Updated 4 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

544new WordPress flaws this week

391,181entries in the database

7,698 results · page 8 of 154

Oct 6, 2026Unauthenticated Sensitive Data Exposure in Xserver Migrator <= 1.6.6 versions.CVE-2026-102387 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Sensitive Data Exposure in Xserver Migrator <= 1.6.6 versions.
Affected
up to 1.6.6
What to do
Affects up to 1.6.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 6, 2026Slider Pro: Does not perform any capability or authorisation check on one of its AJAX actionsCVE-2026-86786 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Slider Pro WordPress plugin through 1.0.0 does not perform any capability or authorisation check on one of its AJAX actions, allowing unauthenticated users to retrieve the title, excerpt and permalink of non-public posts, including drafts, pending, scheduled, private and trashed posts, as well as post revisions and media metadata.
Product
Slider Pro
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Slider Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Oct 6, 2026ACPT (Premium): Remote Code ExecutionCVE-2026-105701 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The ACPT (Premium) plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.0.66 via the render function. This is due to missing capability check on the REST API form creation endpoint and unsandboxed Twig environment rendering email templates. This makes it possible for authenticated attackers, with subscriber-level access and above, to execute code on the server. The exploit requires the attacker to first create a form with malicious email_settings via the REST API endpoint, then trigger form submission to execute the injected Twig expressions.
Product
ACPT (Premium)
Affected
up to 2.0.66
What to do
Affects up to 2.0.66. Update ACPT (Premium) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record acpt.io wordfence.com
Oct 6, 2026Unauthenticated Sensitive Data Exposure in Sitemovr <= 1.0.1 versions.CVE-2026-41563 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Sensitive Data Exposure in Sitemovr <= 1.0.1 versions.
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 6, 2026Unauthenticated Cross Site Scripting (XSS) in Real 3D FlipBook <= 5.5 versions.CVE-2026-39760 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Real 3D FlipBook <= 5.5 versions.
Affected
up to 5.5
What to do
Affects up to 5.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 5, 2026WP Ultimate Exporter: Deserialization of Untrusted DataCVE-2026-103348 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Deserialization of Untrusted Data vulnerability in Smackcoders Inc. WP Ultimate Exporter wp-ultimate-exporter allows Object Injection.This issue affects WP Ultimate Exporter: from n/a through 3.0.
Product
WP Ultimate Exporter
Affected
up to 3.0
What to do
Affects up to 3.0. Update WP Ultimate Exporter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 5, 2026WP Event Solution: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2026-105073 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Arraytics WP Event Solution wp-event-solution allows Retrieve Embedded Sensitive Data.This issue affects WP Event Solution: from n/a through 4.1.25.
Product
WP Event Solution
Affected
up to 4.1.25
What to do
Affects up to 4.1.25. Update WP Event Solution to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 5, 2026Unlimited Elements For Elementor (Free Widgets, Addons, Templates): Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')CVE-2026-105064 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor allows Parameter Injection.This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 2.0.22.
Product
Unlimited Elements For Elementor (Free Widgets, Addons, Templates)
Affected
up to 2.0.22
What to do
Affects up to 2.0.22. Update Unlimited Elements For Elementor (Free Widgets, Addons, Templates) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 5, 2026Memberful - Membership: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2026-104401 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Memberful Memberful - Membership Plugin memberful-wp allows Retrieve Embedded Sensitive Data.This issue affects Memberful - Membership Plugin: from n/a through 1.81.2.
Product
Memberful - Membership
Affected
up to 1.81.2
What to do
Affects up to 1.81.2. Update Memberful - Membership to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 5, 2026Taxi Booking Manager for WooCommerce: Improper Validation of Specified Quantity in InputCVE-2026-103351 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Improper Validation of Specified Quantity in Input vulnerability in Magepeople inc. Taxi Booking Manager for WooCommerce ecab-taxi-booking-manager allows Input Data Manipulation.This issue affects Taxi Booking Manager for WooCommerce: from n/a through 2.1.1.
