Updated 10 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

457new WordPress flaws this week

390,525entries in the database

2,143 results · page 5 of 43

Sep 23, 2026Unauthenticated Broken Access Control in WP User Manager <= 2.9.19 versions.CVE-2026-94079 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Broken Access Control in WP User Manager <= 2.9.19 versions.
Affected
up to 2.9.19
What to do
Affects up to 2.9.19. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 23, 2026Event Booking Manager for WooCommerce: Does not restrict its event listing query to events the requesting user is permitted to readCVE-2026-91077 · WordPress plugins & themes · reported by WPScanLow 2.7
The Event Booking Manager for WooCommerce WordPress plugin before 5.7.3 does not restrict its event listing query to events the requesting user is permitted to read, so users with contributor-level access and above can retrieve other authors' private, draft and trashed events, together with event detail the standard listing does not show them. This discloses private events and their content that WordPress withholds from users lacking the read_private_posts capability.
Product
Event Booking Manager for WooCommerce
Fixed in
5.7.3
What to do
Update Event Booking Manager for WooCommerce to 5.7.3 or newer.
Full record and what to do →NVD record wpscan.com
Sep 23, 2026Booking Manager: Does not verify that a request to modify a user's Booking Manager WordPress plugin before 2CVE-2026-91025 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Booking Manager WordPress plugin before 2.1.21 does not verify that a request to modify a user's Booking Manager WordPress plugin before 2.1.21-specific settings targets the requesting user's own account, allowing any authenticated user with subscriber-level access and above to create or overwrite the Booking Manager WordPress plugin before 2.1.21's per-user settings on arbitrary users, including administrators.
Product
Booking Manager
Fixed in
2.1.21
What to do
Update Booking Manager to 2.1.21 or newer.
Full record and what to do →NVD record wpscan.com
Sep 23, 2026Paid Membership Subscriptions: Does not bind one of its unauthenticated payment actions to the requesting userCVE-2026-90951 · WordPress plugins & themes · reported by WPScanLow 3.7
The Paid Membership Subscriptions WordPress plugin before 3.1.0 does not bind one of its unauthenticated payment actions to the requesting user, allowing someone who holds another member's in-flight payment identifier to delete that member's checkout state.
Product
Paid Membership Subscriptions
Fixed in
3.1.0
What to do
Update Paid Membership Subscriptions to 3.1.0 or newer.
Full record and what to do →NVD record wpscan.com
Sep 23, 2026Product Badge, Label, Countdown Timer for WooCommerce: Does not check whether a product is published before returning its details to unauthenticated usersCVE-2026-88929 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Product Badge, Label, Countdown Timer for WooCommerce WordPress plugin before 7.5.2 does not check whether a product is published before returning its details to unauthenticated users, allowing them to read the title, description and price of draft, pending and private products.
Product
Product Badge, Label, Countdown Timer for WooCommerce
Fixed in
7.5.2
What to do
Update Product Badge, Label, Countdown Timer for WooCommerce to 7.5.2 or newer.
Full record and what to do →NVD record wpscan.com
Sep 23, 2026Directorist: AI-Powered Business Directory, Listings & Classified Ads: Does not verify that the target user of a REST route matches the authenticated caller before reading and modifying that user's saved favoritesCVE-2026-84150 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not verify that the target user of a REST route matches the authenticated caller before reading and modifying that user's saved favorites, allowing any authenticated user with subscriber-level access to view and alter another user's favorites.
Product
Directorist: AI-Powered Business Directory, Listings & Classified Ads
Fixed in
8.9.5
What to do
Update Directorist: AI-Powered Business Directory, Listings & Classified Ads to 8.9.5 or newer.
Full record and what to do →NVD record wpscan.com
Sep 23, 2026Directorist: AI-Powered Business Directory, Listings & Classified Ads: Does not validate a user-supplied URL before fetching it server-sideCVE-2026-84046 · WordPress plugins & themes · reported by WPScanMedium 5
The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not validate a user-supplied URL before fetching it server-side, allowing users with the subscriber role and above to make the server issue requests to internal addresses.
