Updated 7 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

343new WordPress flaws this week

390,080entries in the database

3,171 results · page 6 of 64

Sep 11, 2026stb_vorbis through 1.22 contains a heap buffer overflow in start_decoder() where the codebook multiplicands allocation size is truncated from size_t to int.CVE-2026-89266 · Other software · nothings · reported by VulnCheckHigh 8.8
stb_vorbis through 1.22 contains a heap buffer overflow in start_decoder() where the codebook multiplicands allocation size is truncated from size_t to int. Attackers can craft a malicious Ogg Vorbis file with large entries and dimensions values to trigger out-of-bounds writes, causing process crashes or heap corruption.
Product
stb_vorbis
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Sep 11, 2026Unauthenticated Broken Access Control in Booktics <= 1.0.24 versions.CVE-2026-62135 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Broken Access Control in Booktics <= 1.0.24 versions.
Affected
up to 1.0.24
What to do
Affects up to 1.0.24. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 11, 2026AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the Bookmark plugin where chapter names aCVE-2026-89256 · Other software · WWBN · reported by VulnCheckCritical 9.3
AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the Bookmark plugin where chapter names are not encoded before being concatenated into public watch-page HTML. A video owner can inject malicious scripts via the bookmark name parameter, and every visitor of that video executes the payload in the AVideo origin.
Product
AVideo
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com vulncheck.com
Sep 11, 2026Booktics – Booking Calendar for Appointments and Service Businesses: Unauthorized modification of dataCVE-2026-11446 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Booktics – Booking Calendar for Appointments and Service Businesses plugin for WordPress is vulnerable to unauthorized modification of data in all versions up to, and including, 1.0.23. This is due to the create_order_permission() permission callback on the POST /wp-json/booktics/v1/orders REST route unconditionally returning true, combined with find_and_update_guest() overwriting an existing customer record's stored name, phone, and wp_user_id whenever the caller-supplied email matches, with no proof of ownership. This makes it possible for unauthenticated attackers to overwrite the contact details (name and phone) of any existing customer whose email address they know, poisoning downstream reminder emails, SMS, calendar invites, and CRM data.
Product
Booktics – Booking Calendar for Appointments and Service Businesses
Affected
up to 1.0.23
What to do
Affects up to 1.0.23. Update Booktics – Booking Calendar for Appointments and Service Businesses to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 10, 2026Salon booking system: Missing AuthorizationCVE-2026-81793 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Dimitri Grassi Salon booking system salon-booking-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Salon booking system: from n/a through 10.31.9.
Product
Salon booking system
Affected
up to 10.31.9
What to do
Affects up to 10.31.9. Update Salon booking system to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 10, 2026Joomla Extension - joomshaper.com - Unvalidated Email Destination & Form Manipulation in Booking Requests in SP Property < 4.1.4 - Booking inquiries previously CVE-2026-78303 · Websites & servers · reported by security@joomla.orgMedium 6.9
Joomla Extension - joomshaper.com - Unvalidated Email Destination & Form Manipulation in Booking Requests in SP Property < 4.1.4 - Booking inquiries previously relied on client-submitted hidden fields for recipient routing, allowing potential email manipulation.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record joomshaper.com
Sep 10, 2026Joomla Extension - joomshaper.com - Missing CSRF Token Verification in Property Booking and Agent Contact Endpoints in SP Property < 4.1.4 - The visitor bookingCVE-2026-78083 · Websites & servers · reported by security@joomla.orgHigh 7.1
Joomla Extension - joomshaper.com - Missing CSRF Token Verification in Property Booking and Agent Contact Endpoints in SP Property < 4.1.4 - The visitor booking (properties.booking) and agent contact form submission (agents.sendmail) endpoints processed POST requests without verifying Joomla session anti-CSRF tokens.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record joomshaper.com
Sep 9, 2026Velociraptor allows for the creation of notebook backups in its default enabled daily backup feature.CVE-2026-19584 · Other software · Rapid7 · reported by cve@rapid7.comHigh 7.7
Velociraptor allows for the creation of notebook backups in its default enabled daily backup feature. When Velociraptor restores the backup, the notebook cell content is interpolated into a template with no ACL checks. This allows a malicious user with NOTEBOOK_EDITOR permission to plant a VQL query which will be evaluated at elevated permissions if the notebook's backup is subsequently restored.
