Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
13,998 results · page 62 of 280
Sep 5, 2026Abandoned Cart Pro for WooCommerce: Privilege EscalationCVE-2026-81543 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 10.7.1. This is due to missing capability checks and nonce verification on multiple AJAX actions including wcap_save_connector_settings, wcap_send_manual_email, wcap_abandoned_cart_info, and wcap_change_manual_email_data. This makes it possible for authenticated attackers, with subscriber-level access and above, to modify SMTP connector settings to route administrator recovery emails through an attacker-controlled server and intercept auto-login links to gain full administrative access. The plugin's auto-login feature must be enabled, which is the default configuration.
- Product
- Abandoned Cart Pro for WooCommerce
- Affected
- up to 10.7.1
- What to do
- Affects up to 10.7.1. Update Abandoned Cart Pro for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 5, 2026Unlimited Elements For Elementor: Reflected Cross-Site ScriptingCVE-2026-75586 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Unlimited Elements For Elementor plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'formData[id]' Parameter in all versions up to, and including, 2.0.17 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. The front-end AJAX handler is registered on the public 'wp' action with no nonce, capability, or referer check, and the raw attacker-controlled id value is interpolated verbatim into an exception message that is echoed back without escaping; when the response is served as text/html rather than application/json, the browser parses the injected markup.
- Product
- Unlimited Elements For Elementor
- Affected
- up to 2.0.17
- What to do
- Affects up to 2.0.17. Update Unlimited Elements For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 5, 2026Custom Contact Forms: Authorization bypassCVE-2026-75018 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Custom Contact Forms plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.16. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to permanently force-delete arbitrary posts of any post type (including pages, administrator-authored posts, and WooCommerce products) and write arbitrary ccf_field_* post meta onto any post regardless of ownership or post type. The top-level form ID is checked via edit_post/publish_posts, but the nested fields[].ID and choices[].ID paths processed by _create_and_map_fields() and _create_and_map_choices() carry no equivalent capability or post-type guard, leaving those sinks fully exposed while delete_item() and delete_submission() contain explicit post-type restriction fixes demonstrating the developer's awareness of scoping requirements.
- Product
- Custom Contact Forms
- Affected
- up to 7.16
- What to do
- Affects up to 7.16. Update Custom Contact Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 5, 2026Video Player for YouTube: Does not properly sanitise and escape user-supplied input before using it in a SQL statementCVE-2026-84937 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Video Player for YouTube WordPress plugin before 2.1.0 does not properly sanitise and escape user-supplied input before using it in a SQL statement, allowing users with the Contributor role and above to perform SQL injection attacks and read arbitrary data from the database.
- Product
- Video Player for YouTube
- Fixed in
- 2.1.0
- What to do
- Update Video Player for YouTube to 2.1.0 or newer.
Sep 5, 2026EmbedPress: Does not have proper authorization on a public review-loading actionCVE-2026-84936 · WordPress plugins & themes · reported by WPScanMedium 5.3
The EmbedPress WordPress plugin before 4.6.4 does not have proper authorization on a public review-loading action, allowing unauthenticated users to force the site to make repeated billable third-party API requests using the site's own configured API key, and to create an unbounded number of attacker-controlled rows in the database.
- Product
- EmbedPress
- Fixed in
- 4.6.4
- What to do
- Update EmbedPress to 4.6.4 or newer.
Sep 5, 2026HT Menu: Does not perform any capability or object-ownership checkCVE-2026-84935 · WordPress plugins & themes · reported by WPScanHigh 8
The HT Menu WordPress plugin before 1.2.7 does not perform any capability or object-ownership check when saving navigation menu-item settings, and does not escape those stored settings when the menu is rendered, allowing users with minimal permissions such as Subscribers to store JavaScript that executes in the browser of any visitor, administrators included, who views the affected menu.
- Product
- HT Menu
- Fixed in
- 1.2.7
- What to do
- Update HT Menu to 1.2.7 or newer.
Sep 5, 2026JCH Optimize: Does not perform a capability check on one of its authenticated AJAX actions and lets the request chooseCVE-2026-84934 · WordPress plugins & themes · reported by WPScanHigh 8
The JCH Optimize WordPress plugin before 6.0.1 does not perform a capability check on one of its authenticated AJAX actions and lets the request choose which internal action runs, allowing any authenticated users such as Subscribers to import arbitrary JCH Optimize WordPress plugin before 6.0.1 settings and store a script that executes in the browser of any visitor or administrator viewing the site.
