Updated 9 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,756exploited flaws on CISA’s list

35added in the last 30 days

308new WordPress flaws this week

13,989entries in the database

11,480 results · page 47 of 230

Sep 18, 2026Gravity Forms: Arbitrary File UploadCVE-2026-84434 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.1.0.4 via the upload_file function. This is due to a mismatch between the field validation pipeline and the file persistence pipeline, where hidden file upload fields bypass extension validation and a rejected file's intact upload state is later passed to upload_file() without re-validation. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. Exploitation requires the targeted form to contain a File Upload field with its Visibility set to 'Hidden'; the vulnerability is reachable by unauthenticated attackers on any publicly accessible form meeting this condition.
Product
Gravity Forms
Affected
up to 3.1.0.4
What to do
Affects up to 3.1.0.4. Update Gravity Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record docs.gravityforms.com wordfence.com
Sep 18, 2026Divi Essential: Sensitive information exposureCVE-2026-15760 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Divi Essential plugin for WordPress is vulnerable to sensitive information exposure in versions up to, and including, 5.8.1 via the dnxte_get_database_tables and dnxte_get_database_data AJAX actions. The handlers only conditionally verify a nonce (the check runs solely when the 'nonce' POST parameter is present and can be trivially bypassed by omitting the parameter) and never call current_user_can() or otherwise enforce a capability. This makes it possible for authenticated attackers, with Subscriber-level access and above, to enumerate every table in the WordPress database and read up to a caller-controlled number of rows from any table — including wp_users (usernames, emails, hashed passwords), wp_usermeta (session tokens, secret keys), and wp_options (privileged settings, API keys, credentials stored by other plugins).
Product
Divi Essential
Affected
up to 5.8.1
What to do
Affects up to 5.8.1. Update Divi Essential to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record divinext.com wordfence.com
Sep 18, 2026SEO Booster: Missing AuthorizationCVE-2026-15660 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The SEO Booster plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 7.4.7. This is due to a missing capability check on the handle_oauth_callback() function which is hooked to admin_init and processes $_GET['access_token'] and $_GET['google_email'] without verifying the caller's role. This makes it possible for authenticated attackers, with Subscriber-level access and above, to overwrite the seobooster_access_token, seobooster_google_email, and seobooster_gsc_sites options and delete the seobooster_needs_reauth flag by visiting a crafted /wp-admin/ URL, disrupting the Google Search Console integration and injecting attacker-chosen data into site options via the attacker-supplied token that drives an outbound Google API request whose response is stored.
Product
SEO Booster
Affected
up to 7.4.7
What to do
Affects up to 7.4.7. Update SEO Booster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 18, 2026Asset CleanUp: Page Speed Booster: Stored Cross-Site ScriptingCVE-2026-13354 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Asset CleanUp: Page Speed Booster plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to, and including, 1.4.0.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is only exploitable on instances where combine_loaded_css has been enabled.
Product
Asset CleanUp: Page Speed Booster
Affected
up to 1.4.0.5
What to do
Affects up to 1.4.0.5. Update Asset CleanUp: Page Speed Booster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 18, 2026WP2Social Auto Publish: Stored Cross-Site ScriptingCVE-2026-12042 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The WP2Social Auto Publish plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.4.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
WP2Social Auto Publish
Affected
up to 2.4.12
What to do
Affects up to 2.4.12. Update WP2Social Auto Publish to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 18, 2026WPComplete: Stored Cross-Site ScriptingCVE-2026-77820 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WPComplete plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'empty' Shortcode Attribute in all versions up to, and including, 2.9.9.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the premium version of the software in order to exploit. Please note this only affects the pro version.
