Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
13,998 results · page 60 of 280
Sep 9, 2026Contact Form 7 Captcha: Runs the shortcode parser over the whole rendered Contact Form 7 formCVE-2026-85117 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Contact Form 7 Captcha WordPress plugin before 0.1.9 runs the shortcode parser over the whole rendered Contact Form 7 form, including the values a visitor submitted, allowing unauthenticated users to execute arbitrary shortcodes registered on the site.
- Product
- Contact Form 7 Captcha
- Fixed in
- 0.1.9
- What to do
- Update Contact Form 7 Captcha to 0.1.9 or newer.
Sep 9, 2026WP Express Checkout: Does not verify server-side that a payment was actually completed before marking an orderCVE-2026-83537 · WordPress plugins & themes · reported by WPScanMedium 5.3
The WP Express Checkout WordPress plugin before 2.5.0 does not verify server-side that a payment was actually completed before marking an order as paid, allowing unauthenticated users to forge a completed order without paying.
- Product
- WP Express Checkout
- Fixed in
- 2.5.0
- What to do
- Update WP Express Checkout to 2.5.0 or newer.
Sep 9, 2026Hustle: Does not prevent shortcodes in submitted form values from being executedCVE-2026-80440 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Hustle WordPress plugin before 7.8.14.2 does not prevent shortcodes in submitted form values from being executed when it substitutes those values into the message it returns after submission, because the guard it applies can be defeated by nesting, allowing unauthenticated users to run any shortcode registered on the site.
- Product
- Hustle
- Fixed in
- 7.8.14.2
- What to do
- Update Hustle to 7.8.14.2 or newer.
Sep 9, 2026CleanTalk: Does not prevent unauthenticatedCVE-2026-19855 · WordPress plugins & themes · reported by WPScanMedium 6.5
The CleanTalk WordPress plugin before 6.87 does not prevent unauthenticated, user-supplied comment content from being passed to WordPress's shortcode engine, allowing any visitor to have arbitrary shortcodes registered on the site executed server-side and rendered to every subsequent visitor of the page.
- Product
- CleanTalk
- Fixed in
- 6.87
- What to do
- Update CleanTalk to 6.87 or newer.
Sep 9, 2026Checkout Custom Fields Builder for WooCommerce: Authorization bypassCVE-2026-19802 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Checkout Custom Fields Builder for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.1.5. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to install and activate an arbitrary attacker-hosted plugin, resulting in remote code execution on the server. The required nonce is emitted inline on all admin pages accessible to subscribers when WooCommerce is inactive, meaning any subscriber-level user can harvest it and trigger the exploit without any additional privileges.
- Product
- Checkout Custom Fields Builder for WooCommerce
- Affected
- up to 1.1.5
- What to do
- Affects up to 1.1.5. Update Checkout Custom Fields Builder for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 9, 2026Reviso Exporter for WooCommerce: Unauthorized modification of dataCVE-2026-8615 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Reviso Exporter for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check and missing nonce verification on the disconnect_callback() function in versions up to, and including, 1.2.3. The function is registered to the 'wp_ajax_wcefr-disconnect' AJAX action and unconditionally calls delete_option('wcefr-agt'), which removes the Reviso Agreement Grant Token used to authenticate API calls. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete the plugin's stored Agreement Grant Token, breaking the connection between WooCommerce and the Reviso service.
- Product
- Reviso Exporter for WooCommerce
- Affected
- up to 1.2.3
- What to do
- Affects up to 1.2.3. Update Reviso Exporter for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 9, 2026Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More: Does not validate a user-supplied HTML tag name in one of its Beaver Builder widgets before echoing it into the rendered markupCVE-2026-85418 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More WordPress plugin before 3.0.9 does not validate a user-supplied HTML tag name in one of its Beaver Builder widgets before echoing it into the rendered markup, allowing users with contributor-level access and above to inject arbitrary web scripts that execute when any visitor views the affected page.
- Product
- Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More
- Fixed in
- 3.0.9
- What to do
- Update Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More to 3.0.9 or newer.
Sep 9, 2026WPLP Cookie Consent: Does not perform nonce or capability checks on several of its settings AJAX actionsCVE-2026-85133 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WPLP Cookie Consent WordPress plugin before 4.4.2 does not perform nonce or capability checks on several of its settings AJAX actions, allowing any authenticated user, such as a subscriber, to read and destroy scan data belonging to the administrator and to overwrite the WPLP Cookie Consent WordPress plugin before 4.4.2's stored configuration.
