Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
13,868 results · page 5 of 278
Oct 21, 2026SureCart: Does not restrictCVE-2026-108073 · WordPress plugins & themes · reported by WPScanMedium 5.3
The SureCart WordPress plugin before 4.9.5 does not restrict which related objects an anonymous visitor may include when reading a single upsell funnel through its REST API, nor strip private fields from those objects, allowing unauthenticated users to read merchant-private catalog data such as pricing, commission, stock, SKU and tax internals, including unpublished products.
- Product
- SureCart
- Fixed in
- 4.9.5
- What to do
- Update SureCart to 4.9.5 or newer.
Oct 21, 2026HireZoot: Does not sanitise and escape some of its stored data before outputting it in the admin dashboardCVE-2026-107790 · WordPress plugins & themes · reported by WPScanMedium 6.8
The HireZoot WordPress plugin before 4.1.1 does not sanitise and escape some of its stored data before outputting it in the admin dashboard, and additionally reverses the HTML-entity encoding that would otherwise neutralise it, allowing users with the Author role to perform Stored Cross-Site Scripting attacks that execute in the context of a logged-in administrator.
- Product
- HireZoot
- Fixed in
- 4.1.1
- What to do
- Update HireZoot to 4.1.1 or newer.
Oct 21, 2026SmartyParcel: Does not perform authorisation checksCVE-2026-107789 · WordPress plugins & themes · reported by WPScanMedium 5.3
The SmartyParcel WordPress plugin before 1.23.4 does not perform authorisation checks when serving shipping label downloads, allowing unauthenticated users to obtain the shipping labels of arbitrary orders, which contain customer names, addresses and phone numbers.
- Product
- SmartyParcel
- Fixed in
- 1.23.4
- What to do
- Update SmartyParcel to 1.23.4 or newer.
Oct 21, 2026SmartyParcel: Does not perform authorisation checksCVE-2026-107788 · WordPress plugins & themes · reported by WPScanMedium 4.3
The SmartyParcel WordPress plugin before 1.23.4 does not perform authorisation checks when deleting shipping label records, allowing any authenticated user such as a subscriber to delete the shipping label and tracking records of arbitrary orders store-wide.
- Product
- SmartyParcel
- Fixed in
- 1.23.4
- What to do
- Update SmartyParcel to 1.23.4 or newer.
Oct 21, 2026Simple Banner: Does not correctly limit the capabilities it grants to the user roles an administrator allows to manage its bannersCVE-2026-107506 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Simple Banner WordPress plugin before 3.3.3 does not correctly limit the capabilities it grants to the user roles an administrator allows to manage its banners, granting such roles the full administrator capability, which allows users in a low-privileged role to escalate their privileges and fully compromise the site.
- Product
- Simple Banner
- Fixed in
- 3.3.3
- What to do
- Update Simple Banner to 3.3.3 or newer.
Oct 21, 2026Backup and Staging by WP Time Capsule: Does not perform capability or nonce checks on the handler that deploys a staging site to the live siteCVE-2026-107237 · WordPress plugins & themes · reported by WPScanHigh 8.2
The Backup and Staging by WP Time Capsule WordPress plugin before 1.22.28 does not perform capability or nonce checks on the handler that deploys a staging site to the live site, allowing any authenticated user with a Subscriber account on a WP Time Capsule staging site to overwrite the separate live site's database and configuration and take it offline.
- Product
- Backup and Staging by WP Time Capsule
- Fixed in
- 1.22.28
- What to do
- Update Backup and Staging by WP Time Capsule to 1.22.28 or newer.
Oct 21, 2026Uncanny Toolkit for LearnDash: Does not verify that the acting user is permitted to manage the targeted accounts before changing their verification stateCVE-2026-107128 · WordPress plugins & themes · reported by WPScanMedium 5
The Uncanny Toolkit for LearnDash WordPress plugin before 3.8.2 does not verify that the acting user is permitted to manage the targeted accounts before changing their verification state, allowing a subsite administrator on a multisite network to mark arbitrary network users outside their own site as unverified and prevent those users from logging in.
