Vulnerability database

7,673 results · page 5 of 154

• Oct 11, 2026Tcard WP: Does not sanitise and escape a parameter before using it in a SQL statement in one of its unauthenticated AJAX actionsCVE-2026-81420 · WordPress plugins & themes · reported by WPScanHigh 8.6

  The Tcard WP WordPress plugin through 1.8.0 does not sanitise and escape a parameter before using it in a SQL statement in one of its unauthenticated AJAX actions, allowing unauthenticated users to perform SQL injection attacks.

  Product

  Tcard WP

  Affected

  up to 1.8.0

  What to do

  Affects up to 1.8.0. Update Tcard WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordwpscan.com

• Oct 11, 2026Robo Gallery: Does not sanitise and escape image alt text before outputting it in one of its gallery layoutsCVE-2026-81154 · WordPress plugins & themes · reported by WPScanMedium 6.8

  The Robo Gallery WordPress plugin before 5.2.6 does not sanitise and escape image alt text before outputting it in one of its gallery layouts, allowing users with the Author role and above to perform Stored Cross-Site Scripting attacks that execute in the browser of any user viewing the affected gallery, including administrators.

  Product

  Robo Gallery

  Fixed in

  5.2.6

  What to do

  Update Robo Gallery to 5.2.6 or newer.

  Full record and what to do →NVD recordwpscan.com

• Oct 11, 2026WooCommerce Bookings: Does not limit a user-supplied value before using it to allocate memory in one of its unauthenticated AJAX actionsCVE-2026-14854 · WordPress plugins & themes · reported by WPScanHigh 7.5

  The WooCommerce Bookings WordPress plugin before 3.11.0 does not limit a user-supplied value before using it to allocate memory in one of its unauthenticated AJAX actions, allowing unauthenticated attackers to exhaust server memory and cause a Denial of Service with a single request.

  Product

  WooCommerce Bookings

  Fixed in

  3.11.0

  What to do

  Update WooCommerce Bookings to 3.11.0 or newer.

  Full record and what to do →NVD recordwpscan.com

• Oct 11, 2026Anton Extensions: Does not perform any capability checkCVE-2026-104028 · WordPress plugins & themes · reported by WPScanCritical 9.8

  The Anton Extensions WordPress plugin through 1.2.2 does not perform any capability check, nonce verification, or file-type validation before writing attacker-supplied content to an attacker-chosen path, allowing unauthenticated attackers to upload arbitrary PHP files and achieve remote code execution.

  Product

  Anton Extensions

  Affected

  up to 1.2.2

  What to do

  Affects up to 1.2.2. Update Anton Extensions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordwpscan.com

• Oct 10, 2026MultiVendorX WordPress plugin through 5.0.19 contains an incorrect authorization vulnerability that allows vendor accounts to modify marketplace-wide settings vCVE-2026-108695 · WordPress plugins & themes · reported by VulnCheckHigh 7.1

  MultiVendorX WordPress plugin through 5.0.19 contains an incorrect authorization vulnerability that allows vendor accounts to modify marketplace-wide settings via the settings REST endpoint. Attackers with the store_owner role can send POST requests to /wp-json/multivendorx/v1/settings, gated only by edit_stores, to overwrite commission, payout, and onboarding settings.

  Affected

  up to 5.0.19

  What to do

  Affects up to 5.0.19. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordgithub.comgithub.com

• Oct 10, 2026Unauthenticated Cross Site Scripting (XSS) in Educavo <= 3.4.2 versions.CVE-2026-78534 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in Educavo <= 3.4.2 versions.

  Affected

  up to 3.4.2

  What to do

  Affects up to 3.4.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 10, 2026Unauthenticated Cross Site Scripting (XSS) in LMS <= 8.3 versions.CVE-2026-78532 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in LMS <= 8.3 versions.

