Vulnerability database

5,825 results · page 5 of 117

• Oct 5, 2026Image Slider Widget: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-42700 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GhozyLab Image Slider Widget image-slider-widget allows Stored XSS.This issue affects Image Slider Widget: from n/a through 1.1.130.

  Product

  Image Slider Widget

  Affected

  up to 1.1.130

  What to do

  Affects up to 1.1.130. Update Image Slider Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 5, 2026Adsmonetizer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-15643 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jose Fernandez Adsmonetizer adsensei-b30 allows Reflected XSS.This issue affects Adsmonetizer: from n/a through 3.2.4.

  Product

  Adsmonetizer

  Affected

  up to 3.2.4

  What to do

  Affects up to 3.2.4. Update Adsmonetizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 5, 2026QR Redirector: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-105069 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nikki Blight QR Redirector qr-redirector allows Stored XSS.This issue affects QR Redirector: from n/a through 2.0.5.

  Product

  QR Redirector

  Affected

  up to 2.0.5

  What to do

  Affects up to 2.0.5. Update QR Redirector to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 5, 2026Logo Showcase: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-105060 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themepoints Logo Showcase logo-showcase allows Stored XSS.This issue affects Logo Showcase: from n/a through 4.0.4.

  Product

  Logo Showcase

  Affected

  up to 4.0.4

  What to do

  Affects up to 4.0.4. Update Logo Showcase to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 5, 2026eCommerce Product Catalog: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-105056 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in impleCode eCommerce Product Catalog ecommerce-product-catalog allows Stored XSS.This issue affects eCommerce Product Catalog: from n/a through 3.6.2.

  Product

  eCommerce Product Catalog

  Affected

  up to 3.6.2

  What to do

  Affects up to 3.6.2. Update eCommerce Product Catalog to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 5, 2026MP3 Audio Player for Music, Radio & Podcast by Sonaar: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-104673 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sonaar MP3 Audio Player for Music, Radio & Podcast by Sonaar mp3-music-player-by-sonaar allows Stored XSS.This issue affects MP3 Audio Player for Music, Radio & Podcast by Sonaar: from n/a through 5.14.2.

  Product

  MP3 Audio Player for Music, Radio & Podcast by Sonaar

  Affected

  up to 5.14.2

  What to do

  Affects up to 5.14.2. Update MP3 Audio Player for Music, Radio & Podcast by Sonaar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 5, 2026Image Photo Gallery Final Tiles Grid: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-104409 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Image Photo Gallery Final Tiles Grid final-tiles-grid-gallery-lite allows Stored XSS.This issue affects Image Photo Gallery Final Tiles Grid: from n/a through 3.6.13.

  Product

  Image Photo Gallery Final Tiles Grid

  Affected

  up to 3.6.13

  What to do

  Affects up to 3.6.13. Update Image Photo Gallery Final Tiles Grid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 5, 2026GiveWP: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-104404 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / StellarWP GiveWP give allows Stored XSS.This issue affects GiveWP: from n/a through 4.17.0.

  Product

  GiveWP

  Affected

  up to 4.17.0

  What to do

  Affects up to 4.17.0. Update GiveWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 5, 2026B Blocks: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-104400 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins B Blocks b-blocks allows Stored XSS.This issue affects B Blocks: from n/a through 2.1.8.

  Product

  B Blocks

  Affected

  up to 2.1.8

  What to do

  Affects up to 2.1.8. Update B Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 5, 2026Name Directory: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-104396 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jeroen Peters Name Directory name-directory allows Stored XSS.This issue affects Name Directory: from n/a through 1.34.2.

  Product

  Name Directory

  Affected

  up to 1.34.2

  What to do

  Affects up to 1.34.2. Update Name Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 5, 2026Premium Addons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-103084 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LeapWorx Premium Addons for Elementor premium-addons-for-elementor allows Stored XSS.This issue affects Premium Addons for Elementor: from n/a through 4.11.109.

  Product

  Premium Addons for Elementor

  Affected

  up to 4.11.109

  What to do

  Affects up to 4.11.109. Update Premium Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 5, 2026Presto Player: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-102914 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force Presto Player presto-player allows Stored XSS.This issue affects Presto Player: from n/a through 4.5.2.

  Product

  Presto Player

  Affected

  up to 4.5.2

  What to do

  Affects up to 4.5.2. Update Presto Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 5, 2026Starter Templates: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-102393 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force Starter Templates astra-sites allows Stored XSS.This issue affects Starter Templates: from n/a through 4.7.7.