Product
Taxi Booking Manager for WooCommerce
Affected
up to 2.1.1
What to do
Affects up to 2.1.1. Update Taxi Booking Manager for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 4, 2026Horizontal scrolling announcements: Does not sanitise and escape one of its announcement settings before outputting it into an attribute context on the front endCVE-2026-17005 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Horizontal scrolling announcements WordPress plugin through 2.6 does not sanitise and escape one of its announcement settings before outputting it into an attribute context on the front end, allowing users granted access to the announcement management page (Contributor and above, once permitted) to perform Stored Cross-Site Scripting attacks that execute in the browser of anyone viewing the announcement.
Product
Horizontal scrolling announcements
Affected
up to 2.6
What to do
Affects up to 2.6. Update Horizontal scrolling announcements to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Oct 3, 2026The Beaver Builder Page Builder – Drag and Drop Website Builder: Arbitrary shortcode executionCVE-2026-92084 · WordPress plugins & themes · reported by WordfenceCritical 9.1
The The Beaver Builder Page Builder – Drag and Drop Website Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.11.0.5. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. Exploitation requires the target site to have a Beaver Builder page containing the Sidebar module populated with a widget that displays attacker-controllable text, such as the core Recent Comments widget, with comment moderation disabled or the attacker's comment approved.
Product
The Beaver Builder Page Builder – Drag and Drop Website Builder
Affected
up to 2.11.0.5
What to do
Affects up to 2.11.0.5. Update The Beaver Builder Page Builder – Drag and Drop Website Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 3, 2026The WP Ultimate Review: Arbitrary shortcode executionCVE-2026-103519 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The The WP Ultimate Review plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.4.3. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for authenticated attackers, with subscriber-level access and above, to execute arbitrary shortcodes. The bypass relies on WordPress's own strip_shortcodes() function unwrapping the [[tag]] double-bracket escape to a bare [tag] that survives wp_insert_post storage and fires when the publicly queryable xs_review post type is rendered through the_content.
Product
The WP Ultimate Review
Affected
up to 2.4.3
What to do
Affects up to 2.4.3. Update The WP Ultimate Review to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 3, 2026The WP Ultimate Review: Arbitrary shortcode executionCVE-2026-100157 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The The WP Ultimate Review plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.4.3. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. The nonce required to pass the only gate is emitted to unauthenticated visitors via the public review form, and submitted shortcode payloads are auto-published without admin approval by default, meaning exploitation requires no account and no privileged interaction.
Product
The WP Ultimate Review
Affected
up to 2.4.3
What to do
Affects up to 2.4.3. Update The WP Ultimate Review to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 3, 2026Transliterator – Multilingual and Multi-script Text Conversion: Stored Cross-Site ScriptingCVE-2026-96575 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Transliterator – Multilingual and Multi-script Text Conversion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Predictable {rstr_keep} Placeholder in all versions up to, and including, 2.5.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload survives WordPress comment save-time sanitization because the tags and attributes used (such as a[title] and code) are permitted by the core comment kses allow-list, and the literal characters comprising the plugin's shortcode markers and placeholder tokens are not stripped.
Product
Transliterator – Multilingual and Multi-script Text Conversion
Affected
up to 2.5.8
What to do
Affects up to 2.5.8. Update Transliterator – Multilingual and Multi-script Text Conversion to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 3, 2026Alt Text AI – Automatically generate image alt text for SEO and accessibility: Authorization bypassCVE-2026-91108 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Alt Text AI – Automatically generate image alt text for SEO and accessibility plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.10.41. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to overwrite the post_content of any post or page on the site — including content they do not own — with LLM-generated text influenced by attacker-controlled keywords, enabling black-hat SEO manipulation and unauthorized consumption of the site owner's paid AltText.ai API credits. The nonce required to invoke the action is emitted on every admin page including /wp-admin/profile.php, which is accessible to Subscribers, making the nonce trivially obtainable by any authenticated user.
Product
Alt Text AI – Automatically generate image alt text for SEO and accessibility
Affected
up to 1.10.41
What to do
Affects up to 1.10.41. Update Alt Text AI – Automatically generate image alt text for SEO and accessibility to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 3, 2026Kubio AI Page Builder: Does not limit its widening of the allowed HTML elements to the editor contextCVE-2026-88783 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Kubio AI Page Builder WordPress plugin before 2.9.3 does not limit its widening of the allowed HTML elements to the editor context, so the wider set is applied when filtering content submitted by unauthenticated users as well, allowing them to store markup which the Kubio AI Page Builder WordPress plugin before 2.9.3's own script later executes in the browser of any visitor, or of an administrator reviewing the still-unapproved submission.
