Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
399,281 results · page 700 of 7986
Sep 11, 2026Smart Video Intercom System developed by Kingdom Communication Associated has a Sensitive Data Exposure vulnerability.CVE-2026-89173 · Other software · Kingdom Communication Associated · reported by twcert@cert.org.twMedium 6.9
Smart Video Intercom System developed by Kingdom Communication Associated has a Sensitive Data Exposure vulnerability. Unauthenticated remote attackers can enumerate valid user accounts by exploiting differences in system responses.
- Product
- EH3040
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Sep 11, 2026Media Library Assistant: Stored Cross-Site ScriptingCVE-2026-6642 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Media Library Assistant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the bulk edit preset export/import mechanism in versions up to and including 3.35. This is due to insufficient output escaping on preset field values when they are rendered in HTML attribute contexts in the mla_generate_bulk_edit_form_fieldsets() function and mla-bulk-edit-fieldsets.tpl template. While wp_kses() filtering is applied during preset export for users without unfiltered_html capability, this does not prevent attribute injection attacks since the malicious payload consists of quotes and HTML attributes rather than HTML tags. When preset values are retrieved and rendered, they are directly assigned to template variables without esc_attr() escaping and then inserted into input element value attributes via simple string replacement. This makes it possible for authenticated attackers, with Author-level access and above (upload_files capability), to inject arbitrary web scripts that execute when an administrator imports the poisoned preset and the targeted input field receives focus.
- Product
- Media Library Assistant
- Affected
- up to 3.35
- What to do
- Affects up to 3.35. Update Media Library Assistant to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 11, 2026Media Library Assistant: Stored Cross-Site ScriptingCVE-2026-6641 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Media Library Assistant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mla_gallery' shortcode in versions up to and including 3.35. This is due to insufficient input sanitization and output escaping on the mla_link_href parameter when mla_output is set to 'paginate_links', where the _paginate_links() function processes the value through mla_process_shortcode_parameter() and _replace_query_parameter() without proper URL escaping, then outputs it directly in href attributes without applying esc_url(). This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Media Library Assistant
- Affected
- up to 3.35
- What to do
- Affects up to 3.35. Update Media Library Assistant to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 11, 2026Media Library Assistant: Stored Cross-Site ScriptingCVE-2026-6640 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Media Library Assistant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mla_link_attributes' parameter in all versions up to, and including, 3.35 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Media Library Assistant
- Affected
- up to 3.35
- What to do
- Affects up to 3.35. Update Media Library Assistant to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 11, 2026multiparty is a Node.js library for parsing multipart/form-data request bodies.CVE-2026-87908 · Other software · multiparty · reported by ce714d77-add3-4f53-aff5-83d477b104bbHigh 7.5
multiparty is a Node.js library for parsing multipart/form-data request bodies. In versions from 2.1.0 up to but not including 4.3.1, the parser does not bound the amount of memory used while accumulating the headers of a single multipart part. An unauthenticated attacker can send a single request whose part carries a very large volume of header bytes, forcing the parser to buffer all of them and exhausting the process memory, which crashes the server. This is a denial of service with no confidentiality or integrity impact. The issue is fixed in multiparty 4.3.1, which caps the size of the accumulated part headers. Users should upgrade to multiparty 4.3.1 or later.
- Product
- multiparty
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcna.openjsf.orggithub.com
Sep 11, 2026BackWPup: Does not properly restrict access to several of its REST API routes for jobCVE-2026-86815 · WordPress plugins & themes · reported by WPScanMedium 5.5
The BackWPup WordPress plugin before 5.7.5 does not properly restrict access to several of its REST API routes for job, backup-destination, and backup-execution management, allowing users holding a BackWPup WordPress plugin before 5.7.5-defined, administrator-assigned limited role to create and run backup jobs and exfiltrate a full database backup to an attacker-controlled destination.
- Product
- BackWPup
- Fixed in
- 5.7.5
- What to do
- Update BackWPup to 5.7.5 or newer.
Sep 11, 2026WPCafe: Does not correctly restrict access to a set of order-management REST endpoints because their permission callbacks return an incorrect type on failureCVE-2026-86812 · WordPress plugins & themes · reported by WPScanMedium 6.5
The WPCafe WordPress plugin before 3.0.18 does not correctly restrict access to a set of order-management REST endpoints because their permission callbacks return an incorrect type on failure, allowing unauthenticated users to disclose guest order information and to change the status of, or trash, any order.
