Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
7,411 results · page 9 of 149
Sep 30, 2026In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 sandbox escape leading to code execution was possible via the versioned settings Kotlin DSLCVE-2026-100253 · Other software · JetBrains · reported by cve@jetbrains.comHigh 8.8
In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 sandbox escape leading to code execution was possible via the versioned settings Kotlin DSL
- Product
- TeamCity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2026Apache WSS4J remembers the Nonce of each UsernameToken it accepts, so a captured token cannot be reused.CVE-2026-92899 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 4.8
Apache WSS4J remembers the Nonce of each UsernameToken it accepts, so a captured token cannot be reused. It stored the Nonce as raw base64 text, but authentication decodes that text and uses the bytes.The same bytes can be written as base64 in several ways. An attacker who captured an authenticated request could re-send it with a space added to the Nonce: the password digest still verified, but the token no longer matched the remembered one, so the replay was accepted. Since a UsernameToken does not cover the message body, the captured token could then be reused on requests of the attacker's choosing until it expired. Affects deployments with a nonce replay cache configured, as Apache CXF has by default, and only tokens using a password digest. The cache is now keyed on the decoded Nonce. Users are recommended to upgrade to versions 4.0.2 or 3.0.6 or 2.4.4, which fix this issue.
- Product
- Apache WSS4J
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orgopenwall.com
Sep 30, 2026Media Library Organizer: Does not verify that the requesting user holds the target taxonomy's management capability before creating a new termCVE-2026-94297 · WordPress plugins & themes · reported by WPScanLow 2.7
The Media Library Organizer WordPress plugin before 2.1.4 does not verify that the requesting user holds the target taxonomy's management capability before creating a new term, allowing users with contributor-level access and above to create publicly visible terms in any taxonomy registered on the site.
- Product
- Media Library Organizer
- Fixed in
- 2.1.4
- What to do
- Update Media Library Organizer to 2.1.4 or newer.
Sep 30, 2026Image Optimizer: Does not enforce its intended capability check on several of its read REST routesCVE-2026-90953 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Image Optimizer WordPress plugin before 1.7.7 does not enforce its intended capability check on several of its read REST routes, allowing any authenticated user to read attachment metadata and site-wide statistics that should be restricted to administrators.
- Product
- Image Optimizer
- Fixed in
- 1.7.7
- What to do
- Update Image Optimizer to 1.7.7 or newer.
Sep 30, 2026Robin Image Optimizer: Does not escape values that its bundled HTML parser re-emits into element attributesCVE-2026-89193 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Robin Image Optimizer WordPress plugin before 2.0.8 does not escape values that its bundled HTML parser re-emits into element attributes when a non-default image delivery mode is enabled, allowing unauthenticated users to submit content that is stored and later executed as Cross-Site Scripting in the browser of any user viewing an affected page, including administrators.
- Product
- Robin Image Optimizer
- Fixed in
- 2.0.8
- What to do
- Update Robin Image Optimizer to 2.0.8 or newer.
Sep 30, 2026Robin Image Optimizer: Does not check the user's capabilities before dispatching one of its bundled admin framework's request handlersCVE-2026-89190 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Robin Image Optimizer WordPress plugin before 2.0.8 does not check the user's capabilities before dispatching one of its bundled admin framework's request handlers, allowing users with a subscriber-level account to render admin-only Robin Image Optimizer WordPress plugin before 2.0.8 pages and disclose the Robin Image Optimizer WordPress plugin before 2.0.8's stored settings.
- Product
- Robin Image Optimizer
- Fixed in
- 2.0.8
- What to do
- Update Robin Image Optimizer to 2.0.8 or newer.
Sep 30, 2026Vayu X: Does not perform any capability check on one of its AJAX actions and exposes the nonce guarding it to every logged-in userCVE-2026-88797 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Vayu X WordPress theme before 1.0.6 does not perform any capability check on one of its AJAX actions and exposes the nonce guarding it to every logged-in user, allowing any authenticated user, such as a subscriber, to install and activate any hosted on the WordPress.org repository.