Product
Kubio AI Page Builder
Fixed in
2.9.3
What to do
Update Kubio AI Page Builder to 2.9.3 or newer.
Full record and what to do →NVD record wpscan.com
Oct 3, 2026Unlimited Elements for Elementor: Does not sanitise file paths inside uploaded archives before extracting themCVE-2026-85015 · WordPress plugins & themes · reported by WPScanMedium 6.6
The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not sanitise file paths inside uploaded archives before extracting them, allowing authenticated users with access to its asset-management feature (Administrators by default, or Editors when a non-default Unlimited Elements for Elementor WordPress plugin before 2.0.21 setting is enabled) to write arbitrary files, including executable PHP, outside the intended upload directory on servers where the PHP zip extension is unavailable, leading to Remote Code Execution.
Product
Unlimited Elements for Elementor
Fixed in
2.0.21
What to do
Update Unlimited Elements for Elementor to 2.0.21 or newer.
Full record and what to do →NVD record wpscan.com
Oct 3, 2026The All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights): Arbitrary shortcode executionCVE-2026-100152 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The The All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.0.2 This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. This requires the AIOSEO breadcrumb to be rendered on the search results page via the block, widget, shortcode, or template tag.
Product
The All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights)
Affected
up to 5.0.2
What to do
Affects up to 5.0.2. Update The All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 3, 2026WPZOOM Connect: AI Chat, Click to Chat, Social Icons & Share Buttons: Sensitive Information ExposureCVE-2026-100149 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WPZOOM Connect: AI Chat, Click to Chat, Social Icons & Share Buttons plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.7.3 via the 'x-yamidoo-signature (attacker-obtained via inline_js identify payload)' parameter. This makes it possible for unauthenticated attackers to extract the full customer card — including name, WordPress user ID, order history, order totals, purchased products, payment method labels, and EDD Software Licensing license keys with status and activation counts — for any arbitrary victim email address on the site. Exploitation requires the attacker to register a WooCommerce customer or subscriber-level account with a crafted email address whose local part encodes the target timestamp and victim email, allowing the signature printed into the page HTML by inline_js() to pass verify_request() for an arbitrary victim; both the share_customer_data and identify_logged_in settings are enabled by default, so no non-default configuration is required.
Product
WPZOOM Connect: AI Chat, Click to Chat, Social Icons & Share Buttons
Affected
up to 4.7.3
What to do
Affects up to 4.7.3. Update WPZOOM Connect: AI Chat, Click to Chat, Social Icons & Share Buttons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Oct 3, 2026Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress: Sensitive Information ExposureCVE-2026-92536 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.17.4 via the get_user_profile_structure. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract other users' email addresses, login names, and registration dates via the Member Directory's per-row user rebinding when attacker-controlled base64 payloads in the [pp-custom-html] shortcode invoke [profile-email], [profile-username], and [profile-date-registered]. When the WordPress users_can_register option is enabled, unauthenticated attackers can also exploit this vulnerability by supplying the split shortcode fragments through the plugin's own registration handler, which processes the reg_nickname and reg_bio fields without a nonce requirement.
Product
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress
Affected
up to 4.17.4
What to do
Affects up to 4.17.4. Update Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 2, 2026Booking Calendar: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')CVE-2026-39601 · WordPress plugins & themes · reported by PatchstackLow 3.7
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in WPdevelop Booking Calendar booking allows Leveraging Race Conditions.This issue affects Booking Calendar: from n/a through 11.8.4.
Product
Booking Calendar
Affected
up to 11.8.4
What to do
Affects up to 11.8.4. Update Booking Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 2, 2026Smart One Click Setup – Complete Demo Import & Export: Insertion of Sensitive Information Into Sent DataCVE-2026-32584 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Insertion of Sensitive Information Into Sent Data vulnerability in Chiranjit Hazarika Smart One Click Setup – Complete Demo Import & Export smart-one-click-setup allows Retrieve Embedded Sensitive Data.This issue affects Smart One Click Setup – Complete Demo Import & Export: from n/a through 1.4.3.
