Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
13,998 results · page 53 of 280
Sep 17, 2026Contributor Cross Site Scripting (XSS) in JetBlocks For Elementor <= 1.5.2 versions.CVE-2026-66576 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Cross Site Scripting (XSS) in JetBlocks For Elementor <= 1.5.2 versions.
- What to do
- Update the plugin to the newest version.
Sep 17, 2026Unauthenticated Insecure Direct Object References (IDOR) in King Addons for Elementor <= 51.1.81 versions.CVE-2026-66575 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Insecure Direct Object References (IDOR) in King Addons for Elementor <= 51.1.81 versions.
- What to do
- Update the plugin to the newest version.
Sep 17, 2026Contributor Cross Site Scripting (XSS) in Element Pack Elementor Addons <= 8.8.3 versions.CVE-2026-66574 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Cross Site Scripting (XSS) in Element Pack Elementor Addons <= 8.8.3 versions.
- What to do
- Update the plugin to the newest version.
Sep 17, 2026Contributor Cross Site Scripting (XSS) in JetTabs <= 2.3.3.1 versions.CVE-2026-66573 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Cross Site Scripting (XSS) in JetTabs <= 2.3.3.1 versions.
- What to do
- Update the plugin to the newest version.
Sep 17, 2026Contributor Cross Site Scripting (XSS) in JetBlog <= 2.4.10 versions.CVE-2026-66572 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Cross Site Scripting (XSS) in JetBlog <= 2.4.10 versions.
- What to do
- Update the plugin to the newest version.
Sep 17, 2026Unauthenticated Cross Site Request Forgery (CSRF) in Asset CleanUp: Page Speed Booster <= 1.4.0.5 versions.CVE-2026-66571 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Request Forgery (CSRF) in Asset CleanUp: Page Speed Booster <= 1.4.0.5 versions.
- What to do
- Update the plugin to the newest version.
Sep 17, 2026Unauthenticated Broken Authentication in Headless Single Sign On <= 1.7.0 versions.CVE-2026-62108 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated Broken Authentication in Headless Single Sign On <= 1.7.0 versions.
- What to do
- Update the plugin to the newest version.
Sep 17, 2026Unauthenticated Remote Code Execution (RCE) in Migratico Lite <= 2.6.8 versions.CVE-2026-62104 · WordPress plugins & themes · reported by PatchstackCritical 10
Unauthenticated Remote Code Execution (RCE) in Migratico Lite <= 2.6.8 versions.
- What to do
- Update the plugin to the newest version.
Sep 17, 2026Unauthenticated Broken Authentication in EduAdmin Booking <= 5.4.2 versions.CVE-2026-62101 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated Broken Authentication in EduAdmin Booking <= 5.4.2 versions.
- What to do
- Update the plugin to the newest version.
Sep 17, 2026WP ManageNinja LLC FluentAuth: Insufficient Verification of Data AuthenticityCVE-2026-78296 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Insufficient Verification of Data Authenticity vulnerability in WP ManageNinja LLC FluentAuth allows Identity Spoofing. This issue affects FluentAuth: from n/a through 2.1.2.
- Product
- WP ManageNinja LLC FluentAuth
- Affected
- up to 2.1.2
- What to do
- Affects up to 2.1.2. Update WP ManageNinja LLC FluentAuth to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 17, 2026Checkout Field Manager (Checkout Manager) for WooCommerce: Does not properly validate the ownership of an attachment before deleting itCVE-2026-87831 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Checkout Field Manager (Checkout Manager) for WooCommerce WordPress plugin before 7.9.7 does not properly validate the ownership of an attachment before deleting it, allowing any authenticated user such as a customer to delete arbitrary media attachments belonging to other users.
- Product
- Checkout Field Manager (Checkout Manager) for WooCommerce
- Fixed in
- 7.9.7
- What to do
- Update Checkout Field Manager (Checkout Manager) for WooCommerce to 7.9.7 or newer.
Sep 17, 2026Checkout Field Manager (Checkout Manager) for WooCommerce: Does not properly validate the ownership of an attachment before deleting itCVE-2026-87829 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Checkout Field Manager (Checkout Manager) for WooCommerce WordPress plugin before 7.9.7 does not properly validate the ownership of an attachment before deleting it, allowing any authenticated user such as a customer to delete arbitrary media attachments belonging to other users.
- Product
- Checkout Field Manager (Checkout Manager) for WooCommerce
- Fixed in
- 7.9.7
- What to do
- Update Checkout Field Manager (Checkout Manager) for WooCommerce to 7.9.7 or newer.
