Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
14,013 results · page 64 of 281
Sep 3, 2026LearnPress WordPress Plugin before 4.4.6 contains a broken object-level authorization vulnerability that allows authenticated attackers with the Instructor roleCVE-2026-82023 · WordPress plugins & themes · reported by VulnCheckMedium 5.3
LearnPress WordPress Plugin before 4.4.6 contains a broken object-level authorization vulnerability that allows authenticated attackers with the Instructor role to add answers to quiz questions owned by other instructors by exploiting a missing ownership check on the question answer insert path. Attackers can supply arbitrary question identifiers during answer insertion, bypassing instructor-boundary restrictions to persistently modify quiz content across courses they do not own.
- Fixed in
- 4.4.6
- What to do
- Update the plugin to 4.4.6 or newer.
Sep 3, 2026Supsystic Ultimate Maps by Supsystic: Missing AuthorizationCVE-2026-85309 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Supsystic Ultimate Maps by Supsystic allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Ultimate Maps by Supsystic: from n/a through 1.5.3.
- Product
- Supsystic Ultimate Maps by Supsystic
- Affected
- up to 1.5.3
- What to do
- Affects up to 1.5.3. Update Supsystic Ultimate Maps by Supsystic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 3, 2026Brainstorm Force SureForms: Authorization Bypass Through User-Controlled KeyCVE-2026-85308 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Authorization Bypass Through User-Controlled Key vulnerability in Brainstorm Force SureForms allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects SureForms: from n/a through 2.12.5.
- Product
- Brainstorm Force SureForms
- Affected
- up to 2.12.5
- What to do
- Affects up to 2.12.5. Update Brainstorm Force SureForms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 3, 2026Kevin Pirnie KP Agent Ready: Insertion of Sensitive Information Into Sent DataCVE-2026-85307 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Insertion of Sensitive Information Into Sent Data vulnerability in Kevin Pirnie KP Agent Ready allows Retrieve Embedded Sensitive Data. This issue affects KP Agent Ready: from n/a before 1.2.08.
- Product
- Kevin Pirnie KP Agent Ready
- Fixed in
- 1.2.08
- What to do
- Update Kevin Pirnie KP Agent Ready to 1.2.08 or newer.
Sep 3, 2026Cascadia Web Services MountDev AI MCP Connector for WordPress: Missing AuthorizationCVE-2026-85306 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Cascadia Web Services MountDev AI MCP Connector for WordPress allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects MountDev AI MCP Connector for WordPress: from n/a through 1.6.5.
- Product
- Cascadia Web Services MountDev AI MCP Connector for WordPress
- Affected
- up to 1.6.5
- What to do
- Affects up to 1.6.5. Update Cascadia Web Services MountDev AI MCP Connector for WordPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 3, 2026SEOPress: Server-Side Request Forgery (SSRF)CVE-2026-85305 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Server-Side Request Forgery (SSRF) vulnerability in SEOPress allows Server Side Request Forgery. This issue affects SEOPress: from n/a through 10.1.
- Product
- SEOPress
- Affected
- up to 10.1
- What to do
- Affects up to 10.1. Update SEOPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 3, 2026Unlimited Elements Unlimited Elements For Elementor: Missing AuthorizationCVE-2026-85304 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 2.0.17.
- Product
- Unlimited Elements Unlimited Elements For Elementor
- Affected
- up to 2.0.17
- What to do
- Affects up to 2.0.17. Update Unlimited Elements Unlimited Elements For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 3, 2026Magepeople inc: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-85303 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Magepeople inc. Booking and Rental Manager allows Stored XSS. This issue affects Booking and Rental Manager: from n/a through 2.7.7.
- Product
- Magepeople inc
- Affected
- up to 2.7.7
- What to do
- Affects up to 2.7.7. Update Magepeople inc to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 3, 2026WPKoi WordPress Themes WPKoi Templates for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-85302 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPKoi WordPress Themes WPKoi Templates for Elementor allows DOM-Based XSS. This issue affects WPKoi Templates for Elementor: from n/a through 3.7.2.