  Affected

  up to 8.3

  What to do

  Affects up to 8.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 10, 2026YITH WooCommerce Product Add-Ons: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2026-66480 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in YITH YITH WooCommerce Product Add-Ons allows Retrieve Embedded Sensitive Data. This issue affects YITH WooCommerce Product Add-Ons: from n/a through 4.34.0.

  Product

  YITH WooCommerce Product Add-Ons

  Affected

  up to 4.34.0

  What to do

  Affects up to 4.34.0. Update YITH WooCommerce Product Add-Ons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 10, 2026Unauthenticated PHP Object Injection in Invetex <= 2.18 versions.CVE-2026-62123 · WordPress plugins & themes · reported by PatchstackCritical 9.8

  Unauthenticated PHP Object Injection in Invetex <= 2.18 versions.

  Affected

  up to 2.18

  What to do

  Affects up to 2.18. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 10, 2026Unauthenticated Cross Site Scripting (XSS) in Barcode Scanner with Inventory & Order Manager <= 1.13.1 versions.CVE-2026-62116 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in Barcode Scanner with Inventory & Order Manager <= 1.13.1 versions.

  Affected

  up to 1.13.1

  What to do

  Affects up to 1.13.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 10, 2026Unauthenticated Cross Site Scripting (XSS) in KuteShop <= 4.2.9 versions.CVE-2026-62100 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in KuteShop <= 4.2.9 versions.

  Affected

  up to 4.2.9

  What to do

  Affects up to 4.2.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 10, 2026Unauthenticated Cross Site Scripting (XSS) in Biolife <= 3.2.3 versions.CVE-2026-62095 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in Biolife <= 3.2.3 versions.

  Affected

  up to 3.2.3

  What to do

  Affects up to 3.2.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 10, 2026Unauthenticated Cross Site Scripting (XSS) in TechOne <= 3.0.3 versions.CVE-2026-62093 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in TechOne <= 3.0.3 versions.

  Affected

  up to 3.0.3

  What to do

  Affects up to 3.0.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 10, 2026Unauthenticated Cross Site Scripting (XSS) in Armania <= 1.4.8 versions.CVE-2026-62091 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in Armania <= 1.4.8 versions.

  Affected

  up to 1.4.8

  What to do

  Affects up to 1.4.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 10, 2026Unauthenticated Cross Site Scripting (XSS) in Pin WP <= 7.0 versions.CVE-2026-62082 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in Pin WP <= 7.0 versions.

  Affected

  up to 7.0

  What to do

  Affects up to 7.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 10, 2026Unauthenticated Cross Site Scripting (XSS) in Ambed <= 1.0.0 versions.CVE-2026-62064 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in Ambed <= 1.0.0 versions.

  Affected

  up to 1.0.0

  What to do

  Affects up to 1.0.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 10, 2026Unauthenticated Sensitive Data Exposure in Contact Form 7 – Dynamic Text Extension <= 5.0.7 versions.CVE-2026-62043 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Unauthenticated Sensitive Data Exposure in Contact Form 7 – Dynamic Text Extension <= 5.0.7 versions.

  Affected

  up to 5.0.7

  What to do

  Affects up to 5.0.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 10, 2026Unauthenticated Cross Site Scripting (XSS) in Document Embedder <= 2.4.0 versions.CVE-2026-62037 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in Document Embedder <= 2.4.0 versions.

  Affected

  up to 2.4.0

  What to do

  Affects up to 2.4.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 10, 2026Unauthenticated Cross Site Scripting (XSS) in Before After Image Comparison – Image comparison for WP <= 1.1.21 versions.CVE-2026-62034 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in Before After Image Comparison – Image comparison for WP <= 1.1.21 versions.

  Affected

  up to 1.1.21

  What to do

  Affects up to 1.1.21. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 10, 2026Unauthenticated Cross Site Scripting (XSS) in Team Section Block <= 2.0.4 versions.CVE-2026-62027 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in Team Section Block <= 2.0.4 versions.