Sep 17, 2026Robokassa payment gateway for Woocommerce: Does not verify the authenticity of incoming payment notificationsCVE-2026-91017 · WordPress plugins & themes · reported by WPScanLow 3.7
The Robokassa payment gateway for Woocommerce WordPress plugin before 1.8.9 does not verify the authenticity of incoming payment notifications when its non-default deferred-payment feature is enabled, allowing unauthenticated attackers to forge a notification and mark arbitrary WooCommerce orders as paid or on-hold without payment or a valid signature.
- Product
- Robokassa payment gateway for Woocommerce
- Fixed in
- 1.8.9
- What to do
- Update Robokassa payment gateway for Woocommerce to 1.8.9 or newer.
Sep 17, 2026The Yo WordPress plugin from 1.1 through 1.3.1 does not sanitize or parameterize the username request parameter before using it in a SQL query, and reads it befCVE-2026-87963 · WordPress plugins & themes · reported by WPScanHigh 8.6
The Yo WordPress plugin from 1.1 through 1.3.1 does not sanitize or parameterize the username request parameter before using it in a SQL query, and reads it before WordPress applies its request escaping, allowing unauthenticated attackers to perform SQL injection and read arbitrary database contents including administrator password hashes.
- Affected
- up to 1.3.1
- What to do
- Affects up to 1.3.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 17, 2026The To Do List Member WordPress plugin from 1.4 through 1.6 ships a file upload endpoint that does not load WordPress and therefore applies no authentication, cCVE-2026-86801 · WordPress plugins & themes · reported by WPScanHigh 8.8
The To Do List Member WordPress plugin from 1.4 through 1.6 ships a file upload endpoint that does not load WordPress and therefore applies no authentication, capability or nonce check of any kind, and validates only the name of an uploaded file rather than its content, allowing unauthenticated users to store active content served from the site's own origin, and to list and delete the files already staged there.
- Affected
- up to 1.6
- What to do
- Affects up to 1.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 17, 2026Event Booking Manager for WooCommerce: Does not restrict who can view its stored payment gateway configurationCVE-2026-91019 · WordPress plugins & themes · reported by WPScanMedium 4.9
The Event Booking Manager for WooCommerce WordPress plugin before 5.6.0 does not restrict who can view its stored payment gateway configuration, allowing users with Contributor-level access and above to read the site's PayPal and Stripe credentials, including their secret keys.
- Product
- Event Booking Manager for WooCommerce
- Fixed in
- 5.6.0
- What to do
- Update Event Booking Manager for WooCommerce to 5.6.0 or newer.
Sep 17, 2026Motors: Does not verify that a request is authorized to view a user's non-published listings before returning themCVE-2026-91016 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Motors WordPress plugin before 1.4.121 does not verify that a request is authorized to view a user's non-published listings before returning them, allowing unauthenticated attackers to read any author's draft, pending and private car listings - including titles, prices, media URLs and seller notes - by supplying only the target's numeric user id.
- Product
- Motors
- Fixed in
- 1.4.121
- What to do
- Update Motors to 1.4.121 or newer.
Sep 17, 2026Master Addons for Elementor: Does not perform an authorization check on the AJAX action that deactivates its Popup Builder popupsCVE-2026-91015 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Master Addons for Elementor WordPress plugin before 3.1.9 does not perform an authorization check on the AJAX action that deactivates its Popup Builder popups, relying only on a nonce that is publicly output to every visitor, allowing unauthenticated attackers to permanently disable any popup on the site.
- Product
- Master Addons for Elementor
- Fixed in
- 3.1.9
- What to do
- Update Master Addons for Elementor to 3.1.9 or newer.
Sep 17, 2026Realtyna Organic IDX plugin + WPL Real Estate: Does not sanitise and escape some of its parameters before reflecting them back in the pageCVE-2026-91014 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Realtyna Organic IDX plugin + WPL Real Estate WordPress plugin before 5.4.2 does not sanitise and escape some of its parameters before reflecting them back in the page, allowing unauthenticated attackers to run arbitrary web scripts in a visitor's browser if they can trick the visitor into following a crafted link (reflected XSS).
- Product
- Realtyna Organic IDX plugin + WPL Real Estate
- Fixed in
- 5.4.2
- What to do
- Update Realtyna Organic IDX plugin + WPL Real Estate to 5.4.2 or newer.