- Product
- Uncanny Toolkit for LearnDash
- Fixed in
- 3.8.2
- What to do
- Update Uncanny Toolkit for LearnDash to 3.8.2 or newer.
Oct 21, 2026Uncanny Toolkit for LearnDash: Does not validate the origin of a password-reset requestCVE-2026-107127 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Uncanny Toolkit for LearnDash WordPress plugin before 3.8.2 does not validate the origin of a password-reset request, allowing an unauthenticated attacker to set the password of a user who is partway through a password reset to an attacker-chosen value through a forged request, resulting in full account takeover.
- Product
- Uncanny Toolkit for LearnDash
- Fixed in
- 3.8.2
- What to do
- Update Uncanny Toolkit for LearnDash to 3.8.2 or newer.
Oct 21, 2026Moloni: Does not perform capability or nonce checks on several of its authenticated AJAX actionsCVE-2026-106932 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Moloni WordPress plugin before 5.0.14 does not perform capability or nonce checks on several of its authenticated AJAX actions, relying only on whether the site holds a stored connection to its external invoicing provider, allowing any authenticated user such as a Subscriber to generate fiscal invoices for arbitrary orders, discard arbitrary orders, and create or modify products and stock.
- Product
- Moloni
- Fixed in
- 5.0.14
- What to do
- Update Moloni to 5.0.14 or newer.
Oct 21, 2026Booking Package: Does not perform authorization checks before returning calendar-account configuration in a responseCVE-2026-105999 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Booking Package WordPress plugin before 1.7.31 does not perform authorization checks before returning calendar-account configuration in a response, allowing unauthenticated users to disclose sensitive settings including the administrator's notification email addresses.
- Product
- Booking Package
- Fixed in
- 1.7.31
- What to do
- Update Booking Package to 1.7.31 or newer.
Oct 21, 2026Booking Package: Does not perform any authorization or validity check before resetting its premium subscription stateCVE-2026-105998 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Booking Package WordPress plugin before 1.7.31 does not perform any authorization or validity check before resetting its premium subscription state, allowing unauthenticated attackers to disable the Booking Package WordPress plugin before 1.7.31's paid features.
- Product
- Booking Package
- Fixed in
- 1.7.31
- What to do
- Update Booking Package to 1.7.31 or newer.
Oct 21, 2026Booking Package: Does not generate booking cancellation tokens using a secure source of randomnessCVE-2026-105996 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Booking Package WordPress plugin before 1.7.31 does not generate booking cancellation tokens using a secure source of randomness, deriving them instead from values it exposes publicly, so an unauthenticated attacker can reconstruct an arbitrary booking's token, disclose that booking's personal data and, where visitor cancellation is enabled, cancel the booking.
- Product
- Booking Package
- Fixed in
- 1.7.31
- What to do
- Update Booking Package to 1.7.31 or newer.
Oct 21, 2026Ettrick Escape Room Booking: Does not verify a booking's payment status against the payment provider before marking it paid and confirmedCVE-2026-105992 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Ettrick Escape Room Booking WordPress plugin before 1.3.1 does not verify a booking's payment status against the payment provider before marking it paid and confirmed, allowing unauthenticated attackers to mark bookings as paid without paying.
- Product
- Ettrick Escape Room Booking
- Fixed in
- 1.3.1
- What to do
- Update Ettrick Escape Room Booking to 1.3.1 or newer.
Oct 21, 2026Falang multilanguage for: Does not perform a capability checkCVE-2026-105262 · WordPress plugins & themes · reported by WPScanHigh 8
The Falang multilanguage for WordPress plugin before 1.4.6 does not perform a capability check when saving term translations, and exposes a valid nonce to any logged-in user through an unprotected handler, allowing users with Subscriber-level access and above to store content that is later output without proper escaping, leading to Stored Cross-Site Scripting that executes in the context of higher-privileged users such as administrators.
- Product
- Falang multilanguage for
- Fixed in
- 1.4.6
- What to do
- Update Falang multilanguage for to 1.4.6 or newer.