- Product
- WPLP Cookie Consent
- Fixed in
- 4.4.2
- What to do
- Update WPLP Cookie Consent to 4.4.2 or newer.
Sep 9, 2026WPLP Cookie Consent: Does not perform nonce or capability checks on one of its cookie scanner AJAX actionsCVE-2026-85132 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WPLP Cookie Consent WordPress plugin before 4.4.2 does not perform nonce or capability checks on one of its cookie scanner AJAX actions, allowing any authenticated user, such as a subscriber, to read back the automated scan schedule the administrator configured.
- Product
- WPLP Cookie Consent
- Fixed in
- 4.4.2
- What to do
- Update WPLP Cookie Consent to 4.4.2 or newer.
Sep 9, 2026Sunshine Photo Cart: Does not validate that a client-supplied price identifier belongs to the item being purchasedCVE-2026-85037 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Sunshine Photo Cart WordPress plugin before 3.7 does not validate that a client-supplied price identifier belongs to the item being purchased when it is added to the cart, allowing unauthenticated users to buy items at a lower price defined elsewhere on the site and complete an order at that price, resulting in financial loss for the site owner.
- Product
- Sunshine Photo Cart
- Fixed in
- 3.7
- What to do
- Update Sunshine Photo Cart to 3.7 or newer.
Sep 9, 2026WPFunnels: Missing AuthorizationCVE-2026-84908 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WPFunnels plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 3.12.13. This is due to the plugin registering the 'wpfnl_load_payment' AJAX action for both authenticated and unauthenticated (wp_ajax_nopriv_) users and the underlying add_offer_product_to_cart() function performing no nonce verification, no capability check, and no validation that the attacker-supplied product_id is the offer product actually configured on the attacker-supplied step_id. This makes it possible for unauthenticated attackers to add arbitrary WooCommerce products to a cart at any discounted price configured on any funnel step, enabling price manipulation and revenue loss at checkout.
- Product
- WPFunnels
- Affected
- up to 3.12.13
- What to do
- Affects up to 3.12.13. Update WPFunnels to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 9, 2026Kirki: Does not check whether the requester is allowed to read a post before rendering and returning its page contentCVE-2026-84222 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Kirki WordPress plugin before 6.3.0 does not check whether the requester is allowed to read a post before rendering and returning its page content, allowing unauthenticated users to retrieve the content of pages that are not publicly available, such as private, draft, pending and trashed ones.
- Product
- Kirki
- Fixed in
- 6.3.0
- What to do
- Update Kirki to 6.3.0 or newer.
Sep 9, 2026Quentn WP: Does not properly sanitise and escape a parameter before using it in an SQL queryCVE-2026-84113 · WordPress plugins & themes · reported by WPScanMedium 4.1
The Quentn WP WordPress plugin before 1.2.15 does not properly sanitise and escape a parameter before using it in an SQL query, allowing high privilege users such as administrators to perform SQL injection attacks.
- Product
- Quentn WP
- Fixed in
- 1.2.15
- What to do
- Update Quentn WP to 1.2.15 or newer.
Sep 9, 2026Quentn WP: Does not adequately escape a request parameter before using it in an unprepared SQL queryCVE-2026-84068 · WordPress plugins & themes · reported by WPScanHigh 8.6
The Quentn WP WordPress plugin before 1.2.15 does not adequately escape a request parameter before using it in an unprepared SQL query, allowing unauthenticated attackers to extract arbitrary data from the database via SQL injection.
- Product
- Quentn WP
- Fixed in
- 1.2.15
- What to do
- Update Quentn WP to 1.2.15 or newer.
Sep 9, 2026WPBot – AI ChatBot for Live Support, Lead Generation, AI Services: Stored Cross-Site ScriptingCVE-2026-83593 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The WPBot – AI ChatBot for Live Support, Lead Generation, AI Services plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'conversation' parameter in all versions up to, and including, 8.7.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The action is gated only by a nonce that is localized into every public-facing page via wp_localize_script, rendering the nonce check ineffective as an access control barrier for unauthenticated users.