Product
Smart One Click Setup – Complete Demo Import & Export
Affected
up to 1.4.3
What to do
Affects up to 1.4.3. Update Smart One Click Setup – Complete Demo Import & Export to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 2, 2026ThemeREX Addons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-102798 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeREX Group ThemeREX Addons trx_addons allows Stored XSS.This issue affects ThemeREX Addons: from n/a through 2.46.0.
Product
ThemeREX Addons
Affected
up to 2.46.0
What to do
Affects up to 2.46.0. Update ThemeREX Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 2, 2026ThemeREX Addons: Server-Side Request Forgery (SSRF)CVE-2026-102797 · WordPress plugins & themes · reported by PatchstackMedium 6.4
Server-Side Request Forgery (SSRF) vulnerability in ThemeREX Group ThemeREX Addons trx_addons allows Server Side Request Forgery.This issue affects ThemeREX Addons: from n/a through 2.46.0.
Product
ThemeREX Addons
Affected
up to 2.46.0
What to do
Affects up to 2.46.0. Update ThemeREX Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 2, 2026GSpeech TTS – WordPress Text To Speech: Stored Cross-Site ScriptingCVE-2026-96578 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The GSpeech TTS – WordPress Text To Speech Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to, and including, 3.22.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This mXSS-style transform bypasses WordPress comment kses sanitization because the payload is stored using only kses-allowed tags and attributes; the malicious event handlers and style fragments become active only when the plugin's output-buffer callback rewrites the rendered HTML at request time.
Product
GSpeech TTS – WordPress Text To Speech
Affected
up to 3.22.0
What to do
Affects up to 3.22.0. Update GSpeech TTS – WordPress Text To Speech to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 2, 2026No External Links: Stored Cross-Site ScriptingCVE-2026-95670 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The No External Links plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Log URL via /goto/{base64} Redirect in all versions up to, and including, 5.2.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is only exploitable when the administrator has enabled the 'Link Encoding: Base64' option in the plugin settings.
Product
No External Links
Affected
up to 5.2.0
What to do
Affects up to 5.2.0. Update No External Links to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 2, 2026Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE: Sensitive Information ExposureCVE-2026-102002 · WordPress plugins & themes · reported by WordfenceLow 3.1
The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.2.6 via the 'otter_form_widget_filter' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract the email addresses of the five most recent form submitters, their submission dates, and the site's total form submission count. The widget is registered whenever the themeisle_blocks_form_emails option is non-empty — the normal state after any Form block has been saved — meaning the exposure is active on any standard site using the plugin's form feature.
Product
Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE
Affected
up to 3.2.6
What to do
Affects up to 3.2.6. Update Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 2, 2026Popup Maker WP: Does not perform authorization checks on several of its actions and exposes its management page to any logged-in userCVE-2026-85005 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Popup Maker WP WordPress plugin through 1.4.5 does not perform authorization checks on several of its actions and exposes its management page to any logged-in user, allowing users with a low-privileged role such as Subscriber to store display-targeting values that are later invoked as zero-argument PHP callables on public page loads, leading to sensitive information disclosure and denial of service.
Product
Popup Maker WP
Affected
up to 1.4.5
What to do
Affects up to 1.4.5. Update Popup Maker WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Oct 2, 2026Events Calendar: Does not validate or sanitise data submitted to an unauthenticated AJAX action before merging it into its rendering contextCVE-2026-84740 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Events Calendar WordPress plugin before 6.17.5.1 does not validate or sanitise data submitted to an unauthenticated AJAX action before merging it into its rendering context, allowing unauthenticated users to execute arbitrary shortcodes registered on the site.
Product
Events Calendar
Fixed in
6.17.5.1
What to do
Update Events Calendar to 6.17.5.1 or newer.
Full record and what to do →NVD record wpscan.com
Oct 2, 2026Request a Quote: Does not perform an authorization check on one of its unauthenticated AJAX handlersCVE-2026-90988 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Request a Quote WordPress plugin through 2.5.6 does not perform an authorization check on one of its unauthenticated AJAX handlers, allowing unauthenticated users to read the contact records of quote-request submissions, including records the site has not published.