  Affected

  up to 2.0.4

  What to do

  Affects up to 2.0.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 10, 2026Unauthenticated Local File Inclusion in Uminex <= 1.0.9 versions.CVE-2026-48193 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Unauthenticated Local File Inclusion in Uminex <= 1.0.9 versions.

  Affected

  up to 1.0.9

  What to do

  Affects up to 1.0.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 10, 2026Unauthenticated Cross Site Scripting (XSS) in Photo Gallery by 10Web <= 1.8.47 versions.CVE-2026-42715 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in Photo Gallery by 10Web <= 1.8.47 versions.

  Affected

  up to 1.8.47

  What to do

  Affects up to 1.8.47. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 10, 2026Unauthenticated Cross Site Scripting (XSS) in Slider by 10Web <= 1.2.63 versions.CVE-2026-42711 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in Slider by 10Web <= 1.2.63 versions.

  Affected

  up to 1.2.63

  What to do

  Affects up to 1.2.63. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 10, 2026Unauthenticated Cross Site Scripting (XSS) in Food Menu – Restaurant Menu & Online Ordering for WooCommerce <= 6.0.5 versions.CVE-2026-42709 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in Food Menu – Restaurant Menu & Online Ordering for WooCommerce <= 6.0.5 versions.

  Affected

  up to 6.0.5

  What to do

  Affects up to 6.0.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 10, 2026Unauthenticated Cross Site Scripting (XSS) in FV Player 8 <= 8.1.8 versions.CVE-2026-42699 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in FV Player 8 <= 8.1.8 versions.

  Affected

  up to 8.1.8

  What to do

  Affects up to 8.1.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 10, 2026Unauthenticated Cross Site Scripting (XSS) in Qode Real Estate <= 1.1.7.3 versions.CVE-2026-42632 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in Qode Real Estate <= 1.1.7.3 versions.

  Affected

  up to 1.1.7.3

  What to do

  Affects up to 1.1.7.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 10, 2026Unauthenticated Cross Site Scripting (XSS) in Qode Music <= 2.1.8.2 versions.CVE-2026-42631 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in Qode Music <= 2.1.8.2 versions.

  Affected

  up to 2.1.8.2

  What to do

  Affects up to 2.1.8.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 10, 2026Unauthenticated Sensitive Data Exposure in Web Plura Backup & Restore Manager <= 0.2.25 versions.CVE-2026-42630 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Unauthenticated Sensitive Data Exposure in Web Plura Backup & Restore Manager <= 0.2.25 versions.

  Affected

  up to 0.2.25

  What to do

  Affects up to 0.2.25. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 10, 2026Unauthenticated Sensitive Data Exposure in Swish Migrate and Backup <= 1.4.0 versions.CVE-2026-42419 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Unauthenticated Sensitive Data Exposure in Swish Migrate and Backup <= 1.4.0 versions.

  Affected

  up to 1.4.0

  What to do

  Affects up to 1.4.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 10, 2026Unauthenticated Cross Site Scripting (XSS) in Jotform &#8211; AI Chatbot <= 3.8.2 versions.CVE-2026-40803 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in Jotform &#8211; AI Chatbot <= 3.8.2 versions.

  Affected

  up to 3.8.2

  What to do

  Affects up to 3.8.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 10, 2026Subscriber SQL Injection in ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes <= 1.5.3 versions.CVE-2026-40800 · WordPress plugins & themes · reported by PatchstackCritical 9.3

  Subscriber SQL Injection in ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes <= 1.5.3 versions.

  Affected

  up to 1.5.3

  What to do

  Affects up to 1.5.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 10, 2026Unauthenticated Remote Code Execution (RCE) in Everest Backup <= 2.3.13 versions.CVE-2026-39802 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Unauthenticated Remote Code Execution (RCE) in Everest Backup <= 2.3.13 versions.

  Affected

  up to 2.3.13

  What to do

  Affects up to 2.3.13. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 10, 2026Unauthenticated Cross Site Scripting (XSS) in Additional Order Filters for WooCommerce <= 1.24 versions.CVE-2026-39800 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in Additional Order Filters for WooCommerce <= 1.24 versions.