- Product
- WPBot – AI ChatBot for Live Support, Lead Generation, AI Services
- Affected
- up to 8.7.3
- What to do
- Affects up to 8.7.3. Update WPBot – AI ChatBot for Live Support, Lead Generation, AI Services to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 9, 2026Sina Extension for Elementor: Does not properly escape a Table widget setting before outputting it within an HTML attributeCVE-2026-83541 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Sina Extension for Elementor WordPress plugin before 3.10.4 does not properly escape a Table widget setting before outputting it within an HTML attribute, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Sina Extension for Elementor
- Fixed in
- 3.10.4
- What to do
- Update Sina Extension for Elementor to 3.10.4 or newer.
Sep 9, 2026Masteriyo LMS: Does not perform any authorization check before returning a course enrolment record over its REST APICVE-2026-82848 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Masteriyo LMS WordPress plugin before 3.4.0 does not perform any authorization check before returning a course enrolment record over its REST API, allowing unauthenticated users to read any learner's enrolment status, timestamps and course-progress data by walking sequential record identifiers. A related gap lets any enrolled user retrieve other learners' enrolment records as well.
- Product
- Masteriyo LMS
- Fixed in
- 3.4.0
- What to do
- Update Masteriyo LMS to 3.4.0 or newer.
Sep 9, 2026WPLP Cookie Consent: Does not have capability or nonce checks on some of its A/B testing actionsCVE-2026-82185 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WPLP Cookie Consent WordPress plugin before 4.4.2 does not have capability or nonce checks on some of its A/B testing actions, allowing any authenticated user, such as a subscriber, to overwrite the cookie banner configuration shown to every visitor and to irreversibly reset the stored A/B test results.
- Product
- WPLP Cookie Consent
- Fixed in
- 4.4.2
- What to do
- Update WPLP Cookie Consent to 4.4.2 or newer.
Sep 9, 2026WPLP Cookie Consent: Does not have any authorisation or CSRF checksCVE-2026-82184 · WordPress plugins & themes · reported by WPScanMedium 5.3
The WPLP Cookie Consent WordPress plugin before 4.4.2 does not have any authorisation or CSRF checks when storing visitor consent state, and the code that does so runs on every front-end page load, allowing unauthenticated attackers to overwrite a site-wide option with arbitrary data.
- Product
- WPLP Cookie Consent
- Fixed in
- 4.4.2
- What to do
- Update WPLP Cookie Consent to 4.4.2 or newer.
Sep 9, 2026Groundhogg — CRM, Newsletters, and Marketing Automation: Does not restrict the redirect target of its email preference confirmation flow to the site's own hostCVE-2026-81741 · WordPress plugins & themes · reported by WPScanMedium 4.7
The Groundhogg — CRM, Newsletters, and Marketing Automation WordPress plugin before 4.7.2 does not restrict the redirect target of its email preference confirmation flow to the site's own host, allowing unauthenticated attackers to redirect visitors to an arbitrary external URL by way of a crafted link.
- Product
- Groundhogg — CRM, Newsletters, and Marketing Automation
- Fixed in
- 4.7.2
- What to do
- Update Groundhogg — CRM, Newsletters, and Marketing Automation to 4.7.2 or newer.
Sep 9, 2026SupportCandy: Does not validate a submitted per-ticket authorization code before disclosing the real code to the requesterCVE-2026-81022 · WordPress plugins & themes · reported by WPScanMedium 5.3
The SupportCandy WordPress plugin before 3.5.3 does not validate a submitted per-ticket authorization code before disclosing the real code to the requester, allowing unauthenticated users to read the contents of any support ticket.
- Product
- SupportCandy
- Fixed in
- 3.5.3
- What to do
- Update SupportCandy to 3.5.3 or newer.
Sep 9, 2026SupportCandy: Does not perform an authorization check on one of its support-ticket attachment download pathsCVE-2026-81021 · WordPress plugins & themes · reported by WPScanMedium 5.3
The SupportCandy WordPress plugin before 3.5.3 does not perform an authorization check on one of its support-ticket attachment download paths, allowing unauthenticated attackers to read protected customer-uploaded attachments by enumerating sequential attachment identifiers.
- Product
- SupportCandy
- Fixed in
- 3.5.3
- What to do
- Update SupportCandy to 3.5.3 or newer.
Sep 9, 2026Payment Plugins for PayPal WooCommerce: Does not verify that a stored payment method belongs to the user attaching itCVE-2026-80341 · WordPress plugins & themes · reported by WPScanMedium 5.9
The Payment Plugins for PayPal WooCommerce WordPress plugin before 2.0.26 does not verify that a stored payment method belongs to the user attaching it, allowing any authenticated user, such as a subscriber, to bind another customer's stored card to their own account and then charge or delete it. Exploitation requires the attacker to already know the payment provider's identifier for the victim's stored method, which the Payment Plugins for PayPal WooCommerce WordPress plugin before 2.0.26 does not expose.
