Updated 10 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,756exploited flaws on CISA’s list

33added in the last 30 days

299new WordPress flaws this week

13,998entries in the database

13,998 results · page 61 of 280

Sep 8, 2026Graphina – Charts and Graphs For Elementor: Stored Cross-Site ScriptingCVE-2026-13709 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Graphina – Charts and Graphs For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'iq_tree_tree_chart_template' Widget Setting in all versions up to, and including, 3.1.11 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Graphina – Charts and Graphs For Elementor
Affected
up to 3.1.11
What to do
Affects up to 3.1.11. Update Graphina – Charts and Graphs For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 8, 2026Contact Form to DB by BestWebSoft – Messages Database Plugin For WordPress: Stored Cross-Site ScriptingCVE-2026-13359 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Contact Form to DB by BestWebSoft – Messages Database Plugin For WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via cntctfrm_contact_dropdown Parameter in all versions up to, and including, 1.7.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload executes in the context of an administrator's browser session when they visit the plugin's message manager page at /wp-admin/admin.php?page=cntctfrmtdb_manager, making it possible to compromise administrator-level sessions via a simple unauthenticated contact form submission.
Product
Contact Form to DB by BestWebSoft – Messages Database Plugin For WordPress
Affected
up to 1.7.5
What to do
Affects up to 1.7.5. Update Contact Form to DB by BestWebSoft – Messages Database Plugin For WordPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 8, 2026WP Event Solution (Eventin): Missing AuthorizationCVE-2026-12956 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WP Event Solution (Eventin) plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 4.1.22 via the create_item() handler for the /wp-json/eventin/v2/orders REST endpoint. The endpoint's create_item_permissions_check() function only verifies a wp_rest nonce (which is leaked to every visitor through the etn-public script's localized_data_obj on every frontend page) and accepts a user-supplied 'status' value in prepare_item_for_database() with no whitelist validation. This makes it possible for unauthenticated attackers to create etn-order posts with status='completed' that are counted as sold by etn_get_sold_tickets_by_event(); because the auto-cleanup wp_schedule_single_event() in create_item() only fires for status='pending' orders, the forged completed orders persist indefinitely and exhaust ticket inventory.
Product
WP Event Solution (Eventin)
Affected
up to 4.1.22
What to do
Affects up to 4.1.22. Update WP Event Solution (Eventin) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 8, 2026Zephyr Project Manager: Stored Cross-Site ScriptingCVE-2026-76931 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Zephyr Project Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘message’ parameter in all versions up to, and including, 3.3.205 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Custom-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerability can only be exploited when the 'Directly link to project' plugin setting is disabled.
Product
Zephyr Project Manager
Affected
up to 3.3.205
What to do
Affects up to 3.3.205. Update Zephyr Project Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 8, 2026Event Tickets and Registration: Unauthorized modification of dataCVE-2026-3174 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Event Tickets and Registration plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the Stripe OAuth return endpoint in all versions up to, and including, 5.27.4. This makes it possible for unauthenticated attackers to overwrite the site's Stripe merchant credentials (access tokens, publishable keys, and account ID), diverting all subsequent payment processing to the attacker's Stripe account.
Product
Event Tickets and Registration
Affected
up to 5.27.4
What to do
Affects up to 5.27.4. Update Event Tickets and Registration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 8, 2026Online Scheduling and Appointment Booking System – Bookly: Unauthorized modification of dataCVE-2026-2520 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'updateAddon' function in all versions up to, and including, 27.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update any plugin with a main file of 'main.php' to its latest version.
Product
Online Scheduling and Appointment Booking System – Bookly
Affected
up to 27.2
What to do