- Product
- JCH Optimize
- Fixed in
- 6.0.1
- What to do
- Update JCH Optimize to 6.0.1 or newer.
Sep 5, 2026Joli Table Of Contents: Does not sanitise or escape a shortcode attribute value before outputting it inside an HTML element's attributeCVE-2026-84931 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Joli Table Of Contents WordPress plugin before 3.0.3 does not sanitise or escape a shortcode attribute value before outputting it inside an HTML element's attribute, allowing users with the Author role and above to inject arbitrary HTML attributes and JavaScript that execute in the browser of any user who views the post, including higher-privileged users such as administrators. This crosses a privilege boundary even on multisite, where such users are not permitted to post unfiltered HTML.
- Product
- Joli Table Of Contents
- Fixed in
- 3.0.3
- What to do
- Update Joli Table Of Contents to 3.0.3 or newer.
Sep 5, 2026CatFolders Document Gallery & PDF Library: Does not properly validate a block attribute before using itCVE-2026-84930 · WordPress plugins & themes · reported by WPScanMedium 6.8
The CatFolders Document Gallery & PDF Library WordPress plugin before 2.0.7 does not properly validate a block attribute before using it as an HTML tag name in its gallery output, allowing users with the Author role and above to inject arbitrary web scripts that execute in the browser of anyone who views the affected post.
- Product
- CatFolders Document Gallery & PDF Library
- Fixed in
- 2.0.7
- What to do
- Update CatFolders Document Gallery & PDF Library to 2.0.7 or newer.
Sep 5, 2026EmbedPress: Does not perform a sufficient authorization check on one of its Google Reviews REST API routesCVE-2026-84927 · WordPress plugins & themes · reported by WPScanLow 2.7
The EmbedPress WordPress plugin before 4.6.4 does not perform a sufficient authorization check on one of its Google Reviews REST API routes, allowing users with the Contributor role and above to modify a site-wide store, deleting entries an administrator configured and injecting their own, which are rendered publicly across the site.
- Product
- EmbedPress
- Fixed in
- 4.6.4
- What to do
- Update EmbedPress to 4.6.4 or newer.
Sep 5, 2026EmbedPress: Does not correctly restrict access to one of its Google Reviews REST routes to administratorsCVE-2026-84926 · WordPress plugins & themes · reported by WPScanLow 2.7
The EmbedPress WordPress plugin before 4.6.4 does not correctly restrict access to one of its Google Reviews REST routes to administrators, allowing any authenticated user with contributor-level access or above to read the site administrator's email address, a value WordPress core withholds from that role.
- Product
- EmbedPress
- Fixed in
- 4.6.4
- What to do
- Update EmbedPress to 4.6.4 or newer.
Sep 5, 2026Eventin: Does not properly check authorization on several of its event-management REST routesCVE-2026-84901 · WordPress plugins & themes · reported by WPScanMedium 4.9
The Eventin WordPress plugin before 4.1.22 does not properly check authorization on several of its event-management REST routes, allowing users with contributor-level access and above to change the site's front-page setting to an event they do not own and to create, edit and delete global event and speaker taxonomy terms they should not be able to manage.
- Product
- Eventin
- Fixed in
- 4.1.22
- What to do
- Update Eventin to 4.1.22 or newer.
Sep 5, 2026VikWidgetsLoader: Does not sanitise or escape a block attribute before outputting it inside an inline scriptCVE-2026-84899 · WordPress plugins & themes · reported by WPScanMedium 6.8
The VikWidgetsLoader WordPress plugin before 1.12.0 does not sanitise or escape a block attribute before outputting it inside an inline script, allowing users with the Contributor role to store arbitrary JavaScript that executes in the browser of any user viewing the affected post, including the administrator who reviews the pending submission.
- Product
- VikWidgetsLoader
- Fixed in
- 1.12.0
- What to do
- Update VikWidgetsLoader to 1.12.0 or newer.
Sep 5, 2026Eventin: Does not properly validate a template path value before using it to include a local fileCVE-2026-84898 · WordPress plugins & themes · reported by WPScanMedium 6.6
The Eventin WordPress plugin before 4.1.21 does not properly validate a template path value before using it to include a local file, allowing users with contributor-level access and above to include and execute arbitrary local PHP files.