Product
WPComplete
Affected
up to 2.9.9.0
What to do
Affects up to 2.9.9.0. Update WPComplete to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 18, 2026The WP Cloud Plugins Use-your-Drive, Out-of-the-Box, Share-one-Drive, and Lets-Box plugins for WordPress are vulnerable to Arbitrary File Upload in all versionsCVE-2026-93031 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The WP Cloud Plugins Use-your-Drive, Out-of-the-Box, Share-one-Drive, and Lets-Box plugins for WordPress are vulnerable to Arbitrary File Upload in all versions from 2.0 up to, and including, 3.8.3 via the download_file_to_uploads function. This is due to the import action being registered for unauthenticated users via wp_ajax_nopriv_, a missing capability check in can_import(), and the imported file's extension and contents not being validated against get_allowed_mime_types() before it is written to the uploads directory. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload files that may be executable, which makes remote code execution possible.
Affected
up to 3.8.3
What to do
Affects up to 3.8.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record documentation.wpcloudplugins.com wpcloudplugins.gitbook.io
Sep 18, 2026WP Recipe Maker: Stored Cross-Site ScriptingCVE-2026-90884 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The WP Recipe Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'notes' parameter in all versions up to, and including, 10.8.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WP Recipe Maker
Affected
up to 10.8.1
What to do
Affects up to 10.8.1. Update WP Recipe Maker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org wordfence.com
Sep 18, 2026Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder: Stored Cross-Site ScriptingCVE-2026-87915 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via values[Name] Parameter in all versions up to, and including, 1.24.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The wp_kses sanitization applied on output is insufficient in this context because HTML entities within allowed attribute values survive normalization intact and are later evaluated by the jQuery(link.attr('href')) sink in wp-admin/js/common.js when a contextual help tab anchor is clicked.
Product
Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder
Affected
up to 1.24.0
What to do
Affects up to 1.24.0. Update Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 18, 2026Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress: Stored Cross-Site ScriptingCVE-2026-18405 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to, and including, 3.2.16 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires that the targeted post also renders a legitimate Jeg Kit Countdown widget, which causes the countdown frontend script to be enqueued and to initialize on any matching DOM element — including forged widget markup stored in comments.
Product
Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress
Affected
up to 3.2.16
What to do
Affects up to 3.2.16. Update Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 18, 2026Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder: Stored Cross-Site ScriptingCVE-2026-15797 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via post_title in all versions up to, and including, 1.24.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the attacker to create a post with an HTML entity-encoded payload in the title, which bypasses sanitize_text_field on save and is later decoded and executed by the browser when rendered by the Select2 component.
Product
Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder
Affected
up to 1.24.0
What to do
Affects up to 1.24.0. Update Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 18, 2026Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits: Authorization bypassCVE-2026-85410 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.2.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to modify the title and metadata of arbitrary WordPress posts or permanently delete arbitrary WordPress posts by supplying an attacker-controlled popup_id. The required nonce is emitted on the edit-jltma_popup admin screen, which is accessible to Contributors because the jltma_popup custom post type is registered with capability_type='post'.
Product
Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits
Affected
up to 3.2.2
What to do
Affects up to 3.2.2. Update Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 18, 2026Complianz GDPR/CCPA Cookie Consent Banner: Stored Cross-Site ScriptingCVE-2026-83561 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Complianz GDPR/CCPA Cookie Consent Banner plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Elementor Cookie Blocker Regex in all versions up to, and including, 7.5.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires an administrator to approve the attacker's comment, and the site must have both the Elementor plugin installed and Complianz configured with the Twitter or Facebook cookie/script blocker enabled.
Product
Complianz GDPR/CCPA Cookie Consent Banner
Affected
up to 7.5.4
What to do
Affects up to 7.5.4. Update Complianz GDPR/CCPA Cookie Consent Banner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 18, 2026CSS & JavaScript Toolbox: Stored Cross-Site ScriptingCVE-2025-13533 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The CSS & JavaScript Toolbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 12.0.6 via the Assignment Engine fields. This is due to insufficient input sanitization and output escaping on assignment data fields including Expressions, URLs, and Advanced assignment data. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the CJT block edit screen in the admin dashboard.