- Product
- Payment Plugins for PayPal WooCommerce
- Fixed in
- 2.0.26
- What to do
- Update Payment Plugins for PayPal WooCommerce to 2.0.26 or newer.
Sep 9, 2026Payment Plugins for PayPal WooCommerce: Does not validate the order key before adding order data to the JavaScript configuration it outputs on the front endCVE-2026-80340 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Payment Plugins for PayPal WooCommerce WordPress plugin before 2.0.26 does not validate the order key before adding order data to the JavaScript configuration it outputs on the front end, allowing unauthenticated users to obtain the secret that gates access to any order and, through it, that customer's billing and shipping details, by iterating sequential order identifiers.
- Product
- Payment Plugins for PayPal WooCommerce
- Fixed in
- 2.0.26
- What to do
- Update Payment Plugins for PayPal WooCommerce to 2.0.26 or newer.
Sep 9, 2026Payment Plugins for Stripe WooCommerce: Does not validate the order key before adding order data to the JavaScript configuration it outputs on the front endCVE-2026-80339 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Payment Plugins for Stripe WooCommerce WordPress plugin before 4.0.12 does not validate the order key before adding order data to the JavaScript configuration it outputs on the front end, allowing unauthenticated users to obtain the billing details of any order, together with the secret that gates access to it, by iterating sequential order identifiers.
- Product
- Payment Plugins for Stripe WooCommerce
- Fixed in
- 4.0.12
- What to do
- Update Payment Plugins for Stripe WooCommerce to 4.0.12 or newer.
Sep 9, 2026Next-Cart Store to WooCommerce Migration: Authentication BypassCVE-2026-76009 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Next-Cart Store to WooCommerce Migration plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 3.9.8 via the `NCWM_Kitconnect::run()` function. This is due to the plugin registering the `/wp-json/next_cart/v1/migration` REST route with `permission_callback` set to `__return_true` and relying on a hardcoded fallback value of `__token__` in `get_option('nextcart_token', '__token__')` when the `nextcart_token` option has not yet been written to the database. This makes it possible for unauthenticated attackers to bypass authentication to the migration endpoint by supplying the literal string `__token__` as the token, gaining access to privileged handlers that pass attacker-controlled SQL directly to `$wpdb->query()` and `$wpdb->get_results()` — enabling arbitrary SQL execution including administrator account creation — and pass an attacker-controlled path to `unlink()`, enabling arbitrary file deletion and full site takeover. The hardcoded fallback is reachable whenever the `nextcart_token` option has not yet been populated, which occurs after WP-CLI, network, or programmatic plugin activation without a subsequent authenticated `wp-admin
- Product
- Next-Cart Store to WooCommerce Migration
- Affected
- up to 3.9.8
- What to do
- Affects up to 3.9.8. Update Next-Cart Store to WooCommerce Migration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 9, 2026WP Recipe Maker: Authorization bypassCVE-2026-75905 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP Recipe Maker plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 10.8.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to take ownership of any admin-authored recipe by rewriting its post_author to the attacker's user ID, and unpublish it by overwriting its post_status with the contributor's draft or pending post status. This requires the default 'recipe_use_author' setting to be set to 'parent' for the ownership transfer to occur, though unpublishing remains possible regardless of this setting.
- Product
- WP Recipe Maker
- Affected
- up to 10.8.0
- What to do
- Affects up to 10.8.0. Update WP Recipe Maker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 9, 2026Ultimate Gift Cards for WooCommerce: Does not verify that the user redeeming a gift card is its intended recipientCVE-2026-75861 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Ultimate Gift Cards for WooCommerce WordPress plugin before 3.2.10 does not verify that the user redeeming a gift card is its intended recipient, allowing any authenticated user, such as a subscriber, to redeem gift cards belonging to other users, zeroing their balance and crediting the value to themselves. In 3.2.9 an ownership check was added on one of the two affected redemption paths; the one that remains requires a companion Ultimate Gift Cards for WooCommerce WordPress plugin before 3.2.10 from the same vendor to be active.
