Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
3,989 results · page 7 of 80
Sep 17, 2026RT Mega Menu: Stored Cross-Site ScriptingCVE-2026-14855 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The RT Mega Menu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'css[left]' parameter in all versions up to, and including, 1.5.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- RT Mega Menu
- Affected
- up to 1.5.1
- What to do
- Affects up to 1.5.1. Update RT Mega Menu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 17, 2026Administrator SQL Injection in WPMasterToolKit <= 2.22.0 versions.CVE-2026-66624 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Administrator SQL Injection in WPMasterToolKit <= 2.22.0 versions.
- Affected
- up to 2.22.0
- What to do
- Affects up to 2.22.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 17, 2026Contributor Cross Site Scripting (XSS) in PropertyHive <= 2.2.6 versions.CVE-2026-66578 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Cross Site Scripting (XSS) in PropertyHive <= 2.2.6 versions.
- Affected
- up to 2.2.6
- What to do
- Affects up to 2.2.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 17, 2026Paid Membership Subscriptions: Does not verify that the amount and currency reported by the payment provider match the pending payment before completing itCVE-2026-90922 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Paid Membership Subscriptions WordPress plugin before 3.0.9 does not verify that the amount and currency reported by the payment provider match the pending payment before completing it, allowing unauthenticated users to obtain a paid membership by paying an arbitrary lower amount.
- Product
- Paid Membership Subscriptions
- Fixed in
- 3.0.9
- What to do
- Update Paid Membership Subscriptions to 3.0.9 or newer.
Sep 17, 2026Comments Import & Export: Does not restrict its comment export to users able to moderate commentsCVE-2026-87836 · WordPress plugins & themes · reported by WPScanLow 2.7
The Comments Import & Export WordPress plugin before 2.5.4 does not restrict its comment export to users able to moderate comments, nor scope the export to content owned by the requesting user, allowing users with the Author role and above to retrieve every comment on the site, including commenter email addresses, IP addresses, unapproved comment content and comment meta.
- Product
- Comments Import & Export
- Fixed in
- 2.5.4
- What to do
- Update Comments Import & Export to 2.5.4 or newer.
Sep 16, 2026Formidable Forms: Does not prevent a request-derived value from reaching the WordPress shortcode parserCVE-2026-19857 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Formidable Forms WordPress plugin before 6.35 does not prevent a request-derived value from reaching the WordPress shortcode parser when it substitutes a supported token into a form's custom HTML, allowing unauthenticated visitors to have arbitrary shortcodes, with attacker-chosen attributes, executed server-side on any page displaying an affected form.
- Product
- Formidable Forms
- Fixed in
- 6.35
- What to do
- Update Formidable Forms to 6.35 or newer.
Sep 16, 2026Visualizer: Does not sanitise and escape a chart's JSON data source configuration before outputting it back in the chart editorCVE-2026-86784 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Visualizer WordPress plugin before 4.0.8 does not sanitise and escape a chart's JSON data source configuration before outputting it back in the chart editor, allowing users with the Contributor role and above to store JavaScript that executes in the browser of any higher-privileged user, such as an administrator, who reviews the affected chart.
- Product
- Visualizer
- Fixed in
- 4.0.8
- What to do
- Update Visualizer to 4.0.8 or newer.
Sep 16, 2026Ni WooCommerce Sales Report: Does not have any authentication or authorisation checks on one of its report-printing routinesCVE-2026-78474 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Ni WooCommerce Sales Report WordPress plugin before 4.2.0 does not have any authentication or authorisation checks on one of its report-printing routines, allowing unauthenticated users to retrieve WooCommerce order details and customer contact information, to target an individual order, and to search the store's orders by customer name or email address.
- Product
- Ni WooCommerce Sales Report
- Fixed in
- 4.2.0
- What to do
- Update Ni WooCommerce Sales Report to 4.2.0 or newer.