Oct 21, 2026Appointment Booking: Does not verify that an authenticated agent-level user is assigned to a customer before returning or searching that customer's recordCVE-2026-105257 · WordPress plugins & themes · reported by WPScanLow 2.7
The Appointment Booking Plugin WordPress plugin before 5.7.5 does not verify that an authenticated agent-level user is assigned to a customer before returning or searching that customer's record, allowing any agent to read and enumerate the personal information of every customer on the site, including those managed by other agents.
- Product
- Appointment Booking
- Fixed in
- 5.7.5
- What to do
- Update Appointment Booking to 5.7.5 or newer.
Oct 21, 2026Payment Gateway for Idram: Does not verify the authenticity of incoming payment notificationsCVE-2026-103302 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Payment Gateway for Idram WordPress plugin before 2.1.6 does not verify the authenticity of incoming payment notifications, because the merchant credentials used to compute their checksum are empty by default, allowing unauthenticated attackers to forge a valid payment confirmation and mark arbitrary orders as paid, and to force arbitrary orders into a failed state regardless of the gateway's configuration.
- Product
- Payment Gateway for Idram
- Fixed in
- 2.1.6
- What to do
- Update Payment Gateway for Idram to 2.1.6 or newer.
Oct 21, 2026Modern Events Calendar Lite WordPress plugin before 7.37.0, Modern Event Calendar Pro: Do not sanitise and escape a parameter before using it in a SQL statementCVE-2026-102499 · WordPress plugins & themes · reported by WPScanHigh 7.7
The Modern Events Calendar Lite WordPress plugin before 7.37.0, Modern Event Calendar Pro WordPress plugin before 7.37.0 do not sanitise and escape a parameter before using it in a SQL statement, which allows authenticated users with Subscriber-level access and above to append additional SQL queries into already existing queries and extract sensitive data from the database.
- Product
- Modern Events Calendar Lite WordPress plugin before 7.37.0, Modern Event Calendar Pro
- Fixed in
- 7.37.0
- What to do
- Update Modern Events Calendar Lite WordPress plugin before 7.37.0, Modern Event Calendar Pro to 7.37.0 or newer.
Oct 21, 2026Synchrony Financing: Does not properly authorise requests to one of its REST routes that modifies WooCommerce ordersCVE-2026-100145 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Synchrony Financing WordPress plugin before 1.1.2 does not properly authorise requests to one of its REST routes that modifies WooCommerce orders, allowing unauthenticated attackers to reassign any order to an account they control, tamper with its details, and read the associated customer's personal data.
- Product
- Synchrony Financing
- Fixed in
- 1.1.2
- What to do
- Update Synchrony Financing to 1.1.2 or newer.
Oct 20, 2026The Duplicator and Duplicator Pro plugins for WordPress are vulnerable to PHP Object Injection in all versions up to, and including, 1.5.17 and 4.6.10, respectiCVE-2026-82814 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Duplicator and Duplicator Pro plugins for WordPress are vulnerable to PHP Object Injection in all versions up to, and including, 1.5.17 and 4.6.10, respectively, via deserialization of untrusted database content in DUPX_UpdateEngine::unserializeTest() during migration. This allows unauthenticated attackers to store a serialized object in public site content before an administrator builds a package and later performs a migration or import that runs database search-and-replace. Duplicator Free bundles a Requests 1.7 POP chain that permits attacker-selected callbacks, resulting in direct operating-system command execution. Duplicator Pro bundles an IndexList destructor gadget that permits deletion of an attacker-selected existing file when its containing directory is writable by the installer PHP process; deletion of wp-config.php can expose the setup wizard and lead to site takeover and code execution if the attacker reaches it first and supplies a reachable database they control. The package must be created after the carrier is stored, and a later administrator migration action is required.