Product
Request a Quote
Affected
up to 2.5.6
What to do
Affects up to 2.5.6. Update Request a Quote to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Oct 2, 2026CTX Feed Pro: Code InjectionCVE-2026-10026 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The CTX Feed Pro plugin for WordPress is vulnerable to Code Injection in all versions up to, and including, 7.6.12. This is due to insufficient input validation on the 'Feed Config' field which is passed directly to the eval() function. This makes it possible for authenticated attackers, with Administrator-level access and above, to execute arbitrary PHP code on the server.
Product
CTX Feed Pro
Affected
up to 7.6.12
What to do
Affects up to 7.6.12. Update CTX Feed Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record webappick.com wordfence.com
Oct 1, 2026Unauthenticated Cross Site Scripting (XSS) in Premmerce Wishlist for WooCommerce <= 1.1.13 versions.CVE-2026-97273 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Premmerce Wishlist for WooCommerce <= 1.1.13 versions.
Affected
up to 1.1.13
What to do
Affects up to 1.1.13. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 1, 2026Unauthenticated Cross Site Scripting (XSS) in Premmerce Wishlist for WooCommerce <= 1.1.13 versions.CVE-2026-97268 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Premmerce Wishlist for WooCommerce <= 1.1.13 versions.
Affected
up to 1.1.13
What to do
Affects up to 1.1.13. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 1, 2026Unauthenticated Cross Site Scripting (XSS) in MaxGalleria <= 6.5.3 versions.CVE-2026-97260 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in MaxGalleria <= 6.5.3 versions.
Affected
up to 6.5.3
What to do
Affects up to 6.5.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 1, 2026Unauthenticated Cross Site Scripting (XSS) in Parallax Section block <= 2.0.4 versions.CVE-2026-102378 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Parallax Section block <= 2.0.4 versions.
Affected
up to 2.0.4
What to do
Affects up to 2.0.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 1, 2026Redux Framework: Stored Cross-Site ScriptingCVE-2026-90992 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via User Meta Merge via 'user-mediaurl' Media Field in all versions up to, and including, 4.5.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable by Subscriber-level users who can store a payload in user meta fields such as the biography, session_tokens (via a crafted User-Agent at login), or persisted_preferences (via the REST API), which are then promoted to the site-wide redux_demo option when a media URL repair is triggered on the demo panel.
Product
Redux Framework
Affected
up to 4.5.14
What to do
Affects up to 4.5.14. Update Redux Framework to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 1, 2026WP Fusion Lite: Does not perform a capability check on two of its admin AJAX handlersCVE-2026-90972 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Fusion Lite WordPress plugin before 3.48.0 does not perform a capability check on two of its admin AJAX handlers, allowing any authenticated subscriber to read other users' email addresses and to trigger a cross-user CRM re-sync.
Product
WP Fusion Lite
Fixed in
3.48.0
What to do
Update WP Fusion Lite to 3.48.0 or newer.
Full record and what to do →NVD record wpscan.com
Oct 1, 2026Redux Framework: Authorization bypassCVE-2026-88999 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Redux Framework plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5.14 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary media library attachments, including administrator-owned files, from the affected site. This is exploitable by Subscribers when a Custom Fonts field is registered on the user profile page via Redux_Users::set_profile(), as doing so causes the required redux_custom_fonts nonce to be rendered into the Subscriber's wp-admin/profile.php page.
Product
Redux Framework
Affected
up to 4.5.14
What to do
Affects up to 4.5.14. Update Redux Framework to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Oct 1, 2026If-So Dynamic Content: Does not escape a request-supplied value before reflecting it in an unauthenticated AJAX response that is servedCVE-2026-87970 · WordPress plugins & themes · reported by WPScanMedium 4.7
The If-So Dynamic Content WordPress plugin before 1.10.2 does not escape a request-supplied value before reflecting it in an unauthenticated AJAX response that is served as HTML, allowing attackers to execute arbitrary JavaScript in the browser of a visitor who opens a crafted link.
Product
If-So Dynamic Content
Fixed in
1.10.2
What to do
Update If-So Dynamic Content to 1.10.2 or newer.
Full record and what to do →NVD record wpscan.com
Oct 1, 2026Extendify: Stored Cross-Site ScriptingCVE-2026-85679 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Extendify plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'styles.blocks' Block Type Key in all versions up to, and including, 3.1.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is possible because registerIncoming() is hooked on rest_request_before_callbacks and runs before WordPress evaluates the route's permission_callback, meaning any unauthenticated POST, PUT, or PATCH request to a /wp/v2/global-styles route can trigger the vulnerable code path.