- Product
- Ultimate Gift Cards for WooCommerce
- Fixed in
- 3.2.10
- What to do
- Update Ultimate Gift Cards for WooCommerce to 3.2.10 or newer.
Sep 9, 2026Awesome Support: Missing AuthorizationCVE-2026-19946 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Awesome Support plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 6.3.9. This is due to a missing capability check on the wpas_do_mr_deny_user() function, which unlike its counterpart wpas_do_mr_activate_user() does not enforce current_user_can('edit_users') or current_user_can('edit_user', $user_id), relying solely on a nonce that is not scoped to the target user. This makes it possible for authenticated attackers, with subscriber-level access and above, to set the mr_user_denied flag on any user account — including administrators — permanently blocking their moderated activation and dispatching a denial notification email to the victim.
- Product
- Awesome Support
- Affected
- up to 6.3.9
- What to do
- Affects up to 6.3.9. Update Awesome Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 9, 2026WP Travel: Does not verify that the requester is authorized to act on the booking targeted by one of its front-end payment-message handlersCVE-2026-18042 · WordPress plugins & themes · reported by WPScanMedium 5.3
The WP Travel WordPress plugin before 12.0.2 does not verify that the requester is authorized to act on the booking targeted by one of its front-end payment-message handlers, allowing unauthenticated attackers to cancel the payment on any customer's booking.
- Product
- WP Travel
- Fixed in
- 12.0.2
- What to do
- Update WP Travel to 12.0.2 or newer.
Sep 9, 2026Loops & Logic: Does not restrict its public template-data action to the data a visitor is permitted to seeCVE-2026-16960 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Loops & Logic WordPress plugin before 4.3.0 does not restrict its public template-data action to the data a visitor is permitted to see, allowing unauthenticated users to read arbitrary user records (including email addresses and roles) and arbitrary site options.
- Product
- Loops & Logic
- Fixed in
- 4.3.0
- What to do
- Update Loops & Logic to 4.3.0 or newer.
Sep 9, 2026ELEX WooCommerce Request a Quote: Does not properly sanitise and escape a parameter before using it in a SQL queryCVE-2026-14962 · WordPress plugins & themes · reported by WPScanHigh 8.6
The ELEX WooCommerce Request a Quote WordPress plugin before 2.4.1 does not properly sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks and extract arbitrary data from the database.
- Product
- ELEX WooCommerce Request a Quote
- Fixed in
- 2.4.1
- What to do
- Update ELEX WooCommerce Request a Quote to 2.4.1 or newer.
Sep 9, 2026WP Travel: Does not properly verify that the requester owns the booking targeted by its bank-deposit slip submissionCVE-2026-13146 · WordPress plugins & themes · reported by WPScanLow 3.7
The WP Travel WordPress plugin before 12.0.2 does not properly verify that the requester owns the booking targeted by its bank-deposit slip submission, allowing an unauthenticated attacker who knows the target customer's email address to change that customer's booking payment state and attach a file to it.
- Product
- WP Travel
- Fixed in
- 12.0.2
- What to do
- Update WP Travel to 12.0.2 or newer.
Sep 9, 2026WP Travel: Does not properly verify that the requester is authorized to modify the targeted booking on one branch of its bank-deposit handlerCVE-2026-13144 · WordPress plugins & themes · reported by WPScanLow 3.7
The WP Travel WordPress plugin before 12.0.2 does not properly verify that the requester is authorized to modify the targeted booking on one branch of its bank-deposit handler, allowing an unauthenticated attacker who knows the target customer's email address to reset that customer's booking payment to an unpaid state and wipe its stored deposit-reconciliation data.
- Product
- WP Travel
- Fixed in
- 12.0.2
- What to do
- Update WP Travel to 12.0.2 or newer.
Sep 9, 2026Content Mask: Does not properly sanitise and escape content submitted with a post before outputting it in the pages it generatesCVE-2025-15690 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Content Mask WordPress plugin before 1.8.5.6 does not properly sanitise and escape content submitted with a post before outputting it in the pages it generates, allowing users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks against any user viewing or previewing the affected page. The Content Mask WordPress plugin before 1.8.5.6's option to restrict its use by role does not prevent this.
- Product
- Content Mask
- Fixed in
- 1.8.5.6
- What to do
- Update Content Mask to 1.8.5.6 or newer.