Product
CSS & JavaScript Toolbox
Affected
up to 12.0.6
What to do
Affects up to 12.0.6. Update CSS & JavaScript Toolbox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record gist.github.com plugins.trac.wordpress.org
Sep 18, 2026Strong Testimonials: Stored Cross-Site ScriptingCVE-2026-92622 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Strong Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'lightbox_class' Shortcode Attribute in all versions up to, and including, 3.3.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that the targeted testimonial view has at least one published testimonial with a featured image and the lightbox wrapper enabled, as the vulnerable code path is only reached when a thumbnail is rendered.
Product
Strong Testimonials
Affected
up to 3.3.8
What to do
Affects up to 3.3.8. Update Strong Testimonials to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 18, 2026ShopLentor – All-in-One WooCommerce Growth & Store Enhancement: Reflected Cross-Site ScriptingCVE-2026-92554 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via Query-String Parameter Name in all versions up to, and including, 3.5.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. The vulnerability is triggered via the WL: Product Horizontal Filter widget, which reflects attacker-supplied query-string parameter names from the current URL into option element value attributes without escaping, allowing payload breakout from the value="..." attribute context.
Product
ShopLentor – All-in-One WooCommerce Growth & Store Enhancement
Affected
up to 3.5.1
What to do
Affects up to 3.5.1. Update ShopLentor – All-in-One WooCommerce Growth & Store Enhancement to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 18, 2026Qi Addons For Elementor: Reflected Cross-Site ScriptingCVE-2026-92249 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Qi Addons For Elementor plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in all versions up to, and including, 1.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the Table of Contents widget to be placed on a template that renders on the WordPress search-results page (e.g., a sitewide header or footer template) with the 'Limit ToC to Main Page Content' option left at its default value of No, so the widget scans the search-results heading that reflects the unsanitized `s` parameter.
Product
Qi Addons For Elementor
Affected
up to 1.11
What to do
Affects up to 1.11. Update Qi Addons For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 18, 2026Newsletter – Send awesome emails from WordPress: Reflected Cross-Site ScriptingCVE-2026-90981 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Newsletter – Send awesome emails from WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'nn' parameter in all versions up to, and including, 9.3.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Successful exploitation requires the victim to be a logged-in administrator, as the antibot check auto-passes for authenticated users, routing the unsanitized payload through the administrator-visible output branch of dienow().
Product
Newsletter – Send awesome emails from WordPress
Affected
up to 9.3.8
What to do
Affects up to 9.3.8. Update Newsletter – Send awesome emails from WordPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 18, 2026Location Manager: Generic SQL InjectionCVE-2026-85705 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Location Manager plugin for WordPress is vulnerable to generic SQL Injection via 'latitude' and 'longitude' REST API Parameters in all versions up to, and including, 2.3.38 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The injection is triggered when the orderby=lat_lon parameter is supplied, and affects multiple publicly accessible REST endpoints including geodir/v2/locations/cities, /regions, /countries, and /neighbourhoods via both the get_locations() and get_neighbourhoods() functions.
Product
Location Manager
Affected
up to 2.3.38
What to do
Affects up to 2.3.38. Update Location Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record wpgeodirectory.com wordfence.com
Sep 18, 2026Photo Gallery by 10Web – Mobile-Friendly Image Gallery: Time-based SQL InjectionCVE-2026-85652 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to time-based SQL Injection via 'album_id' Shortcode Attribute in all versions up to, and including, 1.8.44 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with author-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. An Author-level user can store a SQL injection payload inside a published post's shortcode attribute, causing the payload to execute when any visitor renders the post; notably, the unsanitized value appears on both sides of a UNION query, potentially doubling the observable time-based delay.
Product
Photo Gallery by 10Web – Mobile-Friendly Image Gallery
Affected
up to 1.8.44
What to do
Affects up to 1.8.44. Update Photo Gallery by 10Web – Mobile-Friendly Image Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 18, 2026NEX-Forms – Ultimate Forms Plugin for WordPress: Generic SQL InjectionCVE-2026-75961 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to generic SQL Injection via the 'additional_params' parameter in all versions up to, and including, 9.3.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with custom-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The operator allowlist applied by get_table_records() when building its own WHERE fragment is not enforced on the same tainted additional_params array when it is forwarded to get_total_records(), leaving the SQL sink unprotected.