  Affected

  up to 1.24

  What to do

  Affects up to 1.24. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 10, 2026Unauthenticated Cross Site Scripting (XSS) in WP File Download <= 6.3.6 versions.CVE-2026-39799 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in WP File Download <= 6.3.6 versions.

  Affected

  up to 6.3.6

  What to do

  Affects up to 6.3.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 10, 2026ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce: Missing AuthorizationCVE-2026-103685 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in VillaTheme ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce woo-alidropship allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce: from n/a through 2.2.4.

  Product

  ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce

  Affected

  up to 2.2.4

  What to do

  Affects up to 2.2.4. Update ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 10, 2026ThemeStek Extras for LabtechCO: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-94160 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themeStek ThemeStek Extras for LabtechCO Theme themestek-labtechco-extras allows Reflected XSS.This issue affects ThemeStek Extras for LabtechCO Theme: from n/a through 8.4.

  Product

  ThemeStek Extras for LabtechCO

  Affected

  up to 8.4

  What to do

  Affects up to 8.4. Update ThemeStek Extras for LabtechCO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 10, 2026Convex: Deserialization of Untrusted DataCVE-2026-93943 · WordPress plugins & themes · reported by PatchstackCritical 9.8

  Deserialization of Untrusted Data vulnerability in ThemeREX Group Convex convex allows Object Injection.This issue affects Convex: from n/a through 1.16.0.

  Product

  Convex

  Affected

  up to 1.16.0

  What to do

  Affects up to 1.16.0. Update Convex to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 10, 2026Kirki – Freeform Page Builder, Website Builder & Customizer: Arbitrary shortcode executionCVE-2026-102291 · WordPress plugins & themes · reported by WordfenceMedium 5.4

  The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 6.3.1 This is due to the plugin substituting a user's `display_name` into the composed page markup unfiltered and then running the whole result through `do_shortcode()` in `TheFrontend::replace_content()`. Because `display_name` is writable by any user on their own account through the core profile form, this makes it possible for authenticated attackers with Subscriber-level access and above to execute arbitrary shortcodes. Where the page is a users collection — an ordinary team or member-directory page — the shortcode runs in the request of every visitor, including unauthenticated ones. Requires a published page with a Kirki element whose dynamic content is bound to the `display_name` user field.

  Product

  Kirki – Freeform Page Builder, Website Builder & Customizer

  Affected

  up to 6.3.1

  What to do

  Affects up to 6.3.1. Update Kirki – Freeform Page Builder, Website Builder & Customizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Oct 10, 2026Molongui Authorship – Author Boxes, Guest Authors & Co-Authors for: Stored DOM-Based Cross-Site ScriptingCVE-2026-101920 · WordPress plugins & themes · reported by WordfenceHigh 7.2

  The Molongui Authorship – Author Boxes, Guest Authors & Co-Authors for WordPress plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'comment (href attribute inside comment content)' parameter in all versions up to, and including, 5.2.12 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable in the free build because the plugin's author-filter rewriter never appends the ?m_bm=true marker to its own anchors (Plugin::has_pro() returns false), meaning every href the byline script selects and rewrites is fully attacker-controlled.

  Product

  Molongui Authorship – Author Boxes, Guest Authors & Co-Authors for

  Affected

  up to 5.2.12

  What to do

  Affects up to 5.2.12. Update Molongui Authorship – Author Boxes, Guest Authors & Co-Authors for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Oct 10, 2026Post Grid Gutenberg Blocks – PostX: Stored Cross-Site ScriptingCVE-2026-96840 · WordPress plugins & themes · reported by WordfenceHigh 7.2

  The Post Grid Gutenberg Blocks – PostX plugin for WordPress is vulnerable to Stored Cross-Site Scripting via display_name User Field in all versions up to, and including, 5.1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. WordPress core's pre_user_display_name filter encodes &, <, and > but leaves double-quotes intact (ENT_NOQUOTES), allowing a Subscriber-level user to store a double-quote in their display_name via /wp-admin/profile.php that subsequently breaks out of the alt="" attribute at Archive_Title.php:144.