- Product
- Eventin
- Fixed in
- 4.1.21
- What to do
- Update Eventin to 4.1.21 or newer.
Sep 5, 2026King Addons for Elementor: Does not escape a widget display-style setting before outputting it in an HTML attributeCVE-2026-84896 · WordPress plugins & themes · reported by WPScanMedium 6.8
The King Addons for Elementor WordPress plugin before 51.1.77 does not escape a widget display-style setting before outputting it in an HTML attribute, allowing users with Contributor-level access and above to store JavaScript that executes in the browser of any visitor to the affected page, including logged-in administrators.
- Product
- King Addons for Elementor
- Fixed in
- 51.1.77
- What to do
- Update King Addons for Elementor to 51.1.77 or newer.
Sep 5, 2026Events Calendar: Does not restrict non-public content to the users entitled to read it on its public REST archivesCVE-2026-84745 · WordPress plugins & themes · reported by WPScanLow 2.7
The Events Calendar WordPress plugin before 6.17.3.1 does not restrict non-public content to the users entitled to read it on its public REST archives, allowing users with a low-privilege role such as contributor to read the full contents of every unpublished record on the site, including other users'.
- Product
- Events Calendar
- Fixed in
- 6.17.3.1
- What to do
- Update Events Calendar to 6.17.3.1 or newer.
Sep 5, 2026Kirki: Does not check that a user is allowed to act on a collaboration comment before changing its stateCVE-2026-84225 · WordPress plugins & themes · reported by WPScanLow 2.2
The Kirki WordPress plugin before 6.3.0 does not check that a user is allowed to act on a collaboration comment before changing its state, allowing users whom an administrator has granted content-level access to the page builder to modify comments left by other users, including on pages they cannot themselves open.
- Product
- Kirki
- Fixed in
- 6.3.0
- What to do
- Update Kirki to 6.3.0 or newer.
Sep 5, 2026Kirki: Does not escape a user-supplied identifier before using it in a SQL queryCVE-2026-84221 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Kirki WordPress plugin before 6.3.0 does not escape a user-supplied identifier before using it in a SQL query, allowing users with editor-level access and above to append arbitrary SQL and read the contents of the database, including user credentials.
- Product
- Kirki
- Fixed in
- 6.3.0
- What to do
- Update Kirki to 6.3.0 or newer.
Sep 5, 2026Bold Page Builder: Does not sanitise and escape several shortcode attributes before outputting them in HTML attributesCVE-2026-84022 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Bold Page Builder WordPress plugin before 5.9.8 does not sanitise and escape several shortcode attributes before outputting them in HTML attributes, allowing users with the Contributor role and above to inject arbitrary web scripts that execute when a user views the affected page.
- Product
- Bold Page Builder
- Fixed in
- 5.9.8
- What to do
- Update Bold Page Builder to 5.9.8 or newer.
Sep 5, 2026Bold Page Builder: Does not properly validate a link URL before outputting it in an HTML attributeCVE-2026-84021 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Bold Page Builder WordPress plugin before 5.9.8 does not properly validate a link URL before outputting it in an HTML attribute, relying on a filter that can be evaded, allowing users with the Contributor role and above to inject arbitrary web scripts that execute when a user clicks the affected link.
- Product
- Bold Page Builder
- Fixed in
- 5.9.8
- What to do
- Update Bold Page Builder to 5.9.8 or newer.
Sep 5, 2026Greenshift: Does not properly escape a block animation attribute before outputting it within an HTML attributeCVE-2026-83544 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Greenshift WordPress plugin before 13.2.0 does not properly escape a block animation attribute before outputting it within an HTML attribute, allowing users with contributor-level access and above to inject arbitrary web scripts that execute when the content is viewed.
- Product
- Greenshift
- Fixed in
- 13.2.0
- What to do
- Update Greenshift to 13.2.0 or newer.
Sep 5, 2026Greenshift: Does not validate a user-supplied URL before fetching it server-sideCVE-2026-83543 · WordPress plugins & themes · reported by WPScanMedium 4.1
The Greenshift WordPress plugin before 13.2.0 does not validate a user-supplied URL before fetching it server-side, allowing users with contributor-level access and above to make the server issue requests to arbitrary hosts and read the response.