Product
NEX-Forms – Ultimate Forms Plugin for WordPress
Affected
up to 9.3.0
What to do
Affects up to 9.3.0. Update NEX-Forms – Ultimate Forms Plugin for WordPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 18, 2026WCFM Marketplace – Multivendor Marketplace for WooCommerce: Generic SQL InjectionCVE-2026-18442 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The WCFM Marketplace – Multivendor Marketplace for WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 'wcfmmp_user_location_lng' parameter in all versions up to, and including, 3.8.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
WCFM Marketplace – Multivendor Marketplace for WooCommerce
Affected
up to 3.8.2
What to do
Affects up to 3.8.2. Update WCFM Marketplace – Multivendor Marketplace for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 18, 2026WP Inventory Manager: SQL InjectionCVE-2026-17607 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The WP Inventory Manager plugin for WordPress is vulnerable to SQL Injection via the 'where' shortcode attribute of the [wpinventory] shortcode in versions up to, and including, 2.5.1. This is due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the existing SQL query in the WPIMItem::get_all() function — parse_custom_where() only performs html_entity_decode(), strips semicolons, and does field-label name replacements, without using $wpdb->prepare() or a whitelist. The resulting string is concatenated into a raw SELECT statement that is executed via $wpdb->get_results(). This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
WP Inventory Manager
Affected
up to 2.5.1
What to do
Affects up to 2.5.1. Update WP Inventory Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 18, 2026VK All in One Expansion Unit: Stored Cross-Site ScriptingCVE-2026-17586 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The VK All in One Expansion Unit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'vkExUnit_cta_img_position' Post Meta in all versions up to, and including, 9.118.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The sanitize_text_field callback applied on save does not strip double-quote characters or on* event-handler attributes, and the output filter Vk_Call_To_Action::safe_kses_post() only rewrites disallowed iframe elements while returning all other content verbatim, leaving the injected payload intact in the rendered HTML.
Product
VK All in One Expansion Unit
Affected
up to 9.118.0
What to do
Affects up to 9.118.0. Update VK All in One Expansion Unit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 18, 2026Store Exporter – Export WooCommerce Products, Orders, Subscriptions, Customers: Directory TraversalCVE-2026-16777 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The Store Exporter – Export WooCommerce Products, Orders, Subscriptions, Customers plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.8.0 via the 'filename' parameter parameter. This makes it possible for authenticated attackers, with shop manager-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.
Product
Store Exporter – Export WooCommerce Products, Orders, Subscriptions, Customers
Affected
up to 2.8.0
What to do
Affects up to 2.8.0. Update Store Exporter – Export WooCommerce Products, Orders, Subscriptions, Customers to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 18, 2026WP Multi Store Locator Pro: Generic SQL InjectionCVE-2026-15275 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The WP Multi Store Locator Pro plugin for WordPress is vulnerable to generic SQL Injection via the 'store_locatore_search_radius' parameter in all versions up to, and including, 4.5.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The injection occurs in a numeric, unquoted SQL context, meaning WordPress's wp_magic_quotes() addslashes-based protection cannot neutralize the payload, and the AJAX handler is registered on wp_ajax_nopriv_make_search_request with no nonce or capability check, making it fully accessible without authentication.
Product
WP Multi Store Locator Pro
Affected
up to 4.5.1
What to do
Affects up to 4.5.1. Update WP Multi Store Locator Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record codecanyon.net wordfence.com
Sep 18, 2026FileBird – WordPress Media Library Folders & File Manager: Stored Cross-Site ScriptingCVE-2026-15004 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The FileBird – WordPress Media Library Folders & File Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via image alt text in all versions up to, and including, 6.5.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
FileBird – WordPress Media Library Folders & File Manager
Affected
up to 6.5.6
What to do
Affects up to 6.5.6. Update FileBird – WordPress Media Library Folders & File Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 18, 2026Kubio AI Page Builder: Stored Cross-Site ScriptingCVE-2026-14472 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Kubio AI Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via kubio/copyright Block Content in all versions up to, and including, 2.8.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This bypasses both the WordPress core kses-on-save filter and the plugin's own wp_kses_post() call, because entity-encoded script tags are treated as inert text by kses but are decoded into live HTML by the subsequent html_entity_decode() call in CopyrightBlock::render_template().