- Product
- WPCafe
- Fixed in
- 3.0.18
- What to do
- Update WPCafe to 3.0.18 or newer.
Sep 11, 2026Visualizer: Does not properly authorise access to its chart-building actionsCVE-2026-86782 · WordPress plugins & themes · reported by WPScanMedium 5.5
The Visualizer WordPress plugin before 4.0.6 does not properly authorise access to its chart-building actions, allowing users with the Contributor role and above to publish, rename, and overwrite the content of posts and pages they do not own, including other users' private drafts.
- Product
- Visualizer
- Fixed in
- 4.0.6
- What to do
- Update Visualizer to 4.0.6 or newer.
Sep 11, 2026SSL Zen — SSL Certificate Installer & HTTPS Redirects: Does not perform capability or nonce checks on a certificate-file download routine that runs early in the WordPress admin request lifecycleCVE-2026-86781 · WordPress plugins & themes · reported by WPScanMedium 5.3
The SSL Zen — SSL Certificate Installer & HTTPS Redirects WordPress plugin before 4.7.40 does not perform capability or nonce checks on a certificate-file download routine that runs early in the WordPress admin request lifecycle, allowing any authenticated user, including Subscribers, to download the site's TLS private key, certificates, and diagnostic logs.
- Product
- SSL Zen — SSL Certificate Installer & HTTPS Redirects
- Fixed in
- 4.7.40
- What to do
- Update SSL Zen — SSL Certificate Installer & HTTPS Redirects to 4.7.40 or newer.
Sep 11, 2026Featured Image with URL: Does not sanitise and escape a stored image attribute value before outputting itCVE-2026-86780 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Featured Image with URL WordPress plugin before 1.0.6 does not sanitise and escape a stored image attribute value before outputting it, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks that execute in the browser of any user viewing the affected post, including higher-privileged users such as Editors and Administrators.
- Product
- Featured Image with URL
- Fixed in
- 1.0.6
- What to do
- Update Featured Image with URL to 1.0.6 or newer.
Sep 11, 2026Visualizer: Does not properly authorise chart-deletion requestsCVE-2026-86779 · WordPress plugins & themes · reported by WPScanLow 2.7
The Visualizer WordPress plugin before 4.0.6 does not properly authorise chart-deletion requests, performing only a site-wide capability check with no per-object ownership verification, allowing users with the Contributor role and above to permanently delete any chart on the site, including charts created by other users such as administrators.
- Product
- Visualizer
- Fixed in
- 4.0.6
- What to do
- Update Visualizer to 4.0.6 or newer.
Sep 11, 2026AI Builder: Does not sanitise custom JavaScript saved against a post before echoing it inside a script tag on the front endCVE-2026-85678 · WordPress plugins & themes · reported by WPScanMedium 6.8
The AI Builder WordPress plugin before 2.7.8 does not sanitise custom JavaScript saved against a post before echoing it inside a script tag on the front end, allowing users with contributor level access and above to store arbitrary JavaScript that will execute in the browser of anyone who views the post, including the editor or administrator who reviews it.
- Product
- AI Builder
- Fixed in
- 2.7.8
- What to do
- Update AI Builder to 2.7.8 or newer.
Sep 11, 2026Gutenverse News: Does not restrict the extra HTML it adds to WordPress's allowed elements to the context it is meant forCVE-2026-85677 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Gutenverse News WordPress plugin before 3.3.3 does not restrict the extra HTML it adds to WordPress's allowed elements to the context it is meant for, applying the same relaxed list to every sanitisation context including untrusted comments, allowing unauthenticated users to store JavaScript that will execute in the browser of any administrator who reviews the comment queue, and of any visitor to the post once the comment is approved.
- Product
- Gutenverse News
- Fixed in
- 3.3.3
- What to do
- Update Gutenverse News to 3.3.3 or newer.
Sep 11, 2026CoolClock: Does not properly escape a skin setting before outputting it within an HTML attributeCVE-2026-83546 · WordPress plugins & themes · reported by WPScanMedium 6.8
The CoolClock WordPress plugin before 4.3.8 does not properly escape a skin setting before outputting it within an HTML attribute, allowing users with contributor-level access and above to inject arbitrary web scripts that execute when the content is viewed.
