest version.
Sep 23, 2026Unauthenticated Insecure Direct Object References (IDOR) in Team <= 6.0.0 versions.CVE-2026-95592 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Insecure Direct Object References (IDOR) in Team <= 6.0.0 versions.
- What to do
- Update the plugin to the newest version.
Sep 23, 2026Subscriber SQL Injection in Tainacan <= 1.2.0 versions.CVE-2026-95590 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Subscriber SQL Injection in Tainacan <= 1.2.0 versions.
- What to do
- Update the plugin to the newest version.
Sep 23, 2026Contributor Cross Site Scripting (XSS) in Ultimate Addons for Contact Form 7 <= 3.5.50 versions.CVE-2026-95586 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Cross Site Scripting (XSS) in Ultimate Addons for Contact Form 7 <= 3.5.50 versions.
- What to do
- Update the plugin to the newest version.
Sep 23, 2026Subscriber Cross Site Scripting (XSS) in PixelYourSite – Your smart PIXEL (TAG) Manager <= 11.4.1 versions.CVE-2026-95530 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Subscriber Cross Site Scripting (XSS) in PixelYourSite – Your smart PIXEL (TAG) Manager <= 11.4.1 versions.
- What to do
- Update the plugin to the newest version.
Sep 23, 2026Unauthenticated Cross Site Scripting (XSS) in Calculated Fields Form <= 5.5.1.1 versions.CVE-2026-95529 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Calculated Fields Form <= 5.5.1.1 versions.
- What to do
- Update the plugin to the newest version.
Sep 23, 2026Unauthenticated Cross Site Scripting (XSS) in Core Web Vitals & PageSpeed Booster <= 1.0.31 versions.CVE-2026-95528 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Core Web Vitals & PageSpeed Booster <= 1.0.31 versions.
- What to do
- Update the plugin to the newest version.
Sep 23, 2026Unauthenticated Broken Access Control in Conekta Payment Gateway <= 6.2.4 versions.CVE-2026-95527 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Broken Access Control in Conekta Payment Gateway <= 6.2.4 versions.
- What to do
- Update the plugin to the newest version.
Sep 23, 2026Subscriber Arbitrary File Deletion in WP User Frontend <= 4.3.11 versions.CVE-2026-95525 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Subscriber Arbitrary File Deletion in WP User Frontend <= 4.3.11 versions.
- What to do
- Update the plugin to the newest version.
Sep 23, 2026WP User Frontend <= 4: Unauthenticated BypassCVE-2026-95524 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Bypass Vulnerability in WP User Frontend <= 4.3.11 versions.
- Product
- WP User Frontend <= 4
- What to do
- Update WP User Frontend <= 4 to the newest version.
Sep 23, 2026WP User Frontend <= 4: Subscriber BypassCVE-2026-95523 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Subscriber Bypass Vulnerability in WP User Frontend <= 4.3.11 versions.
- Product
- WP User Frontend <= 4
- What to do
- Update WP User Frontend <= 4 to the newest version.
Sep 23, 2026Shop manager SQL Injection in Easy Digital Downloads <= 3.7.0 versions.CVE-2026-95522 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Shop manager SQL Injection in Easy Digital Downloads <= 3.7.0 versions.
- What to do
- Update the plugin to the newest version.
Sep 23, 2026Unauthenticated Cross Site Scripting (XSS) in Ninja Forms <= 3.15.3 versions.CVE-2026-95515 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Ninja Forms <= 3.15.3 versions.
- What to do
- Update the plugin to the newest version.
Sep 23, 2026Netgsm <= 2: Unauthenticated BypassCVE-2026-95514 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Bypass Vulnerability in Netgsm <= 2.10.0 versions.
- Product
- Netgsm <= 2
- What to do
- Update Netgsm <= 2 to the newest version.
Sep 23, 2026Unauthenticated Broken Access Control in Online Booking & Scheduling Calendar for WordPress by vcita <= 4.6.0 versions.CVE-2026-95513 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in Online Booking & Scheduling Calendar for WordPress by vcita <= 4.6.0 versions.
- What to do
- Update the plugin to the newest version.
Sep 23, 2026Contributor Cross Site Scripting (XSS) in Podcast Importer SecondLine <= 1.5.6 versions.CVE-2026-94682 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Cross Site Scripting (XSS) in Podcast Importer SecondLine <= 1.5.6 versions.
- What to do
- Update the plugin to the newest version.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. The WordPress, CMS and hosting-panel entries come from the National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan and others); we show who. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, a booking system, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.