- Affected
- up to 1.5.17
- What to do
- Affects up to 1.5.17. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 20, 2026Cherry: Path traversalCVE-2016-20103 · WordPress plugins & themes · reported by VulnCheckHigh 8.7
Cherry Plugin for WordPress before 1.2.7 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files via the 'file' parameter. Attackers can send GET requests to /admin/import-export/download-content.php with traversal sequences like ../../../../../wp-config.php to read database credentials, since the script passes input directly to readfile(). Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.
- Product
- Cherry
- Fixed in
- 1.2.7
- What to do
- Update Cherry to 1.2.7 or newer.
Oct 20, 2026Issuu Panel: PHP file inclusionCVE-2016-20101 · WordPress plugins & themes · reported by VulnCheckCritical 9.2
Issuu Panel plugin for WordPress before 1.6.6 contains a PHP file inclusion vulnerability that allows unauthenticated attackers to include remote or local files through the 'abspath' parameter. Attackers can send GET requests to menu/documento/requests/ajax-docs.php with a crafted abspath value passed to require() to execute remote PHP code or include local files. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-20.
- Product
- Issuu Panel
- Fixed in
- 1.6.6
- What to do
- Update Issuu Panel to 1.6.6 or newer.
Oct 20, 2026Memphis Documents Library: Path traversalCVE-2016-20100 · WordPress plugins & themes · reported by VulnCheckHigh 8.7
Memphis Documents Library plugin for WordPress before 3.1.6 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files via the mdocs-img-preview parameter. Attackers can send GET requests with traversal sequences to mdocs_img_preview() in mdocs-downloads.php to download wp-config.php containing database credentials. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-22.
- Product
- Memphis Documents Library
- Fixed in
- 3.1.6
- What to do
- Update Memphis Documents Library to 3.1.6 or newer.
Oct 20, 2026Aspose PDF Exporter: Path traversalCVE-2015-20125 · WordPress plugins & themes · reported by VulnCheckHigh 8.7
Aspose PDF Exporter plugin for WordPress before 2.0 contains a path traversal vulnerability that allows unauthenticated attackers to download files through the unsanitized 'file' parameter passed to readfile(). Attackers can send GET requests to aspose_pdf_exporter_download.php with traversal sequences like ../../../wp-config.php to retrieve WordPress database credentials. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.
- Product
- Aspose PDF Exporter
- Fixed in
- 2.0
- What to do
- Update Aspose PDF Exporter to 2.0 or newer.
Oct 20, 2026Aspose Importer & Exporter: Path traversalCVE-2015-20124 · WordPress plugins & themes · reported by VulnCheckHigh 8.7
Aspose Importer & Exporter plugin for WordPress before 3.0 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files via the unsanitized 'file' parameter. Attackers can send GET requests to aspose_import_export_download.php with traversal sequences like ../../../wp-config.php to read database credentials. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-20.
- Product
- Aspose Importer & Exporter
- Fixed in
- 3.0
- What to do
- Update Aspose Importer & Exporter to 3.0 or newer.
Oct 20, 2026Aspose Doc Exporter: Path traversalCVE-2015-20123 · WordPress plugins & themes · reported by VulnCheckHigh 8.7
Aspose Doc Exporter plugin for WordPress before 2.0 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files by passing unsanitized paths to readfile(). Attackers can send GET requests to aspose_doc_exporter_download.php with the 'file' parameter set to values like ../../../wp-config.php to retrieve database credentials. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-23.
- Product
- Aspose Doc Exporter
- Fixed in
- 2.0
- What to do
- Update Aspose Doc Exporter to 2.0 or newer.
Oct 20, 2026ChurcHope: Path traversalCVE-2014-125134 · WordPress plugins & themes · reported by VulnCheckHigh 8.7
ChurcHope theme for WordPress before 2.2 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files through the 'file' parameter of /wp-content/themes/churchope/lib/downloadlink.php. Attackers can supply directory traversal sequences to read sensitive files like wp-config.php or /etc/passwd, exposing database credentials. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-18.
- Product
- ChurcHope
- Fixed in
- 2.2
- What to do
- Update ChurcHope to 2.2 or newer.