Product
Velociraptor
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.velociraptor.app github.com
Sep 9, 2026PocketMine-MP versions before 5.11.2 contain a denial of service vulnerability in BookEditPacket handling that crashes the server when an invalid inventory slotCVE-2024-58380 · Other software · pmmp · reported by VulnCheckHigh 7.1
PocketMine-MP versions before 5.11.2 contain a denial of service vulnerability in BookEditPacket handling that crashes the server when an invalid inventory slot value is provided. Attackers can send a crafted BookEditPacket with an inventory slot greater than 35 to trigger an unhandled exception and crash the server.
Product
PocketMine-MP
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Sep 9, 2026SiYuan before v3.8.2 inserts persisted notebook template paths into HTML input value attributes without proper attribute encoding.CVE-2026-87811 · Other software · siyuan-note · reported by VulnCheckHigh 8.4
SiYuan before v3.8.2 inserts persisted notebook template paths into HTML input value attributes without proper attribute encoding. Attackers can craft malicious template paths that break out of the attribute context and execute JavaScript when a victim opens notebook configuration, enabling same-origin API requests and application state manipulation.
Product
siyuan
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com vulncheck.com
Sep 9, 2026WP Travel: Does not verify that the requester is authorized to act on the booking targeted by one of its front-end payment-message handlersCVE-2026-18042 · WordPress plugins & themes · reported by WPScanMedium 5.3
The WP Travel WordPress plugin before 12.0.2 does not verify that the requester is authorized to act on the booking targeted by one of its front-end payment-message handlers, allowing unauthenticated attackers to cancel the payment on any customer's booking.
Product
WP Travel
Fixed in
12.0.2
What to do
Update WP Travel to 12.0.2 or newer.
Full record and what to do →NVD record wpscan.com
Sep 9, 2026WP Travel: Does not properly verify that the requester owns the booking targeted by its bank-deposit slip submissionCVE-2026-13146 · WordPress plugins & themes · reported by WPScanLow 3.7
The WP Travel WordPress plugin before 12.0.2 does not properly verify that the requester owns the booking targeted by its bank-deposit slip submission, allowing an unauthenticated attacker who knows the target customer's email address to change that customer's booking payment state and attach a file to it.
Product
WP Travel
Fixed in
12.0.2
What to do
Update WP Travel to 12.0.2 or newer.
Full record and what to do →NVD record wpscan.com
Sep 9, 2026WP Travel: Does not properly verify that the requester is authorized to modify the targeted booking on one branch of its bank-deposit handlerCVE-2026-13144 · WordPress plugins & themes · reported by WPScanLow 3.7
The WP Travel WordPress plugin before 12.0.2 does not properly verify that the requester is authorized to modify the targeted booking on one branch of its bank-deposit handler, allowing an unauthenticated attacker who knows the target customer's email address to reset that customer's booking payment to an unpaid state and wipe its stored deposit-reconciliation data.
Product
WP Travel
Fixed in
12.0.2
What to do
Update WP Travel to 12.0.2 or newer.
Full record and what to do →NVD record wpscan.com
Sep 9, 2026Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered): Authorization bypassCVE-2026-11821 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.1.17. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to view, create, update, clone, and delete notification flow event automation workflows that should be restricted to administrators.
Product
Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered)
Affected
up to 4.1.17
What to do
Affects up to 4.1.17. Update Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 8, 2026Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered): Local File InclusionCVE-2026-15667 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.1.22 via the 'event_layout' parameter parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. The etn_manage_event capability is assigned to Contributors by default, meaning any Contributor-level user can set the malicious event_layout value via the REST API without any additional configuration.
Product
Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered)
Affected
up to 4.1.22
What to do
Affects up to 4.1.22. Update Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 8, 2026Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered): Local File InclusionCVE-2026-15406 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.1.22 via the 'event_layout' parameter parameter. This makes it possible for authenticated attackers, with custom-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.