Affects up to 27.2. Update Online Scheduling and Appointment Booking System – Bookly to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 8, 2026The Beaver Builder Page Builder – Drag and Drop Website Builder: Arbitrary shortcode executionCVE-2026-18021 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The The Beaver Builder Page Builder – Drag and Drop Website Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.10.3.1. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
Product
The Beaver Builder Page Builder – Drag and Drop Website Builder
Affected
up to 2.10.3.1
What to do
Affects up to 2.10.3.1. Update The Beaver Builder Page Builder – Drag and Drop Website Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 8, 2026WPML Multilingual CMS: Time-based SQL InjectionCVE-2026-17509 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The WPML Multilingual CMS plugin for WordPress is vulnerable to time-based SQL Injection via the ‘elementIds’ parameter in all versions up to, and including, 4.9.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This vulnerability is exploitable due to an authorization bypass where the registered authorization callback fails to execute, allowing any authenticated user regardless of role to access administrative translation functionalities.
Product
WPML Multilingual CMS
Affected
up to 4.9.5
What to do
Affects up to 4.9.5. Update WPML Multilingual CMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record wpml.org wordfence.com
Sep 8, 2026Live Composer – Free WordPress Website Builder: PHP Object InjectionCVE-2026-16502 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.1.18 via deserialization of untrusted input . This makes it possible for authenticated attackers, with contributor-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.
Product
Live Composer – Free WordPress Website Builder
Affected
up to 2.1.18
What to do
Affects up to 2.1.18. Update Live Composer – Free WordPress Website Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 8, 2026LearnPress – WordPress LMS Plugin for Create and Sell Online Courses: Stored Cross-Site ScriptingCVE-2026-12230 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'layout_custom_css' parameter in all versions up to, and including, 4.3.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
Affected
up to 4.3.9.1
What to do
Affects up to 4.3.9.1. Update LearnPress – WordPress LMS Plugin for Create and Sell Online Courses to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 8, 2026EDD Product Catalog Feed by PixelYourSite: Unauthorized modification of data that can lead to a denial of serviceCVE-2026-9331 · WordPress plugins & themes · reported by WordfenceHigh 7.1
The EDD Product Catalog Feed by PixelYourSite plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capability check on the wpeddpcf_delete_feed function in all versions up to, and including, 1.0.2. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary option values on the WordPress site. This can be leveraged to delete an option that would create an error on the site and deny service to legitimate users.
Product
EDD Product Catalog Feed by PixelYourSite
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update EDD Product Catalog Feed by PixelYourSite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record pixelyoursite.com wordfence.com
Sep 8, 2026Unauthenticated Cross Site Scripting (XSS) in Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 2.0.17 versions.CVE-2026-84820 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 2.0.17 versions.
What to do
Update the plugin to the newest version.
NVD record patchstack.com
Sep 8, 2026Unauthenticated Cross Site Scripting (XSS) in Open User Map <= 1.4.50 versions.CVE-2026-84818 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Open User Map <= 1.4.50 versions.
What to do
Update the plugin to the newest version.
NVD record patchstack.com
Sep 8, 2026Unauthenticated Cross Site Scripting (XSS) in JetFormBuilder <= 3.6.5.1 versions.CVE-2026-84817 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in JetFormBuilder <= 3.6.5.1 versions.
What to do
Update the plugin to the newest version.
NVD record patchstack.com
Sep 8, 2026John Darrel Hide My WP Ghost: Server-Side Request Forgery (SSRF)CVE-2026-81806 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Server-Side Request Forgery (SSRF) vulnerability in John Darrel Hide My WP Ghost allows Server Side Request Forgery. This issue affects Hide My WP Ghost: from n/a through 7.0.09.
Product
John Darrel Hide My WP Ghost
Affected
up to 7.0.09
What to do
Affects up to 7.0.09. Update John Darrel Hide My WP Ghost to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record patchstack.com
Sep 8, 2026Unauthenticated Insecure Direct Object References (IDOR) in WpEvently <= 5.6.0 versions.CVE-2026-81802 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Insecure Direct Object References (IDOR) in WpEvently <= 5.6.0 versions.
What to do