Product
Directorist: AI-Powered Business Directory, Listings & Classified Ads
Fixed in
8.9.5
What to do
Update Directorist: AI-Powered Business Directory, Listings & Classified Ads to 8.9.5 or newer.
Full record and what to do →NVD record wpscan.com
Sep 23, 2026Directorist: AI-Powered Business Directory, Listings & Classified Ads: Does not check user capabilitiesCVE-2026-84027 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not check user capabilities when creating orders through its REST API, allowing users with the subscriber role and above to create paid order and payment records with arbitrary amounts and attribute them to other users.
Product
Directorist: AI-Powered Business Directory, Listings & Classified Ads
Fixed in
8.9.5
What to do
Update Directorist: AI-Powered Business Directory, Listings & Classified Ads to 8.9.5 or newer.
Full record and what to do →NVD record wpscan.com
Sep 23, 2026Directorist: AI-Powered Business Directory, Listings & Classified Ads: Does not restrict access to a REST endpoint that returns user recordsCVE-2026-84026 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not restrict access to a REST endpoint that returns user records, allowing unauthenticated attackers to read registered users' private contact details.
Product
Directorist: AI-Powered Business Directory, Listings & Classified Ads
Fixed in
8.9.5
What to do
Update Directorist: AI-Powered Business Directory, Listings & Classified Ads to 8.9.5 or newer.
Full record and what to do →NVD record wpscan.com
Sep 23, 2026MasterStudy LMS: Does not properly sanitise and restrict HTML in user-submitted content before storing it and rendering it to other usersCVE-2026-81338 · WordPress plugins & themes · reported by WPScanMedium 4.6
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not properly sanitise and restrict HTML in user-submitted content before storing it and rendering it to other users, allowing users with subscriber-level accounts and above to perform stored HTML injection, such as embedding iframes, that can be leveraged for phishing and content spoofing against other users viewing the content.
Product
MasterStudy LMS
Fixed in
3.7.50
What to do
Update MasterStudy LMS to 3.7.50 or newer.
Full record and what to do →NVD record wpscan.com
Sep 23, 2026Directorist: AI-Powered Business Directory, Listings & Classified Ads: Does not scope one of its REST collection endpoints to the requesting userCVE-2026-77766 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not scope one of its REST collection endpoints to the requesting user, allowing users with a subscriber-level account to read every customer's order and payment records. Versions 8.8.1 to 8.9 are not affected. The endpoint was scoped correctly in 8.8.1 and the unscoped behaviour was reintroduced in 8.9.1.
Product
Directorist: AI-Powered Business Directory, Listings & Classified Ads
Fixed in
8.9.5
What to do
Update Directorist: AI-Powered Business Directory, Listings & Classified Ads to 8.9.5 or newer.
Full record and what to do →NVD record wpscan.com
Sep 22, 2026WP User Manager: Unauthorized modification of dataCVE-2026-18345 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP User Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the Connect::complete() function in versions up to, and including, 2.9.18. The function is registered on the admin_init hook (which fires for every authenticated user that reaches /wp-admin/, including Subscribers) and performs no current_user_can() or nonce verification before fetching Stripe credentials from the external WPUM connect service and writing them (publishable key, secret key, gateway mode, and connected Stripe account ID) into the wpum_settings option via wpum_update_option()/update_option(). This makes it possible for authenticated attackers, with Subscriber-level access and above, to hijack the site's Stripe integration by completing their own Stripe Connect OAuth flow and then invoking the callback on the target site, causing all subsequent Stripe payments to be routed to the attacker's Stripe account.