- Product
- Greenshift
- Fixed in
- 13.2.0
- What to do
- Update Greenshift to 13.2.0 or newer.
Sep 5, 2026Masteriyo LMS: Does not sanitise and escape some course settings before outputting them in a page available to all visitorsCVE-2026-82846 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Masteriyo LMS WordPress plugin before 3.4.0 does not sanitise and escape some course settings before outputting them in a page available to all visitors, allowing users with a course-author role to perform Stored Cross-Site Scripting attacks that run in the session of anyone viewing the course, including a logged-in administrator.
- Product
- Masteriyo LMS
- Fixed in
- 3.4.0
- What to do
- Update Masteriyo LMS to 3.4.0 or newer.
Sep 5, 2026Music Store: Does not sanitise and escape user input before using it in a SQL statementCVE-2026-82304 · WordPress plugins & themes · reported by WPScanHigh 8.6
The Music Store WordPress plugin before 1.4.5 does not sanitise and escape user input before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users.
- Product
- Music Store
- Fixed in
- 1.4.5
- What to do
- Update Music Store to 1.4.5 or newer.
Sep 5, 2026Accept Stripe Payments: Does not verify that the product fulfilledCVE-2026-81424 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Accept Stripe Payments WordPress plugin before 2.1.4 does not verify that the product fulfilled when a checkout is completed matches the product the authoritative payment was actually made for, checking only that the amount paid is at least the referenced product's price, allowing unauthenticated attackers who complete a genuine payment to obtain fulfilment for a different, equal- or lower-priced product than the one they paid for.
- Product
- Accept Stripe Payments
- Fixed in
- 2.1.4
- What to do
- Update Accept Stripe Payments to 2.1.4 or newer.
Sep 5, 2026Accept Stripe Payments: Does not validate a user-supplied URL before using it in a redirectCVE-2026-81423 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Accept Stripe Payments WordPress plugin before 2.1.4 does not validate a user-supplied URL before using it in a redirect, allowing unauthenticated attackers to redirect visitors to an arbitrary external website, which can be leveraged for phishing.
- Product
- Accept Stripe Payments
- Fixed in
- 2.1.4
- What to do
- Update Accept Stripe Payments to 2.1.4 or newer.
Sep 5, 2026IPGP Visitors Origin: Does not sanitise or escape user input before reflecting it back in the HTTP responseCVE-2026-81404 · WordPress plugins & themes · reported by WPScanHigh 7.1
The IPGP Visitors Origin WordPress plugin before 1.6 does not sanitise or escape user input before reflecting it back in the HTTP response, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting attacks against users who are tricked into submitting a crafted request.
- Product
- IPGP Visitors Origin
- Fixed in
- 1.6
- What to do
- Update IPGP Visitors Origin to 1.6 or newer.
Sep 5, 2026My Private Site: Does not apply its site-privacy access control to certain unauthenticated front-end read surfacesCVE-2026-81348 · WordPress plugins & themes · reported by WPScanLow 3.7
The My Private Site WordPress plugin before 4.2.3 does not apply its site-privacy access control to certain unauthenticated front-end read surfaces, allowing unauthenticated users to view post content, comments and post URLs from a site the administrator placed behind mandatory login.
- Product
- My Private Site
- Fixed in
- 4.2.3
- What to do
- Update My Private Site to 4.2.3 or newer.
Sep 5, 2026W3 Total Cache: Stored Cross-Site ScriptingCVE-2026-78438 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via LazyLoad Background Mutator in all versions up to, and including, 2.10.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the "Lazy Load Images" feature with "Process background images" to be enabled, and the malicious comment to be approved by a moderator before execution is triggered.
- Product
- W3 Total Cache
- Affected
- up to 2.10.5
- What to do
- Affects up to 2.10.5. Update W3 Total Cache to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 5, 2026SEO Flow by LupsOnline: Does not correctly validate the credential supplied with its API requestsCVE-2026-78362 · WordPress plugins & themes · reported by WPScanCritical 9.8
The SEO Flow by LupsOnline WordPress plugin before 3.0.3 does not correctly validate the credential supplied with its API requests, allowing unauthenticated users to be served as the administrator who configured the SEO Flow by LupsOnline WordPress plugin before 3.0.3 and take over the site. Exploitation requires the SEO Flow by LupsOnline WordPress plugin before 3.0.3 to have been configured, which is its normal operating state.