- Product
- CoolClock
- Fixed in
- 4.3.8
- What to do
- Update CoolClock to 4.3.8 or newer.
Sep 11, 2026CoolClock: Does not properly escape a custom skin setting before outputting it inside an inline scriptCVE-2026-83545 · WordPress plugins & themes · reported by WPScanMedium 6.8
The CoolClock WordPress plugin before 4.3.8 does not properly escape a custom skin setting before outputting it inside an inline script, allowing users with contributor-level access and above to inject arbitrary JavaScript that executes when the content is viewed.
- Product
- CoolClock
- Fixed in
- 4.3.8
- What to do
- Update CoolClock to 4.3.8 or newer.
Sep 11, 2026YITH WooCommerce Wishlist: Does not verify that a user is authorised to rename a given wishlistCVE-2026-82305 · WordPress plugins & themes · reported by WPScanMedium 5.3
The YITH WooCommerce Wishlist WordPress plugin before 4.18.1 does not verify that a user is authorised to rename a given wishlist, allowing unauthenticated users to rename any wishlist on the site.
- Product
- YITH WooCommerce Wishlist
- Fixed in
- 4.18.1
- What to do
- Update YITH WooCommerce Wishlist to 4.18.1 or newer.
Sep 11, 2026MultiVendorX: Does not restrict who can update its role and capability settingsCVE-2026-74925 · WordPress plugins & themes · reported by WPScanHigh 7.2
The MultiVendorX WordPress plugin before 5.0.16 does not restrict who can update its role and capability settings, allowing users holding its vendor role to grant that role administrator-level capabilities and take over the site.
- Product
- MultiVendorX
- Fixed in
- 5.0.16
- What to do
- Update MultiVendorX to 5.0.16 or newer.
Sep 11, 2026A potential security vulnerability in HPE IceWall Federation Agent and Proxy could allow a remote unauthenticated attacker to cause a denial of service (DoS).CVE-2026-73785 · Other software · Hewlett Packard Enterprise · reported by security-alert@hpe.comHigh 7.5
A potential security vulnerability in HPE IceWall Federation Agent and Proxy could allow a remote unauthenticated attacker to cause a denial of service (DoS).
- Product
- HPE IceWall products
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 11, 2026A potential security vulnerability in HPE IceWall products could be exploited to tamper SAML response, allowing an attacker to impersonate another user.CVE-2026-73784 · Other software · Hewlett Packard Enterprise · reported by security-alert@hpe.comHigh 8.8
A potential security vulnerability in HPE IceWall products could be exploited to tamper SAML response, allowing an attacker to impersonate another user.
- Product
- HPE IceWall products
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 11, 2026advanced-customized-prompts: Does not perform any capabilityCVE-2026-14566 · WordPress plugins & themes · reported by WPScanMedium 4.3
The advanced-customized-prompts WordPress plugin through 1.0.1 does not perform any capability, ownership, or nonce check before updating WooCommerce order item metadata for a supplied order, allowing any authenticated user such as a subscriber to tamper with the custom metadata of orders belonging to other customers.
- Product
- advanced-customized-prompts
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update advanced-customized-prompts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 11, 2026advanced-customized-prompts: Does not perform any capabilityCVE-2026-14565 · WordPress plugins & themes · reported by WPScanMedium 5.4
The advanced-customized-prompts WordPress plugin through 1.0.1 does not perform any capability, ownership, or nonce check before saving popup configuration to a product, nor escape the stored values on output, allowing any authenticated user such as a subscriber to store JavaScript that executes in the browser of visitors viewing the affected product.
- Product
- advanced-customized-prompts
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update advanced-customized-prompts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 11, 2026advanced-customized-prompts: Does not verify the password before issuing an authenticated session for a supplied email address in an unauthenticated actionCVE-2026-14563 · WordPress plugins & themes · reported by WPScanCritical 9.8
The advanced-customized-prompts WordPress plugin through 1.0.1 does not verify the password before issuing an authenticated session for a supplied email address in an unauthenticated action, allowing unauthenticated attackers to log in as any registered user, including administrators, or to create arbitrary new accounts.