Oct 20, 2026NativeChurch: Path traversalCVE-2014-125133 · WordPress plugins & themes · reported by VulnCheckHigh 8.7
NativeChurch theme for WordPress before 1.6.2 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files through the file parameter of download.php. Attackers can send GET requests with directory traversal sequences in the file parameter to retrieve sensitive files like wp-config.php. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.
- Product
- NativeChurch
- Fixed in
- 1.6.2
- What to do
- Update NativeChurch to 1.6.2 or newer.
Oct 20, 2026Blogroll Fun: Reflected cross-site scriptingCVE-2014-125132 · WordPress plugins & themes · reported by VulnCheckMedium 5.1
Blogroll Fun plugin for WordPress before 0.8.5 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the 'k' parameter in blogroll.php. Attackers can craft GET requests to /wp-content/plugins/blogroll-fun/blogroll.php with malicious 'k' values that are echoed unsanitized, executing JavaScript in victims' browsers. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.
- Product
- Blogroll Fun
- Fixed in
- 0.8.5
- What to do
- Update Blogroll Fun to 0.8.5 or newer.
Oct 20, 2026SocialFit: Reflected cross-site scriptingCVE-2012-20005 · WordPress plugins & themes · reported by VulnCheckMedium 5.1
SocialFit plugin for WordPress through 1.2.2 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts via the unsanitized msg parameter. Attackers can craft GET requests to /wp-content/plugins/socialfit/popup.php with service=googleplus and malicious msg values to execute script and steal session cookies. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.
- Product
- SocialFit
- Affected
- up to 1.2.2
- What to do
- Affects up to 1.2.2. Update SocialFit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 20, 2026K-news: Reflected cross-site scriptingCVE-2012-20004 · WordPress plugins & themes · reported by VulnCheckMedium 5.1
K-news plugin for WordPress before 1.1.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script by supplying unsanitized input through the 'ff' parameter. Attackers can craft GET requests to /wp-content/plugins/knews/wysiwyg/fontpicker/index.php with malicious 'ff' values echoed into option tags to execute script and steal session cookies. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.
- Product
- K-news
- Fixed in
- 1.1.1
- What to do
- Update K-news to 1.1.1 or newer.
Oct 20, 2026Custom Tables: Reflected cross-site scriptingCVE-2012-20003 · WordPress plugins & themes · reported by VulnCheckMedium 5.1
Custom Tables plugin for WordPress before 3.4.6 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the unsanitized 'key' parameter in iframe.php. Attackers can craft GET requests to /wp-content/plugins/custom-tables/iframe.php with s=1 and a malicious key value to execute script in victims' browsers and steal cookies. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-20.
- Product
- Custom Tables
- Fixed in
- 3.4.6
- What to do
- Update Custom Tables to 3.4.6 or newer.
Oct 20, 2026TinyMCE Thumbnail Gallery: Path traversalCVE-2012-20002 · WordPress plugins & themes · reported by VulnCheckHigh 8.7
TinyMCE Thumbnail Gallery plugin for WordPress before 1.1.0 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files via the href parameter. Attackers can send GET requests to /php/download-image.php with traversal sequences like ../../../../wp-config.php to retrieve database credentials and system files. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.
- Product
- TinyMCE Thumbnail Gallery
- Fixed in
- 1.1.0
- What to do
- Update TinyMCE Thumbnail Gallery to 1.1.0 or newer.
Oct 20, 2026xnau webdesign Participants Database participants-database: Authorization Bypass Through User-Controlled KeyCVE-2026-112861 · WordPress plugins & themes · reported by PatchstackMedium 6.3
Authorization Bypass Through User-Controlled Key vulnerability in xnau webdesign Participants Database participants-database allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Participants Database: from n/a through 2.7.8.5.
- Product
- xnau webdesign Participants Database participants-database
- Affected
- up to 2.7.8.5
- What to do
- Affects up to 2.7.8.5. Update xnau webdesign Participants Database participants-database to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 20, 2026Brainstorm Force SureCart surecart: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-112840 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force SureCart surecart allows Stored XSS.This issue affects SureCart: from n/a through 4.9.5.