  Product

  Post Grid Gutenberg Blocks – PostX

  Affected

  up to 5.1.0

  What to do

  Affects up to 5.1.0. Update Post Grid Gutenberg Blocks – PostX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Oct 10, 2026SpeedyCache – Cache, Optimization, Performance: Sensitive Information ExposureCVE-2026-104006 · WordPress plugins & themes · reported by WordfenceLow 3.7

  The SpeedyCache – Cache, Optimization, Performance plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.2 via the 'comment_author_*, comment_author_email_*' parameter. This makes it possible for unauthenticated attackers to extract the full name and email address of returning commenters pre-filled into comment form input fields and persisted as the site-wide cached page by any unauthenticated attacker requesting the same public URL. The read-side handler in advanced-cache.php correctly skips cached delivery for requests carrying comment_author_* cookies, but this check is absent on the write path, meaning the cache poisoning is invisible to the victim commenter yet fully exploitable by any unauthenticated attacker with no cookies.

  Product

  SpeedyCache – Cache, Optimization, Performance

  Affected

  up to 1.4.2

  What to do

  Affects up to 1.4.2. Update SpeedyCache – Cache, Optimization, Performance to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Oct 10, 2026Responsive Lightbox & Gallery: Stored Cross-Site ScriptingCVE-2026-103897 · WordPress plugins & themes · reported by WordfenceMedium 4.4

  The Responsive Lightbox & Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 2.7.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with editor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the plugin's 'Comments' lightbox setting to be enabled (disabled by default), a moderator to approve the injected comment, and a site visitor to click the affected image to open the lightbox.

  Product

  Responsive Lightbox & Gallery

  Affected

  up to 2.7.9

  What to do

  Affects up to 2.7.9. Update Responsive Lightbox & Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Oct 10, 2026Order Export & Order Import for WooCommerce: Sensitive Information ExposureCVE-2026-94375 · WordPress plugins & themes · reported by WordfenceMedium 5.3

  The Order Export & Order Import for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.7.8 via the get_file_path. This makes it possible for unauthenticated attackers to extract download exported order CSV files containing customer PII — including names, billing and shipping addresses, email addresses, phone numbers, and order contents — directly over HTTP with no authentication. This is exploitable whenever the .htaccess and index.php guard files are absent from wp-content/webtoffee_export/, which can occur after any uninstall/reinstall cycle, migration, backup restore, or staging sync, since the export directory persists but its guard files do not; export filenames follow a fully deterministic second-precision timestamp pattern, making them brute-forceable across any suspected export window.

  Product

  Order Export & Order Import for WooCommerce

  Affected

  up to 2.7.8

  What to do

  Affects up to 2.7.8. Update Order Export & Order Import for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Oct 10, 2026Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files: Stored Cross-Site ScriptingCVE-2026-18558 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'embeddoc' shortcode in all versions up to, and including, 2.7.13 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

  Product

  Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files

  Affected

  up to 2.7.13

  What to do

  Affects up to 2.7.13. Update Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com

• Oct 10, 2026Booking Calendar: Sensitive Information ExposureCVE-2026-18496 · WordPress plugins & themes · reported by WordfenceMedium 5.3

  The Booking Calendar plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 11.4.3 via the wpbc_is_show_popover_in_flex_timeline() function. This makes it possible for unauthenticated attackers to extract sensitive data including names, email addresses, and phone numbers of customers who have made bookings.