  Product

  Starter Templates

  Affected

  up to 4.7.7

  What to do

  Affects up to 4.7.7. Update Starter Templates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 4, 2026WP Statistics: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-97276 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VeronaLabs WP Statistics wp-statistics allows Reflected XSS.This issue affects WP Statistics: from n/a through 14.16.14.

  Product

  WP Statistics

  Affected

  up to 14.16.14

  What to do

  Affects up to 14.16.14. Update WP Statistics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 4, 2026Gutenberg Blocks by Kadence Blocks: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-103354 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / StellarWP Gutenberg Blocks by Kadence Blocks kadence-blocks allows Stored XSS.This issue affects Gutenberg Blocks by Kadence Blocks: from n/a through 3.7.11.1.

  Product

  Gutenberg Blocks by Kadence Blocks

  Affected

  up to 3.7.11.1

  What to do

  Affects up to 3.7.11.1. Update Gutenberg Blocks by Kadence Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 4, 2026Unlimited Elements For Elementor (Free Widgets, Addons, Templates): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-103344 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor allows Reflected XSS.This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 2.0.20.

  Product

  Unlimited Elements For Elementor (Free Widgets, Addons, Templates)

  Affected

  up to 2.0.20

  What to do

  Affects up to 2.0.20. Update Unlimited Elements For Elementor (Free Widgets, Addons, Templates) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 4, 2026TranslatePress: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-103062 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cozmoslabs TranslatePress translatepress-multilingual allows Stored XSS.This issue affects TranslatePress: from n/a through 3.3.6.

  Product

  TranslatePress

  Affected

  up to 3.3.6

  What to do

  Affects up to 3.3.6. Update TranslatePress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 4, 2026Razorpay for WooCommerce: Does not perform ownership or authorization checks on a REST API route used during checkoutCVE-2026-104118 · WordPress plugins & themes · reported by WPScanMedium 5.3

  The Razorpay for WooCommerce WordPress plugin before 4.8.8 does not perform ownership or authorization checks on a REST API route used during checkout, allowing unauthenticated attackers to modify the shipping information stored on arbitrary orders.

  Product

  Razorpay for WooCommerce

  Fixed in

  4.8.8

  What to do

  Update Razorpay for WooCommerce to 4.8.8 or newer.

  Full record and what to do →NVD recordwpscan.com

• Oct 3, 2026Unlimited Elements For Elementor (Free Widgets, Addons, Templates): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-103342 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor allows Reflected XSS.This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 2.0.20.

  Product

  Unlimited Elements For Elementor (Free Widgets, Addons, Templates)

  Affected

  up to 2.0.20

  What to do

  Affects up to 2.0.20. Update Unlimited Elements For Elementor (Free Widgets, Addons, Templates) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 3, 2026Kubio AI Page Builder: Does not validate the URI scheme of a user-supplied value before outputting itCVE-2026-88782 · WordPress plugins & themes · reported by WPScanMedium 6.8

  The Kubio AI Page Builder WordPress plugin before 2.9.3 does not validate the URI scheme of a user-supplied value before outputting it as a link target, allowing users with the contributor role and above to store a payload which executes in the browser of anyone who follows the link, including an administrator previewing the unpublished submission.

  Product

  Kubio AI Page Builder

  Fixed in

  2.9.3

  What to do

  Update Kubio AI Page Builder to 2.9.3 or newer.

  Full record and what to do →NVD recordwpscan.com

• Oct 2, 2026ThemeREX Addons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-102798 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeREX Group ThemeREX Addons trx_addons allows Stored XSS.This issue affects ThemeREX Addons: from n/a through 2.46.0.

  Product

  ThemeREX Addons

  Affected

  up to 2.46.0

  What to do

  Affects up to 2.46.0. Update ThemeREX Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 1, 2026FluentForm: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-103343 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP ManageNinja LLC FluentForm fluentform allows Stored XSS.This issue affects FluentForm: from n/a through 6.2.14.

  Product

  FluentForm

  Affected

  up to 6.2.14

  What to do

  Affects up to 6.2.14. Update FluentForm to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 1, 2026Metform: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-103339 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wpmet Metform metform allows Stored XSS.This issue affects Metform: from n/a through 4.3.0.

  Product

  Metform

  Affected

  up to 4.3.0

  What to do

  Affects up to 4.3.0. Update Metform to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 1, 2026ElementsKit Elementor addons Lite: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-103064 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wpmet ElementsKit Elementor addons Lite elementskit-lite allows Stored XSS.This issue affects ElementsKit Elementor addons Lite: from n/a through 4.0.6.