Update the plugin to the newest version.
NVD record patchstack.com
Sep 8, 2026Easy Appointments: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-81798 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Easy Appointments allows DOM-Based XSS. This issue affects Easy Appointments: from n/a through 4.0.2.1.
Product
Easy Appointments
Affected
up to 4.0.2.1
What to do
Affects up to 4.0.2.1. Update Easy Appointments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record patchstack.com
Sep 8, 2026MultiVendorX Product Catalog Enquiry for WooCommerce by MultiVendorX woocommerce-catalog-enquiry: Incorrect Privilege AssignmentCVE-2026-81792 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Incorrect Privilege Assignment vulnerability in MultiVendorX Product Catalog Enquiry for WooCommerce by MultiVendorX woocommerce-catalog-enquiry allows Privilege Escalation.This issue affects Product Catalog Enquiry for WooCommerce by MultiVendorX: from n/a through 6.1.5.
Product
MultiVendorX Product Catalog Enquiry for WooCommerce by MultiVendorX woocommerce-catalog-enquiry
Affected
up to 6.1.5
What to do
Affects up to 6.1.5. Update MultiVendorX Product Catalog Enquiry for WooCommerce by MultiVendorX woocommerce-catalog-enquiry to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record patchstack.com
Sep 8, 2026Viszt Péter Csomagpontok és szállítási címkék WooCommerce-hez: Missing AuthorizationCVE-2026-81790 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in Viszt Péter Csomagpontok és szállítási címkék WooCommerce-hez allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Csomagpontok és szállítási címkék WooCommerce-hez: from n/a before 4.2.8.
Product
Viszt Péter Csomagpontok és szállítási címkék WooCommerce-hez
Fixed in
4.2.8
What to do
Update Viszt Péter Csomagpontok és szállítási címkék WooCommerce-hez to 4.2.8 or newer.
NVD record patchstack.com
Sep 8, 2026Unbounce Unbounce Landing Pages unbounce: Missing AuthorizationCVE-2026-81781 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Missing Authorization vulnerability in Unbounce Unbounce Landing Pages unbounce allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Unbounce Landing Pages: from n/a through 1.1.4.
Product
Unbounce Unbounce Landing Pages unbounce
Affected
up to 1.1.4
What to do
Affects up to 1.1.4. Update Unbounce Unbounce Landing Pages unbounce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record patchstack.com
Sep 8, 2026Automattic WooCommerce: Allocation of Resources Without Limits or ThrottlingCVE-2026-48888 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Allocation of Resources Without Limits or Throttling vulnerability in Automattic WooCommerce allows HTTP DoS. This issue affects WooCommerce: from n/a before 11.1.0.
Product
Automattic WooCommerce
Fixed in
11.1.0
What to do
Update Automattic WooCommerce to 11.1.0 or newer.
NVD record patchstack.com
Sep 7, 2026WP Fusion (Pro): Privilege EscalationCVE-2026-14444 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The WP Fusion (Pro) plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.47.13. This is due to insufficient authorization checks on the role parameter in the ThriveCart Auto Login handler's thrivecart() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, and who possess the access_key, to create a new user account with administrator privileges and gain full control over the WordPress site. The required access_key is intentionally shared with ThriveCart customers as part of the plugin's documented setup process, making it accessible to attackers who have made a purchase. The vulnerability is only exploitable when the ThriveCart Auto Login option is enabled.
Product
WP Fusion (Pro)
Affected
up to 3.47.13
What to do
Affects up to 3.47.13. Update WP Fusion (Pro) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record wpfusion.com wordfence.com
Sep 7, 2026The Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress: Arbitrary shortcode executionCVE-2026-12757 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The The Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.9.27. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
Product
The Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress
Affected
up to 5.9.27
What to do
Affects up to 5.9.27. Update The Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 7, 2026Masteriyo LMS: Unauthorized data deletionCVE-2026-8279 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Masteriyo LMS plugin for WordPress is vulnerable to unauthorized data deletion due to a missing capability check on the 'delete_item_permissions_check' function in the CourseProgressItemsController in all versions up to, and including, 2.2.0. This makes it possible for unauthenticated attackers to delete arbitrary course progress records belonging to any student.
Product