Product
Kubio AI Page Builder
Affected
up to 2.8.4
What to do
Affects up to 2.8.4. Update Kubio AI Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 18, 2026Printcart Web to Print Product Designer for WooCommerce: Directory TraversalCVE-2026-14323 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Printcart Web to Print Product Designer for WooCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.8.5 via the 'mockups' parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. A valid nonce is obtainable by unauthenticated users via the companion nbd_check_use_logged_in nopriv AJAX endpoint, which freely mints and returns a nbdesigner-get-data nonce to any visitor; additionally, if the NBDESIGNER_ENABLE_NONCE constant is disabled, even this nonce gate is bypassed entirely.
Product
Printcart Web to Print Product Designer for WooCommerce
Affected
up to 2.8.5
What to do
Affects up to 2.8.5. Update Printcart Web to Print Product Designer for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 18, 2026LatePoint – Calendar Booking Plugin for Appointments and Events: Insecure Direct Object ReferenceCVE-2026-13471 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.6.3 via the LatePointAbilityDeleteBooking::execute due to missing validation on a user controlled key. This makes it possible for attackers, with LatePoint Agent-level access and above, to read bookings and customer PII (full name, email, phone, and notes) assigned to other LatePoint agents, and delete arbitrary bookings by supplying any booking ID. This vulnerability is only exploitable when an administrator has enabled the Abilities API toggles (latepoint_abilities_api, latepoint_abilities_api_delete, and/or latepoint_abilities_api_edit) in the plugin settings.
Product
LatePoint – Calendar Booking Plugin for Appointments and Events
Affected
up to 5.6.3
What to do
Affects up to 5.6.3. Update LatePoint – Calendar Booking Plugin for Appointments and Events to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 18, 2026Mapster WP Maps: Arbitrary User Meta WriteCVE-2026-12954 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Mapster WP Maps plugin for WordPress is vulnerable to Arbitrary User Meta Write in all versions up to, and including, 1.23.0 via the `my_profile_update()` function. This is due to the function performing no nonce verification, no capability check, and no allowlist validation on the meta key supplied via the `acf-photo-gallery-groups` POST parameter before passing both the meta key and its corresponding value directly to `update_user_meta()`. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary user meta values, though privilege escalation is not possible.
Product
Mapster WP Maps
Affected
up to 1.23.0
What to do
Affects up to 1.23.0. Update Mapster WP Maps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 18, 2026WP Easy Pay – Payment and Donation form Builder for Square: Authorization bypassCVE-2026-12739 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP Easy Pay – Payment and Donation form Builder for Square plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to permanently delete arbitrary posts, pages, and custom post types (bypassing the trash via force deletion) or change any published post to draft status.
Product
WP Easy Pay – Payment and Donation form Builder for Square
Affected
up to 4.5.0
What to do
Affects up to 4.5.0. Update WP Easy Pay – Payment and Donation form Builder for Square to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 18, 2026Download Manager: Insecure Direct Object ReferenceCVE-2026-92714 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Download Manager plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 3.3.68 via the duplicate() function hooked on admin_init. This is due to the handler only verifying the generic 'edit_posts' capability and a plugin-wide static nonce (NONCE_KEY) without any object-level authorization check against the targeted wpdmpro package ID. This makes it possible for authenticated attackers, with Author-level access and above, to duplicate arbitrary Download Manager packages owned by other users (including administrators), which copies all package metadata — including protected file references, role-based access restrictions, and password lock settings — into an attacker-owned clone that they can then edit to remove restrictions and download the previously protected files.