- Product
- Vayu X
- Fixed in
- 1.0.6
- What to do
- Update Vayu X to 1.0.6 or newer.
Sep 30, 2026Hostinger Reach: Does not sanitize and escape a widget setting before outputting it in the editor previewCVE-2026-87777 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Hostinger Reach WordPress plugin before 1.8.3 does not sanitize and escape a widget setting before outputting it in the editor preview, allowing users with contributor-level access and above to inject arbitrary web scripts that will execute in the session of a higher-privileged user who opens the affected content in the editor.
- Product
- Hostinger Reach
- Fixed in
- 1.8.3
- What to do
- Update Hostinger Reach to 1.8.3 or newer.
Sep 30, 2026All in One Files Upload: Does not have any capability checkCVE-2026-85576 · WordPress plugins & themes · reported by WPScanMedium 4.3
The All in One Files Upload WordPress plugin before 2.0.17 does not have any capability check, and does not verify the authenticity of the request, when saving its settings, allowing any authenticated user, such as a subscriber, to change them.
- Product
- All in One Files Upload
- Fixed in
- 2.0.17
- What to do
- Update All in One Files Upload to 2.0.17 or newer.
Sep 30, 2026EmbedPress: Does not sanitise and escape one of its Elementor widget settings before outputting it into an HTML attributeCVE-2026-85001 · WordPress plugins & themes · reported by WPScanMedium 6.8
The EmbedPress WordPress plugin before 4.6.7 does not sanitise and escape one of its Elementor widget settings before outputting it into an HTML attribute, which could allow users with the Contributor role or above to inject arbitrary web scripts that execute when the affected content is viewed.
- Product
- EmbedPress
- Fixed in
- 4.6.7
- What to do
- Update EmbedPress to 4.6.7 or newer.
Sep 30, 2026Schema & Structured Data for WP & AMP: Does not perform a capability checkCVE-2026-82127 · WordPress plugins & themes · reported by WPScanLow 3.5
The Schema & Structured Data for WP & AMP WordPress plugin before 1.67 does not perform a capability check when saving several of its fields, nor escape them when outputting them back, allowing users with the editor role and above to inject arbitrary web scripts that execute when a higher privileged user views the affected screen. This is only exploitable on multisite installs, where editors do not hold the unfiltered_html capability.
- Product
- Schema & Structured Data for WP & AMP
- Fixed in
- 1.67
- What to do
- Update Schema & Structured Data for WP & AMP to 1.67 or newer.
Sep 30, 2026Zella: Does not perform any capability or nonce check on one of its font upload actionsCVE-2026-75873 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Zella Theme WordPress theme before 2.6.3 does not perform any capability or nonce check on one of its font upload actions, which is available to unauthenticated users, allowing them to upload arbitrary files, including PHP ones, and achieve remote code execution.
- Product
- Zella
- Fixed in
- 2.6.3
- What to do
- Update Zella to 2.6.3 or newer.
Sep 29, 2026An authentication bypass vulnerability in the captive portal of HPE Networking Instant On could allow an unauthenticated remote attacker to circumvent existing CVE-2026-76731 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comMedium 6.5
An authentication bypass vulnerability in the captive portal of HPE Networking Instant On could allow an unauthenticated remote attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to gain limited access to some data and to make limited changes within the affected component.