- Product
- advanced-customized-prompts
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update advanced-customized-prompts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 11, 2026teddy-bear-customize-addon: Does not perform any authorization or ownership checks before returning WooCommerce order metadata and the URLs of customer-uploaded attachmentsCVE-2026-14562 · WordPress plugins & themes · reported by WPScanMedium 5.3
The teddy-bear-customize-addon WordPress plugin through 1.0.5 does not perform any authorization or ownership checks before returning WooCommerce order metadata and the URLs of customer-uploaded attachments, allowing unauthenticated attackers to disclose other customers' order and attachment data.
- Product
- teddy-bear-customize-addon
- Affected
- up to 1.0.5
- What to do
- Affects up to 1.0.5. Update teddy-bear-customize-addon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 11, 2026teddy-bear-customize-addon: Does not properly validate uploaded filesCVE-2026-14560 · WordPress plugins & themes · reported by WPScanCritical 10
The teddy-bear-customize-addon WordPress plugin through 1.0.5 does not properly validate uploaded files, relying on a client-supplied content type and preserving the original filename, allowing unauthenticated attackers to upload arbitrary PHP files and execute code on the server.
- Product
- teddy-bear-customize-addon
- Affected
- up to 1.0.5
- What to do
- Affects up to 1.0.5. Update teddy-bear-customize-addon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 11, 2026teddy-bear-customize-addon: Does not verify a user's password before authenticating themCVE-2026-14559 · WordPress plugins & themes · reported by WPScanCritical 9.8
The teddy-bear-customize-addon WordPress plugin through 1.0.5 does not verify a user's password before authenticating them, allowing unauthenticated attackers to log in as any registered user, including administrators, by supplying only that user's email address.
- Product
- teddy-bear-customize-addon
- Affected
- up to 1.0.5
- What to do
- Affects up to 1.0.5. Update teddy-bear-customize-addon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 11, 2026An out-of-bounds read in Qt NFC's language code length parsing allows a physically proximate attacker to cause a denial of service or limited memory disclosure CVE-2026-13326 · Other software · qt · reported by a59d8014-47c4-4630-ab43-e1b13cbe58e3Medium 6.9
An out-of-bounds read in Qt NFC's language code length parsing allows a physically proximate attacker to cause a denial of service or limited memory disclosure via a crafted NFC tag.
- Product
- qt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcodereview.qt-project.org
Sep 11, 2026Translate WordPress with GTranslate: Does not validate one of its settings before the bundled front-end scripts build markup from itCVE-2025-15695 · WordPress plugins & themes · reported by WPScanLow 3.5
The Translate WordPress with GTranslate WordPress plugin before 3.0.10 does not validate one of its settings before the bundled front-end scripts build markup from it, allowing users with a role as high as administrator to store JavaScript that runs in the session of any visitor to the site.
- Product
- Translate WordPress with GTranslate
- Fixed in
- 3.0.10
- What to do
- Update Translate WordPress with GTranslate to 3.0.10 or newer.
Sep 11, 2026live-boot ff8867c allows attackers to bypass the dm-verity-enforce-roothash-signature protection mechanism when the .verity file is missing.CVE-2026-89169 · Other software · Debian · reported by MITREMedium 4.1
live-boot ff8867c allows attackers to bypass the dm-verity-enforce-roothash-signature protection mechanism when the .verity file is missing.
- Product
- live-boot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.debian.orgsalsa.debian.org
Sep 11, 2026In PCRE2 before 10.48, pcre2_serialize_encode might disclose two bytes to an adversary, typically in a situation where the access available to the adversary is CVE-2026-89162 · Other software · PCRE · reported by MITRELow 2.9
In PCRE2 before 10.48, pcre2_serialize_encode might disclose two bytes to an adversary, typically in a situation where the access available to the adversary is already unsafe.
- Product
- PCRE2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 11, 2026A cross-namespace authorization flaw in multicluster-observability-addon allows a user with permission to modify a managed cluster’s ManagedClusterAddOn configuCVE-2026-89060 · Other software · Red Hat · reported by Red HatHigh 7.7
A cross-namespace authorization flaw in multicluster-observability-addon allows a user with permission to modify a managed cluster’s ManagedClusterAddOn configuration to reference ClusterLogForwarder or OpenTelemetryCollector resources outside the permitted namespace. If those resources reference Secrets, the add-on may copy the referenced Secrets to the attacker-controlled managed cluster.