Product
Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered)
Affected
up to 4.1.22
What to do
Affects up to 4.1.22. Update Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 8, 2026Online Scheduling and Appointment Booking System – Bookly: Unauthorized modification of dataCVE-2026-2520 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'updateAddon' function in all versions up to, and including, 27.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update any plugin with a main file of 'main.php' to its latest version.
Product
Online Scheduling and Appointment Booking System – Bookly
Affected
up to 27.2
What to do
Affects up to 27.2. Update Online Scheduling and Appointment Booking System – Bookly to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 7, 2026PocketMine-MP before 3.26.5 and 4.0.x before 4.0.5 does not limit book page text length, page count, or author/title length.CVE-2022-51018 · Other software · pmmp · reported by VulnCheckHigh 7.1
PocketMine-MP before 3.26.5 and 4.0.x before 4.0.5 does not limit book page text length, page count, or author/title length. A player who obtains a writable book can create oversized NBT ('book bombs'), causing excess bandwidth consumption and server crashes (exceeding the 1 MB chunk size limit when saving region-based worlds in PM3, or exceeding the 32 KiB TAG_String limit in PM4).
Product
PocketMine-MP
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com vulncheck.com
Sep 7, 2026A vulnerability was detected in BookStack up to 26.05.2.CVE-2026-86285 · Other software · reported by VulDBLow 2.1
A vulnerability was detected in BookStack up to 26.05.2. Affected by this issue is the function AttachmentController::getUpdateForm of the file app/Uploads/Controllers/AttachmentController.php of the component Attachment Edit Endpoint. The manipulation of the argument ID results in improper access controls. The attack may be launched remotely. The exploit is now public and may be used. The patch is identified as 4e406c41c4c8060a5795e74c66fb96362e54f400. It is advisable to implement a patch to correct this issue.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record ashutosh-jena.in codeberg.org
Sep 5, 2026NetBox through 4.7.0 fails to properly scope user-private records in REST and GraphQL API endpoints for Notifications, Subscriptions, and Bookmarks.CVE-2026-86176 · Other software · netbox-community · reported by VulnCheckMedium 5.3
NetBox through 4.7.0 fails to properly scope user-private records in REST and GraphQL API endpoints for Notifications, Subscriptions, and Bookmarks. Authenticated users with view permissions can access all users' private records through unscoped querysets, disclosing which users watch or bookmark which objects.
Product
netbox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Sep 5, 2026BookWyrm through 0.9.1 contains an authorization bypass vulnerability in the edit_readthrough function that allows authenticated users to modify other users' reCVE-2026-86113 · Other software · bookwyrm-social · reported by VulnCheckHigh 7.1
BookWyrm through 0.9.1 contains an authorization bypass vulnerability in the edit_readthrough function that allows authenticated users to modify other users' reading records. Attackers can exploit sequential ReadThrough IDs to overwrite arbitrary users' start dates, finish dates, progress, and progress mode, affecting reading statistics and exported data.
Product
bookwyrm
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Sep 5, 2026BookWyrm through 0.9.1 fails to validate user visibility permissions in the Favorite and Unfavorite views, allowing authenticated attackers to favorite or unfavCVE-2026-86112 · Other software · bookwyrm-social · reported by VulnCheckMedium 5.3
BookWyrm through 0.9.1 fails to validate user visibility permissions in the Favorite and Unfavorite views, allowing authenticated attackers to favorite or unfavorite followers-only and direct statuses they cannot access. Attackers can POST to the favorite endpoint with a status ID to create unauthorized interactions, trigger ActivityPub broadcasts, and enumerate private status IDs through response differentiation.
Product
bookwyrm
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Sep 5, 2026BookWyrm through 0.9.1 fails to validate user visibility permissions in the status edit endpoint, allowing authenticated attackers to read followers-only and diCVE-2026-86111 · Other software · bookwyrm-social · reported by VulnCheckHigh 7.1
BookWyrm through 0.9.1 fails to validate user visibility permissions in the status edit endpoint, allowing authenticated attackers to read followers-only and direct-message reviews by enumerating sequential status IDs. Attackers can access the raw content of restricted statuses through the edit view, bypassing the privacy protections documented for these message types.
