Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
4,127 results · page 8 of 83
Sep 18, 2026VikBooking Hotel Booking Engine & PMS: Does not restrict the type of files unauthenticated visitors may attach to its live chatCVE-2026-85127 · WordPress plugins & themes · reported by WPScanHigh 8.8
The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.8.15 does not restrict the type of files unauthenticated visitors may attach to its live chat, nor sanitize their contents, allowing them to store active content which is executed in the context of an administrator viewing the conversation.
- Product
- VikBooking Hotel Booking Engine & PMS
- Fixed in
- 1.8.15
- What to do
- Update VikBooking Hotel Booking Engine & PMS to 1.8.15 or newer.
Sep 17, 2026The To Do List Member WordPress plugin from 1.4 through 1.6 ships a file upload endpoint that does not load WordPress and therefore applies no authentication, cCVE-2026-86801 · WordPress plugins & themes · reported by WPScanHigh 8.8
The To Do List Member WordPress plugin from 1.4 through 1.6 ships a file upload endpoint that does not load WordPress and therefore applies no authentication, capability or nonce check of any kind, and validates only the name of an uploaded file rather than its content, allowing unauthenticated users to store active content served from the site's own origin, and to list and delete the files already staged there.
- Affected
- up to 1.6
- What to do
- Affects up to 1.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 17, 2026Motors: Does not verify that a request is authorized to view a user's non-published listings before returning themCVE-2026-91016 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Motors WordPress plugin before 1.4.121 does not verify that a request is authorized to view a user's non-published listings before returning them, allowing unauthenticated attackers to read any author's draft, pending and private car listings - including titles, prices, media URLs and seller notes - by supplying only the target's numeric user id.
- Product
- Motors
- Fixed in
- 1.4.121
- What to do
- Update Motors to 1.4.121 or newer.
Sep 17, 2026Master Addons for Elementor: Does not perform an authorization check on the AJAX action that deactivates its Popup Builder popupsCVE-2026-91015 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Master Addons for Elementor WordPress plugin before 3.1.9 does not perform an authorization check on the AJAX action that deactivates its Popup Builder popups, relying only on a nonce that is publicly output to every visitor, allowing unauthenticated attackers to permanently disable any popup on the site.
- Product
- Master Addons for Elementor
- Fixed in
- 3.1.9
- What to do
- Update Master Addons for Elementor to 3.1.9 or newer.
Sep 17, 2026Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms: Does not check the user's capabilities in its message deletion AJAX actionCVE-2026-91010 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms WordPress plugin before 5.1.1 does not check the user's capabilities in its message deletion AJAX action, and only tests that a nonce parameter is present rather than validating it, allowing any authenticated user, such as a subscriber, to permanently delete every form submission the Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms WordPress plugin before 5.1.1 has stored.
- Product
- Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms
- Fixed in
- 5.1.1
- What to do
- Update Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms to 5.1.1 or newer.
Sep 17, 2026Active Woot Products Tables for WooCommerce. 100% FREE: Does not have authorisation and CSRF checks in some of its AJAX actionsCVE-2026-91009 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Active Woot Products Tables for WooCommerce. 100% FREE WordPress plugin before 2.1.3 does not have authorisation and CSRF checks in some of its AJAX actions, allowing any authenticated users, such as subscriber, to change the title of arbitrary posts, pages and products.
- Product
- Active Woot Products Tables for WooCommerce. 100% FREE
- Fixed in
- 2.1.3
- What to do
- Update Active Woot Products Tables for WooCommerce. 100% FREE to 2.1.3 or newer.
Sep 17, 2026Paid Membership Subscriptions: Does not verify that the amount and currency reported by the payment provider match the pending payment before completing itCVE-2026-90922 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Paid Membership Subscriptions WordPress plugin before 3.0.9 does not verify that the amount and currency reported by the payment provider match the pending payment before completing it, allowing unauthenticated users to obtain a paid membership by paying an arbitrary lower amount.
- Product
- Paid Membership Subscriptions
- Fixed in
- 3.0.9
- What to do
- Update Paid Membership Subscriptions to 3.0.9 or newer.