Sep 16, 2026Ni WooCommerce Sales Report: Does not sanitise and escape a parameter before using it in a SQL statementCVE-2026-78472 · WordPress plugins & themes · reported by WPScanHigh 8.6
The Ni WooCommerce Sales Report WordPress plugin before 4.2.0 does not sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks.
- Product
- Ni WooCommerce Sales Report
- Fixed in
- 4.2.0
- What to do
- Update Ni WooCommerce Sales Report to 4.2.0 or newer.
Sep 16, 2026WP Import Export Lite: Does not properly validate URLs before requesting them during the import processCVE-2026-76559 · WordPress plugins & themes · reported by WPScanMedium 4.1
The WP Import Export Lite WordPress plugin before 3.9.33 does not properly validate URLs before requesting them during the import process, allowing users with the import capability, which administrators hold by default, to make the site issue requests to internal hosts and services and read their responses. This is an incomplete fix for CVE-2026-11397.
- Product
- WP Import Export Lite
- Fixed in
- 3.9.33
- What to do
- Update WP Import Export Lite to 3.9.33 or newer.
Sep 16, 2026WP Import Export Lite: Does not escape custom field names retrieved from the database before inserting them into the DOM of one of its administration screensCVE-2026-76558 · WordPress plugins & themes · reported by WPScanMedium 6.8
The WP Import Export Lite WordPress plugin before 3.9.33 does not escape custom field names retrieved from the database before inserting them into the DOM of one of its administration screens, allowing users with a role as low as contributor to perform Stored XSS attacks which will trigger in the browser of a high privileged user, such as an administrator, viewing that screen.
- Product
- WP Import Export Lite
- Fixed in
- 3.9.33
- What to do
- Update WP Import Export Lite to 3.9.33 or newer.
Sep 16, 2026WP Import Export Lite: Does not properly sanitise and escape some import configuration values before using them in SQL statementsCVE-2026-76557 · WordPress plugins & themes · reported by WPScanMedium 6.8
The WP Import Export Lite WordPress plugin before 3.9.33 does not properly sanitise and escape some import configuration values before using them in SQL statements, allowing users whose role an administrator has granted the WP Import Export Lite WordPress plugin before 3.9.33's import permission to perform SQL injection attacks.
- Product
- WP Import Export Lite
- Fixed in
- 3.9.33
- What to do
- Update WP Import Export Lite to 3.9.33 or newer.
Sep 16, 2026WP Import Export Lite: Does not properly sanitise and escape some export filter values before using them in SQL statementsCVE-2026-76556 · WordPress plugins & themes · reported by WPScanMedium 6.8
The WP Import Export Lite WordPress plugin before 3.9.33 does not properly sanitise and escape some export filter values before using them in SQL statements, allowing users holding its export permission, which administrators have by default and may also grant to lower roles, to perform SQL injection attacks.
- Product
- WP Import Export Lite
- Fixed in
- 3.9.33
- What to do
- Update WP Import Export Lite to 3.9.33 or newer.
Sep 16, 2026WP Import Export Lite: Does not validate a user-supplied file path before reading it and copying it into a publicly accessible directoryCVE-2026-76555 · WordPress plugins & themes · reported by WPScanMedium 6.8
The WP Import Export Lite WordPress plugin before 3.9.33 does not validate a user-supplied file path before reading it and copying it into a publicly accessible directory, allowing any user whose role an administrator has granted the WP Import Export Lite WordPress plugin before 3.9.33's import permission to disclose sensitive files from the server, including files located outside the web root. The same code path also relaxes the file-system permissions of any path it is given, whether or not the copy succeeds.
- Product
- WP Import Export Lite
- Fixed in
- 3.9.33
- What to do
- Update WP Import Export Lite to 3.9.33 or newer.