Product
WP User Manager
Affected
up to 2.9.18
What to do
Affects up to 2.9.18. Update WP User Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 22, 2026The Ninja Forms WordPress plugin 3.15.3 does not prevent user-submitted form field values from being deserialised when an administrator later exports form submiCVE-2026-91827 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Ninja Forms WordPress plugin 3.15.3 does not prevent user-submitted form field values from being deserialised when an administrator later exports form submissions to CSV, allowing unauthenticated attackers to perform PHP Object Injection; if a suitable POP chain is present via another installed plugin or theme, this can lead to actions such as arbitrary file operations or remote code execution.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record wpscan.com
Sep 22, 2026Text Styler: Does not sanitise and escape user-supplied styling values before outputting them within a front-end style blockCVE-2026-88788 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Text Styler WordPress plugin through 1.1.1 does not sanitise and escape user-supplied styling values before outputting them within a front-end style block, and does not verify that a user may edit the target post, allowing users with contributor-level access or above to store JavaScript that executes in the browser of anyone viewing the affected post, including administrators.
Product
Text Styler
Affected
up to 1.1.1
What to do
Affects up to 1.1.1. Update Text Styler to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Sep 21, 2026Metaphor Creations Ditty (ditty-news-ticker) before 3.1.70 contains a stored cross-site scripting vulnerability that allows authenticated users with Author-leveCVE-2026-93339 · WordPress plugins & themes · reported by VulnCheckMedium 5.1
Metaphor Creations Ditty (ditty-news-ticker) before 3.1.70 contains a stored cross-site scripting vulnerability that allows authenticated users with Author-level privileges or higher to inject arbitrary HTML elements by supplying malicious wrapper attribute values in layout tags. The ditty_layout_render_tag_wrapper() function inserts caller-supplied wrapper attribute values directly as HTML element names without allowlist validation, bypassing wp_kses_post() sanitization because KSES runs at save time before layout tag attributes are resolved at render time, causing the payload to execute in the browser of any visitor viewing posts or pages embedding the affected Ditty item.
Fixed in
3.1.70
What to do
Update the plugin to 3.1.70 or newer.
Full record and what to do →NVD record lazytitan.ro wordpress.org
Sep 20, 2026Import and export users and customers: Does not enforce the promote_users capability in its front-end import functionalityCVE-2026-92541 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Import and export users and customers WordPress plugin before 2.5.2 does not enforce the promote_users capability in its front-end import functionality, allowing users with only the create_users capability to change the role of existing users, including promoting them to administrator.
Product
Import and export users and customers
Fixed in
2.5.2
What to do
Update Import and export users and customers to 2.5.2 or newer.
Full record and what to do →NVD record wpscan.com
Sep 20, 2026Import and export users and customers: Does not correctly enforce the promote_users capabilityCVE-2026-92540 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Import and export users and customers WordPress plugin before 2.5.2 does not correctly enforce the promote_users capability when assigning roles during a CSV import, allowing users with only the create_users capability to create new administrator accounts or promote existing users to administrator.
Product
Import and export users and customers
Fixed in
2.5.2
What to do
Update Import and export users and customers to 2.5.2 or newer.
Full record and what to do →NVD record wpscan.com
Sep 20, 2026Meow Gallery: Does not perform a proper capability check or restrict results to the requesting user's own posts before returning post dataCVE-2026-92423 · WordPress plugins & themes · reported by WPScanLow 2.7
The Meow Gallery WordPress plugin before 5.5.5 does not perform a proper capability check or restrict results to the requesting user's own posts before returning post data, allowing authenticated users with Author-level access and above to disclose the titles, authors, dates and statuses of other users' draft and private posts.
Product
Meow Gallery
Fixed in
5.5.5
What to do
Update Meow Gallery to 5.5.5 or newer.
Full record and what to do →NVD record wpscan.com
Sep 20, 2026Meow Gallery: Does not properly sanitize a user-supplied value before concatenating it into a shortcode string that it passes to the WordPress shortcode parser on a publicly reachable endpointCVE-2026-92422 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Meow Gallery WordPress plugin before 5.5.5 does not properly sanitize a user-supplied value before concatenating it into a shortcode string that it passes to the WordPress shortcode parser on a publicly reachable endpoint, allowing unauthenticated users to execute arbitrary registered shortcodes and disclose non-public gallery content.