Product
Download Manager
Affected
up to 3.3.68
What to do
Affects up to 3.3.68. Update Download Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 18, 2026Booking Calendar: Privilege EscalationCVE-2026-92619 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Booking Calendar plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 11.8.2 via the `wpbc_ajax_option_save` AJAX action. The vulnerability exists because the `handle_ajax_save()` function applies per-option safeguards only to names explicitly registered via `register_option_policy()`, causing `get_option_policy()` to return an empty policy — bypassing all can_save, force_mode, and allowed_keys checks — for any unregistered option name, including core WordPress options, while an attacker-controlled `data_name` parameter passes through `sanitize_key()` and is written directly to `update_option()` without restriction. This makes it possible for authenticated attackers with Editor-level access and above to escalate their privileges to Administrator by writing core WordPress options such as `default_role=administrator` and `users_can_register=1`, then self-registering a new Administrator account. The nonce check does not meaningfully restrict this attack, as both the nonce value and nonce action are attacker-supplied POST parameters, and a valid nonce is trivially obtainable via `admin-ajax.php?action=rest-nonce`.
Product
Booking Calendar
Affected
up to 11.8.2
What to do
Affects up to 11.8.2. Update Booking Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 18, 2026Booking Calendar: Reflected Cross-Site ScriptingCVE-2026-92561 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Booking Calendar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'options' parameter in all versions up to, and including, 11.8.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. The nonce check is bypassed by default because the 'booking_is_nonce_at_front_end' option ships disabled, allowing unauthenticated requests to reach the vulnerable sink without any verification.
Product
Booking Calendar
Affected
up to 11.8.2
What to do
Affects up to 11.8.2. Update Booking Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 18, 2026The Divi: Arbitrary shortcode executionCVE-2026-91707 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The The Divi theme for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.11.1. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. When the 'Force Enable D4 Shortcode Framework' option is enabled, this includes invoking the et_pb_contact_form shortcode to send email to an attacker-selected recipient with attacker-controlled content.
Product
The Divi
Affected
up to 5.11.1
What to do
Affects up to 5.11.1. Update The Divi to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record divichangelog.com divichangelog.com
Sep 18, 2026Clean Login: Does not verify its registration CAPTCHACVE-2026-90977 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Clean Login WordPress plugin before 1.19 does not verify its registration CAPTCHA when the stored session value is empty, allowing unauthenticated users to bypass the anti-automation control on the registration form and create accounts without solving it.
Product
Clean Login
Fixed in
1.19
What to do
Update Clean Login to 1.19 or newer.
NVD record wpscan.com
Sep 18, 2026Clean Login: Does not check whether user registration is enabled before creating an account in its registration handlerCVE-2026-90976 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Clean Login WordPress plugin before 1.19 does not check whether user registration is enabled before creating an account in its registration handler, allowing unauthenticated users to create accounts even when the site has registration disabled.
Product
Clean Login
Fixed in
1.19
What to do
Update Clean Login to 1.19 or newer.
NVD record wpscan.com
Sep 18, 2026Filter Gallery: Authorization bypassCVE-2026-89413 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Filter Gallery plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.1.4. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete any arbitrary Filter Gallery records — including all associated filters, image mappings, settings, and details options — by supplying attacker-controlled gallery IDs. The nonce bypass requires omitting the nonce POST field entirely rather than submitting an invalid value, as a present-but-invalid nonce is correctly rejected.
Product
Filter Gallery
Affected
up to 1.1.4
What to do
Affects up to 1.1.4. Update Filter Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 18, 2026EmbedPress – PDF Embedder, 3D PDF FlipBook, Google Reviews, YouTube Videos, Upload & Embed PDF documents: Reflected Cross-Site ScriptingCVE-2026-89330 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The EmbedPress – PDF Embedder, 3D PDF FlipBook, Google Reviews, YouTube Videos, Upload & Embed PDF documents plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'unique' parameter in all versions up to, and including, 4.6.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. This is a regression: the esc_url() wrapper that remediated the equivalent CVE-2023-5749 in version 3.9.2 was removed in version 4.3.0 during a refactor that introduced the 'unique' parameter.