Sep 16, 2026WP Import Export Lite: Does not validate a path taken from storedCVE-2026-76553 · WordPress plugins & themes · reported by WPScanMedium 6.5
The WP Import Export Lite WordPress plugin before 3.9.33 does not validate a path taken from stored, user-supplied data before recursively deleting the directory it resolves to, allowing users to whom an administrator has delegated a WP Import Export Lite WordPress plugin before 3.9.33 capability to delete arbitrary directories, and every file within them, including outside the web root.
- Product
- WP Import Export Lite
- Fixed in
- 3.9.33
- What to do
- Update WP Import Export Lite to 3.9.33 or newer.
Sep 16, 2026WP Import Export Lite: Does not validate the typeCVE-2026-76552 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WP Import Export Lite WordPress plugin before 3.9.33 does not validate the type, extension or content of files it retrieves from a user-supplied URL during import, allowing users granted its import permission to store arbitrary files, including executable ones, on the server and achieve remote code execution.
- Product
- WP Import Export Lite
- Fixed in
- 3.9.33
- What to do
- Update WP Import Export Lite to 3.9.33 or newer.
Sep 16, 2026WP Import Export Lite: Does not restrictCVE-2026-76551 · WordPress plugins & themes · reported by WPScanHigh 7.2
The WP Import Export Lite WordPress plugin before 3.9.33 does not restrict which PHP function may be applied to exported field values, allowing users granted its export permission to have arbitrary functions invoked on values they control, leading to remote code execution.
- Product
- WP Import Export Lite
- Fixed in
- 3.9.33
- What to do
- Update WP Import Export Lite to 3.9.33 or newer.
Sep 16, 2026WP Import Export Lite: Does not validate a user-supplied output pathCVE-2026-76550 · WordPress plugins & themes · reported by WPScanHigh 7.2
The WP Import Export Lite WordPress plugin before 3.9.34 does not validate a user-supplied output path when writing export files, allowing users granted its export permission to write files with arbitrary names to arbitrary locations on the server, leading to remote code execution.
- Product
- WP Import Export Lite
- Fixed in
- 3.9.34
- What to do
- Update WP Import Export Lite to 3.9.34 or newer.
Sep 16, 2026Ad Inserter – Ad Manager & AdSense Ads: Authorization bypassCVE-2026-11984 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.8.16 due to a missing capability check on the `ai-debug-code` URL-parameter. This makes it possible for unauthenticated attackers to view administrator-configured header and footer code blocks that have been disabled from public display.
- Product
- Ad Inserter – Ad Manager & AdSense Ads
- Affected
- up to 2.8.16
- What to do
- Affects up to 2.8.16. Update Ad Inserter – Ad Manager & AdSense Ads to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Sep 15, 2026WP Directory Kit: Does not check authorization or listing visibility in one of its shortcodesCVE-2026-16592 · WordPress plugins & themes · reported by WPScanLow 2.7
The WP Directory Kit WordPress plugin through 1.5.7 does not check authorization or listing visibility in one of its shortcodes, allowing users with a role as low as Contributor to disclose non-public listing content, including password-protected and hidden fields, belonging to other users.
- Product
- WP Directory Kit
- Affected
- up to 1.5.7
- What to do
- Affects up to 1.5.7. Update WP Directory Kit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 13, 2026The Hoo Companion WordPress plugin 1.0.2 does not have any authorisation or validation checks in one of its import features, and does not sanitise the data submCVE-2026-85129 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Hoo Companion WordPress plugin 1.0.2 does not have any authorisation or validation checks in one of its import features, and does not sanitise the data submitted to it before storing it as the active theme's settings, allowing unauthenticated attackers to inject arbitrary web scripts which will execute for anyone viewing the site, including administrators. The same request destroys the site's existing theme settings.
- What to do
- Update the plugin to the newest version.