Product
Meow Gallery
Fixed in
5.5.5
What to do
Update Meow Gallery to 5.5.5 or newer.
Full record and what to do →NVD record wpscan.com
Sep 20, 2026Photo Gallery, Sliders, Proofing and: Does not check that a user holds its options capability before saving image sizing settingsCVE-2026-81654 · WordPress plugins & themes · reported by WPScanLow 3.1
The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not check that a user holds its options capability before saving image sizing settings, allowing users granted only its gallery-management capability by an administrator to change settings that apply across the whole site.
Product
Photo Gallery, Sliders, Proofing and
Fixed in
4.5.0
What to do
Update Photo Gallery, Sliders, Proofing and to 4.5.0 or newer.
Full record and what to do →NVD record wpscan.com
Sep 20, 2026Photo Gallery, Sliders, Proofing and: Does not verify that the user acting on an image owns the gallery it belongs toCVE-2026-81653 · WordPress plugins & themes · reported by WPScanMedium 4.2
The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not verify that the user acting on an image owns the gallery it belongs to, allowing users granted its gallery-management capability by an administrator to delete, copy and re-tag any image on the site, including images in galleries belonging to other users.
Product
Photo Gallery, Sliders, Proofing and
Fixed in
4.5.0
What to do
Update Photo Gallery, Sliders, Proofing and to 4.5.0 or newer.
Full record and what to do →NVD record wpscan.com
Sep 20, 2026Photo Gallery, Sliders, Proofing and: Does not verify that the requesting user is entitled to a given image record before returning itCVE-2026-81652 · WordPress plugins & themes · reported by WPScanLow 2.7
The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not verify that the requesting user is entitled to a given image record before returning it, allowing users with the Contributor role and above to read the stored metadata of any image on the site, including images in galleries belonging to other users. The disclosed data includes the image's stored EXIF subset, covering camera make and model and capture timestamp, along with internal checksums and identifiers that the Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0's own capability-gated read path reserves to administrators.
Product
Photo Gallery, Sliders, Proofing and
Fixed in
4.5.0
What to do
Update Photo Gallery, Sliders, Proofing and to 4.5.0 or newer.
Full record and what to do →NVD record wpscan.com
Sep 20, 2026Photo Gallery, Sliders, Proofing and: Does not verify that the user saving a gallery owns itCVE-2026-81651 · WordPress plugins & themes · reported by WPScanLow 3.1
The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not verify that the user saving a gallery owns it, allowing any user granted its gallery-management capability by an administrator to overwrite the stored settings of any gallery on the site, including its filesystem path, and including galleries belonging to other users.
Product
Photo Gallery, Sliders, Proofing and
Fixed in
4.5.0
What to do
Update Photo Gallery, Sliders, Proofing and to 4.5.0 or newer.
Full record and what to do →NVD record wpscan.com
Sep 20, 2026Import and export users and customers: Does not validate a user-supplied URL before requesting it server-side during a CSV importCVE-2026-16542 · WordPress plugins & themes · reported by WPScanMedium 4.1
The Import and export users and customers WordPress plugin before 2.4.5 does not validate a user-supplied URL before requesting it server-side during a CSV import, allowing high-privileged users to perform Server-Side Request Forgery attacks.
Product
Import and export users and customers
Fixed in
2.4.5
What to do
Update Import and export users and customers to 2.4.5 or newer.
Full record and what to do →NVD record wpscan.com
Sep 19, 2026Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress: Arbitrary shortcode executionCVE-2026-85658 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 4.17.2 This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for authenticated attackers, with subscriber-level access and above, to execute arbitrary shortcodes.