- Product
- Instant ON
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2026Incorrect authorization in MediaCapture in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to obtain cross-origin dCVE-2026-95317 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comLow 3.1
Incorrect authorization in MediaCapture in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to obtain cross-origin data via a crafted Chrome extension. (Chromium security severity: Medium)
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comissues.chromium.org
Sep 29, 2026Joomla! Core - [20260912] - Core - XSS in module list in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - The module list layout did not properly escape user supplied values, CVE-2026-92225 · Websites & servers · reported by security@joomla.orgMedium 5.9
Joomla! Core - [20260912] - Core - XSS in module list in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - The module list layout did not properly escape user supplied values, leading to an XSS vector.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddeveloper.joomla.orgjoomla.org
Sep 29, 2026Joomla! Core - [20260911] - Core - XSS in link toolbar layout in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - The link toolbar layout did not properly escape inputs, leadiCVE-2026-92224 · Websites & servers · reported by security@joomla.orgMedium 5.9
Joomla! Core - [20260911] - Core - XSS in link toolbar layout in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - The link toolbar layout did not properly escape inputs, leading to an XSS vector.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddeveloper.joomla.orgjoomla.org
Sep 29, 2026Joomla! Core - [20260908] - Core - XSS in HTML Mail Templates in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - The mail template feature lacks an escaping mechanism, causinCVE-2026-90918 · Websites & servers · reported by security@joomla.orgMedium 6.9
Joomla! Core - [20260908] - Core - XSS in HTML Mail Templates in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - The mail template feature lacks an escaping mechanism, causing XSS vectors in multiple extensions.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddeveloper.joomla.orgjoomla.org
Sep 29, 2026Joomla! Core - [20260904] - Core - XSS in the generic media output layouts in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - Lack of escaping leads to an XSS vulnerability iCVE-2026-90914 · Websites & servers · reported by security@joomla.orgMedium 5.9
Joomla! Core - [20260904] - Core - XSS in the generic media output layouts in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - Lack of escaping leads to an XSS vulnerability in the generic audio and video output layouts.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddeveloper.joomla.orgjoomla.org
Sep 29, 2026Joomla! Core - [20260901] - XSS in HTMLHelper::link method in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3 - Lack of escaping leads to XSS vulnerabilities in the link methodCVE-2026-90906 · Websites & servers · reported by security@joomla.orgMedium 5.9
Joomla! Core - [20260901] - XSS in HTMLHelper::link method in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3 - Lack of escaping leads to XSS vulnerabilities in the link method of the HTML Helper.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddeveloper.joomla.orgjoomla.org
Sep 29, 2026Sandbox escape due to incorrect boundary conditions in the XPCOM component.CVE-2026-100819 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgCritical 9.6
Sandbox escape due to incorrect boundary conditions in the XPCOM component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Sep 29, 2026Sandbox escape due to use-after-free in the Widget: Gtk component.CVE-2026-100818 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgCritical 9.6
Sandbox escape due to use-after-free in the Widget: Gtk component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.
- Product
- Thunderbird
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Sep 29, 2026Sandbox escape due to use-after-free in the DOM: Core & HTML component.CVE-2026-100811 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgCritical 9.6
Sandbox escape due to use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.
- Product
- Thunderbird
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Sep 29, 2026Sandbox escape due to use-after-free in the Preferences: Backend component.CVE-2026-100804 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgCritical 9.6
Sandbox escape due to use-after-free in the Preferences: Backend component. This vulnerability was fixed in Thunderbird 157 and Firefox 157.
- Product
- Thunderbird
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Sep 29, 2026Sandbox escape due to use-after-free in the Disability Access APIs component.CVE-2026-100800 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgCritical 9.6
Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Sep 29, 2026Sandbox escape due to incorrect boundary conditions in the Internationalization component.CVE-2026-100794 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgCritical 9.6
Sandbox escape due to incorrect boundary conditions in the Internationalization component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.