Sep 17, 2026PuppyFW: Does not have proper authorisation on one of its REST routesCVE-2026-88904 · WordPress plugins & themes · reported by WPScanHigh 8.8
The PuppyFW WordPress plugin through 0.4.4 does not have proper authorisation on one of its REST routes, which tests the caller against a capability taken from the request itself, allowing any authenticated user, including subscribers, to add, modify and delete arbitrary blog options and thereby escalate their privileges.
- Product
- PuppyFW
- Affected
- up to 0.4.4
- What to do
- Affects up to 0.4.4. Update PuppyFW to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 17, 2026Dictionary: Does not have authorisationCVE-2026-88792 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Dictionary WordPress plugin through 1.0 does not have authorisation, sanitisation or escaping in place when adding or updating dictionary entries, allowing unauthenticated users to store arbitrary web scripts which will execute when a user views an affected entry.
- Product
- Dictionary
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Dictionary to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 17, 2026Newsletter: Does not generate its email tracking signing key with sufficient entropy and signs its tracking links with an unkeyed hashCVE-2026-86824 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Newsletter WordPress plugin before 9.3.8 does not generate its email tracking signing key with sufficient entropy and signs its tracking links with an unkeyed hash, allowing an unauthenticated attacker who recovers that key offline to forge tracking links, obtain any subscriber's session token, and read and modify that subscriber's stored personal data.
- Product
- Newsletter
- Fixed in
- 9.3.8
- What to do
- Update Newsletter to 9.3.8 or newer.
Sep 17, 2026Login with QR: Does not verify that the code used to log a user in is one it issuedCVE-2026-86710 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Login with QR WordPress plugin through 1.0.0 does not verify that the code used to log a user in is one it issued, matching any stored user metadata value instead, which allows unauthenticated attackers to log in as any user, including administrators.
- Product
- Login with QR
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Login with QR to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 17, 2026Pressengine: Does not stop its login handler from issuing a sessionCVE-2026-86709 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Pressengine WordPress plugin through 1.0 does not stop its login handler from issuing a session when authentication fails, allowing unauthenticated attackers to log in as any user, including administrators.
- Product
- Pressengine
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Pressengine to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 17, 2026Private Feed Key: Does not verify that the key used to authenticate a feed request is one it issuedCVE-2026-86707 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Private Feed Key WordPress plugin through 0.1 does not verify that the key used to authenticate a feed request is one it issued, matching any stored user metadata value instead, which allows unauthenticated attackers to log in as any user, including administrators.
- Product
- Private Feed Key
- Affected
- up to 0.1
- What to do
- Affects up to 0.1. Update Private Feed Key to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 16, 2026In AVideo through 29.0, the autoCSRFGuard() function maintains a hardcoded allowlist of exempt basenames tested without directory context, allowing plugin filesCVE-2026-92579 · WordPress plugins & themes · reported by VulnCheckMedium 5.3
In AVideo through 29.0, the autoCSRFGuard() function maintains a hardcoded allowlist of exempt basenames tested without directory context, allowing plugin files matching core filenames to inherit CSRF exemptions. The LoginWordPress plugin file login.json.php inherits an exemption and unconditionally logs out authenticated users on cross-site POST requests before validating credentials.
- Affected
- up to 29.0
- What to do
- Affects up to 29.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.comvulncheck.com
Sep 16, 2026Eventin: Does not verify that a completed payment corresponds to the order it is applied toCVE-2026-84906 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Eventin WordPress plugin before 4.1.24 does not verify that a completed payment corresponds to the order it is applied to, confirming only that the payment gateway reports the transaction as successful, not its amount, currency, or which order it belongs to, allowing unauthenticated visitors to mark unpaid orders of any value as paid by replaying the transaction of a single genuine low-value payment.
- Product
- Eventin
- Fixed in
- 4.1.24
- What to do
- Update Eventin to 4.1.24 or newer.