Masteriyo LMS
Affected
up to 2.2.0
What to do
Affects up to 2.2.0. Update Masteriyo LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 7, 2026User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor: Stored Cross-Site ScriptingCVE-2026-6431 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Biographical Info' meta field parameter in all versions up to, and including, 3.15.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
Affected
up to 3.15.7
What to do
Affects up to 3.15.7. Update User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 7, 2026Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE: Insecure Direct Object ReferenceCVE-2026-4945 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.1.7 via the 'watch_checkout' function due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to pay for a lower-cost product while obtaining entitlement for a premium product by manipulating the product_id parameter independently of the price_id parameter in the Stripe checkout URL.
Product
Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE
Affected
up to 3.1.7
What to do
Affects up to 3.1.7. Update Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 7, 2026Flamingo: Authorization bypassCVE-2026-12853 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Flamingo plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to enumerate taxonomy terms including channel names derived from Contact Form 7 form titles that may reveal internal form purposes, department names, or workflow identifiers, as well as submission counts per channel and contact tag names. The plugin's flamingo_map_meta_cap() filter restricts access to Flamingo's admin UI but does not extend to WordPress core APIs such as XML-RPC wp.getTerms and admin-ajax ajax-tag-search.
Product
Flamingo
Affected
up to 2.6.2
What to do
Affects up to 2.6.2. Update Flamingo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 7, 2026Powerkit: Stored Cross-Site ScriptingCVE-2026-2390 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Powerkit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Lazy Load module's image processing in all versions up to, and including, 3.0.4. This is due to the 'content_process_images' function using a flawed regex-based HTML attribute parser. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Powerkit
Affected
up to 3.0.4
What to do
Affects up to 3.0.4. Update Powerkit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 7, 2026Vulnerability involving incorrect access control in the Tools::getRemoteAddr() function in PrestaShop, which allows the client’s IP address to be spoofed via thCVE-2026-84186 · Websites & servers · reported by cve-coordination@incibe.esMedium 6.9
Vulnerability involving incorrect access control in the Tools::getRemoteAddr() function in PrestaShop, which allows the client’s IP address to be spoofed via the X-Forwarded-For header when the application is running behind a reverse proxy, load balancer or CDN. The application incorrectly processes the IP address string and uses the address controlled by the visitor rather than the one provided by the trusted infrastructure, allowing an unauthenticated remote attacker to cause the application to interpret their connection as originating from an arbitrary IP address. This condition allows IP-based controls, such as the maintenance mode allowlist, to be bypassed, as well as enabling the forgery of security and audit logs and the evasion of third-party mechanisms that rely on the IP address, such as geolocation checks, fraud detection or request throttling.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
NVD record incibe.es
Sep 6, 2026The Redirection for Contact Form 7 WordPress plugin from 2.2.7 before 3.2.11 does not prevent shortcodes in submitted form values from being executed when it suCVE-2026-80439 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Redirection for Contact Form 7 WordPress plugin from 2.2.7 before 3.2.11 does not prevent shortcodes in submitted form values from being executed when it substitutes those values into an action's settings and then processes those settings for shortcodes, allowing unauthenticated users to run any shortcode registered on the site and read its output.
Fixed in
3.2.11
What to do
Update the plugin to 3.2.11 or newer.
NVD record wpscan.com
Sep 6, 2026The Ninja Forms WordPress plugin from 3.14.10 before 3.15.2 does not prevent shortcodes in request-derived values from being executed when it substitutes them iCVE-2026-80437 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Ninja Forms WordPress plugin from 3.14.10 before 3.15.2 does not prevent shortcodes in request-derived values from being executed when it substitutes them into content it later processes for shortcodes, allowing unauthenticated users to run any shortcode registered on the site.