Sep 17, 2026EWWW Image Optimizer: Does not properly escape image attribute valuesCVE-2026-91011 · WordPress plugins & themes · reported by WPScanMedium 6.8
The EWWW Image Optimizer WordPress plugin before 8.7.7 does not properly escape image attribute values when it rewrites page output, allowing authenticated users with author-level access and above to inject arbitrary JavaScript that is stored in published content and executes in the browser of any user who later views the affected page.
- Product
- EWWW Image Optimizer
- Fixed in
- 8.7.7
- What to do
- Update EWWW Image Optimizer to 8.7.7 or newer.
Sep 17, 2026Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms: Does not check the user's capabilities in its message deletion AJAX actionCVE-2026-91010 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms WordPress plugin before 5.1.1 does not check the user's capabilities in its message deletion AJAX action, and only tests that a nonce parameter is present rather than validating it, allowing any authenticated user, such as a subscriber, to permanently delete every form submission the Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms WordPress plugin before 5.1.1 has stored.
- Product
- Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms
- Fixed in
- 5.1.1
- What to do
- Update Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms to 5.1.1 or newer.
Sep 17, 2026Active Woot Products Tables for WooCommerce. 100% FREE: Does not have authorisation and CSRF checks in some of its AJAX actionsCVE-2026-91009 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Active Woot Products Tables for WooCommerce. 100% FREE WordPress plugin before 2.1.3 does not have authorisation and CSRF checks in some of its AJAX actions, allowing any authenticated users, such as subscriber, to change the title of arbitrary posts, pages and products.
- Product
- Active Woot Products Tables for WooCommerce. 100% FREE
- Fixed in
- 2.1.3
- What to do
- Update Active Woot Products Tables for WooCommerce. 100% FREE to 2.1.3 or newer.
Sep 17, 2026Event Booking Manager for WooCommerce: Does not perform an ownership or authorization check before rendering booking confirmation detailsCVE-2026-91008 · WordPress plugins & themes · reported by WPScanLow 3.7
The Event Booking Manager for WooCommerce WordPress plugin before 5.3.8 does not perform an ownership or authorization check before rendering booking confirmation details, allowing unauthenticated attackers to retrieve registered attendees' personal information (full name, email address, phone number, and custom registration fields) by supplying an enumerable booking reference. Exploitation is limited to sites configured to use the Event Booking Manager for WooCommerce WordPress plugin before 5.3.8's native (non-WooCommerce) checkout, which is not the default.
- Product
- Event Booking Manager for WooCommerce
- Fixed in
- 5.3.8
- What to do
- Update Event Booking Manager for WooCommerce to 5.3.8 or newer.
Sep 17, 2026Autopay: Does not enforce the signature on one of its payment callbacksCVE-2026-90923 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Autopay WordPress plugin before 5.0.1 does not enforce the signature on one of its payment callbacks, allowing unauthenticated users to disclose and delete the stored payment parameters of other customers' orders.
- Product
- Autopay
- Fixed in
- 5.0.1
- What to do
- Update Autopay to 5.0.1 or newer.
Sep 17, 2026Paid Membership Subscriptions: Does not verify that the amount and currency reported by the payment provider match the pending payment before completing itCVE-2026-90922 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Paid Membership Subscriptions WordPress plugin before 3.0.9 does not verify that the amount and currency reported by the payment provider match the pending payment before completing it, allowing unauthenticated users to obtain a paid membership by paying an arbitrary lower amount.
- Product
- Paid Membership Subscriptions
- Fixed in
- 3.0.9
- What to do
- Update Paid Membership Subscriptions to 3.0.9 or newer.
Sep 17, 2026PuppyFW: Does not have proper authorisation on one of its REST routesCVE-2026-88904 · WordPress plugins & themes · reported by WPScanHigh 8.8
The PuppyFW WordPress plugin through 0.4.4 does not have proper authorisation on one of its REST routes, which tests the caller against a capability taken from the request itself, allowing any authenticated user, including subscribers, to add, modify and delete arbitrary blog options and thereby escalate their privileges.
- Product
- PuppyFW
- Affected
- up to 0.4.4
- What to do
- Affects up to 0.4.4. Update PuppyFW to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 17, 2026wpShopGermany IT-RECHT KANZLEI: Does not generate its API authentication token securelyCVE-2026-88795 · WordPress plugins & themes · reported by WPScanCritical 9
The wpShopGermany IT-RECHT KANZLEI WordPress plugin before 2.4 does not generate its API authentication token securely, deriving it from data the requester controls and creating it as a side effect of the check that is supposed to validate it, allowing unauthenticated attackers to predict the token and use the access it grants to write arbitrary files, leading to remote code execution.