Product
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress
Affected
up to 4.17.2
What to do
Affects up to 4.17.2. Update Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 19, 2026Mailchimp for WooCommerce: Does not verify that the requesting user holds the required capability in the permission callback for several of its REST API routesCVE-2026-92435 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Mailchimp for WooCommerce WordPress plugin before 6.1.1 does not verify that the requesting user holds the required capability in the permission callback for several of its REST API routes, allowing unauthenticated users to reach administrator-oriented endpoints and trigger a persistent state change.
Product
Mailchimp for WooCommerce
Fixed in
6.1.1
What to do
Update Mailchimp for WooCommerce to 6.1.1 or newer.
Full record and what to do →NVD record wpscan.com
Sep 19, 2026Hydra Booking — Appointment Scheduling & Booking Calendar: Does not verify that the host record being modified belongs to the user making the requestCVE-2026-92421 · WordPress plugins & themes · reported by WPScanMedium 4.7
The Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.3 does not verify that the host record being modified belongs to the user making the request, allowing authenticated users holding a Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.3-assigned host role to modify other hosts' profile data and reassign ownership of another host's record to themselves.
Product
Hydra Booking — Appointment Scheduling & Booking Calendar
Fixed in
1.2.3
What to do
Update Hydra Booking — Appointment Scheduling & Booking Calendar to 1.2.3 or newer.
Full record and what to do →NVD record wpscan.com
Sep 19, 2026Hydra Booking — Appointment Scheduling & Booking Calendar: Does not verify that a booking belongs to the requesting user before modifying or deleting it on two of its booking endpointsCVE-2026-92420 · WordPress plugins & themes · reported by WPScanLow 3.8
The Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.2 does not verify that a booking belongs to the requesting user before modifying or deleting it on two of its booking endpoints, allowing a booking-provider-level user to cancel and permanently delete other providers' bookings on the same site.
Product
Hydra Booking — Appointment Scheduling & Booking Calendar
Fixed in
1.2.2
What to do
Update Hydra Booking — Appointment Scheduling & Booking Calendar to 1.2.2 or newer.
Full record and what to do →NVD record wpscan.com
Sep 19, 2026UsersWP: Does not verify that a social login provider has confirmed ownership of an email address before using it to resolve an existing accountCVE-2026-86814 · WordPress plugins & themes · reported by WPScanHigh 8.1
The UsersWP WordPress plugin before 1.5.10 does not verify that a social login provider has confirmed ownership of an email address before using it to resolve an existing account, allowing unauthenticated attackers to log in as any user, including administrators, whose email address they can assert through a provider account of their own.
Product
UsersWP
Fixed in
1.5.10
What to do
Update UsersWP to 1.5.10 or newer.
Full record and what to do →NVD record wpscan.com
Sep 19, 2026Ultimate Member: Does not escape a value derived from user supplied profile names before outputting it in the page titleCVE-2026-85680 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Ultimate Member WordPress plugin before 2.13.1 does not escape a value derived from user supplied profile names before outputting it in the page title, and decodes HTML entities in it after its own sanitisation has already run, allowing unauthenticated attackers who register an account to store JavaScript that will execute when any visitor, including an administrator, views their profile.
Product
Ultimate Member
Fixed in
2.13.1
What to do
Update Ultimate Member to 2.13.1 or newer.
Full record and what to do →NVD record wpscan.com
Sep 19, 2026WP Import Export Lite: Does not verify that the user running an import is permitted to create or modify user accounts and assign rolesCVE-2026-76554 · WordPress plugins & themes · reported by WPScanHigh 7.2
The WP Import Export Lite WordPress plugin before 3.9.35 does not verify that the user running an import is permitted to create or modify user accounts and assign roles, allowing users granted a delegated WP Import Export Lite WordPress plugin before 3.9.35 permission, who cannot otherwise manage users, to create administrator accounts and to overwrite the credentials and role of existing accounts, including administrators.