Sep 13, 2026rtMedia for WordPress, BuddyPress and bbPress: Does not check ownership before changing the privacy level of an activity and its attached mediaCVE-2026-88912 · WordPress plugins & themes · reported by WPScanMedium 4.2
The rtMedia for WordPress, BuddyPress and bbPress WordPress plugin before 4.7.12 does not check ownership before changing the privacy level of an activity and its attached media, relying only on a nonce shared with every logged-in user, allowing users with a subscriber-level account or above to make another user's private activity public or hide it.
- Product
- rtMedia for WordPress, BuddyPress and bbPress
- Fixed in
- 4.7.12
- What to do
- Update rtMedia for WordPress, BuddyPress and bbPress to 4.7.12 or newer.
Sep 12, 2026Smart Marketing SMS and Newsletters Forms: Generic SQL InjectionCVE-2026-77161 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Smart Marketing SMS and Newsletters Forms plugin for WordPress is vulnerable to generic SQL Injection via Parameter Name in all versions up to, and including, 5.1.24 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Exploitation requires the plugin's sync feature to be enabled (options['enabled']) and get_option('egoi_mapping') to be truthy, both of which reflect ordinary configured states for the plugin's core contact mapping functionality.
- Product
- Smart Marketing SMS and Newsletters Forms
- Affected
- up to 5.1.24
- What to do
- Affects up to 5.1.24. Update Smart Marketing SMS and Newsletters Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 12, 2026rtMedia for WordPress, BuddyPress and bbPress: Time-based blind SQL InjectionCVE-2026-16482 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The rtMedia for WordPress, BuddyPress and bbPress plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'compare' parameter in all versions up to, and including, 4.7.11 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This is exploitable on any public page containing an rtMedia shortcode (e.g., [rtmedia_gallery]) when the rtmedia_shortcode GET parameter is set, because RTMediaQuery::query() merges $_REQUEST into the internal query while only validating top-level array keys, allowing the nested 'compare' subvalue to reach the vulnerable sink without authentication.
- Product
- rtMedia for WordPress, BuddyPress and bbPress
- Affected
- up to 4.7.11
- What to do
- Affects up to 4.7.11. Update rtMedia for WordPress, BuddyPress and bbPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 12, 2026WP Highlight Box: Does not escape some shortcode attributes before outputting them in a page where the shortcode is embeddedCVE-2026-86790 · WordPress plugins & themes · reported by WPScanMedium 6.8
The WP Highlight Box WordPress plugin through 1.0 does not escape some shortcode attributes before outputting them in a page where the shortcode is embedded, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- WP Highlight Box
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update WP Highlight Box to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 12, 2026wpstorecart: Does not prevent directCVE-2026-84099 · WordPress plugins & themes · reported by WPScanHigh 8.1
The wpstorecart WordPress plugin through 5.0.7 does not prevent direct, unauthenticated access to a bundled add-on that deserializes user-supplied input without restricting the permitted classes, allowing unauthenticated attackers to inject arbitrary PHP objects, which may be escalated further when a suitable gadget chain is present on the site.
- Product
- wpstorecart
- Affected
- up to 5.0.7
- What to do
- Affects up to 5.0.7. Update wpstorecart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 12, 2026Custom Menu Wizard Widget: Does not sanitize and escape several shortcode attributes before rendering them into HTMLCVE-2026-83532 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Custom Menu Wizard Widget WordPress plugin through 3.3.1 does not sanitize and escape several shortcode attributes before rendering them into HTML, allowing users with contributor-level access and above to inject arbitrary web scripts that execute when the affected content is viewed.
- Product
- Custom Menu Wizard Widget
- Affected
- up to 3.3.1
- What to do
- Affects up to 3.3.1. Update Custom Menu Wizard Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 12, 2026Export & Import WPBakery Page Builder: Does not perform any CSRF check on its template-import feature and does not sanitise the imported data before storing it and echoing it backCVE-2026-81429 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Export & Import WPBakery Page Builder WordPress plugin through 1.0.2 does not perform any CSRF check on its template-import feature and does not sanitise the imported data before storing it and echoing it back, allowing attackers to make a logged-in administrator import a crafted template via a forged request that results in Stored Cross-Site Scripting executed in the administrator's session.