  Product

  Booking Calendar

  Affected

  up to 11.4.3

  What to do

  Affects up to 11.4.3. Update Booking Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com

• Oct 10, 2026Accept PayPal Payments using Contact Form 7: Does not perform any authorization checks before exporting stored form submissionsCVE-2026-105990 · WordPress plugins & themes · reported by WPScanMedium 5.3

  The Accept PayPal Payments using Contact Form 7 WordPress plugin before 4.0.7 does not perform any authorization checks before exporting stored form submissions, allowing unauthenticated attackers to download the personal data (name, email, telephone, postal address, message) and payment metadata of everyone who submitted a payment form.

  Product

  Accept PayPal Payments using Contact Form 7

  Fixed in

  4.0.7

  What to do

  Update Accept PayPal Payments using Contact Form 7 to 4.0.7 or newer.

  Full record and what to do →NVD recordwpscan.com

• Oct 10, 2026Accept PayPal Payments using Contact Form 7: Does not perform any authorization or request-validation checks on one of its AJAX actionsCVE-2026-105989 · WordPress plugins & themes · reported by WPScanMedium 5.3

  The Accept PayPal Payments using Contact Form 7 WordPress plugin before 4.0.7 does not perform any authorization or request-validation checks on one of its AJAX actions, allowing unauthenticated attackers to forge the stored transaction status of records and to write the Accept PayPal Payments using Contact Form 7 WordPress plugin before 4.0.7's status metadata onto arbitrary posts.

  Product

  Accept PayPal Payments using Contact Form 7

  Fixed in

  4.0.7

  What to do

  Update Accept PayPal Payments using Contact Form 7 to 4.0.7 or newer.

  Full record and what to do →NVD recordwpscan.com

• Oct 10, 2026Portfolio Filter Gallery: Does not perform proper authorization checks in a set of AJAX actionsCVE-2026-105976 · WordPress plugins & themes · reported by WPScanMedium 4.7

  The Portfolio Filter Gallery WordPress plugin before 2.2.1 does not perform proper authorization checks in a set of AJAX actions, allowing users with at least the Contributor role to read, modify and delete other users' galleries as well as site-wide gallery filters.

  Product

  Portfolio Filter Gallery

  Fixed in

  2.2.1

  What to do

  Update Portfolio Filter Gallery to 2.2.1 or newer.

  Full record and what to do →NVD recordwpscan.com

• Oct 10, 2026Post Export Import with Media: Directory TraversalCVE-2026-104763 · WordPress plugins & themes · reported by WordfenceMedium 4.9

  The Post Export Import with Media plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.17.1 via the 'file_path' parameter parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. This requires the attacker to upload a crafted ZIP archive containing a media_metadata.json file with path traversal sequences in the file_path field while specifying an allowed file extension for the destination filename to bypass the extension guard introduced in version 1.13.2.

  Product

  Post Export Import with Media

  Affected

  up to 1.17.1

  What to do

  Affects up to 1.17.1. Update Post Export Import with Media to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.svn.wordpress.orgplugins.trac.wordpress.org

• Oct 10, 2026FireBox – WooCommerce Popup Builder, Exit Intent Popup, Email Optin & Cart Abandonment: Generic SQL InjectionCVE-2026-104724 · WordPress plugins & themes · reported by WordfenceMedium 5.3

  The FireBox – WooCommerce Popup Builder, Exit Intent Popup, Email Optin & Cart Abandonment plugin for WordPress is vulnerable to generic SQL Injection via FireBox Form Display Condition in all versions up to, and including, 3.1.13 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with author-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. On fresh installations of version 3.1.10 and later, exploitation requires administrator-level access; however, on sites upgraded from a version prior to 3.1.10, the preserveCampaignRoleAccess() migration grants the edit_fireboxes capability to any role that previously held edit_posts, reducing the minimum required privilege to Author-level.

  Product

  FireBox – WooCommerce Popup Builder, Exit Intent Popup, Email Optin & Cart Abandonment

  Affected

  up to 3.1.13

  What to do

  Affects up to 3.1.13. Update FireBox – WooCommerce Popup Builder, Exit Intent Popup, Email Optin & Cart Abandonment to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.