Sep 16, 2026FluentBoards: Does not properly verify that a user holds board-manager privileges before performing several board-management operationsCVE-2026-89328 · WordPress plugins & themes · reported by WPScanLow 3.8
The FluentBoards WordPress plugin before 2.0.15 does not properly verify that a user holds board-manager privileges before performing several board-management operations, checking only board membership. This allows any member of a board to carry out manager-only actions on it, including adding or removing members and enabling public access to a private board.
- Product
- FluentBoards
- Fixed in
- 2.0.15
- What to do
- Update FluentBoards to 2.0.15 or newer.
Sep 16, 2026FluentBoards: Does not verify that a board member submitting a comment is the user the comment is attributed toCVE-2026-89327 · WordPress plugins & themes · reported by WPScanLow 3.8
The FluentBoards WordPress plugin before 2.0.15 does not verify that a board member submitting a comment is the user the comment is attributed to, allowing any board member to post comments that appear to be authored by another user, including administrators.
- Product
- FluentBoards
- Fixed in
- 2.0.15
- What to do
- Update FluentBoards to 2.0.15 or newer.
Sep 16, 2026WPBot: Does not perform a capability check on the AJAX action that saves its Claude AI provider settingsCVE-2026-87959 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WPBot WordPress plugin before 8.7.6 does not perform a capability check on the AJAX action that saves its Claude AI provider settings, allowing users with subscriber-level access to overwrite those settings, including the API key used for the WPBot WordPress plugin before 8.7.6's outgoing AI requests.
- Product
- WPBot
- Fixed in
- 8.7.6
- What to do
- Update WPBot to 8.7.6 or newer.
Sep 16, 2026Rox Appointment Booking: Does not perform any authorization check on the endpoints that return booking service and category recordsCVE-2026-87907 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Rox Appointment Booking WordPress plugin before 1.2.8 does not perform any authorization check on the endpoints that return booking service and category records, allowing unauthenticated attackers to read the private internal notes stored on each service and category.
- Product
- Rox Appointment Booking
- Fixed in
- 1.2.8
- What to do
- Update Rox Appointment Booking to 1.2.8 or newer.
Sep 16, 2026Rox Appointment Booking: Does not perform any authorization check on the endpoint that returns booking agent (staff) recordsCVE-2026-87896 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Rox Appointment Booking WordPress plugin before 1.2.8 does not perform any authorization check on the endpoint that returns booking agent (staff) records, allowing unauthenticated attackers to read staff email addresses, phone numbers, private internal notes and the linked WordPress account name for every agent.
- Product
- Rox Appointment Booking
- Fixed in
- 1.2.8
- What to do
- Update Rox Appointment Booking to 1.2.8 or newer.
Sep 16, 2026Subscriptions for WooCommerce: Does not verify the security token on the request that cancels a subscriptionCVE-2026-87860 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Subscriptions for WooCommerce WordPress plugin before 2.0.3 does not verify the security token on the request that cancels a subscription, allowing attackers to make a logged-in customer cancel their own active subscription through a crafted request they are tricked into making.
- Product
- Subscriptions for WooCommerce
- Fixed in
- 2.0.3
- What to do
- Update Subscriptions for WooCommerce to 2.0.3 or newer.
Sep 16, 2026Subscriptions for WooCommerce: Does not correctly validate the shared secret protecting one of its REST endpointsCVE-2026-87854 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Subscriptions for WooCommerce WordPress plugin before 2.0.3 does not correctly validate the shared secret protecting one of its REST endpoints, allowing unauthenticated users to retrieve the store's full list of subscriptions, including customer usernames, product names, recurring amounts and payment dates.
- Product
- Subscriptions for WooCommerce
- Fixed in
- 2.0.3
- What to do
- Update Subscriptions for WooCommerce to 2.0.3 or newer.
Sep 16, 2026Visualizer: Does not sanitise and escape a chart's JSON data source configuration before outputting it back in the chart editorCVE-2026-86784 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Visualizer WordPress plugin before 4.0.8 does not sanitise and escape a chart's JSON data source configuration before outputting it back in the chart editor, allowing users with the Contributor role and above to store JavaScript that executes in the browser of any higher-privileged user, such as an administrator, who reviews the affected chart.