Sep 9, 2026WP Crowdfunding: Stored Cross-Site ScriptingCVE-2026-19945 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP Crowdfunding plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'first_name' parameter in all versions up to, and including, 2.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. An administrator viewing any user's profile via the ?show_user_id= parameter will render the attacker's stored payload in the admin's browser session, enabling cross-privilege script execution.
- Product
- WP Crowdfunding
- Affected
- up to 2.2.1
- What to do
- Affects up to 2.2.1. Update WP Crowdfunding to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 9, 2026Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered): Authorization bypassCVE-2026-11821 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.1.17. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to view, create, update, clone, and delete notification flow event automation workflows that should be restricted to administrators.
- Product
- Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered)
- Affected
- up to 4.1.17
- What to do
- Affects up to 4.1.17. Update Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 9, 2026Repeater Fields for Gravity Forms: Stored Cross-Site ScriptingCVE-2026-84293 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Repeater Fields for Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Repeated Multi-Input Sub-Field Values in all versions up to, and including, 3.0.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability only affects multi-input sub-field types within a repeater (such as Name, Address, and Checkbox fields), as scalar single-input field values are escaped with esc_html() at the output stage in version 3.0.4.
- Product
- Repeater Fields for Gravity Forms
- Affected
- up to 3.0.4
- What to do
- Affects up to 3.0.4. Update Repeater Fields for Gravity Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 9, 2026Product Filter for WooCommerce by WBW: Reflected Cross-Site ScriptingCVE-2026-7804 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Product Filter for WooCommerce by WBW plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'wpf_fid' parameter in all versions up to, and including, 3.4.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Exploitation requires the crafted request to target a page where a filter using the vulnerable recalculation output is present.
- Product
- Product Filter for WooCommerce by WBW
- Affected
- up to 3.4.2
- What to do
- Affects up to 3.4.2. Update Product Filter for WooCommerce by WBW to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 9, 2026My Calendar – Accessible Event Manager: Stored Cross-Site ScriptingCVE-2026-77187 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'before' and 'after' Shortcode Attributes in all versions up to, and including, 3.8.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- My Calendar – Accessible Event Manager
- Affected
- up to 3.8.3
- What to do
- Affects up to 3.8.3. Update My Calendar – Accessible Event Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 9, 2026My Calendar – Accessible Event Manager: Stored Cross-Site ScriptingCVE-2026-77186 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'fallback' Shortcode Attribute in all versions up to, and including, 3.8.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The bypass relies on hex-encoded shortcode attribute payloads (e.g. \x3cscript\x3e), which wp_kses_post cannot strip on save because they appear as literal backslash sequences rather than real HTML tags; WordPress core's shortcode_parse_atts() then calls stripcslashes() at render time, decoding the escapes into real angle brackets before they reach the unescaped sink.
- Product
- My Calendar – Accessible Event Manager
- Affected
- up to 3.8.3
- What to do
- Affects up to 3.8.3. Update My Calendar – Accessible Event Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 9, 2026Podlove Podcast Publisher: Stored Cross-Site ScriptingCVE-2026-75966 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Podlove Podcast Publisher plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'episode_contributor[..][..][comment]' Parameter in all versions up to, and including, 4.5.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The contributor comment is stored in a plugin-managed custom table, bypassing WordPress core's wp_kses_post filter, and the save_post hook fires without a nonce check, meaning any user who can edit posts can exploit this without further preconditions.
- Product
- Podlove Podcast Publisher
- Affected
- up to 4.5.5
- What to do
- Affects up to 4.5.5. Update Podlove Podcast Publisher to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 9, 2026WP Crowdfunding: Generic SQL InjectionCVE-2026-19944 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The WP Crowdfunding plugin for WordPress is vulnerable to generic SQL Injection via 'wpneo_reward' Post Meta in all versions up to, and including, 2.2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with shop manager-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This is a second-order injection: a Shop Manager writes the malicious payload once via the WooCommerce REST products endpoint (POST/PUT /wp-json/wc/v3/products/{id}), and the injected query executes on every subsequent public page view that renders the campaign rewards sidebar.