Product
EmbedPress – PDF Embedder, 3D PDF FlipBook, Google Reviews, YouTube Videos, Upload & Embed PDF documents
Affected
up to 4.6.5
What to do
Affects up to 4.6.5. Update EmbedPress – PDF Embedder, 3D PDF FlipBook, Google Reviews, YouTube Videos, Upload & Embed PDF documents to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 18, 2026GPTranslate – Multilingual AI Translation Agent for WordPress: Translate Your Site with AI: Sensitive Information ExposureCVE-2026-89278 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The GPTranslate – Multilingual AI Translation Agent for WordPress: Translate Your Site with AI plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.34.6 via the enqueue_frontend_scripts. This makes it possible for unauthenticated attackers to extract the plaintext third-party AI provider API key (OpenAI, DeepL, xAI/Grok, Gemini, Claude, or Google Cloud Translation) — a credential granting billed account access — by fetching any public page and applying the inverse transformation bundled in the plugin's own public JavaScript asset. This exposure affects the default configuration (gpt-3.5-turbo in client mode) and all supported non-DeepSeek providers; only deepseek-* models and gpt-* models configured in server-proxy mode correctly suppress key emission.
Product
GPTranslate – Multilingual AI Translation Agent for WordPress: Translate Your Site with AI
Affected
up to 2.34.6
What to do
Affects up to 2.34.6. Update GPTranslate – Multilingual AI Translation Agent for WordPress: Translate Your Site with AI to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 18, 2026Filter Gallery: Authorization bypassCVE-2026-89138 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Filter Gallery plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.1.4. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to overwrite the title and content of arbitrary WordPress posts, write the _wp_attachment_image_alt meta key on arbitrary posts, and create or overwrite arbitrary ufg_gallery_* options.
Product
Filter Gallery
Affected
up to 1.1.4
What to do
Affects up to 1.1.4. Update Filter Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 18, 2026All Bootstrap Blocks: Does not validate a block attribute before using it to build a filesystem path that is included at render timeCVE-2026-88994 · WordPress plugins & themes · reported by WPScanMedium 6.6
The All Bootstrap Blocks WordPress plugin through 1.3.31 does not validate a block attribute before using it to build a filesystem path that is included at render time, allowing users with contributor-level access and above to include arbitrary local files, disclose their contents, and execute PHP where a local file containing PHP code can be reached. Exploitation requires the plugin's Lightspeed subsystem to be enabled, which is not the default.
Product
All Bootstrap Blocks
Affected
up to 1.3.31
What to do
Affects up to 1.3.31. Update All Bootstrap Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record wpscan.com
Sep 18, 2026Hide My WP Ghost: Does not properly validate a loopback security-check request before disabling its login and URL hiding protectionCVE-2026-86800 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Hide My WP Ghost WordPress plugin before 7.0.11 does not properly validate a loopback security-check request before disabling its login and URL hiding protection, dropping that protection precisely when the request's verification value is missing or incorrect, which any visitor can arrange, allowing unauthenticated attackers to re-expose the concealed WordPress login page location.
Product
Hide My WP Ghost
Fixed in
7.0.11
What to do
Update Hide My WP Ghost to 7.0.11 or newer.
NVD record wpscan.com
Sep 18, 2026Hide My WP Ghost: Does not verify that a request is a genuine WooCommerce request before disabling its firewallCVE-2026-86796 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Hide My WP Ghost WordPress plugin before 7.0.11 does not verify that a request is a genuine WooCommerce request before disabling its firewall, threat-detection and login/URL-hiding protections, treating the mere presence of an attacker-suppliable request parameter as sufficient, which allows unauthenticated attackers to disable those protections and re-expose the concealed login and admin URLs on any request.
Product
Hide My WP Ghost
Fixed in
7.0.11
What to do
Update Hide My WP Ghost to 7.0.11 or newer.