- Product
- Red Hat Advanced Cluster Management for Kubernetes 2.13
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Sep 11, 2026MIPL Grouped Checkout Fields for WooCommerce – Customize & Organize Checkout Fields.: Arbitrary file uploadsCVE-2026-8778 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The MIPL Grouped Checkout Fields for WooCommerce – Customize & Organize Checkout Fields. plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the `mipl_wc_upload_file` function in all versions up to, and including, 1.2.1. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
- Product
- MIPL Grouped Checkout Fields for WooCommerce – Customize & Organize Checkout Fields.
- Affected
- up to 1.2.1
- What to do
- Affects up to 1.2.1. Update MIPL Grouped Checkout Fields for WooCommerce – Customize & Organize Checkout Fields. to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 11, 2026In PCRE2 before 10.48, pcre2_jit_match mishandles a previously copied subject being passed in as a context.CVE-2026-89161 · Other software · PCRE · reported by MITREHigh 7.4
In PCRE2 before 10.48, pcre2_jit_match mishandles a previously copied subject being passed in as a context. An incorrect free operation can occur.
- Product
- PCRE2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 11, 2026PCRE2 before 10.48 has a pcre2_match out-of-bounds read during the PCRE2_MATCH_INVALID_UTF matching of an invalid UTF subject.CVE-2026-89160 · Other software · PCRE · reported by MITRELow 3.7
PCRE2 before 10.48 has a pcre2_match out-of-bounds read during the PCRE2_MATCH_INVALID_UTF matching of an invalid UTF subject.
- Product
- PCRE2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 11, 2026PCRE2 before 10.48, on 32-bit platforms, has a pcre2_compile_32 integer overflow and resultant out-of-bounds write.CVE-2026-89158 · Other software · PCRE · reported by MITREMedium 6.5
PCRE2 before 10.48, on 32-bit platforms, has a pcre2_compile_32 integer overflow and resultant out-of-bounds write.
- Product
- PCRE2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 11, 2026PCRE2 before 10.48, on 32-bit platforms, has a pcre2_pattern_convert out-of-bounds write when an attacker can provide a large pattern.CVE-2026-89157 · Other software · PCRE · reported by MITREMedium 5.7
PCRE2 before 10.48, on 32-bit platforms, has a pcre2_pattern_convert out-of-bounds write when an attacker can provide a large pattern.
- Product
- PCRE2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 11, 2026PCRE2 before 10.48 has a pcre2_match out-of-bounds read after a JIT fallback when an attacker can provide invalid UTF data.CVE-2026-89156 · Other software · PCRE · reported by MITRELow 2.9
PCRE2 before 10.48 has a pcre2_match out-of-bounds read after a JIT fallback when an attacker can provide invalid UTF data.
- Product
- PCRE2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 11, 2026WP-Members Membership: Reflected Cross-Site ScriptingCVE-2026-84960 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WP-Members Membership Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via URL Query String in all versions up to, and including, 3.5.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Successful exploitation requires the victim to first visit the attacker-crafted URL and then click the Terms of Service link rendered on the resulting registration page.
- Product
- WP-Members Membership
- Affected
- up to 3.5.6
- What to do
- Affects up to 3.5.6. Update WP-Members Membership to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 11, 2026Simple Ajax Chat – Add a Fast, Secure Chat Box: Stored Cross-Site ScriptingCVE-2026-81825 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Simple Ajax Chat – Add a Fast, Secure Chat Box plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Chat Message in all versions up to, and including, <= 20260811 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The nonce protecting chat message submission is publicly visible on the chat page, rendering it ineffective as an authentication barrier and allowing fully unauthenticated attackers to submit malicious messages that are stored persistently and rendered to all visitors on every page load.
- Product
- Simple Ajax Chat – Add a Fast, Secure Chat Box
- Affected
- up to 20260811
- What to do
- Affects up to 20260811. Update Simple Ajax Chat – Add a Fast, Secure Chat Box to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 11, 2026Vigilant – 100% Free Security Suite: Firewall, 2FA, Login, Headers, Scanner…: Stored Cross-Site ScriptingCVE-2026-81754 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Vigilant – 100% Free Security Suite: Firewall, 2FA, Login, Headers, Scanner… plugin for WordPress is vulnerable to Stored Cross-Site Scripting via User-Agent Header in all versions up to, and including, 2.10.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The malicious payload is delivered passively by any unauthenticated visitor who triggers a failed login attempt with a crafted User-Agent header, requiring no further interaction from the attacker once stored.