- Product
- wpShopGermany IT-RECHT KANZLEI
- Fixed in
- 2.4
- What to do
- Update wpShopGermany IT-RECHT KANZLEI to 2.4 or newer.
Sep 17, 2026Dictionary: Does not have authorisationCVE-2026-88792 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Dictionary WordPress plugin through 1.0 does not have authorisation, sanitisation or escaping in place when adding or updating dictionary entries, allowing unauthenticated users to store arbitrary web scripts which will execute when a user views an affected entry.
- Product
- Dictionary
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Dictionary to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 17, 2026Comments Import & Export: Does not restrict its comment export to users able to moderate commentsCVE-2026-87836 · WordPress plugins & themes · reported by WPScanLow 2.7
The Comments Import & Export WordPress plugin before 2.5.4 does not restrict its comment export to users able to moderate comments, nor scope the export to content owned by the requesting user, allowing users with the Author role and above to retrieve every comment on the site, including commenter email addresses, IP addresses, unapproved comment content and comment meta.
- Product
- Comments Import & Export
- Fixed in
- 2.5.4
- What to do
- Update Comments Import & Export to 2.5.4 or newer.
Sep 17, 2026Dewa Kirim: Does not escape delivery coordinates submitted at checkout before outputting them inside an inline scriptCVE-2026-87786 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Dewa Kirim WordPress plugin through 1.0.0 does not escape delivery coordinates submitted at checkout before outputting them inside an inline script, allowing unauthenticated users to store JavaScript that runs in the session of an administrator who later opens the order.
- Product
- Dewa Kirim
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Dewa Kirim to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 17, 2026Newsletter: Does not generate its email tracking signing key with sufficient entropy and signs its tracking links with an unkeyed hashCVE-2026-86824 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Newsletter WordPress plugin before 9.3.8 does not generate its email tracking signing key with sufficient entropy and signs its tracking links with an unkeyed hash, allowing an unauthenticated attacker who recovers that key offline to forge tracking links, obtain any subscriber's session token, and read and modify that subscriber's stored personal data.
- Product
- Newsletter
- Fixed in
- 9.3.8
- What to do
- Update Newsletter to 9.3.8 or newer.
Sep 17, 2026HT Mega Addons for Elementor: Does not restrict the HTML tag name used to render the section headline in several of its widgets and blocks to a safe allowlistCVE-2026-86788 · WordPress plugins & themes · reported by WPScanMedium 6.8
The HT Mega Addons for Elementor WordPress plugin before 3.2.6 does not restrict the HTML tag name used to render the section headline in several of its widgets and blocks to a safe allowlist, allowing users with contributor-level access and above to store a crafted tag name that executes arbitrary JavaScript when the content is viewed, including by higher-privileged users who review or publish it.
- Product
- HT Mega Addons for Elementor
- Fixed in
- 3.2.6
- What to do
- Update HT Mega Addons for Elementor to 3.2.6 or newer.
Sep 17, 2026Login with QR: Does not verify that the code used to log a user in is one it issuedCVE-2026-86710 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Login with QR WordPress plugin through 1.0.0 does not verify that the code used to log a user in is one it issued, matching any stored user metadata value instead, which allows unauthenticated attackers to log in as any user, including administrators.
- Product
- Login with QR
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Login with QR to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 17, 2026Pressengine: Does not stop its login handler from issuing a sessionCVE-2026-86709 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Pressengine WordPress plugin through 1.0 does not stop its login handler from issuing a session when authentication fails, allowing unauthenticated attackers to log in as any user, including administrators.
- Product
- Pressengine
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Pressengine to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 17, 2026Private Feed Key: Does not verify that the key used to authenticate a feed request is one it issuedCVE-2026-86707 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Private Feed Key WordPress plugin through 0.1 does not verify that the key used to authenticate a feed request is one it issued, matching any stored user metadata value instead, which allows unauthenticated attackers to log in as any user, including administrators.
- Product
- Private Feed Key
- Affected
- up to 0.1
- What to do
- Affects up to 0.1. Update Private Feed Key to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 17, 2026LearnPress: Does not restrict the correctness flags it returnsCVE-2026-86446 · WordPress plugins & themes · reported by WPScanLow 3.7
The LearnPress WordPress plugin before 4.4.7 does not restrict the correctness flags it returns when a quiz answer is checked, allowing unauthenticated attackers to obtain the correct answer to every option of a question, along with the instructor's explanation, on courses configured to be taken without enrolling.