- Product
- WPKoi WordPress Themes WPKoi Templates for Elementor
- Affected
- up to 3.7.2
- What to do
- Affects up to 3.7.2. Update WPKoi WordPress Themes WPKoi Templates for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 3, 2026Pre-Orders for WooCommerce <= 2: Unauthenticated BypassCVE-2026-84849 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Bypass Vulnerability in Pre-Orders for WooCommerce <= 2.3 versions.
- Product
- Pre-Orders for WooCommerce <= 2
- What to do
- Update Pre-Orders for WooCommerce <= 2 to the newest version.
Sep 3, 2026Unauthenticated Cross Site Scripting (XSS) in Quick Event Manager <= 9.17 versions.CVE-2026-84848 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Quick Event Manager <= 9.17 versions.
- What to do
- Update the plugin to the newest version.
Sep 3, 2026Unauthenticated Broken Access Control in Quick Event Manager <= 9.17 versions.CVE-2026-84847 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in Quick Event Manager <= 9.17 versions.
- What to do
- Update the plugin to the newest version.
Sep 3, 2026Subscriber Insecure Direct Object References (IDOR) in WC Ukraine Shipping <= 1.22.3 versions.CVE-2026-84836 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Subscriber Insecure Direct Object References (IDOR) in WC Ukraine Shipping <= 1.22.3 versions.
- What to do
- Update the plugin to the newest version.
Sep 3, 2026Unauthenticated PHP Object Injection in JobSearch <= 3.2.0 versions.CVE-2026-84834 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in JobSearch <= 3.2.0 versions.
- What to do
- Update the plugin to the newest version.
Sep 3, 2026Subscriber Privilege Escalation in Bricksforge <= 3.1.8.8 versions.CVE-2026-84814 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Subscriber Privilege Escalation in Bricksforge <= 3.1.8.8 versions.
- What to do
- Update the plugin to the newest version.
Sep 3, 2026Unauthenticated SQL Injection in GeoDirectory <= 2.8.174 versions.CVE-2026-84813 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in GeoDirectory <= 2.8.174 versions.
- What to do
- Update the plugin to the newest version.
Sep 3, 2026Unauthenticated Cross Site Scripting (XSS) in BP Better Messages <= 2.15.27 versions.CVE-2026-84812 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in BP Better Messages <= 2.15.27 versions.
- What to do
- Update the plugin to the newest version.
Sep 3, 2026Subscriber Broken Access Control in Agentimus – AI SEO, llms.txt & MCP for AI Agents <= 1.51.0 versions.CVE-2026-84779 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Subscriber Broken Access Control in Agentimus – AI SEO, llms.txt & MCP for AI Agents <= 1.51.0 versions.
- What to do
- Update the plugin to the newest version.
Sep 3, 2026Unauthenticated Denial of Service Attack in Migrate Guru – Site Migration & Cloning <= 6.65 versions.CVE-2026-84778 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Denial of Service Attack in Migrate Guru – Site Migration & Cloning <= 6.65 versions.
- What to do
- Update the plugin to the newest version.
Sep 3, 2026Unauthenticated Broken Authentication in Really Simple SSL <= 9.8.0 versions.CVE-2026-84777 · WordPress plugins & themes · reported by PatchstackHigh 7.4
Unauthenticated Broken Authentication in Really Simple SSL <= 9.8.0 versions.
- What to do
- Update the plugin to the newest version.
Sep 3, 2026Unauthenticated Denial of Service Attack in MalCare Security <= 6.69 versions.CVE-2026-84776 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Denial of Service Attack in MalCare Security <= 6.69 versions.
- What to do
- Update the plugin to the newest version.
Sep 3, 2026Unauthenticated Cross Site Scripting (XSS) in WP Statistics <= 14.16.11 versions.CVE-2026-84774 · WordPress plugins & themes · reported by PatchstackMedium 6.1
Unauthenticated Cross Site Scripting (XSS) in WP Statistics <= 14.16.11 versions.
- What to do
- Update the plugin to the newest version.
Sep 3, 2026Unauthenticated Cross Site Scripting (XSS) in EWWW Image Optimizer <= 8.7.6 versions.CVE-2026-84773 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Unauthenticated Cross Site Scripting (XSS) in EWWW Image Optimizer <= 8.7.6 versions.