Fixed in
3.15.2
What to do
Update the plugin to 3.15.2 or newer.
NVD record wpscan.com
Sep 6, 2026JetFormBuilder: Does not validate or strip line breaks from address values it sources from submitted form fields before adding them to the headers of the e-mails it sendsCVE-2026-19862 · WordPress plugins & themes · reported by WPScanMedium 4.8
The JetFormBuilder WordPress plugin before 3.6.5.2 does not validate or strip line breaks from address values it sources from submitted form fields before adding them to the headers of the e-mails it sends, allowing unauthenticated users to inject arbitrary e-mail headers, add hidden recipients and spoof the sender. Exploitation requires the site to be configured to take one of the message's addresses from a form field.
Product
JetFormBuilder
Fixed in
3.6.5.2
What to do
Update JetFormBuilder to 3.6.5.2 or newer.
NVD record wpscan.com
Sep 6, 2026JetFormBuilder: Does not sanitize a request parameter before rendering itCVE-2026-19859 · WordPress plugins & themes · reported by WPScanMedium 6.5
The JetFormBuilder WordPress plugin before 3.6.5.2 does not sanitize a request parameter before rendering it as message content, allowing unauthenticated users to execute arbitrary shortcodes registered on the site on any page displaying a form. Escaping is applied to that content before a later shortcode-expansion pass rather than after it, so the escaping can be bypassed.
Product
JetFormBuilder
Fixed in
3.6.5.2
What to do
Update JetFormBuilder to 3.6.5.2 or newer.
NVD record wpscan.com
Sep 6, 2026B2BKing — Ultimate WooCommerce B2B and Wholesale Plugin — Wholesale Prices, Bulk Order Form & More: Does not verify that a role selected during registration is one actually offered on the registration formCVE-2026-85038 · WordPress plugins & themes · reported by WPScanMedium 5.3
The B2BKing — Ultimate WooCommerce B2B and Wholesale Plugin — Wholesale Prices, Bulk Order Form & More WordPress plugin before 5.2.40 does not verify that a role selected during registration is one actually offered on the registration form, allowing unauthenticated users to assign themselves to restricted B2B customer groups and to skip the manual account-approval workflow during self-registration.
Product
B2BKing — Ultimate WooCommerce B2B and Wholesale Plugin — Wholesale Prices, Bulk Order Form & More
Fixed in
5.2.40
What to do
Update B2BKing — Ultimate WooCommerce B2B and Wholesale Plugin — Wholesale Prices, Bulk Order Form & More to 5.2.40 or newer.
NVD record wpscan.com
Sep 6, 2026Kirki: Does not hold back every spelling of the HTML entities it decodesCVE-2026-84219 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Kirki WordPress plugin before 6.3.0 does not hold back every spelling of the HTML entities it decodes when rendering, allowing unauthenticated users to store JavaScript in a comment which then runs in the session of anyone viewing a page that displays it, including an administrator, and on every page of the site when its header or footer is built to show comments.
Product
Kirki
Fixed in
6.3.0
What to do
Update Kirki to 6.3.0 or newer.
NVD record wpscan.com
Sep 6, 2026Bold Page Builder: Does not sanitise and escape a shortcode attribute before outputting it in an HTML attributeCVE-2026-84028 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Bold Page Builder WordPress plugin before 5.9.9 does not sanitise and escape a shortcode attribute before outputting it in an HTML attribute, allowing users with the Contributor role and above to inject arbitrary web scripts that execute when a user views the affected page.
Product
Bold Page Builder
Fixed in
5.9.9
What to do
Update Bold Page Builder to 5.9.9 or newer.
NVD record wpscan.com
Sep 6, 2026SureCart: Does not consult the site's user registration setting before creating WordPress accountsCVE-2026-75793 · WordPress plugins & themes · reported by WPScanMedium 6.5
The SureCart WordPress plugin before 4.7.0 does not consult the site's user registration setting before creating WordPress accounts, allowing unauthenticated users to create an account and receive a logged-in session even when registration is disabled.
Product
SureCart
Fixed in
4.7.0
What to do
Update SureCart to 4.7.0 or newer.
NVD record wpscan.com
Sep 6, 2026SureCart: Does not ensure that the account affected by a customer update is the same account its permission check authorisedCVE-2026-18480 · WordPress plugins & themes · reported by WPScanHigh 8.8
The SureCart WordPress plugin before 4.6.3 does not ensure that the account affected by a customer update is the same account its permission check authorised, allowing users with a subscriber-level account to change another user's email address, including an administrator's, and take over that account via a password reset. It further allows an attacker-controlled customer record to be associated with an arbitrary user, and discloses customer identifiers and email addresses to any authenticated user, which together make the takeover reachable from a subscriber-level account alone.