- Product
- WP Crowdfunding
- Affected
- up to 2.2.1
- What to do
- Affects up to 2.2.1. Update WP Crowdfunding to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 9, 2026Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails: SQL InjectionCVE-2026-19800 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails plugin for WordPress is vulnerable to SQL Injection via the 'status' parameter in all versions up to, and including, 1.31.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. The $wpdb->prepare() call does not protect against this injection because the attacker-controlled $contact_filter_query fragment is concatenated into the SQL format string before prepare() executes — prepare() only processes %s/%d placeholders and cannot sanitize content already embedded in the format string. REST API JSON bodies are parsed from php://input and bypass WordPress's wp_magic_quotes(), meaning double-quote characters in status array values reach the SQL sink unescaped. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The required 'mint_read_contacts' capability is a plugin-specific capability not assigned to any default WordPress role; it must be explicitly granted by an
- Product
- Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails
- Affected
- up to 1.31.0
- What to do
- Affects up to 1.31.0. Update Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 9, 2026User Access Manager: Reflected Cross-Site ScriptingCVE-2026-19797 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The User Access Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab_group_section' parameter in all versions up to, and including, 2.3.18 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- User Access Manager
- Affected
- up to 2.3.18
- What to do
- Affects up to 2.3.18. Update User Access Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 9, 2026WP EasyCart: Privilege escalationCVE-2026-17553 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The WP EasyCart plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.9.3. This is due to the ec_ajax_save_page_default_options() AJAX handler iterating over every $_POST key and passing it directly into update_option() without any allowlist, while gating the handler only on 'manage_options' OR the plugin's custom 'wpec_manager' capability. The plugin's built-in 'wpec_store_manager' role holds 'wpec_manager' but not 'manage_options', and the required nonce is emitted on frontend product/category templates that render for any user with 'wpec_manager'. This makes it possible for authenticated attackers, with Store Manager-level access and above, to elevate their privileges to administrator by updating arbitrary WordPress options such as default_role='administrator' and users_can_register='1', then self-registering a new account that is assigned the administrator role.
- Product
- WP EasyCart
- Affected
- up to 5.9.3
- What to do
- Affects up to 5.9.3. Update WP EasyCart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 9, 2026Ninja Forms – The Contact Form Builder That Grows With You: PHP Object InjectionCVE-2026-11363 · WordPress plugins & themes · reported by WordfenceMedium 6.6
The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.14.6 via deserialization of untrusted input . This makes it possible for authenticated attackers, with administrator-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present. The deserialization is triggered automatically during form import when WPN_Helper::build_nf_cache() invokes $action->get_settings() immediately after the crafted form is imported, requiring no further interaction beyond the import action itself.
- Product
- Ninja Forms – The Contact Form Builder That Grows With You
- Affected
- up to 3.14.6
- What to do
- Affects up to 3.14.6. Update Ninja Forms – The Contact Form Builder That Grows With You to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 8, 2026FireBox – WooCommerce Popup Builder, Exit Intent Popup, Email Optin & Cart Abandonment: Remote Code ExecutionCVE-2026-76801 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The FireBox – WooCommerce Popup Builder, Exit Intent Popup, Email Optin & Cart Abandonment plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 3.1.10 via the value function. This is due to a trivially bypassable regex blacklist in Executer::allowedToRun() that fails to block WordPress core functions such as wp_insert_user, update_option, and file_put_contents, combined with no sanitization of PHP condition rule values stored via the firebox_meta REST endpoint. This makes it possible for authenticated attackers, with author-level access and above, to execute code on the server. On sites upgraded from a version prior to 3.1.10, the Migrator::preserveCampaignRoleAccess() function automatically grants the edit_fireboxes and publish_fireboxes capabilities to the Author role, lowering the effective entry point to Author-level access.
- Product
- FireBox – WooCommerce Popup Builder, Exit Intent Popup, Email Optin & Cart Abandonment
- Affected
- up to 3.1.10
- What to do
- Affects up to 3.1.10. Update FireBox – WooCommerce Popup Builder, Exit Intent Popup, Email Optin & Cart Abandonment to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 8, 2026Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered): Local File InclusionCVE-2026-15667 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.1.22 via the 'event_layout' parameter parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. The etn_manage_event capability is assigned to Contributors by default, meaning any Contributor-level user can set the malicious event_layout value via the REST API without any additional configuration.
- Product
- Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered)
- Affected
- up to 4.1.22
- What to do
- Affects up to 4.1.22. Update Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 8, 2026Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered): Local File InclusionCVE-2026-15406 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.1.22 via the 'event_layout' parameter parameter. This makes it possible for authenticated attackers, with custom-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.
- Product
- Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered)
- Affected
- up to 4.1.22
- What to do
- Affects up to 4.1.22. Update Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. The WordPress, CMS and hosting-panel entries come from the National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan and others); we show who. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, a booking system, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.