- Product
- Thunderbird
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Sep 29, 2026Sandbox escape in the XUL component.CVE-2026-100787 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgCritical 9.6
Sandbox escape in the XUL component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Sep 29, 2026Sandbox escape due to use-after-free in the Graphics component.CVE-2026-100786 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgCritical 9.6
Sandbox escape due to use-after-free in the Graphics component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Sep 29, 2026Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component.CVE-2026-100781 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgCritical 9.6
Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Sep 29, 2026Sandbox escape due to use-after-free in the DOM: Core & HTML component.CVE-2026-100778 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgCritical 9.6
Sandbox escape due to use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Sep 29, 2026Sandbox escape in the Graphics component.CVE-2026-100775 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgCritical 9.6
Sandbox escape in the Graphics component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Sep 29, 2026Sandbox escape due to use-after-free in the DOM: Content Processes component.CVE-2026-100770 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgCritical 9.6
Sandbox escape due to use-after-free in the DOM: Content Processes component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Sep 29, 2026Sandbox escape due to use-after-free in the DOM: Content Processes component.CVE-2026-100762 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgCritical 9.6
Sandbox escape due to use-after-free in the DOM: Content Processes component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Sep 29, 2026Sandbox escape in the Security: Process Sandboxing component.CVE-2026-100760 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgCritical 9.6
Sandbox escape in the Security: Process Sandboxing component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Sep 29, 2026Sandbox escape in the DOM: Navigation component.CVE-2026-100758 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgCritical 9.6
Sandbox escape in the DOM: Navigation component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Sep 28, 2026Authentication Bypass by Capture-replay in Apache Roller 6.1.5 allows an attacker who captures a valid WSSE digest authentication header to replay it and gain tCVE-2026-82379 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 7.7
Authentication Bypass by Capture-replay in Apache Roller 6.1.5 allows an attacker who captures a valid WSSE digest authentication header to replay it and gain the victim's AtomPub authority, because the authentication does not enforce nonce uniqueness or timestamp freshness. Only installations that enable the non-default AtomPub API with WSSE authentication and plaintext-compatible password storage are affected. Users are recommended to upgrade to Apache Roller 6.1.6 or later, which removes WSSE as an AtomPub authentication method; existing installations configured for WSSE fail closed until an administrator explicitly selects a supported authentication method.
- Product
- Apache Roller
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.apache.org
Sep 28, 2026Post Voting System: Does not properly sanitize and escape a parameter before using it in a SQL queryCVE-2026-89303 · WordPress plugins & themes · reported by WPScanMedium 6.4
The Post Voting System WordPress plugin through 1.0 does not properly sanitize and escape a parameter before using it in a SQL query, allowing any authenticated user to perform SQL injection attacks.
- Product
- Post Voting System
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Post Voting System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 27, 2026navi through 2.24.0 fails to properly escape cheatsheet variable values when substituting them into shell commands.CVE-2026-101032 · Other software · denisidoro · reported by VulnCheckHigh 7.3
navi through 2.24.0 fails to properly escape cheatsheet variable values when substituting them into shell commands. Attackers can inject shell metacharacters through crafted file names in suggestion command directories to execute arbitrary commands with victim privileges.
- Product
- navi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 27, 2026onefetch through 2.28.1 writes repository information field values to the terminal without removing control characters, allowing terminal escape sequence injectCVE-2026-100866 · Other software · o2sh · reported by VulnCheckMedium 4.8
onefetch through 2.28.1 writes repository information field values to the terminal without removing control characters, allowing terminal escape sequence injection. Attackers can embed ANSI/OSC escape sequences in project manifest version and name fields to manipulate terminal output, rewrite window titles, hide text, or trigger emulator-specific behavior when victims run onefetch.
- Product
- onefetch
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 27, 2026PowerPress Podcasting plugin by Blubrry: Does not sanitize and escape a block attribute before outputting it in a pageCVE-2026-97319 · WordPress plugins & themes · reported by WPScanMedium 6.8
The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.17.2 does not sanitize and escape a block attribute before outputting it in a page, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- PowerPress Podcasting plugin by Blubrry
- Fixed in
- 11.17.2
- What to do
- Update PowerPress Podcasting plugin by Blubrry to 11.17.2 or newer.