Product
SureCart
Fixed in
4.6.3
What to do
Update SureCart to 4.6.3 or newer.
NVD record wpscan.com
Sep 6, 2026Real Estate Papi: Does not perform capability or CSRF checks on one of its AJAX actionsCVE-2026-13159 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Real Estate Papi WordPress theme through 1.0.5 does not perform capability or CSRF checks on one of its AJAX actions, allowing any authenticated user, such as a subscriber, to install a fixed set of companion from the WordPress.org repository. Where the request runs in the session of a user who can activate , those are activated as well.
Product
Real Estate Papi
Affected
up to 1.0.5
What to do
Affects up to 1.0.5. Update Real Estate Papi to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record wpscan.com
Sep 5, 2026Frontend Admin by DynamiApps: Authentication Bypass to Account TakeoverCVE-2026-75816 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Authentication Bypass to Account Takeover in all versions up to, and including, 3.29.12. This is due to the pre_update_value function lacking any capability or ownership check, and ActionPost::conditions_logic() short-circuiting its current_user_can('edit_post') authorization gate whenever the post ID is non-numeric — such as the string user_1 — allowing unauthenticated form submissions to be routed to arbitrary user records without restriction. This makes it possible for unauthenticated attackers to overwrite any user's registered email address, including an administrator's, and then leverage WordPress's native password-reset flow to fully take over the targeted account.
Product
Frontend Admin by DynamiApps
Affected
up to 3.29.12
What to do
Affects up to 3.29.12. Update Frontend Admin by DynamiApps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 5, 2026HivePress Authentication: Authentication BypassCVE-2026-18056 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The HivePress Authentication plugin for WordPress is vulnerable to Authentication Bypass via the access_token parameter in all versions up to, and including, 1.1.4. This is due to the authenticate_user function's Facebook authenticator resolving third-party identity by forwarding the attacker-supplied access_token to the Facebook Graph API and trusting the returned email and ID verbatim, without performing any application ID or audience validation — specifically, no /debug_token verification and no comparison of the token's app_id against the configured hp_facebook_app_id. This makes it possible for unauthenticated attackers to authenticate as any existing WordPress user, including administrators, whose email address is associated with a Facebook account for which the attacker can obtain any valid access token. Important Note: To exploit the vulnerability, the attacker must obtain the victim's access token.
Product
HivePress Authentication
Affected
up to 1.1.4
What to do
Affects up to 1.1.4. Update HivePress Authentication to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record developers.facebook.com github.com
Sep 5, 2026MemberDash: Insecure Direct Object ReferenceCVE-2026-16310 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The MemberDash plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.8.5 via the 'id' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to change the password of any WordPress user, including administrators, by supplying an arbitrary user ID during registration, and take over their account without any notification sent to the victim.
Product
MemberDash
Affected
up to 1.8.5
What to do
Affects up to 1.8.5. Update MemberDash to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record memberdashwp.com wordfence.com
Sep 5, 2026Ninja Forms - Save Progress: Missing AuthorizationCVE-2026-15550 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Ninja Forms - Save Progress plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 3.0.30. This is due to the lack of capability checks and nonce verification in the 'bulk_actions' function. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary database records from the 'wp_nf3_objects' table, such as saved submissions.
Product
Ninja Forms - Save Progress
Affected
up to 3.0.30
What to do
Affects up to 3.0.30. Update Ninja Forms - Save Progress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record ninjaforms.com wordfence.com
Sep 5, 2026LearnDash LMS: Authorization bypassCVE-2026-12843 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The LearnDash LMS plugin for WordPress is vulnerable to authorization bypass in versions 4.25.0 - 5.1.6. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to enroll arbitrary users in paid courses without payment verification, bypassing the entire payment system and gaining unauthorized access to premium educational content.