Product
Extendify
Affected
up to 3.1.6
What to do
Affects up to 3.1.6. Update Extendify to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 1, 2026The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for: Arbitrary shortcode executionCVE-2026-92966 · WordPress plugins & themes · reported by WordfenceCritical 9.1
The The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.7.0. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. The payload is planted during the unauthenticated booking flow and triggered when the Customer Cabinet block rendered by render_customer_dashboard() outputs the stored name into the content stream, where WordPress core's do_shortcode filter at priority 11 re-parses and executes it.
Product
The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for
Affected
up to 5.7.0
What to do
Affects up to 5.7.0. Update The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 1, 2026WP Popular Posts: Sensitive Information ExposureCVE-2026-92548 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WP Popular Posts plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.4.2 via the 'context' parameter. This makes it possible for unauthenticated attackers to extract sensitive edit-context fields — including raw title, raw content body, password, meta, status, and guid — from non-public post objects such as wp_block synced patterns that WordPress core itself refuses to expose to unauthenticated callers. This is possible because the plugin's REST route is registered with a permission_callback of __return_true and passes the caller-supplied context parameter (e.g., context=edit) directly to WP_REST_Posts_Controller::prepare_item_for_response() without invoking get_item_permissions_check() or check_read_permission(), while the underlying query accepts an arbitrary post_type value without enforcing public or show_in_rest visibility flags.
Product
WP Popular Posts
Affected
up to 7.4.2
What to do
Affects up to 7.4.2. Update WP Popular Posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 1, 2026Simply Schedule Appointments: Sensitive Information ExposureCVE-2026-92245 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Simply Schedule Appointments plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.6.12.32 via the 'recursive' parameter. This makes it possible for unauthenticated attackers to extract customer PII — including names, email addresses, phone numbers, and custom form field data — stored in appointment records, as well as per-appointment public_token values. The leaked per-appointment public_token values also enable unauthenticated attackers to delete arbitrary appointments via the DELETE /wp-json/ssa/v1/appointments/{id} endpoint, which accepts the token as sole authorization.
Product
Simply Schedule Appointments
Affected
up to 1.6.12.32
What to do
Affects up to 1.6.12.32. Update Simply Schedule Appointments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 30, 2026Unauthenticated Cross Site Scripting (XSS) in Photonic Gallery & Lightbox for Flickr, SmugMug & Others <= 3.36 versions.CVE-2026-97290 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Photonic Gallery & Lightbox for Flickr, SmugMug & Others <= 3.36 versions.
Affected
up to 3.36
What to do
Affects up to 3.36. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 30, 2026Shop manager PHP Object Injection in Extra Product Options For WooCommerce | Custom Product Addons and Fields <= 3.3.8 versions.CVE-2026-102392 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Shop manager PHP Object Injection in Extra Product Options For WooCommerce | Custom Product Addons and Fields <= 3.3.8 versions.
Affected
up to 3.3.8
What to do
Affects up to 3.3.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 30, 2026Unauthenticated Cross Site Scripting (XSS) in JetFormBuilder <= 3.6.5.4 versions.CVE-2026-102391 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in JetFormBuilder <= 3.6.5.4 versions.
Affected
up to 3.6.5.4
What to do
Affects up to 3.6.5.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 30, 2026Subscriber Cross Site Scripting (XSS) in Branda <= 3.4.32 versions.CVE-2026-102376 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Subscriber Cross Site Scripting (XSS) in Branda <= 3.4.32 versions.
Affected
up to 3.4.32
What to do
Affects up to 3.4.32. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 30, 2026Unauthenticated Cross Site Scripting (XSS) in Post and Page Builder by BoldGrid <= 1.27.14 versions.CVE-2026-100510 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Post and Page Builder by BoldGrid <= 1.27.14 versions.
Affected
up to 1.27.14
What to do
Affects up to 1.27.14. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 30, 2026Unauthenticated Sensitive Data Exposure in MPG <= 4.2.3 versions.CVE-2026-97302 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Sensitive Data Exposure in MPG <= 4.2.3 versions.
Affected
up to 4.2.3
What to do
Affects up to 4.2.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.