- Product
- Visualizer
- Fixed in
- 4.0.8
- What to do
- Update Visualizer to 4.0.8 or newer.
Sep 16, 2026LearnPress: Does not check the user's capabilities in one of its administrative template handlersCVE-2026-86445 · WordPress plugins & themes · reported by WPScanMedium 5.3
The LearnPress WordPress plugin before 4.4.7 does not check the user's capabilities in one of its administrative template handlers, allowing unauthenticated attackers to retrieve the text, identifier and type of every published quiz question on the site, along with a keyword search over them, which is content the LearnPress WordPress plugin before 4.4.7 otherwise keeps non-public.
- Product
- LearnPress
- Fixed in
- 4.4.7
- What to do
- Update LearnPress to 4.4.7 or newer.
Sep 16, 2026Tutor LMS: Does not check that a user has access to a course before returning its lesson discussion contentCVE-2026-85572 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Tutor LMS WordPress plugin before 4.0.8 does not check that a user has access to a course before returning its lesson discussion content, allowing any authenticated user, such as a subscriber, to read comments from courses they are not enrolled in, including comments awaiting moderation.
- Product
- Tutor LMS
- Fixed in
- 4.0.8
- What to do
- Update Tutor LMS to 4.0.8 or newer.
Sep 16, 2026GiveWP: Does not consistently normalise a donor's e-mail address between the value it stores and the value it later uses to look that donor upCVE-2026-85530 · WordPress plugins & themes · reported by WPScanHigh 8.1
The GiveWP WordPress plugin before 4.16.8.1 does not consistently normalise a donor's e-mail address between the value it stores and the value it later uses to look that donor up, allowing unauthenticated users to be resolved as an arbitrary donor and to set the WordPress password of any user account linked to one, including an administrator's.
- Product
- GiveWP
- Fixed in
- 4.16.8.1
- What to do
- Update GiveWP to 4.16.8.1 or newer.
Sep 16, 2026Schema & Structured Data for WP & AMP: Does not check that a user is allowed to edit the specific post they request schema generation forCVE-2026-82126 · WordPress plugins & themes · reported by WPScanLow 2.7
The Schema & Structured Data for WP & AMP WordPress plugin before 1.66 does not check that a user is allowed to edit the specific post they request schema generation for, allowing users with the contributor role and above to obtain the content of other users' draft, pending, private and password protected posts.
- Product
- Schema & Structured Data for WP & AMP
- Fixed in
- 1.66
- What to do
- Update Schema & Structured Data for WP & AMP to 1.66 or newer.
Sep 16, 2026Ni WooCommerce Sales Report: Does not have any authentication or authorisation checks on one of its report-printing routinesCVE-2026-78474 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Ni WooCommerce Sales Report WordPress plugin before 4.2.0 does not have any authentication or authorisation checks on one of its report-printing routines, allowing unauthenticated users to retrieve WooCommerce order details and customer contact information, to target an individual order, and to search the store's orders by customer name or email address.
- Product
- Ni WooCommerce Sales Report
- Fixed in
- 4.2.0
- What to do
- Update Ni WooCommerce Sales Report to 4.2.0 or newer.
Sep 16, 2026Eventin: Does not prevent the token issued to a guest at checkout from being used to change that order's tickets afterwardsCVE-2026-77702 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Eventin WordPress plugin before 4.1.24 does not prevent the token issued to a guest at checkout from being used to change that order's tickets afterwards, allowing unauthenticated users to replace a paid ticket with a free one and complete the order at no charge.
- Product
- Eventin
- Fixed in
- 4.1.24
- What to do
- Update Eventin to 4.1.24 or newer.
Sep 16, 2026MultiVendorX: Does not verify that a user owns the store they are acting on in one of its REST API routesCVE-2026-74926 · WordPress plugins & themes · reported by WPScanHigh 7.1
The MultiVendorX WordPress plugin before 5.0.16 does not verify that a user owns the store they are acting on in one of its REST API routes, allowing any authenticated user, such as a subscriber, to overwrite any store's details and payout settings and to replace the record of who owns it.