Product
LearnDash LMS
What to do
Update LearnDash LMS to the newest version.
NVD record docs.nexcess.com wordfence.com
Sep 5, 2026Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails: PHP Object InjectionCVE-2026-10196 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.31.0 via deserialization of untrusted input in the 'handle_form_submission' function. This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain allows attackers to execute code on the server. The vulnerability was partially patched in version 1.23.1.
Product
Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails
Affected
up to 1.31.0
What to do
Affects up to 1.31.0. Update Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 5, 2026Nokri – Job Board: Unauthorized modification of dataCVE-2025-9049 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Nokri – Job Board WordPress Theme theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'nokri_account_member_permissions' function in all versions up to, and including, 1.6.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to add new Subscriber users with employer account member permissions, who in turn can escalate privileges by updating the email address of any user, including Administrator users.
Product
Nokri – Job Board
Affected
up to 1.6.4
What to do
Affects up to 1.6.4. Update Nokri – Job Board to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record themeforest.net wordfence.com
Sep 5, 2026Pods – Custom Content Types and Fields: Stored Cross-Site ScriptingCVE-2026-76573 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Pods – Custom Content Types and Fields plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'not_found' Shortcode Attribute in all versions up to, and including, 3.3.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Pods – Custom Content Types and Fields
Affected
up to 3.3.9.1
What to do
Affects up to 3.3.9.1. Update Pods – Custom Content Types and Fields to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 5, 2026Post Grid and Gutenberg Blocks – ComboBlocks: Unauthenticated Hook InjectionCVE-2024-11080 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Post Grid and Gutenberg Blocks – ComboBlocks plugin for WordPress is vulnerable to Unauthenticated Hook Injection in versions 2.2.32 to 2.3.1 via several functions in the ~/includes/blocks/form-wrap/function.php file. This makes it possible for unauthenticated attackers to execute actions with hooks in WordPress, granted no other security controls are present in the function.
Product
Post Grid and Gutenberg Blocks – ComboBlocks
Affected
2.2.32 to 2.3.1
What to do
Affects 2.2.32 to 2.3.1. Update Post Grid and Gutenberg Blocks – ComboBlocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 5, 2026Gallery : FooGallery: Stored Cross-Site ScriptingCVE-2026-85414 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Gallery : FooGallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'custom_settings' Shortcode Attribute in all versions up to, and including, 3.3.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Gallery : FooGallery
Affected
up to 3.3.2
What to do
Affects up to 3.3.2. Update Gallery : FooGallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 5, 2026Contact Form by Supsystic: Stored Cross-Site ScriptingCVE-2026-83625 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Contact Form by Supsystic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via IP Address Header in all versions up to, and including, 1.10.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. An unauthenticated attacker can first call the 'updateNonce' action — which is accessible without authentication due to its absence from the plugin's permission list — to obtain a valid nonce, then submit a contact form with a malicious payload in a spoofed IP header such as X-Forwarded-For.
Product
Contact Form by Supsystic
Affected
up to 1.10.2
What to do
Affects up to 1.10.2. Update Contact Form by Supsystic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. The WordPress, CMS and hosting-panel entries come from the National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan and others); we show who. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Start a project

Tell us what you're building.

A website, a booking system, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.

01The person who'll build it writes back

02A planning call, then a written plan with the price and the date

03A preview on your phone while it's being built

04Launch night handled: redirects, email, Google

843-331-6339

Not ready to talk yet? Run the free website check and see what Google sees.