Product
bookwyrm
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Sep 5, 2026Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer: Stored Cross-Site ScriptingCVE-2026-8625 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post_content (Custom HTML block inner HTML)' parameter in all versions up to, and including, 2.4.30 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. A Contributor-level attacker can insert a crafted .df-element div with data-df-lightbox='thumb' via a Custom HTML block, whose inner HTML is passed as the title argument to parseThumbs() at render time, enabling both innerHTML injection into a span element and attribute breakout via an onerror handler on a constructed img element.
Product
Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer
Affected
up to 2.4.30
What to do
Affects up to 2.4.30. Update Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 5, 2026Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer: Stored Cross-Site ScriptingCVE-2026-8623 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post_content (class attribute of .dvcss element)' parameter in all versions up to, and including, 2.4.30 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload is embedded as a Base64-encoded JSON object in a CSS class name on a Custom HTML block; the frontend parseCSSElements() function decodes it client-side with atob() and JSON.parse() and renders the logo property as raw HTML, meaning no server-side or client-side sanitization intercepts the malicious script before DOM insertion.
Product
Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer
Affected
up to 2.4.30
What to do
Affects up to 2.4.30. Update Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 5, 2026Events Manager - Calendar, Bookings, Tickets, and more!: Stored Cross-Site ScriptingCVE-2025-14945 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Events Manager - Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Stored Cross-Site Scripting via event attribute values in all versions up to, and including, 7.3.3. This is due to insufficient input sanitization when storing attribute values (using only `wp_unslash()` without sanitization) and lack of output escaping when rendering the '#_ATT{key}' placeholder. This makes it possible for authenticated attackers, with Author-level access and above, or unauthenticated attackers when anonymous event submissions are enabled, to inject arbitrary web scripts that execute when any user views the affected event page.
Product
Events Manager - Calendar, Bookings, Tickets, and more!
Affected
up to 7.3.3
What to do
Affects up to 7.3.3. Update Events Manager - Calendar, Bookings, Tickets, and more! to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 4, 2026SiYuan through 3.8.1 contains an authorization bypass vulnerability in the /api/file/getFile endpoint that allows readers to retrieve files from notebooks expliCVE-2026-85578 · Other software · siyuan-note · reported by VulnCheckHigh 7.1
SiYuan through 3.8.1 contains an authorization bypass vulnerability in the /api/file/getFile endpoint that allows readers to retrieve files from notebooks explicitly configured as Visible:false. Attackers with reader role can access private workspace files including notebook metadata and internal configuration by knowing the hidden notebook identifier and file path.
Product
siyuan
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com vulncheck.com
Sep 4, 2026E-cab Taxi Booking Manager for Woocommerce: Does not validate a client-supplied trip distance and base-price value on the server before pricing a bookingCVE-2026-84045 · WordPress plugins & themes · reported by WPScanMedium 5.3
The E-cab Taxi Booking Manager for Woocommerce WordPress plugin before 2.0.5 does not validate a client-supplied trip distance and base-price value on the server before pricing a booking, allowing unauthenticated attackers to manipulate the order total down to zero and place real taxi-booking orders at an arbitrary price.
Product
E-cab Taxi Booking Manager for Woocommerce
Fixed in
2.0.5
What to do
Update E-cab Taxi Booking Manager for Woocommerce to 2.0.5 or newer.
Full record and what to do →NVD record wpscan.com
Sep 3, 2026Booking and Rental Manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-85303 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Magepeople inc. Booking and Rental Manager allows Stored XSS. This issue affects Booking and Rental Manager: from n/a through 2.7.7.
Product
Booking and Rental Manager
Affected
up to 2.7.7
What to do
Affects up to 2.7.7. Update Booking and Rental Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 3, 2026Unauthenticated SQL Injection in VikAppointments Services Booking Calendar <= 1.2.20 versions.CVE-2026-84768 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in VikAppointments Services Booking Calendar <= 1.2.20 versions.