Product
WP Import Export Lite
Fixed in
3.9.35
What to do
Update WP Import Export Lite to 3.9.35 or newer.
Full record and what to do →NVD record wpscan.com
Sep 18, 2026Mapster WP Maps: Arbitrary User Meta WriteCVE-2026-12954 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Mapster WP Maps plugin for WordPress is vulnerable to Arbitrary User Meta Write in all versions up to, and including, 1.23.0 via the `my_profile_update()` function. This is due to the function performing no nonce verification, no capability check, and no allowlist validation on the meta key supplied via the `acf-photo-gallery-groups` POST parameter before passing both the meta key and its corresponding value directly to `update_user_meta()`. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary user meta values, though privilege escalation is not possible.
Product
Mapster WP Maps
Affected
up to 1.23.0
What to do
Affects up to 1.23.0. Update Mapster WP Maps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 18, 2026Clean Login: Does not check whether user registration is enabled before creating an account in its registration handlerCVE-2026-90976 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Clean Login WordPress plugin before 1.19 does not check whether user registration is enabled before creating an account in its registration handler, allowing unauthenticated users to create accounts even when the site has registration disabled.
Product
Clean Login
Fixed in
1.19
What to do
Update Clean Login to 1.19 or newer.
Full record and what to do →NVD record wpscan.com
Sep 18, 2026MasterStudy LMS: Does not verify that the requesting user owns the course before returning its enrolled-student dataCVE-2026-88844 · WordPress plugins & themes · reported by WPScanLow 2.7
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not verify that the requesting user owns the course before returning its enrolled-student data, allowing users with the MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50's Instructor role to disclose the names and email addresses of students enrolled in other instructors' courses.
Product
MasterStudy LMS
Fixed in
3.7.50
What to do
Update MasterStudy LMS to 3.7.50 or newer.
Full record and what to do →NVD record wpscan.com
Sep 18, 2026Tz Weekly Radio Schedule: Does not sanitize and escape a parameter before using it to build a SQL query on an AJAX action available to unauthenticated usersCVE-2026-87775 · WordPress plugins & themes · reported by WPScanHigh 8.6
The Tz Weekly Radio Schedule WordPress plugin through 1.8.1 does not sanitize and escape a parameter before using it to build a SQL query on an AJAX action available to unauthenticated users, allowing unauthenticated attackers to perform SQL injection attacks and extract sensitive data from the database.
Product
Tz Weekly Radio Schedule
Affected
up to 1.8.1
What to do
Affects up to 1.8.1. Update Tz Weekly Radio Schedule to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Sep 18, 2026Tz Weekly Radio Schedule: Does not sanitize and escape a parameter before using it to build a SQL query on an AJAX action available to unauthenticated usersCVE-2026-87774 · WordPress plugins & themes · reported by WPScanHigh 8.6
The Tz Weekly Radio Schedule WordPress plugin through 1.8.1 does not sanitize and escape a parameter before using it to build a SQL query on an AJAX action available to unauthenticated users, allowing unauthenticated attackers to perform SQL injection attacks and extract sensitive data from the database.
Product
Tz Weekly Radio Schedule
Affected
up to 1.8.1
What to do
Affects up to 1.8.1. Update Tz Weekly Radio Schedule to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Sep 18, 2026Product Question and Answer: Does not sanitize and escape parameters before using them in SQL queries on AJAX actions available to unauthenticated usersCVE-2026-87771 · WordPress plugins & themes · reported by WPScanHigh 8.6
The Product Question and Answer WordPress plugin through 1.1.0 does not sanitize and escape parameters before using them in SQL queries on AJAX actions available to unauthenticated users, allowing unauthenticated attackers to perform SQL injection attacks and extract sensitive data from the database.