- Product
- SEO Flow by LupsOnline
- Fixed in
- 3.0.3
- What to do
- Update SEO Flow by LupsOnline to 3.0.3 or newer.
Sep 5, 2026Smart Post: Does not check the typeCVE-2026-78150 · WordPress plugins & themes · reported by WPScanLow 2.7
The Smart Post WordPress plugin before 4.0.8 does not check the type, ownership or status of the post it is asked to duplicate, allowing users with contributor privileges and above to copy any private or password protected post into a draft of their own and read its content and metadata.
- Product
- Smart Post
- Fixed in
- 4.0.8
- What to do
- Update Smart Post to 4.0.8 or newer.
Sep 5, 2026Smart Post: Does not check whether a post is password protected before returning its content and its stored password through an unauthenticated AJAX actionCVE-2026-78149 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Smart Post WordPress plugin before 4.0.8 does not check whether a post is password protected before returning its content and its stored password through an unauthenticated AJAX action, allowing unauthenticated users to read protected post content and the password that guards it.
- Product
- Smart Post
- Fixed in
- 4.0.8
- What to do
- Update Smart Post to 4.0.8 or newer.
Sep 5, 2026Spam protection, Honeypot, Anti-Spam by CleanTalk: Stored Cross-Site ScriptingCVE-2026-77830 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Spam protection, Honeypot, Anti-Spam by CleanTalk plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content aria-label Placeholder in all versions up to, and including, 6.86 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with custom-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload is deliverable via unauthenticated comment submission and executes exclusively for non-logged-in visitors; if comment moderation is enabled, an approving moderator must first publish the comment before the script reaches other users.
- Product
- Spam protection, Honeypot, Anti-Spam by CleanTalk
- Affected
- up to 6.86
- What to do
- Affects up to 6.86. Update Spam protection, Honeypot, Anti-Spam by CleanTalk to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 5, 2026RegistrationMagic: Does not verifyCVE-2026-77826 · WordPress plugins & themes · reported by WPScanHigh 8.8
The RegistrationMagic WordPress plugin before 6.0.9.9 does not verify which application a Facebook access token was issued to before accepting it as proof of identity, allowing unauthenticated attackers to log in as an existing user whose token they can obtain, or to create and log into a new account even when user registration is disabled.
- Product
- RegistrationMagic
- Fixed in
- 6.0.9.9
- What to do
- Update RegistrationMagic to 6.0.9.9 or newer.
Sep 5, 2026Divi: Server-Side Request ForgeryCVE-2026-4361 · WordPress plugins & themes · reported by WordfenceMedium 5
The Divi theme for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.27.6. This is due to the `et_pb_set_video_oembed_thumbnail_resolution()` function using `wp_remote_get()` instead of `wp_safe_remote_get()` to fetch a remote image URL, which does not restrict requests to private or reserved IP ranges. This makes it possible for authenticated attackers, with Contributor-level access and above, to make web requests to arbitrary locations originating from the web application server. The response body is not returned to the attacker (blind SSRF), but two oracles exist: a status oracle (the returned URL string differs depending on whether the target responded with HTTP 200) and a timing oracle (response time varies by target reachability).
- Product
- Divi
- Affected
- up to 4.27.6
- What to do
- Affects up to 4.27.6. Update Divi to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 5, 2026Divi: DOM-Based Stored Cross-Site ScriptingCVE-2026-3853 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Divi theme for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via the `image_src` attribute of the `et_pb_video_slider_item` shortcode in all versions up to, and including, 4.27.6. This is due to the `image_src` field not being included in the `$url_options` whitelist (which only contains `url`, `button_link`, `button_url`), so it never receives `esc_url_raw()` at save time. On the server side, the value is rendered into a `data-image` HTML attribute using `esc_attr()`, which encodes double quotes as `"`. However, the client-side JavaScript carousel code in `custom.unified.js` reads this attribute using jQuery's `.data('image')`, which returns the browser-decoded value (with `"` decoded back to `"`). The decoded value is then concatenated directly into an HTML string and injected into the DOM via `jQuery.after()` without re-escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user hovers over the carousel thumbnail.