- What to do
- Update the plugin to the newest version.
Sep 3, 2026Unauthenticated Insecure Direct Object References (IDOR) in Business Directory <= 6.4.26 versions.CVE-2026-84769 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Insecure Direct Object References (IDOR) in Business Directory <= 6.4.26 versions.
- What to do
- Update the plugin to the newest version.
Sep 3, 2026Unauthenticated SQL Injection in VikAppointments Services Booking Calendar <= 1.2.20 versions.CVE-2026-84768 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in VikAppointments Services Booking Calendar <= 1.2.20 versions.
- What to do
- Update the plugin to the newest version.
Sep 3, 2026BookIt <= 2: Unauthenticated BypassCVE-2026-84767 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Bypass Vulnerability in BookIt <= 2.6.0.3 versions.
- Product
- BookIt <= 2
- What to do
- Update BookIt <= 2 to the newest version.
Sep 3, 2026FluentBooking Pro <= 2: Unauthenticated BypassCVE-2026-84766 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Unauthenticated Bypass Vulnerability in FluentBooking Pro <= 2.2.1 versions.
- Product
- FluentBooking Pro <= 2
- What to do
- Update FluentBooking Pro <= 2 to the newest version.
Sep 3, 2026Unauthenticated Cross Site Scripting (XSS) in Breadcrumb NavXT <= 7.5.1 versions.CVE-2026-84765 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Breadcrumb NavXT <= 7.5.1 versions.
- What to do
- Update the plugin to the newest version.
Sep 3, 2026Unauthenticated Cross Site Scripting (XSS) in RTMKit <= 2.1.5 versions.CVE-2026-84763 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in RTMKit <= 2.1.5 versions.
- What to do
- Update the plugin to the newest version.
Sep 3, 2026WP EasyPay <= 4: Unauthenticated BypassCVE-2026-84762 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Bypass Vulnerability in WP EasyPay <= 4.5.3 versions.
- Product
- WP EasyPay <= 4
- What to do
- Update WP EasyPay <= 4 to the newest version.
Sep 3, 2026Unauthenticated Server Side Request Forgery (SSRF) in LiteSpeed Cache <= 7.9 versions.CVE-2026-84761 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Unauthenticated Server Side Request Forgery (SSRF) in LiteSpeed Cache <= 7.9 versions.
- What to do
- Update the plugin to the newest version.
Sep 3, 2026Unauthenticated Broken Access Control in Business Directory <= 6.4.26 versions.CVE-2026-84758 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Broken Access Control in Business Directory <= 6.4.26 versions.
- What to do
- Update the plugin to the newest version.
Sep 3, 2026Unauthenticated Settings Change in WP Compress <= 7.21.28 versions.CVE-2026-84757 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Unauthenticated Settings Change in WP Compress <= 7.21.28 versions.
- What to do
- Update the plugin to the newest version.
Sep 3, 2026Subscriber Privilege Escalation in WCFM Membership <= 2.11.11 versions.CVE-2026-84756 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Subscriber Privilege Escalation in WCFM Membership <= 2.11.11 versions.
- What to do
- Update the plugin to the newest version.
Sep 3, 2026Unauthenticated Broken Access Control in Mail Mint <= 1.31.0 versions.CVE-2026-84755 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Broken Access Control in Mail Mint <= 1.31.0 versions.
- What to do
- Update the plugin to the newest version.
Sep 3, 2026Unauthenticated Broken Access Control in WPFunnels <= 3.12.13 versions.CVE-2026-84754 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Broken Access Control in WPFunnels <= 3.12.13 versions.
- What to do
- Update the plugin to the newest version.
Sep 3, 2026Unauthenticated PHP Object Injection in Mail Mint <= 1.31.0 versions.CVE-2026-84753 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in Mail Mint <= 1.31.0 versions.
- What to do
- Update the plugin to the newest version.
Sep 3, 2026Contributor PHP Object Injection in RTMKit <= 2.1.5 versions.CVE-2026-84752 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Contributor PHP Object Injection in RTMKit <= 2.1.5 versions.
- What to do
- Update the plugin to the newest version.