Product
Product Question and Answer
Affected
up to 1.1.0
What to do
Affects up to 1.1.0. Update Product Question and Answer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Sep 18, 2026Price Drop Alert for Woo Commerce: Does not sanitize and escape parameters before using them in a SQL query on an AJAX action available to unauthenticated usersCVE-2026-87770 · WordPress plugins & themes · reported by WPScanHigh 8.6
The Price Drop Alert for Woo Commerce WordPress plugin through 1.1 does not sanitize and escape parameters before using them in a SQL query on an AJAX action available to unauthenticated users, allowing unauthenticated attackers to perform SQL injection attacks and extract sensitive data from the database.
Product
Price Drop Alert for Woo Commerce
Affected
up to 1.1
What to do
Affects up to 1.1. Update Price Drop Alert for Woo Commerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Sep 18, 2026wp shortcut link and advertisement baner: Does not sanitize and escape a parameter before using it in a SQL query on an AJAX action available to unauthenticated usersCVE-2026-87767 · WordPress plugins & themes · reported by WPScanHigh 8.6
The wp shortcut link and advertisement baner WordPress plugin through 1.2.0 does not sanitize and escape a parameter before using it in a SQL query on an AJAX action available to unauthenticated users, allowing unauthenticated attackers to perform SQL injection attacks and extract sensitive data from the database.
Product
wp shortcut link and advertisement baner
Affected
up to 1.2.0
What to do
Affects up to 1.2.0. Update wp shortcut link and advertisement baner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Sep 17, 2026Unauthenticated Broken Access Control in User Registration <= 5.2.7 versions.CVE-2026-74017 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Broken Access Control in User Registration <= 5.2.7 versions.
Affected
up to 5.2.7
What to do
Affects up to 5.2.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 17, 2026The Yo WordPress plugin from 1.1 through 1.3.1 does not sanitize or parameterize the username request parameter before using it in a SQL query, and reads it befCVE-2026-87963 · WordPress plugins & themes · reported by WPScanHigh 8.6
The Yo WordPress plugin from 1.1 through 1.3.1 does not sanitize or parameterize the username request parameter before using it in a SQL query, and reads it before WordPress applies its request escaping, allowing unauthenticated attackers to perform SQL injection and read arbitrary database contents including administrator password hashes.
Affected
up to 1.3.1
What to do
Affects up to 1.3.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Sep 17, 2026Motors: Does not verify that a request is authorized to view a user's non-published listings before returning themCVE-2026-91016 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Motors WordPress plugin before 1.4.121 does not verify that a request is authorized to view a user's non-published listings before returning them, allowing unauthenticated attackers to read any author's draft, pending and private car listings - including titles, prices, media URLs and seller notes - by supplying only the target's numeric user id.
Product
Motors
Fixed in
1.4.121
What to do
Update Motors to 1.4.121 or newer.
Full record and what to do →NVD record wpscan.com
Sep 17, 2026Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms: Does not check the user's capabilities in its message deletion AJAX actionCVE-2026-91010 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms WordPress plugin before 5.1.1 does not check the user's capabilities in its message deletion AJAX action, and only tests that a nonce parameter is present rather than validating it, allowing any authenticated user, such as a subscriber, to permanently delete every form submission the Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms WordPress plugin before 5.1.1 has stored.
Product
Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms
Fixed in
5.1.1
What to do
Update Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms to 5.1.1 or newer.
Full record and what to do →NVD record wpscan.com
Sep 17, 2026Comments Import & Export: Does not restrict its comment export to users able to moderate commentsCVE-2026-87836 · WordPress plugins & themes · reported by WPScanLow 2.7
The Comments Import & Export WordPress plugin before 2.5.4 does not restrict its comment export to users able to moderate comments, nor scope the export to content owned by the requesting user, allowing users with the Author role and above to retrieve every comment on the site, including commenter email addresses, IP addresses, unapproved comment content and comment meta.
Product
Comments Import & Export
Fixed in
2.5.4
What to do
Update Comments Import & Export to 2.5.4 or newer.