- Product
- Brainstorm Force SureCart surecart
- Affected
- up to 4.9.5
- What to do
- Affects up to 4.9.5. Update Brainstorm Force SureCart surecart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 20, 2026e4jvikwp VikRentCar vikrentcar: Cross-Site Request Forgery (CSRF)CVE-2026-112836 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Cross-Site Request Forgery (CSRF) vulnerability in e4jvikwp VikRentCar vikrentcar allows Cross Site Request Forgery.This issue affects VikRentCar: from n/a through 1.4.8.
- Product
- e4jvikwp VikRentCar vikrentcar
- Affected
- up to 1.4.8
- What to do
- Affects up to 1.4.8. Update e4jvikwp VikRentCar vikrentcar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 20, 2026Arraytics Booktics booktics: Missing AuthorizationCVE-2026-112829 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Arraytics Booktics booktics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booktics: from n/a through 1.0.30.
- Product
- Arraytics Booktics booktics
- Affected
- up to 1.0.30
- What to do
- Affects up to 1.0.30. Update Arraytics Booktics booktics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 20, 2026Magepeople inc: Missing AuthorizationCVE-2026-112824 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Magepeople inc. Bus Ticket Booking with Seat Reservation bus-ticket-booking-with-seat-reservation allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Bus Ticket Booking with Seat Reservation: from n/a through 5.9.7.
- Product
- Magepeople inc
- Affected
- up to 5.9.7
- What to do
- Affects up to 5.9.7. Update Magepeople inc to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 20, 2026WP User Manager WP User Manager wp-user-manager: Missing AuthorizationCVE-2026-112823 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WP User Manager WP User Manager wp-user-manager allows Manipulating User State.This issue affects WP User Manager: from n/a through 2.9.25.
- Product
- WP User Manager WP User Manager wp-user-manager
- Affected
- up to 2.9.25
- What to do
- Affects up to 2.9.25. Update WP User Manager WP User Manager wp-user-manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 20, 2026CozyThemes Rootblox rootblox: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-111843 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CozyThemes Rootblox rootblox allows Stored XSS.This issue affects Rootblox: from n/a through 1.0.7.
- Product
- CozyThemes Rootblox rootblox
- Affected
- up to 1.0.7
- What to do
- Affects up to 1.0.7. Update CozyThemes Rootblox rootblox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 20, 2026eLightUp Meta Box – WordPress Custom Fields Framework meta-box: Missing AuthorizationCVE-2026-109700 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in eLightUp Meta Box – WordPress Custom Fields Framework meta-box allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Meta Box – WordPress Custom Fields Framework: from n/a through 5.15.2.
- Product
- eLightUp Meta Box – WordPress Custom Fields Framework meta-box
- Affected
- up to 5.15.2
- What to do
- Affects up to 5.15.2. Update eLightUp Meta Box – WordPress Custom Fields Framework meta-box to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 20, 2026Castos Seriously Simple Podcasting seriously-simple-podcasting: Missing AuthorizationCVE-2026-112834 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Castos Seriously Simple Podcasting seriously-simple-podcasting allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Seriously Simple Podcasting: from n/a through 3.17.0.
- Product
- Castos Seriously Simple Podcasting seriously-simple-podcasting
- Affected
- up to 3.17.0
- What to do
- Affects up to 3.17.0. Update Castos Seriously Simple Podcasting seriously-simple-podcasting to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 20, 2026Castos Seriously Simple Podcasting seriously-simple-podcasting: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-112833 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Castos Seriously Simple Podcasting seriously-simple-podcasting allows Stored XSS.This issue affects Seriously Simple Podcasting: from n/a through 3.17.0.
- Product
- Castos Seriously Simple Podcasting seriously-simple-podcasting
- Affected
- up to 3.17.0
- What to do
- Affects up to 3.17.0. Update Castos Seriously Simple Podcasting seriously-simple-podcasting to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 20, 2026Brizy Brizy brizy: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-111844 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brizy Brizy brizy allows Stored XSS.This issue affects Brizy: 2.8.23.