NVD record wpscan.com
Sep 18, 2026Custom Twitter Feeds – A Tweets Widget or X Feed Widget: Stored Cross-Site ScriptingCVE-2026-84909 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Custom Twitter Feeds – A Tweets Widget or X Feed Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'buttoncolor' Shortcode Attribute in all versions up to, and including, 2.8.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability is exploitable on common installs where the admin has configured access tokens with zero or multiple legacy feeds, as this causes the ctf_statuses support_legacy_shortcode option to be set to boolean true by default, activating the unfiltered legacy shortcode attribute code path.
Product
Custom Twitter Feeds – A Tweets Widget or X Feed Widget
Affected
up to 2.8.0
What to do
Affects up to 2.8.0. Update Custom Twitter Feeds – A Tweets Widget or X Feed Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 18, 2026Breeze Cache: Does not include a set of tracking-related query parameters in its page-cache key while still caching pages requested with themCVE-2026-79713 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Breeze Cache WordPress plugin before 2.5.15 does not include a set of tracking-related query parameters in its page-cache key while still caching pages requested with them, allowing unauthenticated attackers to have a page rendered under their own request context stored under, and served from, the clean URL's cache entry to every subsequent visitor.
Product
Breeze Cache
Fixed in
2.5.15
What to do
Update Breeze Cache to 2.5.15 or newer.
NVD record wpscan.com
Sep 18, 2026Magazine Blocks – Blog Designer, Magazine & Newspaper Website Builder, Page Builder with Posts Blocks, Post Grid: Authorization bypassCVE-2026-75017 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Magazine Blocks – Blog Designer, Magazine & Newspaper Website Builder, Page Builder with Posts Blocks, Post Grid plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.8.6. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to demote administrator-owned published builder templates (header, footer, front page, single, archive, 404, and search) to draft status and replace them with attacker-authored block content rendered site-wide, enabling defacement, phishing, and SEO spam. This is possible because the mzb-builder-template post type is registered with capability_type='post' and exposed via the REST API, and the _mzb_template meta key is accessible to any user with edit_posts capability, meaning Contributor-level users and above can trigger the vulnerable save_post() hook.
Product
Magazine Blocks – Blog Designer, Magazine & Newspaper Website Builder, Page Builder with Posts Blocks, Post Grid
Affected
up to 1.8.6
What to do
Affects up to 1.8.6. Update Magazine Blocks – Blog Designer, Magazine & Newspaper Website Builder, Page Builder with Posts Blocks, Post Grid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 18, 2026Magazine Blocks: Stored Cross-Site ScriptingCVE-2026-75016 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Magazine Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the News Ticker block's clientId attribute in versions up to, and including, 1.8.6. This is due to insufficient input sanitization and output escaping in the NewsTicker::render() method, which concatenates the clientId block attribute into an HTML class attribute without applying esc_attr(). This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Magazine Blocks
Affected
up to 1.8.6
What to do
Affects up to 1.8.6. Update Magazine Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 18, 2026Foxtool All-in-One: Contact chat button, Custom login, Media optimize images: Authorization bypassCVE-2026-18317 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Foxtool All-in-One: Contact chat button, Custom login, Media optimize images plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.5.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to modify arbitrary subkeys of the foxtool_settings option, including enabling site-wide SVG uploads by toggling the media-up3 key, which can facilitate stored cross-site scripting via malicious SVG files.
Product
Foxtool All-in-One: Contact chat button, Custom login, Media optimize images
Affected
up to 2.5.3
What to do
Affects up to 2.5.3. Update Foxtool All-in-One: Contact chat button, Custom login, Media optimize images to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. The WordPress, CMS and hosting-panel entries come from the National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan and others); we show who. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Start a project

Tell us what you're building.

A website, a booking system, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.

01The person who'll build it writes back

02A planning call, then a written plan with the price and the date

03A preview on your phone while it's being built

04Launch night handled: redirects, email, Google

843-331-6339

Not ready to talk yet? Run the free website check and see what Google sees.