- Product
- Export & Import WPBakery Page Builder
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update Export & Import WPBakery Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 11, 2026Contributor Insecure Direct Object References (IDOR) in Starter Templates <= 4.7.5 versions.CVE-2026-62134 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Contributor Insecure Direct Object References (IDOR) in Starter Templates <= 4.7.5 versions.
- Affected
- up to 4.7.5
- What to do
- Affects up to 4.7.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 11, 2026Subscriber Cross Site Request Forgery (CSRF) in RTMKit <= 2.1.5 versions.CVE-2026-62133 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Subscriber Cross Site Request Forgery (CSRF) in RTMKit <= 2.1.5 versions.
- Affected
- up to 2.1.5
- What to do
- Affects up to 2.1.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 11, 2026Subscriber Privilege Escalation in SMS Alert Order Notifications <= 3.9.9 versions.CVE-2026-62106 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Subscriber Privilege Escalation in SMS Alert Order Notifications <= 3.9.9 versions.
- Affected
- up to 3.9.9
- What to do
- Affects up to 3.9.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 11, 2026ElasticPress: Insertion of Sensitive Information Into Sent DataCVE-2026-62088 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Insertion of Sensitive Information Into Sent Data vulnerability in 10up ElasticPress allows Retrieve Embedded Sensitive Data. This issue affects ElasticPress: from n/a through 5.3.4.
- Product
- ElasticPress
- Affected
- up to 5.3.4
- What to do
- Affects up to 5.3.4. Update ElasticPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 11, 2026Unauthenticated Broken Access Control in Deposits and Partial Payments for WooCommerce <= 3.1.0 versions.CVE-2026-27378 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Broken Access Control in Deposits and Partial Payments for WooCommerce <= 3.1.0 versions.
- Affected
- up to 3.1.0
- What to do
- Affects up to 3.1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 11, 2026The Simple CAPTCHA with Cloudflare Turnstile WordPress plugin from 1.2.2 before 1.42.3 runs the shortcode parser over the whole rendered Contact Form 7 form, inCVE-2026-85116 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Simple CAPTCHA with Cloudflare Turnstile WordPress plugin from 1.2.2 before 1.42.3 runs the shortcode parser over the whole rendered Contact Form 7 form, including the values a visitor submitted, allowing unauthenticated users to execute arbitrary shortcodes registered on the site.
- Fixed in
- 1.42.3
- What to do
- Update the plugin to 1.42.3 or newer.
Sep 11, 2026Visualizer: Does not properly authorise access to its chart-building actionsCVE-2026-86782 · WordPress plugins & themes · reported by WPScanMedium 5.5
The Visualizer WordPress plugin before 4.0.6 does not properly authorise access to its chart-building actions, allowing users with the Contributor role and above to publish, rename, and overwrite the content of posts and pages they do not own, including other users' private drafts.
- Product
- Visualizer
- Fixed in
- 4.0.6
- What to do
- Update Visualizer to 4.0.6 or newer.
Sep 11, 2026SSL Zen — SSL Certificate Installer & HTTPS Redirects: Does not perform capability or nonce checks on a certificate-file download routine that runs early in the WordPress admin request lifecycleCVE-2026-86781 · WordPress plugins & themes · reported by WPScanMedium 5.3
The SSL Zen — SSL Certificate Installer & HTTPS Redirects WordPress plugin before 4.7.40 does not perform capability or nonce checks on a certificate-file download routine that runs early in the WordPress admin request lifecycle, allowing any authenticated user, including Subscribers, to download the site's TLS private key, certificates, and diagnostic logs.
- Product
- SSL Zen — SSL Certificate Installer & HTTPS Redirects
- Fixed in
- 4.7.40
- What to do
- Update SSL Zen — SSL Certificate Installer & HTTPS Redirects to 4.7.40 or newer.