- Product
- MultiVendorX
- Fixed in
- 5.0.16
- What to do
- Update MultiVendorX to 5.0.16 or newer.
Sep 16, 2026Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots: Reflected Cross-Site ScriptingCVE-2026-18555 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'icn' parameter in all versions up to, and including, 2.15.22 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots
- Affected
- up to 2.15.22
- What to do
- Affects up to 2.15.22. Update Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Sep 15, 2026AI Engine – The Chatbot, AI Framework & MCP for: Insecure Direct Object ReferenceCVE-2026-89141 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.7.7 via the 'mediaId' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with subscriber-level access and above, to access and retrieve the transcribed contents of private audio attachments belonging to other users, including Administrators, via a supplied attachment ID. This vulnerability requires the Public API module to be enabled in the plugin settings; when disabled, the REST route is absent and the endpoint returns HTTP 404.
- Product
- AI Engine – The Chatbot, AI Framework & MCP for
- Affected
- up to 3.7.7
- What to do
- Affects up to 3.7.7. Update AI Engine – The Chatbot, AI Framework & MCP for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 13, 2026The Hoo Companion WordPress plugin 1.0.2 does not have any authorisation or validation checks in one of its import features, and does not sanitise the data submCVE-2026-85129 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Hoo Companion WordPress plugin 1.0.2 does not have any authorisation or validation checks in one of its import features, and does not sanitise the data submitted to it before storing it as the active theme's settings, allowing unauthenticated attackers to inject arbitrary web scripts which will execute for anyone viewing the site, including administrators. The same request destroys the site's existing theme settings.
- What to do
- Update the plugin to the newest version.
Sep 13, 2026The GenieWords WordPress plugin from 1.5.27 to 1.5.34 does not have authorisation checks on some of its REST API and AJAX actions, and decodes stored values befCVE-2026-74933 · WordPress plugins & themes · reported by WPScanHigh 8.8
The GenieWords WordPress plugin from 1.5.27 to 1.5.34 does not have authorisation checks on some of its REST API and AJAX actions, and decodes stored values before printing them, allowing unauthenticated users to overwrite its configuration and inject arbitrary web scripts that execute on every front-end page.
- What to do
- Update the plugin to the newest version.
Sep 13, 2026rtMedia for WordPress, BuddyPress and bbPress: Does not check ownership before changing the privacy level of an activity and its attached mediaCVE-2026-88912 · WordPress plugins & themes · reported by WPScanMedium 4.2
The rtMedia for WordPress, BuddyPress and bbPress WordPress plugin before 4.7.12 does not check ownership before changing the privacy level of an activity and its attached media, relying only on a nonce shared with every logged-in user, allowing users with a subscriber-level account or above to make another user's private activity public or hide it.
- Product
- rtMedia for WordPress, BuddyPress and bbPress
- Fixed in
- 4.7.12
- What to do
- Update rtMedia for WordPress, BuddyPress and bbPress to 4.7.12 or newer.
Sep 13, 2026Simple Membership: Does not validate that the membership level supplied in a PayPal payment notification matches the level configured for the paid payment buttonCVE-2026-88764 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Simple Membership WordPress plugin before 4.7.8 does not validate that the membership level supplied in a PayPal payment notification matches the level configured for the paid payment button, allowing members to pay for a lower-priced membership while being granted a higher, more privileged membership level.
- Product
- Simple Membership
- Fixed in
- 4.7.8
- What to do
- Update Simple Membership to 4.7.8 or newer.
Sep 13, 2026User Registration & Membership: Does not verify that the visitor requesting its membership confirmation page owns the account named in the requestCVE-2026-86407 · WordPress plugins & themes · reported by WPScanLow 3.7
The User Registration & Membership WordPress plugin before 5.2.8 does not verify that the visitor requesting its membership confirmation page owns the account named in the request, nor that any registration or purchase has taken place, allowing unauthenticated users to retrieve another user's email address, profile fields, role and membership order details. Exploitation requires the site owner to have added a user smart tag to that page's configurable message, which the shipped default does not contain.