- Product
- Vigilant – 100% Free Security Suite: Firewall, 2FA, Login, Headers, Scanner…
- Affected
- up to 2.10.2
- What to do
- Affects up to 2.10.2. Update Vigilant – 100% Free Security Suite: Firewall, 2FA, Login, Headers, Scanner… to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 11, 2026Bold Timeline Lite: Stored Cross-Site ScriptingCVE-2026-7438 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Bold Timeline Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `supertitle` and `subtitle` attributes of the `bold_timeline_item` shortcode in all versions up to, and including, 1.2.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Bold Timeline Lite
- Affected
- up to 1.2.8
- What to do
- Affects up to 1.2.8. Update Bold Timeline Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 11, 2026Themify – WooCommerce Product Filter: Reflected Cross-Site ScriptingCVE-2026-78172 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Themify – WooCommerce Product Filter plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via Query Parameter Name in all versions up to, and including, 1.5.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- Themify – WooCommerce Product Filter
- Affected
- up to 1.5.5
- What to do
- Affects up to 1.5.5. Update Themify – WooCommerce Product Filter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 11, 2026Unlimited Elements For Elementor: Reflected Cross-Site ScriptingCVE-2026-77150 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Unlimited Elements For Elementor plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'data[name]' Parameter in all versions up to, and including, 2.0.16 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. The show_preview AJAX action is registered for unauthenticated users and is gated only by a nonce, which an unauthenticated attacker can retrieve by loading any publicly accessible page that emits it.
- Product
- Unlimited Elements For Elementor
- Affected
- up to 2.0.16
- What to do
- Affects up to 2.0.16. Update Unlimited Elements For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 11, 2026UsersWP: Arbitrary File DeletionCVE-2026-19991 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The UsersWP plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 1.2.70 via the upload_file_remove() AJAX handler. The plugin stores the value of an account 'file' form field taken directly from $_POST when no real $_FILES upload is provided (process_account() calls uwp_validate_fields() and array_merges the result with the empty output of UsersWP_Files::validate_uploads()). At storage time the value is only checked with validate_file(), which passes any string that does not contain a literal '../'. When the value is later processed by upload_file_remove(), it is again gated with validate_file() and then normalized through uwp_get_file_relative_url(); that helper performs a global str_replace() of the uploads base URL against the stored URL, allowing a crafted URL containing embedded '..<uploads-baseurl>' tokens to collapse into '../../' traversal sequences after the last validation. The transformed value is then appended to the uploads base directory and passed to wp_delete_file() without any canonical containment check. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files o
- Product
- UsersWP
- Affected
- up to 1.2.70
- What to do
- Affects up to 1.2.70. Update UsersWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 11, 2026Relevanssi – A Better Search: Reflected Cross-Site ScriptingCVE-2026-19985 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Relevanssi – A Better Search plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 4.28.1 via the 's', 'post_types', and 'orderby' request parameters. This is due to insufficient input sanitization and output escaping in the relevanssi_debug_array() function in lib/debug.php, which dumps user-supplied query variables through print_r() inside a <pre> block without HTML escaping. The debug path is enabled by supplying the relevanssi_debug=on request parameter when the administrator has previously enabled the 'Debugging mode' setting; the gate itself is a configuration check with no capability, nonce, or logged-in check (the vendor explicitly suppresses nonce verification on that line). This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a specially crafted link.
- Product
- Relevanssi – A Better Search
- Affected
- up to 4.28.1
- What to do
- Affects up to 4.28.1. Update Relevanssi – A Better Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 11, 2026Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button – Chaty: Reflected Cross-Site ScriptingCVE-2026-18964 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button – Chaty plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in all versions up to, and including, 3.5.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. WordPress's server-side HTML encoding of the 's' search parameter in the <title> element is bypassed because the browser DOM API decodes HTML entities when jQuery's .text() method reads document.title, returning literal special characters that are then embedded unescaped into the constructed HTML attribute value.