Full record and what to do →NVD record wpscan.com
Sep 17, 2026Login with QR: Does not verify that the code used to log a user in is one it issuedCVE-2026-86710 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Login with QR WordPress plugin through 1.0.0 does not verify that the code used to log a user in is one it issued, matching any stored user metadata value instead, which allows unauthenticated attackers to log in as any user, including administrators.
Product
Login with QR
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Login with QR to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Sep 17, 2026Choose User Role at Registration: Does not validate the role requested at registration against the roles an administrator chose to offerCVE-2026-85128 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Choose User Role at Registration WordPress plugin before 1.3.3 does not validate the role requested at registration against the roles an administrator chose to offer, allowing unauthenticated users to request any role, including administrator, and to be granted it once the request is approved. Exploitation requires the Choose User Role at Registration WordPress plugin before 1.3.3's role selection feature and public account registration to both be enabled.
Product
Choose User Role at Registration
Fixed in
1.3.3
What to do
Update Choose User Role at Registration to 1.3.3 or newer.
Full record and what to do →NVD record wpscan.com
Sep 17, 2026Dictionary: Does not escape user input before reflecting it back in the responses of several directly accessible scriptsCVE-2025-15697 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Dictionary WordPress plugin through 1.0 does not escape user input before reflecting it back in the responses of several directly accessible scripts, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting attacks against anyone they can induce to submit a crafted request.
Product
Dictionary
Affected
up to 1.0
What to do
Affects up to 1.0. Update Dictionary to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Sep 16, 2026Adenion Blog2Social plugin for WordPress before 9.1.0 allows low-privileged users to modify the scheduled post records of other users.CVE-2026-89031 · WordPress plugins & themes · reported by VulnCheckMedium 5.3
Adenion Blog2Social plugin for WordPress before 9.1.0 allows low-privileged users to modify the scheduled post records of other users. The b2s_calendar_move_post AJAX handler in includes/Ajax/Post.php issues an UPDATE against the b2s_posts table using only the attacker-supplied b2s_id primary key with no blog_user_id ownership constraint, allowing any user with the edit_posts capability to reschedule, suppress, or alter the publication state of any other user's scheduled social media post.
Fixed in
9.1.0
What to do
Update the plugin to 9.1.0 or newer.
Full record and what to do →NVD record wordpress.org vulncheck.com
Sep 16, 2026Adenion Blog2Social plugin for WordPress before 9.1.0 exposes the email addresses of all registered WordPress users to low-privileged accounts.CVE-2026-89030 · WordPress plugins & themes · reported by VulnCheckMedium 5.3
Adenion Blog2Social plugin for WordPress before 9.1.0 exposes the email addresses of all registered WordPress users to low-privileged accounts. The b2s_search_user AJAX handler in includes/Ajax/Get.php invokes B2S_Tools::searchUser() in includes/Tools.php, which returns the email address of every matching user without restricting access to callers holding the list_users capability, allowing any user with the edit_posts capability to retrieve user email addresses including those of administrators.
Fixed in
9.1.0
What to do
Update the plugin to 9.1.0 or newer.
Full record and what to do →NVD record wordpress.org vulncheck.com
Sep 16, 2026Adenion Blog2Social plugin for WordPress before 9.1.0 allows low-privileged users to enumerate WordPress user accounts.CVE-2026-89029 · WordPress plugins & themes · reported by VulnCheckMedium 5.3
Adenion Blog2Social plugin for WordPress before 9.1.0 allows low-privileged users to enumerate WordPress user accounts. The b2s_get_select_mandant_user AJAX handler in includes/Ajax/Get.php resolves arbitrary user IDs supplied in the owner parameter to display names without verifying that the caller is authorized to read user account data, allowing any user with the edit_posts capability to map WordPress user IDs to display names and confirm account existence for arbitrary IDs.
Fixed in
9.1.0
What to do
Update the plugin to 9.1.0 or newer.
Full record and what to do →NVD record wordpress.org vulncheck.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.