Affected
up to 1.2.20
What to do
Affects up to 1.2.20. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 3, 2026Unauthenticated Bypass Vulnerability in BookIt <= 2.6.0.3 versions.CVE-2026-84767 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Bypass Vulnerability in BookIt <= 2.6.0.3 versions.
Affected
up to 2.6.0.3
What to do
Affects up to 2.6.0.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 3, 2026Unauthenticated Bypass Vulnerability in FluentBooking Pro <= 2.2.1 versions.CVE-2026-84766 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Unauthenticated Bypass Vulnerability in FluentBooking Pro <= 2.2.1 versions.
Affected
up to 2.2.1
What to do
Affects up to 2.2.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 2, 2026Booking Hub: Incorrect Privilege AssignmentCVE-2026-81769 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Incorrect Privilege Assignment vulnerability in LiquidThemes Booking Hub allows Privilege Escalation. This issue affects Booking Hub: from n/a through 1.3.1.
Product
Booking Hub
Affected
up to 1.3.1
What to do
Affects up to 1.3.1. Update Booking Hub to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 2, 2026MotoPress Appointment Booking: Does not perform an authorization or ownership checkCVE-2026-15232 · WordPress plugins & themes · reported by WPScanMedium 5.3
The MotoPress Appointment Booking WordPress plugin before 2.4.8 does not perform an authorization or ownership check when handling a user-supplied booking identifier on an unauthenticated endpoint, allowing unauthenticated attackers to permanently delete other users' reservations. This is an incomplete fix of CVE-2026-9180: the deletion remains reachable on sites using payment confirmation, confirmed through version 2.4.7.
Product
MotoPress Appointment Booking
Fixed in
2.4.8
What to do
Update MotoPress Appointment Booking to 2.4.8 or newer.
Full record and what to do →NVD record wpscan.com
Sep 2, 2026Booking for Appointments and Events Calendar: Does not require authentication or a valid request token before running the post-booking action chainCVE-2026-14215 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Booking for Appointments and Events Calendar WordPress plugin before 2.4.9 does not require authentication or a valid request token before running the post-booking action chain, allowing an unauthenticated user to trigger booking notifications and integration callbacks for a booking by enumerating its identifier.
Product
Booking for Appointments and Events Calendar
Fixed in
2.4.9
What to do
Update Booking for Appointments and Events Calendar to 2.4.9 or newer.
Full record and what to do →NVD record wpscan.com
Sep 2, 2026Booking for Appointments and Events Calendar – Amelia (Premium): Privilege EscalationCVE-2026-9055 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Booking for Appointments and Events Calendar – Amelia (Premium) plugin for WordPress is vulnerable to Privilege Escalation in versions 8.0 - 9.6.2. This is due to insufficient validation of the attacker-controlled 'type' parameter in the customer update endpoint, which allows customers to set their role to 'manager' and trigger creation of a WordPress user with the wpamelia-manager role when the 'externalId' parameter is set to 0. This makes it possible for unauthenticated attackers to escalate their privileges to administrator by first elevating to the manager role, then creating a provider entity linked to an administrator user ID and overwriting that administrator's password.
Product
Booking for Appointments and Events Calendar – Amelia (Premium)
Affected
8.0 to 9.6.2
What to do
Affects 8.0 to 9.6.2. Update Booking for Appointments and Events Calendar – Amelia (Premium) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpamelia.com wordfence.com
Sep 1, 2026BookStack before 26.05.4 contains a stored cross-site scripting vulnerability in the drawing upload endpoint that accepts unvalidated base64 content and stores CVE-2026-84695 · Other software · bookstackapp · reported by VulnCheckCritical 9.3
BookStack before 26.05.4 contains a stored cross-site scripting vulnerability in the drawing upload endpoint that accepts unvalidated base64 content and stores it without content inspection. Attackers with editor permissions can upload SVG files containing scripts that execute in administrator browsers when accessed through the image gallery API without content-type validation or CSP headers.