- Product
- Divi
- Affected
- up to 4.27.6
- What to do
- Affects up to 4.27.6. Update Divi to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 5, 2026Welcart e-Commerce: PHP Object InjectionCVE-2026-19887 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Welcart e-Commerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.12.1 via deserialization of untrusted input in the Telecom EDY payment callback (usces_action_acting_transaction). Unauthenticated attackers can store arbitrary 'reserve' key/value pairs as order metadata during a public checkout, then invoke the callback with an attacker-chosen 'option' parameter to select and unserialize that metadata without any provider signature, source-address, transaction-identity or ownership check. A POP chain is present in the TCPDF library bundled with the plugin itself, so no additional plugin or theme is required. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, including wp-config.php, which can lead to remote code execution when an attacker re-runs the WordPress installer against a database they control. Successful exploitation is contingent on an admin printing an invoice to trigger file deletion.
- Product
- Welcart e-Commerce
- Affected
- up to 2.12.1
- What to do
- Affects up to 2.12.1. Update Welcart e-Commerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 5, 2026JetFormBuilder — Dynamic Blocks Form Builder: Does not properly sanitise and escape a form field's value before including it in the HTML notification emails it sendsCVE-2026-19861 · WordPress plugins & themes · reported by WPScanMedium 4.7
The JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin before 3.6.5.2 does not properly sanitise and escape a form field's value before including it in the HTML notification emails it sends, allowing unauthenticated users to inject arbitrary HTML into messages delivered to administrators and other recipients. Whether injected script executes depends on the recipient's mail client, but the injected markup is rendered regardless.
- Product
- JetFormBuilder — Dynamic Blocks Form Builder
- Fixed in
- 3.6.5.2
- What to do
- Update JetFormBuilder — Dynamic Blocks Form Builder to 3.6.5.2 or newer.
Sep 5, 2026JetFormBuilder — Dynamic Blocks Form Builder: Does not perform authorisation checksCVE-2026-19858 · WordPress plugins & themes · reported by WPScanHigh 7.5
The JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin before 3.6.5.2 does not perform authorisation checks when resolving request-derived data during page rendering, allowing unauthenticated users to read arbitrary user, post and term properties and metadata, including password hashes, private and draft content, and secrets other JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin before 3.6.5.2 store in metadata.
- Product
- JetFormBuilder — Dynamic Blocks Form Builder
- Fixed in
- 3.6.5.2
- What to do
- Update JetFormBuilder — Dynamic Blocks Form Builder to 3.6.5.2 or newer.
Sep 5, 2026Ninja Forms – The Contact Form Builder That Grows With You: Stored Cross-Site ScriptingCVE-2026-19769 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Repeater Child 'type' Confusion via Unmatched Array Key in all versions up to, and including, 3.15.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the Ninja Forms File Uploads add-on to be active, as the attack routes the unwhitelisted child entry through the File Uploads handler to write an attacker-supplied HTML file containing arbitrary JavaScript into any web-server-writable directory, including the site root, where it is served from the site's own origin.
- Product
- Ninja Forms – The Contact Form Builder That Grows With You
- Affected
- up to 3.15.1
- What to do
- Affects up to 3.15.1. Update Ninja Forms – The Contact Form Builder That Grows With You to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 5, 2026Beaver Builder Plugin (Starter Version): Reflected Cross-Site ScriptingCVE-2026-18843 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Beaver Builder Plugin (Starter Version) plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'no_results_message' node_preview Parameter in all versions up to, and including, 2.11.0.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- Beaver Builder Plugin (Starter Version)
- Affected
- up to 2.11.0.1
- What to do
- Affects up to 2.11.0.1. Update Beaver Builder Plugin (Starter Version) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 5, 2026SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz: Stored Cross-Site ScriptingCVE-2026-18406 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Text Field Entity-Encoded Payload in all versions up to, and including, 2.12.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz
- Affected
- up to 2.12.2
- What to do
- Affects up to 2.12.2. Update SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 5, 2026Gravity Forms: Stored Cross-Site ScriptingCVE-2026-16649 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Post Body Field Value in all versions up to, and including, 2.10.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit survives save-time sanitization because wp_kses_post allows the required HTML tags and attributes, and the client-side tooltip script re-parses the browser-decoded aria-label value as innerHTML while only stripping script elements, leaving onerror and other event-handler attributes fully intact and executable.