- Product
- LearnPress
- Fixed in
- 4.4.7
- What to do
- Update LearnPress to 4.4.7 or newer.
Sep 17, 2026WPLP Cookie Consent: Does not escape a value submitted through a public endpoint for the JavaScript context it is later output in on an administrative screenCVE-2026-85130 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WPLP Cookie Consent WordPress plugin before 4.4.4 does not escape a value submitted through a public endpoint for the JavaScript context it is later output in on an administrative screen, allowing unauthenticated users to run arbitrary JavaScript in the session of an administrator who interacts with the logged entry. Only multisite installations are affected.
- Product
- WPLP Cookie Consent
- Fixed in
- 4.4.4
- What to do
- Update WPLP Cookie Consent to 4.4.4 or newer.
Sep 17, 2026Choose User Role at Registration: Does not validate the role requested at registration against the roles an administrator chose to offerCVE-2026-85128 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Choose User Role at Registration WordPress plugin before 1.3.3 does not validate the role requested at registration against the roles an administrator chose to offer, allowing unauthenticated users to request any role, including administrator, and to be granted it once the request is approved. Exploitation requires the Choose User Role at Registration WordPress plugin before 1.3.3's role selection feature and public account registration to both be enabled.
- Product
- Choose User Role at Registration
- Fixed in
- 1.3.3
- What to do
- Update Choose User Role at Registration to 1.3.3 or newer.
Sep 17, 2026Dictionary: Does not escape user input before reflecting it back in the responses of several directly accessible scriptsCVE-2025-15697 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Dictionary WordPress plugin through 1.0 does not escape user input before reflecting it back in the responses of several directly accessible scripts, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting attacks against anyone they can induce to submit a crafted request.
- Product
- Dictionary
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Dictionary to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 17, 2026Paid Downloads: Arbitrary File UploadCVE-2026-87935 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Paid Downloads plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.15 via the admin_request_handler function. This is due to missing authorization and file type validation in the admin_request_handler function, which is reachable unauthenticated via is_admin() returning true for /wp-admin/admin-post.php. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. On Apache servers where AllowOverride is enabled, an .htaccess file placed in the upload directory may block direct HTTP retrieval of uploaded files, limiting exploitability to stacks that do not honor .htaccess directives such as nginx, LiteSpeed, and Apache with AllowOverride None.
- Product
- Paid Downloads
- Affected
- up to 3.15
- What to do
- Affects up to 3.15. Update Paid Downloads to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 17, 2026Multi Uploader for Gravity Forms: Arbitrary File UploadCVE-2026-87796 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Multi Uploader for Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.1.9 via the move_file function. This is due to insufficient file type validation during chunked upload handling. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
- Product
- Multi Uploader for Gravity Forms
- Affected
- up to 1.1.9
- What to do
- Affects up to 1.1.9. Update Multi Uploader for Gravity Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 17, 2026Photo Gallery by 10Web – Mobile-Friendly Image Gallery: Stored Cross-Site ScriptingCVE-2026-86311 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Shortcode Attributes in all versions up to, and including, 1.8.44 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Photo Gallery by 10Web – Mobile-Friendly Image Gallery
- Affected
- up to 1.8.44
- What to do
- Affects up to 1.8.44. Update Photo Gallery by 10Web – Mobile-Friendly Image Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 16, 2026All-in-One WP Migration and Backup: Insufficient Credential ProtectionCVE-2026-89064 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to Insufficient Credential Protection in versions up to, and including, 7.110. This is due to the `Ai1wm_Main_Controller::init()` method — registered on the `admin_init` hook, which fires unauthenticated on `admin-ajax.php` and `admin-post.php` requests — reading `$_SERVER['PHP_AUTH_USER']` and `$_SERVER['PHP_AUTH_PW']` from any incoming request and writing them to the `ai1wm_auth_header` option via `update_option()` as a reversible base64-encoded string, with no capability check, nonce verification, `is_user_logged_in()` check, or confirmation that Basic authentication actually succeeded. This makes it possible for unauthenticated attackers to capture into the database, in reversible base64 form, any WordPress Application Password or HTTP Basic credential presented to `/wp-admin/` by a legitimate integration, or to overwrite the stored credential with an attacker-chosen value by sending an anonymous request carrying a crafted `Authorization: Basic` header. This is particularly impactful in environments using WordPress Application Passwords for REST API or third-party integrations, as those credentials are tr