- Product
- Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button – Chaty
- Affected
- up to 3.5.9
- What to do
- Affects up to 3.5.9. Update Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button – Chaty to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 11, 2026WP Photo Album Plus: Stored Cross-Site ScriptingCVE-2026-18579 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The WP Photo Album Plus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'HTTP_X_FORWARDED_FOR' parameter in all versions up to, and including, 9.2.08.003 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The nonce failure path for the getshortcodedrenderedfenodelay action serves as the log-write trigger rather than an access barrier — a deliberately failed nonce check causes wppa_log() to record the attacker-supplied X-Forwarded-For value to disk, making the exploit fully reachable by unauthenticated callers via the wp_ajax_nopriv_wppa endpoint.
- Product
- WP Photo Album Plus
- Affected
- up to 9.2.08.003
- What to do
- Affects up to 9.2.08.003. Update WP Photo Album Plus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 11, 2026HUSKY – Products Filter Professional for WooCommerce: Reflected Cross-Site ScriptingCVE-2026-18562 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via SEO-friendly permalink filter URL segments in versions up to, and including, 1.4.3. This is due to insufficient input sanitization and output escaping in the wp_load_js() function, which reads filter values from the URL path via the url_request extension's parse_url_query() and embeds them into an inline JavaScript string using json_encode() without escaping single quotes. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a specially crafted link.
- Product
- HUSKY – Products Filter Professional for WooCommerce
- Affected
- up to 1.4.3
- What to do
- Affects up to 1.4.3. Update HUSKY – Products Filter Professional for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 11, 2026Unlimited Elements For Elementor: SQL InjectionCVE-2026-18561 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Unlimited Elements For Elementor plugin for WordPress is vulnerable to SQL Injection via the 'addontype' parameter in versions up to, and including, 2.0.16. This is due to insufficient escaping on the user-supplied parameter and the lack of sufficient preparation on the existing SQL query in the getWhereString() function; when the parameter is supplied as an array, element zero is used verbatim as the SQL comparison operator and concatenated into the WHERE clause without sanitization, while normalizeAjaxInputData() strips WordPress's magic_quotes protection from the value. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- Unlimited Elements For Elementor
- Affected
- up to 2.0.16
- What to do
- Affects up to 2.0.16. Update Unlimited Elements For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 11, 2026Sticky Chat Widget: SQL InjectionCVE-2026-15462 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Sticky Chat Widget plugin for WordPress is vulnerable to SQL Injection via the 'scw_form_fields' parameter array keys of the 'scw_save_form_data' AJAX action in versions up to, and including, 1.4.2. This is due to the save_form_data() function passing attacker-controlled POST array keys unsanitized to $wpdb->insert(), which wraps column identifiers in backticks without escaping them, allowing a backtick in an attacker-supplied key to break out of the column-identifier list into raw SQL; additionally, the use of filter_input() bypasses WordPress's wp_magic_quotes() protection, and the widget_id validation loop is skipped entirely when no valid widget_id is supplied, leaving $isValid at 1. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- Sticky Chat Widget
- Affected
- up to 1.4.2
- What to do
- Affects up to 1.4.2. Update Sticky Chat Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 11, 2026OTP Login & Register Woocommerce: Authentication BypassCVE-2026-12215 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The OTP Login & Register Woocommerce plugin for WordPress is vulnerable to Authentication Bypass via OTP Brute Force in all versions up to, and including, 2.7.2. The vulnerability exists because the OTP rate-limit attempt counter in `process_otp_form` is keyed exclusively on the attacker-controlled `xoo_ml_user_ip_data` cookie's `ip_address` field, allowing unlimited counter resets by simply rotating the cookie, while the OTP itself is generated with PHP's non-cryptographic `rand()` function over a default space of only 9,000 possible values (1000–9999), and both the OTP issuance endpoint (`xoo_ml_login_with_otp`) and verification endpoint (`xoo_ml_otp_form_submit`) are registered as unauthenticated `wp_ajax_nopriv` actions with no nonce or capability checks. This makes it possible for unauthenticated attackers to brute-force the OTP for any registered account and obtain a full WordPress authentication session — including for administrator accounts — via `wp_set_auth_cookie()` in `login_user_with_otp()`. Exploitation requires the attacker to know the target user's registered phone number, which is used to trigger OTP issuance via the unauthenticated `xoo_ml_login_with_otp` endpoint
- Product
- OTP Login & Register Woocommerce
- Affected
- up to 2.7.2
- What to do
- Affects up to 2.7.2. Update OTP Login & Register Woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.