  Product

  ElementsKit Elementor addons Lite

  Affected

  up to 4.0.6

  What to do

  Affects up to 4.0.6. Update ElementsKit Elementor addons Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 1, 2026ElementsKit Elementor addons Lite: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-103063 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wpmet ElementsKit Elementor addons Lite elementskit-lite allows Stored XSS.This issue affects ElementsKit Elementor addons Lite: from n/a through 4.0.6.

  Product

  ElementsKit Elementor addons Lite

  Affected

  up to 4.0.6

  What to do

  Affects up to 4.0.6. Update ElementsKit Elementor addons Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 1, 2026Essential Addons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-102394 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPDeveloper Essential Addons for Elementor essential-addons-for-elementor-lite allows Stored XSS.This issue affects Essential Addons for Elementor: from n/a through 6.8.4.

  Product

  Essential Addons for Elementor

  Affected

  up to 6.8.4

  What to do

  Affects up to 6.8.4. Update Essential Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 1, 2026WP Fusion Lite: Does not require authentication on a settings handler that runs during admin initializationCVE-2026-90974 · WordPress plugins & themes · reported by WPScanMedium 6.5

  The WP Fusion Lite WordPress plugin before 3.48.0 does not require authentication on a settings handler that runs during admin initialization, allowing unauthenticated users to overwrite the site's CRM integration endpoint and credentials, after which synced user data is delivered to an attacker-chosen host.

  Product

  WP Fusion Lite

  Fixed in

  3.48.0

  What to do

  Update WP Fusion Lite to 3.48.0 or newer.

  Full record and what to do →NVD recordwpscan.com

• Sep 30, 2026JetEngine: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-97265 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock. Jetimpex Inc. JetEngine allows Stored XSS. This issue affects JetEngine: from n/a through 3.8.15.3.

  Product

  JetEngine

  Affected

  up to 3.8.15.3

  What to do

  Affects up to 3.8.15.3. Update JetEngine to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 30, 2026VillaTheme CURCY woo-multi-currency: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-94171 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VillaTheme CURCY woo-multi-currency allows DOM-Based XSS.This issue affects CURCY: 2.2.18.

  Product

  VillaTheme CURCY woo-multi-currency

  What to do

  Update VillaTheme CURCY woo-multi-currency to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Sep 30, 2026User Submitted Posts: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-62084 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jeff Starr User Submitted Posts allows Stored XSS. This issue affects User Submitted Posts: from n/a through 20260810.

  Product

  User Submitted Posts

  Affected

  up to 20260810

  What to do

  Affects up to 20260810. Update User Submitted Posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 30, 2026Quiz And Survey Master: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-97289 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows DOM-Based XSS.This issue affects Quiz And Survey Master: from n/a through 11.2.6.

  Product

  Quiz And Survey Master

  Affected

  up to 11.2.6

  What to do

  Affects up to 11.2.6. Update Quiz And Survey Master to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 30, 2026Strong Testimonials: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-97286 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Strong Testimonials strong-testimonials allows Stored XSS.This issue affects Strong Testimonials: from n/a through 3.3.11.

  Product

  Strong Testimonials

  Affected

  up to 3.3.11

  What to do

  Affects up to 3.3.11. Update Strong Testimonials to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 30, 2026LayerSlider: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-97253 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kreatura LayerSlider allows Reflected XSS. This issue affects LayerSlider: from n/a through 8.4.0.

  Product

  LayerSlider

  Affected

  up to 8.4.0

  What to do

  Affects up to 8.4.0. Update LayerSlider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 30, 2026JetEngine: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-97237 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetEngine jet-engine allows DOM-Based XSS.This issue affects JetEngine: from n/a through 3.8.14.3.

  Product

  JetEngine

  Affected

  up to 3.8.14.3

  What to do

  Affects up to 3.8.14.3. Update JetEngine to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 30, 2026Subscriber Bypass Vulnerability in All In One WP Security & Firewall <= 5.4.8 versions.CVE-2026-96825 · WordPress plugins & themes · reported by PatchstackMedium 4.2

  Subscriber Bypass Vulnerability in All In One WP Security & Firewall <= 5.4.8 versions.

  Affected

  up to 5.4.8

  What to do

  Affects up to 5.4.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 30, 2026If-So Dynamic Content Personalization: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-100507 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in If-So Dynamic Content If-So Dynamic Content Personalization if-so allows Reflected XSS.This issue affects If-So Dynamic Content Personalization: from n/a through 1.10.1.