Product
bookstack
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Aug 31, 2026Subscriber Broken Access Control in Booking and Rental Manager <= 2.7.6 versions.CVE-2026-81762 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Subscriber Broken Access Control in Booking and Rental Manager <= 2.7.6 versions.
Affected
up to 2.7.6
What to do
Affects up to 2.7.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 31, 2026GROWI contains a vulnerability with an authorization bypass through user-controlled key in the bookmark folder APIs.CVE-2026-53620 · Other software · GROWI, Inc. · reported by vultures@jpcert.or.jpMedium 5.3
GROWI contains a vulnerability with an authorization bypass through user-controlled key in the bookmark folder APIs. If this vulnerability is exploited, an authenticated attacker could retrieve, tamper with, and/or delete the other user's bookmark data.
Product
GROWI
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record growi.co.jp jvn.jp
Aug 30, 2026SiYuan before v3.8.1 contains a stored cross-site scripting vulnerability in confirmDialog() where unescaped package names and notebook names are interpolated dCVE-2026-82653 · Other software · siyuan-note · reported by VulnCheckCritical 9.3
SiYuan before v3.8.1 contains a stored cross-site scripting vulnerability in confirmDialog() where unescaped package names and notebook names are interpolated directly into innerHTML assignments. Attackers can submit malicious bazaar packages with HTML/script payloads in the name field that execute in users' browsers when uninstalling packages or unlocking encrypted notebooks.
Product
siyuan
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com vulncheck.com
Aug 30, 2026Readest is an open-source e-book reader built on Tauri.CVE-2026-82642 · Other software · readest · reported by reefs@jfrog.comHigh 8.8
Readest is an open-source e-book reader built on Tauri. In versions prior to 0.11.16, EPUB chapter HTML is sanitized with DOMPurify using a configuration that forbade only the <script> tag (FORBID_TAGS: ['script']) in apps/readest-app/src/services/transformers/sanitizer.ts. DOMPurify does not parse the contents of the srcdoc attribute on <iframe> elements, treating it as an opaque string attribute, so an attacker who can get an <iframe> element to survive sanitization can embed a complete HTML document containing a <script> tag inside srcdoc and have it execute when the browser renders the iframe. The content iframe is configured with sandbox="allow-same-origin allow-scripts", so script executing inside it shares the parent origin and can reach parent.parent.__TAURI_INTERNALS__.invoke(...), giving access to every Tauri IPC command the application is permitted to use, which escalates to arbitrary code execution. The payload can be made invisible (zero-size, transparent iframe) so the reader sees only normal book text. Version 0.11.16 hardened the sanitizer configuration by adding 'iframe', 'object' and 'embed' to FORBID_TAGS and adding 'srcdoc' to FORBID_ATTR.
Product
readest
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Aug 29, 2026BookStack before 26.05.4 contains a remote code execution vulnerability in the portable ZIP import functionality that allows users with Import Content and CreatCVE-2026-82450 · Other software · bookstackapp · reported by VulnCheckHigh 8.7
BookStack before 26.05.4 contains a remote code execution vulnerability in the portable ZIP import functionality that allows users with Import Content and Create Books permissions to upload a PHP polyglot file as a book cover. Attackers can bypass image extension validation by embedding a PHP file with a .php filename in the ZIP archive, which is stored in the public web root and executed by unauthenticated requests.
Product
bookstack
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Aug 29, 2026Booking for Appointments and Events Calendar: Does not check that a user holds the required capability before letting them change an appointment's statusCVE-2026-77704 · WordPress plugins & themes · reported by WPScanLow 2.7
The Booking for Appointments and Events Calendar WordPress plugin before 2.4.9 does not check that a user holds the required capability before letting them change an appointment's status, allowing customers to set arbitrary statuses on appointments they are booked on, including approving their own bookings that were left awaiting approval and overwriting another customer's booking status on a shared appointment.
Product
Booking for Appointments and Events Calendar
Fixed in
2.4.9
What to do
Update Booking for Appointments and Events Calendar to 2.4.9 or newer.