- Product
- Brizy Brizy brizy
- What to do
- Update Brizy Brizy brizy to the newest version.
Oct 20, 2026DiviGear Carousel: Stored Cross-Site ScriptingCVE-2026-93878 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The DiviGear Carousel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via update_license AJAX Action in all versions up to, and including, 5.2.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload executes when an administrator visits the DiviGear > Activation settings page, where the unsanitized stored value is echoed unescaped into a single-quoted HTML value attribute.
- Product
- DiviGear Carousel
- Affected
- up to 5.2.0
- What to do
- Affects up to 5.2.0. Update DiviGear Carousel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 20, 2026Easy Property Listings: Does not perform authorisation checks on several of its contact-management read AJAX actionsCVE-2026-96903 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Easy Property Listings WordPress plugin before 3.5.27 does not perform authorisation checks on several of its contact-management read AJAX actions, allowing any authenticated user with a role as low as subscriber to read other users' CRM contact and lead records, including their private activity notes.
- Product
- Easy Property Listings
- Fixed in
- 3.5.27
- What to do
- Update Easy Property Listings to 3.5.27 or newer.
Oct 20, 2026Easy Property Listings: Does not restrictCVE-2026-96902 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Easy Property Listings WordPress plugin before 3.5.28 does not restrict which listing fields it adds to the public REST API output, allowing unauthenticated users to read details a site has chosen to hide on published listings, such as the asking price, sold price, street address and exact map coordinates.
- Product
- Easy Property Listings
- Fixed in
- 3.5.28
- What to do
- Update Easy Property Listings to 3.5.28 or newer.
Oct 20, 2026EventON - Subscriber: Generic SQL InjectionCVE-2026-93300 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The EventON - Subscriber plugin for WordPress is vulnerable to generic SQL Injection via the 'email' parameter in all versions up to, and including, 1.4.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- EventON - Subscriber
- Affected
- up to 1.4.5
- What to do
- Affects up to 1.4.5. Update EventON - Subscriber to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 20, 2026Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 are affected by IMAP command injection.CVE-2026-113386 · Email & office · reported by MITREHigh 7.1
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 are affected by IMAP command injection. A remote authenticated attacker can exploit this via CRLF sequences injected into the _uid parameter of the mail/headers and mail/viewsource actions to execute arbitrary IMAP commands.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2026Cpanel::JSON::XS versions from 4.51 before 4.80 for Perl allow quadratic CPU use by revalidating the remaining buffer per value in incr_parse.CVE-2026-110688 · Websites & servers · reported by 9b29abf9-4ab0-4765-b253-1875cd9b441e
Cpanel::JSON::XS versions from 4.51 before 4.80 for Perl allow quadratic CPU use by revalidating the remaining buffer per value in incr_parse. At the first non-ASCII byte in a string, the decoder validates UTF-8 from there to the end of its input. incr_parse decodes each buffered value with a fresh decoder, so every value revalidates the rest of the buffer, and doubling the input quadruples the work. A peer that sends about a megabyte of ordinary non-ASCII JSON in one read ties up the process for seconds of CPU time.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2026Cpanel::JSON::XS versions from 4.43 before 4.80 for Perl misorder byte-string keys during canonical encoding in utf16_cmp.CVE-2026-110687 · Websites & servers · reported by 9b29abf9-4ab0-4765-b253-1875cd9b441e
Cpanel::JSON::XS versions from 4.43 before 4.80 for Perl misorder byte-string keys during canonical encoding in utf16_cmp. canonical sorts keys by UTF-16 code units. When any key in a hash is UTF-8 flagged, every key is decoded as UTF-8 for the comparison, including byte-string keys that the encoder writes out as Latin-1 characters. A byte-string key whose bytes are valid UTF-8 is sorted out of order, and two keys that encode differently can compare equal and are left in hash order. The same data can encode to different canonical documents across processes.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. The WordPress, CMS and hosting-panel entries come from the National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan and others); we show who. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, a booking system, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.