  Product

  If-So Dynamic Content Personalization

  Affected

  up to 1.10.1

  What to do

  Affects up to 1.10.1. Update If-So Dynamic Content Personalization to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 24, 2026WPForms: Does not verify that a Stripe payment object supplied during a public form submission belongs to it before acting on itCVE-2026-74991 · WordPress plugins & themes · reported by WPScanMedium 6.8

  The WPForms WordPress plugin before 2.0.2 does not verify that a Stripe payment object supplied during a public form submission belongs to it before acting on it, allowing unauthenticated users to trigger a full refund and an immediate subscription cancellation against payments created by other applications on the site owner's Stripe account.

  Product

  WPForms

  Fixed in

  2.0.2

  What to do

  Update WPForms to 2.0.2 or newer.

  Full record and what to do →NVD recordwpscan.com

• Sep 23, 2026JetTricks: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-93618 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock. Jetimpex Inc. JetTricks allows Stored XSS. This issue affects JetTricks: from n/a through 2.0.1.

  Product

  JetTricks

  Affected

  up to 2.0.1

  What to do

  Affects up to 2.0.1. Update JetTricks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 20, 2026Import and export users and customers: Does not validate a user-supplied URL before requesting it server-side during a CSV importCVE-2026-16542 · WordPress plugins & themes · reported by WPScanMedium 4.1

  The Import and export users and customers WordPress plugin before 2.4.5 does not validate a user-supplied URL before requesting it server-side during a CSV import, allowing high-privileged users to perform Server-Side Request Forgery attacks.

  Product

  Import and export users and customers

  Fixed in

  2.4.5

  What to do

  Update Import and export users and customers to 2.4.5 or newer.

  Full record and what to do →NVD recordwpscan.com

• Sep 19, 2026WP Ghost (Hide My WP Ghost) – Security & Firewall: Open RedirectCVE-2026-7527 · WordPress plugins & themes · reported by WordfenceMedium 4.7

  The WP Ghost (Hide My WP Ghost) – Security & Firewall plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 7.0.02. This is due to the plugin not properly validating user input. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if they can successfully trick them into clicking on a specially crafted link. Exploitation requires tricking a logged-in user into clicking a crafted logout URL; the victim is fully logged out via wp_logout() before the malicious redirect is issued, making the logout irreversible as part of the attack chain.

  Product

  WP Ghost (Hide My WP Ghost) – Security & Firewall

  Affected

  up to 7.0.02

  What to do

  Affects up to 7.0.02. Update WP Ghost (Hide My WP Ghost) – Security & Firewall to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Sep 18, 2026Hide My WP Ghost: Does not properly validate a loopback security-check request before disabling its login and URL hiding protectionCVE-2026-86800 · WordPress plugins & themes · reported by WPScanMedium 5.3

  The Hide My WP Ghost WordPress plugin before 7.0.11 does not properly validate a loopback security-check request before disabling its login and URL hiding protection, dropping that protection precisely when the request's verification value is missing or incorrect, which any visitor can arrange, allowing unauthenticated attackers to re-expose the concealed WordPress login page location.

  Product

  Hide My WP Ghost

  Fixed in

  7.0.11

  What to do

  Update Hide My WP Ghost to 7.0.11 or newer.

  Full record and what to do →NVD recordwpscan.com

• Sep 18, 2026WordPress: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-93485 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic WordPress wordpress allows DOM-Based XSS.This issue affects WordPress: from n/a through 7.1.

  Product

  WordPress

  Affected

  up to 7.1

  What to do

  Affects up to 7.1. Update WordPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 18, 2026Really Simple Security: Does not validate a client-supplied address value before using itCVE-2026-88798 · WordPress plugins & themes · reported by WPScanMedium 5.3

  The Really Simple Security WordPress plugin before 9.8.3 does not validate a client-supplied address value before using it as a storage key in one of its own options, allowing unauthenticated attackers to grow that option without bound and to slow the site's handling of missing pages.

  Product

  Really Simple Security

  Fixed in

  9.8.3

  What to do

  Update Really Simple Security to 9.8.3 or newer.

  Full record and what to do →NVD recordwpscan.com

• Sep 16, 2026Subscriptions for WooCommerce: Does not verify the security token on the request that cancels a subscriptionCVE-2026-87860 · WordPress plugins & themes · reported by WPScanMedium 4.3

  The Subscriptions for WooCommerce WordPress plugin before 2.0.3 does not verify the security token on the request that cancels a subscription, allowing attackers to make a logged-in customer cancel their own active subscription through a crafted request they are tricked into making.