Full record and what to do →NVD record wpscan.com
Aug 29, 2026Appointment Booking Calendar Plugin and Scheduling: Does not verify the amount actually paid against the server-side price staged for a bookingCVE-2026-76586 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Appointment Booking Calendar Plugin and Scheduling Plugin WordPress plugin before 1.6.3 does not verify the amount actually paid against the server-side price staged for a booking when confirming an online payment, allowing unauthenticated users to have a paid appointment approved for a fraction of its price.
Product
Appointment Booking Calendar Plugin and Scheduling
Fixed in
1.6.3
What to do
Update Appointment Booking Calendar Plugin and Scheduling to 1.6.3 or newer.
Full record and what to do →NVD record wpscan.com
Aug 28, 2026Booking for Appointments and Events Calendar – Amelia: Stored Cross-Site ScriptingCVE-2026-6286 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to Stored Cross-Site Scripting via customer name fields in versions up to and including 2.2. This is due to an authentication bypass where the AddBookingCommand explicitly skips nonce verification (Command.php line 186), allowing unauthenticated users to submit booking data. While the plugin applies sanitize_text_field() to customer firstName and lastName fields (BookingApplicationService.php lines 302-308), this function only removes HTML tags and preserves special characters including double quotes. The vulnerability manifests in the administrative Calendar view where a FullCalendar eventContent callback interpolates customer names directly into JavaScript template literals (redesign/dist/index.js line 199) and renders them via innerHTML without proper HTML entity encoding. Because double quotes are preserved, an attacker can inject payloads like '" onmouseover="alert(document.cookie)"' to break out of the title attribute and inject malicious event handlers. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that will execute when an administrator accesse
Product
Booking for Appointments and Events Calendar – Amelia
Affected
up to 2.2
What to do
Affects up to 2.2. Update Booking for Appointments and Events Calendar – Amelia to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 27, 2026Unauthenticated Cross Site Request Forgery (CSRF) in FluentBooking Pro <= 2.2.4 versions.CVE-2026-81273 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Cross Site Request Forgery (CSRF) in FluentBooking Pro <= 2.2.4 versions.
Affected
up to 2.2.4
What to do
Affects up to 2.2.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 27, 2026Contributor PHP Object Injection in Booking and Rental Manager <= 2.7.5 versions.CVE-2026-78257 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Contributor PHP Object Injection in Booking and Rental Manager <= 2.7.5 versions.
Affected
up to 2.7.5
What to do
Affects up to 2.7.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 26, 2026Booking Package: Does not validate the payment amount server-side against the stored service priceCVE-2026-16986 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Booking Package WordPress plugin before 1.7.25 does not validate the payment amount server-side against the stored service price, deriving the expected charge from attacker-supplied request values instead, so an unauthenticated attacker can pay an arbitrary fraction of a service's real price.
Product
Booking Package
Fixed in
1.7.25
What to do
Update Booking Package to 1.7.25 or newer.
Full record and what to do →NVD record wpscan.com
Aug 26, 2026Booking for Appointments and Events Calendar: Does not require authentication before processing its pending notification queueCVE-2026-14216 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Booking for Appointments and Events Calendar WordPress plugin before 2.4.7 does not require authentication before processing its pending notification queue, allowing an unauthenticated user to force the dispatch of queued notifications and integration callbacks.
Product
Booking for Appointments and Events Calendar
Fixed in
2.4.7
What to do
Update Booking for Appointments and Events Calendar to 2.4.7 or newer.
Full record and what to do →NVD record wpscan.com
Aug 26, 2026Booking for Appointments and Events Calendar: Does not verify that an authenticated employee (provider) owns the provider account being updatedCVE-2026-14212 · WordPress plugins & themes · reported by WPScanMedium 4.7
The Booking for Appointments and Events Calendar WordPress plugin before 9.8 does not verify that an authenticated employee (provider) owns the provider account being updated, allowing any employee with an Employee Panel login to overwrite another employee's cabinet password and take over their account.
Product
Booking for Appointments and Events Calendar
Fixed in
9.8
What to do
Update Booking for Appointments and Events Calendar to 9.8 or newer.
Full record and what to do →NVD record wpscan.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.