- Product
- Gravity Forms
- Affected
- up to 2.10.5
- What to do
- Affects up to 2.10.5. Update Gravity Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 5, 2026QuickCal: Stored Cross-Site ScriptingCVE-2026-15984 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The QuickCal plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Custom Field Parameters in all versions up to, and including, 1.0.20 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The nonce guarding the unauthenticated booked_add_appt AJAX action is publicly embedded on any page rendering the booking calendar shortcode, making it trivially obtainable by unauthenticated attackers without any prior account or privilege.
- Product
- QuickCal
- Affected
- up to 1.0.20
- What to do
- Affects up to 1.0.20. Update QuickCal to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 5, 2026Search Atlas SEO: Does not perform a nonce or capability check before processing a settings update in one of its early-priority handlersCVE-2026-15247 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Search Atlas SEO WordPress plugin before 2.6.24 does not perform a nonce or capability check before processing a settings update in one of its early-priority handlers, allowing any authenticated user such as a Subscriber to overwrite or delete the site's stored Google service-account credentials.
- Product
- Search Atlas SEO
- Fixed in
- 2.6.24
- What to do
- Update Search Atlas SEO to 2.6.24 or newer.
Sep 5, 2026WP File Download: Directory TraversalCVE-2026-14975 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The WP File Download plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.3.8 via the 'remoteurl' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. An authenticated attacker with Subscriber-level access first poisons the _wpfd_file_metadata['file'] post-meta value via the unprotected file.save handler, after which the streaming endpoint — hooked on init with no authentication requirement — resolves and streams the traversed file path to any caller, including unauthenticated visitors.
- Product
- WP File Download
- Affected
- up to 6.3.8
- What to do
- Affects up to 6.3.8. Update WP File Download to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 5, 2026Joli Table Of Contents: Does not sanitise and escape some of its settings before outputting them in an admin pageCVE-2025-15694 · WordPress plugins & themes · reported by WPScanLow 3.5
The Joli Table Of Contents WordPress plugin before 2.8.1 does not sanitise and escape some of its settings before outputting them in an admin page, which could allow high-privilege users such as administrators to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed, for example in a multisite setup.
- Product
- Joli Table Of Contents
- Fixed in
- 2.8.1
- What to do
- Update Joli Table Of Contents to 2.8.1 or newer.
Sep 5, 2026JCH Optimize: Does not properly restrict a directory path provided to one of its administrative image-browsing features to within the siteCVE-2025-15693 · WordPress plugins & themes · reported by WPScanLow 2.7
The JCH Optimize WordPress plugin before 5.0.1 does not properly restrict a directory path provided to one of its administrative image-browsing features to within the site, allowing high-privilege users, administrators on single-site and sub-site administrators on multisite, to enumerate directories and file names outside the web root.
- Product
- JCH Optimize
- Fixed in
- 5.0.1
- What to do
- Update JCH Optimize to 5.0.1 or newer.
Sep 5, 2026Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer: Stored Cross-Site ScriptingCVE-2026-8625 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post_content (Custom HTML block inner HTML)' parameter in all versions up to, and including, 2.4.30 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. A Contributor-level attacker can insert a crafted .df-element div with data-df-lightbox='thumb' via a Custom HTML block, whose inner HTML is passed as the title argument to parseThumbs() at render time, enabling both innerHTML injection into a span element and attribute breakout via an onerror handler on a constructed img element.
- Product
- Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer
- Affected
- up to 2.4.30
- What to do
- Affects up to 2.4.30. Update Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 5, 2026Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer: Stored Cross-Site ScriptingCVE-2026-8623 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post_content (class attribute of .dvcss element)' parameter in all versions up to, and including, 2.4.30 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload is embedded as a Base64-encoded JSON object in a CSS class name on a Custom HTML block; the frontend parseCSSElements() function decodes it client-side with atob() and JSON.parse() and renders the logo property as raw HTML, meaning no server-side or client-side sanitization intercepts the malicious script before DOM insertion.
- Product
- Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer
- Affected
- up to 2.4.30
- What to do
- Affects up to 2.4.30. Update Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. The WordPress, CMS and hosting-panel entries come from the National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan and others); we show who. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, a booking system, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.