- Product
- All-in-One WP Migration and Backup
- Affected
- up to 7.110
- What to do
- Affects up to 7.110. Update All-in-One WP Migration and Backup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 16, 2026PrestaShop blockwishlist through 3.0.2 fails to validate wishlist ownership in the getUrlByIdWishListAction method, allowing authenticated customers to retrieveCVE-2026-92810 · Websites & servers · reported by VulnCheckMedium 5.3
PrestaShop blockwishlist through 3.0.2 fails to validate wishlist ownership in the getUrlByIdWishListAction method, allowing authenticated customers to retrieve share tokens for any wishlist by identifier. Attackers can supply sequential wishlist identifiers to obtain valid share links and read other customers' private wishlist contents.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 16, 2026PrestaShop psgdpr versions through 1.4.3 fail to validate that GDPR consent log entries are attributed to the authenticated customer.CVE-2026-92809 · Websites & servers · reported by VulnCheckMedium 5.3
PrestaShop psgdpr versions through 1.4.3 fail to validate that GDPR consent log entries are attributed to the authenticated customer. Authenticated attackers can submit arbitrary customer identifiers to create forged consent records for other customers, corrupting audit logs.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 16, 2026Adenion Blog2Social plugin for WordPress before 9.1.0 allows low-privileged users to modify the scheduled post records of other users.CVE-2026-89031 · WordPress plugins & themes · reported by VulnCheckMedium 5.3
Adenion Blog2Social plugin for WordPress before 9.1.0 allows low-privileged users to modify the scheduled post records of other users. The b2s_calendar_move_post AJAX handler in includes/Ajax/Post.php issues an UPDATE against the b2s_posts table using only the attacker-supplied b2s_id primary key with no blog_user_id ownership constraint, allowing any user with the edit_posts capability to reschedule, suppress, or alter the publication state of any other user's scheduled social media post.
- Fixed in
- 9.1.0
- What to do
- Update the plugin to 9.1.0 or newer.
Sep 16, 2026Adenion Blog2Social plugin for WordPress before 9.1.0 exposes the email addresses of all registered WordPress users to low-privileged accounts.CVE-2026-89030 · WordPress plugins & themes · reported by VulnCheckMedium 5.3
Adenion Blog2Social plugin for WordPress before 9.1.0 exposes the email addresses of all registered WordPress users to low-privileged accounts. The b2s_search_user AJAX handler in includes/Ajax/Get.php invokes B2S_Tools::searchUser() in includes/Tools.php, which returns the email address of every matching user without restricting access to callers holding the list_users capability, allowing any user with the edit_posts capability to retrieve user email addresses including those of administrators.
- Fixed in
- 9.1.0
- What to do
- Update the plugin to 9.1.0 or newer.
Sep 16, 2026Adenion Blog2Social plugin for WordPress before 9.1.0 allows low-privileged users to enumerate WordPress user accounts.CVE-2026-89029 · WordPress plugins & themes · reported by VulnCheckMedium 5.3
Adenion Blog2Social plugin for WordPress before 9.1.0 allows low-privileged users to enumerate WordPress user accounts. The b2s_get_select_mandant_user AJAX handler in includes/Ajax/Get.php resolves arbitrary user IDs supplied in the owner parameter to display names without verifying that the caller is authorized to read user account data, allowing any user with the edit_posts capability to map WordPress user IDs to display names and confirm account existence for arbitrary IDs.
- Fixed in
- 9.1.0
- What to do
- Update the plugin to 9.1.0 or newer.
Sep 16, 2026Themeum WP Mega Menu: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-92465 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeum WP Mega Menu allows Blind SQL Injection. This issue affects WP Mega Menu: from n/a through 1.4.2.
- Product
- Themeum WP Mega Menu
- Affected
- up to 1.4.2
- What to do
- Affects up to 1.4.2. Update Themeum WP Mega Menu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 16, 2026Appointment Hour Booking: Does not check every appointment in a booking submission against the capacity configured for its own slotCVE-2026-86475 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Appointment Hour Booking WordPress plugin before 1.5.95 does not check every appointment in a booking submission against the capacity configured for its own slot, allowing unauthenticated visitors to take slots that are already fully booked.
- Product
- Appointment Hour Booking
- Fixed in
- 1.5.95
- What to do
- Update Appointment Hour Booking to 1.5.95 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. The WordPress, CMS and hosting-panel entries come from the National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan and others); we show who. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, a booking system, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.