  Product

  Subscriptions for WooCommerce

  Fixed in

  2.0.3

  What to do

  Update Subscriptions for WooCommerce to 2.0.3 or newer.

  Full record and what to do →NVD recordwpscan.com

• Sep 16, 2026WP Import Export Lite: Does not properly validate URLs before requesting them during the import processCVE-2026-76559 · WordPress plugins & themes · reported by WPScanMedium 4.1

  The WP Import Export Lite WordPress plugin before 3.9.33 does not properly validate URLs before requesting them during the import process, allowing users with the import capability, which administrators hold by default, to make the site issue requests to internal hosts and services and read their responses. This is an incomplete fix for CVE-2026-11397.

  Product

  WP Import Export Lite

  Fixed in

  3.9.33

  What to do

  Update WP Import Export Lite to 3.9.33 or newer.

  Full record and what to do →NVD recordwpscan.com

• Sep 14, 2026Really Simple Security: Missing authorization checkCVE-2026-82519 · WordPress plugins & themes · reported by VulnCheckLow 2.3

  Really Simple Security plugin for WordPress before 9.8.2 contains a missing authorization check vulnerability that allows authenticated low-privileged attackers to bypass enforced two-factor authentication indefinitely by exploiting an unguarded code path in the profile-page update handler. Attackers can submit a crafted POST request without the two-factor-authentication field to skip nonce verification and trigger delete_two_fa_meta(), which resets the grace period anchor timestamp on every login cycle, causing mandatory 2FA enforcement to be deferred indefinitely.

  Product

  Really Simple Security

  Fixed in

  9.8.2

  What to do

  Update Really Simple Security to 9.8.2 or newer.

  Full record and what to do →NVD recordwordpress.orgvulncheck.com

• Sep 13, 2026Really Simple Security: Does not prevent an unauthenticated request from resetting an account's completed email two-factor enrolmentCVE-2026-89080 · WordPress plugins & themes · reported by WPScanHigh 7.5

  The Really Simple Security WordPress plugin before 9.8.1 does not prevent an unauthenticated request from resetting an account's completed email two-factor enrolment, allowing an attacker who already knows the account's password to bypass the second factor and obtain that user's session, up to administrator.

  Product

  Really Simple Security

  Fixed in

  9.8.1

  What to do

  Update Really Simple Security to 9.8.1 or newer.

  Full record and what to do →NVD recordwpscan.com

• Sep 11, 2026Vigilant – 100% Free Security Suite: Firewall, 2FA, Login, Headers, Scanner…: Stored Cross-Site ScriptingCVE-2026-81754 · WordPress plugins & themes · reported by WordfenceHigh 7.2

  The Vigilant – 100% Free Security Suite: Firewall, 2FA, Login, Headers, Scanner… plugin for WordPress is vulnerable to Stored Cross-Site Scripting via User-Agent Header in all versions up to, and including, 2.10.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The malicious payload is delivered passively by any unauthenticated visitor who triggers a failed login attempt with a crafted User-Agent header, requiring no further interaction from the attacker once stored.

  Product

  Vigilant – 100% Free Security Suite: Firewall, 2FA, Login, Headers, Scanner…

  Affected

  up to 2.10.2

  What to do

  Affects up to 2.10.2. Update Vigilant – 100% Free Security Suite: Firewall, 2FA, Login, Headers, Scanner… to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Sep 10, 2026Registration Form for WooCommerce: Does not validate that the form referenced during registration is a legitimate registration formCVE-2026-81431 · WordPress plugins & themes · reported by WPScanHigh 7.2

  The Registration Form for WooCommerce WordPress plugin before 1.1.3 does not validate that the form referenced during registration is a legitimate registration form, reading the permitted-role allow-list from an arbitrary attacker-controlled post instead. A user able to create a post (Contributor and above) can therefore register a new account with an arbitrary role, including Administrator, leading to full site takeover. This is an incomplete fix of CVE-2026-54807.

  Product

  Registration Form for WooCommerce

  Fixed in

  1.1.3

  What to do

  Update Registration Form for WooCommerce to 1.1.3 or newer.

  Full record and what to do →NVD recordwpscan.com

• Sep 8, 2026Easy Appointments: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-81798 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Easy Appointments allows DOM-Based XSS. This issue affects Easy Appointments: from n/a through 4.0.2.1.

  Product

  Easy Appointments

  Affected

  up to 4.0.2.1

  What to do

  Affects up to 4.0.2.1. Update Easy Appointments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.