Sep 3, 2026Unauthenticated Broken Access Control in YITH Request a Quote for WooCommerce Premium < 4.46.0 versions.CVE-2026-84238 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated Broken Access Control in YITH Request a Quote for WooCommerce Premium < 4.46.0 versions.
- What to do
- Update the plugin to the newest version.
Sep 3, 2026Unauthenticated Broken Access Control in Timetics <= 1.0.61 versions.CVE-2026-84215 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Broken Access Control in Timetics <= 1.0.61 versions.
- What to do
- Update the plugin to the newest version.
Sep 3, 2026Unauthenticated Cross Site Scripting (XSS) in WP QuickLaTeX <= 3.8.8 versions.CVE-2026-81776 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in WP QuickLaTeX <= 3.8.8 versions.
- What to do
- Update the plugin to the newest version.
Sep 3, 2026Unauthenticated Cross Site Scripting (XSS) in Ninja Forms File Uploads Extension <= 3.3.26 versions.CVE-2026-81773 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Ninja Forms File Uploads Extension <= 3.3.26 versions.
- What to do
- Update the plugin to the newest version.
Sep 3, 2026Unauthenticated Cross Site Scripting (XSS) in Calculation For Contact Form 7 <= 1.0 versions.CVE-2026-81300 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Calculation For Contact Form 7 <= 1.0 versions.
- What to do
- Update the plugin to the newest version.
Sep 3, 2026Unauthenticated Cross Site Scripting (XSS) in Under Construction <= 5.82 versions.CVE-2026-81295 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Under Construction <= 5.82 versions.
- What to do
- Update the plugin to the newest version.
Sep 3, 2026Unauthenticated Cross Site Scripting (XSS) in Simple Payment <= 2.5.1 versions.CVE-2026-81292 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Simple Payment <= 2.5.1 versions.
- What to do
- Update the plugin to the newest version.
Sep 3, 2026Subscriber Cross Site Scripting (XSS) in Product Variations Swatches for WooCommerce <= 1.1.18 versions.CVE-2026-81282 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Subscriber Cross Site Scripting (XSS) in Product Variations Swatches for WooCommerce <= 1.1.18 versions.
- What to do
- Update the plugin to the newest version.
Sep 3, 2026Subscriber Cross Site Scripting (XSS) in Graphene <= 2.9.4 versions.CVE-2026-81281 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Subscriber Cross Site Scripting (XSS) in Graphene <= 2.9.4 versions.
- What to do
- Update the plugin to the newest version.
Sep 3, 2026Kriesi Enfold: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-84815 · WordPress plugins & themes · reported by PatchstackMedium 5.8
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kriesi Enfold allows Reflected XSS. This issue affects Enfold: from n/a through 8.0.
- Product
- Kriesi Enfold
- Affected
- up to 8.0
- What to do
- Affects up to 8.0. Update Kriesi Enfold to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 3, 2026Joomla Extension - feenders.de - Unauthenticated SQL injection in JooDatabase Lite < 5.1.0 - The cid parameter is used in queries without validation, allowing SCVE-2026-78080 · Websites & servers · reported by security@joomla.orgCritical 9.3
Joomla Extension - feenders.de - Unauthenticated SQL injection in JooDatabase Lite < 5.1.0 - The cid parameter is used in queries without validation, allowing SQLi vectors.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2026Joomla Extension - j2commerce.com - Missing authorization on Apps controller delegation chain in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6 - `J2StoreContrCVE-2026-78069 · Websites & servers · reported by security@joomla.orgCritical 9.5
Joomla Extension - j2commerce.com - Missing authorization on Apps controller delegation chain in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6 - `J2StoreControllerApps`'s `appTask` delegation path instantiates app-plugin controllers with no ACL check anywhere in the code. It currently returns 403 only as a side effect of `fof.xml`'s wildcard-deny resolving under the singularised ACL key `app`, which has no explicit allow rule — not because of any deliberate check. Behind that path, `applocalizationdata::getInstallerTool()` used a caller-influenced table name with no allow-list, both to select a `#__j2store_*` table for truncation and to build a path to SQL files it then executes — a path-traversal-capable file read/execute.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. The WordPress, CMS and hosting-panel entries come from the National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan and others); we show who. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, a booking system, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.