Sep 11, 2026Visualizer: Does not properly authorise chart-deletion requestsCVE-2026-86779 · WordPress plugins & themes · reported by WPScanLow 2.7
The Visualizer WordPress plugin before 4.0.6 does not properly authorise chart-deletion requests, performing only a site-wide capability check with no per-object ownership verification, allowing users with the Contributor role and above to permanently delete any chart on the site, including charts created by other users such as administrators.
- Product
- Visualizer
- Fixed in
- 4.0.6
- What to do
- Update Visualizer to 4.0.6 or newer.
Sep 10, 2026import_contacts Path Traversal in Groundhogg <= 4.7.1 versions.CVE-2026-85310 · WordPress plugins & themes · reported by PatchstackMedium 6.5
import_contacts Path Traversal in Groundhogg <= 4.7.1 versions.
- Affected
- up to 4.7.1
- What to do
- Affects up to 4.7.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 10, 2026Unauthenticated Cross Site Scripting (XSS) in WPAdverts <= 2.3.3 versions.CVE-2026-84819 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in WPAdverts <= 2.3.3 versions.
- Affected
- up to 2.3.3
- What to do
- Affects up to 2.3.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 10, 2026Unauthenticated Broken Access Control in Shirt Product Designer for WooCommerce 1.0.4 versions.CVE-2026-81794 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in Shirt Product Designer for WooCommerce 1.0.4 versions.
- What to do
- Update the plugin to the newest version.
Sep 9, 2026Ninja Forms - Scheduled Exports: Stored Cross-Site ScriptingCVE-2026-87870 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Ninja Forms - Scheduled Exports plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REST API Parameters (interval, format, emailTo) in all versions up to, and including, 3.0.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level privileges and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The REST endpoint is registered without a permission_callback and only validates a nonce without checking user capabilities.
- Product
- Ninja Forms - Scheduled Exports
- Affected
- up to 3.0.3
- What to do
- Affects up to 3.0.3. Update Ninja Forms - Scheduled Exports to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordninjaforms.comwordfence.com
Sep 9, 2026Rara One Click Demo Import: Arbitrary file uploadCVE-2026-26212 · WordPress plugins & themes · reported by VulnCheckHigh 8.6
Rara One Click Demo Import plugin for WordPress before 1.3.5 contains an arbitrary file upload vulnerability that allows authenticated attackers with Administrator privileges to upload arbitrary PHP files by passing a false value to wp_handle_upload() that disables WordPress core's file type validation checks across all three file parameters in the process_uploaded_files() function. Attackers can upload a malicious PHP file to the uploads directory and execute it over HTTP to achieve remote code execution in the web server process, with the uploaded file persisting on disk even after plugin deactivation and leaving no media library record to evade standard integrity checks.
- Product
- Rara One Click Demo Import
- Fixed in
- 1.3.5
- What to do
- Update Rara One Click Demo Import to 1.3.5 or newer.
Full record and what to do →NVD recordwordpress.comvulncheck.com
Sep 9, 2026Contact Form 7 Captcha: Runs the shortcode parser over the whole rendered Contact Form 7 formCVE-2026-85117 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Contact Form 7 Captcha WordPress plugin before 0.1.9 runs the shortcode parser over the whole rendered Contact Form 7 form, including the values a visitor submitted, allowing unauthenticated users to execute arbitrary shortcodes registered on the site.
- Product
- Contact Form 7 Captcha
- Fixed in
- 0.1.9
- What to do
- Update Contact Form 7 Captcha to 0.1.9 or newer.
Sep 9, 2026Hustle: Does not prevent shortcodes in submitted form values from being executedCVE-2026-80440 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Hustle WordPress plugin before 7.8.14.2 does not prevent shortcodes in submitted form values from being executed when it substitutes those values into the message it returns after submission, because the guard it applies can be defeated by nesting, allowing unauthenticated users to run any shortcode registered on the site.