- Product
- User Registration & Membership
- Fixed in
- 5.2.8
- What to do
- Update User Registration & Membership to 5.2.8 or newer.
Sep 13, 2026User Registration & Membership: Does not check the capability of the user making a membership purchaseCVE-2026-86406 · WordPress plugins & themes · reported by WPScanHigh 7.5
The User Registration & Membership WordPress plugin before 5.2.8 does not check the capability of the user making a membership purchase, and does not validate the payment method or the plan submitted with it, allowing any authenticated user such as a subscriber to be granted the WordPress role attached to a paid plan without paying for it. Where the site owner has mapped a plan to a privileged role, this leads to privilege escalation up to administrator.
- Product
- User Registration & Membership
- Fixed in
- 5.2.8
- What to do
- Update User Registration & Membership to 5.2.8 or newer.
Sep 13, 2026Contact Form to Chat Apps | Click to Chat to Order: Does not perform any capabilityCVE-2026-77773 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Contact Form to Chat Apps | Click to Chat to Order WordPress plugin before 2.15.8 does not perform any capability, nonce or session check on one of its public AJAX actions, allowing unauthenticated users to read the submitted entries of any form created with a supported third-party form Contact Form to Chat Apps | Click to Chat to Order WordPress plugin before 2.15.8.
- Product
- Contact Form to Chat Apps | Click to Chat to Order
- Fixed in
- 2.15.8
- What to do
- Update Contact Form to Chat Apps | Click to Chat to Order to 2.15.8 or newer.
Sep 12, 2026WPBot: Does not perform any authorization or nonce check on several AJAX actions that relay prompts to its configured AI providersCVE-2026-87918 · WordPress plugins & themes · reported by WPScanMedium 5.3
The WPBot WordPress plugin before 8.5.7 does not perform any authorization or nonce check on several AJAX actions that relay prompts to its configured AI providers, allowing unauthenticated attackers to make those third-party API calls, and consume the associated cost, using the site's own configured API keys.
- Product
- WPBot
- Fixed in
- 8.5.7
- What to do
- Update WPBot to 8.5.7 or newer.
Sep 12, 2026WPBot: Does not perform any capability or nonce check on the AJAX action that lists stored chat sessionsCVE-2026-87916 · WordPress plugins & themes · reported by WPScanMedium 5.3
The WPBot WordPress plugin before 8.6.0 does not perform any capability or nonce check on the AJAX action that lists stored chat sessions, allowing unauthenticated attackers to retrieve the name, email address and phone number of every chat visitor by requesting a wide date range.
- Product
- WPBot
- Fixed in
- 8.6.0
- What to do
- Update WPBot to 8.6.0 or newer.
Sep 12, 2026Rox Appointment Booking: Does not perform any authorization check on the endpoint that returns a booking's confirmation detailsCVE-2026-87894 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Rox Appointment Booking WordPress plugin before 1.2.3 does not perform any authorization check on the endpoint that returns a booking's confirmation details, and each booking is addressed by a sequential numeric identifier, allowing unauthenticated attackers to read any customer's name, email, phone, booking details and payment status by enumerating that identifier.
- Product
- Rox Appointment Booking
- Fixed in
- 1.2.3
- What to do
- Update Rox Appointment Booking to 1.2.3 or newer.
Sep 12, 2026YayPricing: Does not perform an authorization check on a REST route that saves its pricing rulesCVE-2026-87888 · WordPress plugins & themes · reported by WPScanHigh 8
The YayPricing WordPress plugin before 3.5.7 does not perform an authorization check on a REST route that saves its pricing rules, allowing users with the subscriber role and above to store JavaScript that executes in the browser of an administrator who opens the YayPricing WordPress plugin before 3.5.7's settings page.
- Product
- YayPricing
- Fixed in
- 3.5.7
- What to do
- Update YayPricing to 3.5.7 or newer.
Sep 12, 2026WP Component: Does not have any capability or nonce checks on one of the actions it makes available to unauthenticated usersCVE-2026-85681 · WordPress plugins & themes · reported by WPScanCritical 9.8
The WP Component WordPress plugin through 2.2.4 does not have any capability or nonce checks on one of the actions it makes available to unauthenticated users, and it takes both the option name and the option value from the request, allowing unauthenticated attackers to overwrite any of the site's options. On a single site installation this leads to a full takeover, as registration can be enabled with a default role of administrator.
- Product
- WP Component
- Affected
- up to 2.2.4
- What to do
- Affects up to 2.2.4. Update WP Component to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 12, 2026BEAR: Does not perform ownership checks on several handlers that return product data by a user-supplied identifierCVE-2026-84025 · WordPress plugins & themes · reported by WPScanLow 2.2
The BEAR WordPress plugin before 1.2.2 does not perform ownership checks on several handlers that return product data by a user-supplied identifier, allowing users who are restricted to their own products to read other owners' product information, including protected downloadable file URLs and private product metadata.
- Product
- BEAR
- Fixed in
- 1.2.2
- What to do
- Update BEAR to 1.2.2 or newer.
Sep 12, 2026Yogeta WP Cloud: Does not validate a user-supplied file path before passing it to a file-read function on a public endpoint that lacks any authorization checkCVE-2026-80494 · WordPress plugins & themes · reported by WPScanHigh 8.6
The Yogeta WP Cloud WordPress plugin through 1.0 does not validate a user-supplied file path before passing it to a file-read function on a public endpoint that lacks any authorization check, allowing unauthenticated attackers to download arbitrary files from the server, including files containing sensitive credentials.
- Product
- Yogeta WP Cloud
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Yogeta WP Cloud to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 12, 2026Temporary Login Without Password: Does not verify that the user requesting a temporary login holds network super admin rights before granting the new account those rightsCVE-2026-77752 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Temporary Login Without Password WordPress plugin before 1.9.9 does not verify that the user requesting a temporary login holds network super admin rights before granting the new account those rights, allowing an administrator of a single site on a multisite network to take over the whole network. The same missing check also allows an existing account, including the attacker's own, to be promoted.
- Product
- Temporary Login Without Password
- Fixed in
- 1.9.9
- What to do
- Update Temporary Login Without Password to 1.9.9 or newer.
Sep 12, 2026Booking for Appointments and Events Calendar: Does not verify that the user editing a customer or employee record is entitled to modify the WordPress account linked to itCVE-2026-77705 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Booking for Appointments and Events Calendar WordPress plugin before 2.4.10 does not verify that the user editing a customer or employee record is entitled to modify the WordPress account linked to it, allowing users holding Amelia's customer or employee management permissions to set the password and email address of other users' WordPress accounts and take them over.
- Product
- Booking for Appointments and Events Calendar
- Fixed in
- 2.4.10
- What to do
- Update Booking for Appointments and Events Calendar to 2.4.10 or newer.
Sep 12, 2026Booking for Appointments and Events Calendar: Does not verify that a payment was actually taken before recording a bookingCVE-2026-77689 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Booking for Appointments and Events Calendar WordPress plugin before 9.8.1 does not verify that a payment was actually taken before recording a booking as paid, trusting the payment gateway named in a public, unauthenticated booking request even when the site has never configured that gateway. This lets an unauthenticated attacker obtain confirmed, fully paid appointments and events without any payment being collected.
- Product
- Booking for Appointments and Events Calendar
- Fixed in
- 9.8.1
- What to do
- Update Booking for Appointments and Events Calendar to 9.8.1 or newer.
Sep 11, 2026MetForm: Does not properly neutralize newline characters in user-submitted values that are placed into notification email headersCVE-2026-86813 · WordPress plugins & themes · reported by WPScanMedium 4.8
The MetForm WordPress plugin before 4.1.9 does not properly neutralize newline characters in user-submitted values that are placed into notification email headers, allowing unauthenticated attackers to inject additional email headers, such as Bcc, into the emails the site sends when a submitted field value is configured to populate a header.
- Product
- MetForm
- Fixed in
- 4.1.9
- What to do
- Update MetForm to 4.1.9 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.