- Product
- Hustle
- Fixed in
- 7.8.14.2
- What to do
- Update Hustle to 7.8.14.2 or newer.
Sep 9, 2026Reviso Exporter for WooCommerce: Unauthorized modification of dataCVE-2026-8615 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Reviso Exporter for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check and missing nonce verification on the disconnect_callback() function in versions up to, and including, 1.2.3. The function is registered to the 'wp_ajax_wcefr-disconnect' AJAX action and unconditionally calls delete_option('wcefr-agt'), which removes the Reviso Agreement Grant Token used to authenticate API calls. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete the plugin's stored Agreement Grant Token, breaking the connection between WooCommerce and the Reviso service.
- Product
- Reviso Exporter for WooCommerce
- Affected
- up to 1.2.3
- What to do
- Affects up to 1.2.3. Update Reviso Exporter for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.complugins.trac.wordpress.org
Sep 9, 2026Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More: Does not validate a user-supplied HTML tag name in one of its Beaver Builder widgets before echoing it into the rendered markupCVE-2026-85418 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More WordPress plugin before 3.0.9 does not validate a user-supplied HTML tag name in one of its Beaver Builder widgets before echoing it into the rendered markup, allowing users with contributor-level access and above to inject arbitrary web scripts that execute when any visitor views the affected page.
- Product
- Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More
- Fixed in
- 3.0.9
- What to do
- Update Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More to 3.0.9 or newer.
Sep 9, 2026Sunshine Photo Cart: Does not validate that a client-supplied price identifier belongs to the item being purchasedCVE-2026-85037 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Sunshine Photo Cart WordPress plugin before 3.7 does not validate that a client-supplied price identifier belongs to the item being purchased when it is added to the cart, allowing unauthenticated users to buy items at a lower price defined elsewhere on the site and complete an order at that price, resulting in financial loss for the site owner.
- Product
- Sunshine Photo Cart
- Fixed in
- 3.7
- What to do
- Update Sunshine Photo Cart to 3.7 or newer.
Sep 9, 2026WPBot – AI ChatBot for Live Support, Lead Generation, AI Services: Stored Cross-Site ScriptingCVE-2026-83593 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The WPBot – AI ChatBot for Live Support, Lead Generation, AI Services plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'conversation' parameter in all versions up to, and including, 8.7.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The action is gated only by a nonce that is localized into every public-facing page via wp_localize_script, rendering the nonce check ineffective as an access control barrier for unauthenticated users.
- Product
- WPBot – AI ChatBot for Live Support, Lead Generation, AI Services
- Affected
- up to 8.7.3
- What to do
- Affects up to 8.7.3. Update WPBot – AI ChatBot for Live Support, Lead Generation, AI Services to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 9, 2026SupportCandy: Does not validate a submitted per-ticket authorization code before disclosing the real code to the requesterCVE-2026-81022 · WordPress plugins & themes · reported by WPScanMedium 5.3
The SupportCandy WordPress plugin before 3.5.3 does not validate a submitted per-ticket authorization code before disclosing the real code to the requester, allowing unauthenticated users to read the contents of any support ticket.
- Product
- SupportCandy
- Fixed in
- 3.5.3
- What to do
- Update SupportCandy to 3.5.3 or newer.
Sep 9, 2026SupportCandy: Does not perform an authorization check on one of its support-ticket attachment download pathsCVE-2026-81021 · WordPress plugins & themes · reported by WPScanMedium 5.3
The SupportCandy WordPress plugin before 3.5.3 does not perform an authorization check on one of its support-ticket attachment download paths, allowing unauthenticated attackers to read protected customer-uploaded attachments by enumerating sequential attachment identifiers.
- Product
- SupportCandy
- Fixed in
- 3.5.3
- What to do
- Update SupportCandy to 3.5.3 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.