Sep 27, 2026NextScripts: Social Networks Auto-Poster: Does not perform capability or ownership checks on several of its AJAX actionsCVE-2026-97227 · WordPress plugins & themes · reported by WPScanMedium 5.9
The NextScripts: Social Networks Auto-Poster WordPress plugin before 4.4.8 does not perform capability or ownership checks on several of its AJAX actions, relying on a nonce alone, allowing users an administrator has granted access to its posting features to export the site's configured social account credentials, delete arbitrary posts and reset the NextScripts: Social Networks Auto-Poster WordPress plugin before 4.4.8's configuration.
- Product
- NextScripts: Social Networks Auto-Poster
- Fixed in
- 4.4.8
- What to do
- Update NextScripts: Social Networks Auto-Poster to 4.4.8 or newer.
Sep 27, 2026WP YouTube Lyte: Does not escape some attributes of YouTube embed blocks before outputting them in an HTML attributeCVE-2026-96895 · WordPress plugins & themes · reported by WPScanMedium 6.8
The WP YouTube Lyte WordPress plugin before 1.7.31 does not escape some attributes of YouTube embed blocks before outputting them in an HTML attribute when rendering the block, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks.
- Product
- WP YouTube Lyte
- Fixed in
- 1.7.31
- What to do
- Update WP YouTube Lyte to 1.7.31 or newer.
Sep 27, 2026WPeMatico RSS Feed Fetcher: Does not perform a capability check before fetching a user-supplied URL and rendering the responseCVE-2026-89003 · WordPress plugins & themes · reported by WPScanMedium 4.1
The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27 does not perform a capability check before fetching a user-supplied URL and rendering the response, allowing users with contributor-level access and above to force the server to issue requests to internal-only hosts and read the responses back.
- Product
- WPeMatico RSS Feed Fetcher
- Fixed in
- 2.8.27
- What to do
- Update WPeMatico RSS Feed Fetcher to 2.8.27 or newer.
Sep 27, 2026WPeMatico RSS Feed Fetcher: Does not perform a capability check or validate the destination of a user-supplied feed URL before fetching it server-sideCVE-2026-89000 · WordPress plugins & themes · reported by WPScanMedium 4.1
The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27 does not perform a capability check or validate the destination of a user-supplied feed URL before fetching it server-side, allowing users with contributor-level access and above to make the server issue requests to internal-only resources and read the responses back.
- Product
- WPeMatico RSS Feed Fetcher
- Fixed in
- 2.8.27
- What to do
- Update WPeMatico RSS Feed Fetcher to 2.8.27 or newer.
Sep 27, 2026Download Manager: Does not sanitise and escape data submitted through its email-locked download subscription form before outputting it back in an admin pageCVE-2026-86609 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Download Manager WordPress plugin before 7.5.6 does not sanitise and escape data submitted through its email-locked download subscription form before outputting it back in an admin page, which could allow unauthenticated attackers to perform Stored Cross-Site Scripting attacks against administrators. This affects the commercial Pro edition only; the free Download Manager WordPress plugin before 7.5.6 published under the same slug does not ship the affected feature.
- Product
- Download Manager
- Fixed in
- 7.5.6
- What to do
- Update Download Manager to 7.5.6 or newer.
Sep 27, 2026EmbedPress: Does not escape one of its block attributes before outputting it inside an HTML attributeCVE-2026-85002 · WordPress plugins & themes · reported by WPScanMedium 6.8
The EmbedPress WordPress plugin before 4.6.7 does not escape one of its block attributes before outputting it inside an HTML attribute, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks against higher privileged users viewing the post.
- Product
- EmbedPress
- Fixed in
- 4.6.7
- What to do
- Update EmbedPress to 4.6.7 or newer.
Sep 27, 2026UpdraftPlus: WP Backup & Migration Plugin WordPress plugin before 1.26.8, UpdraftPlus: WP Backup & Migration: Does not have any capability check in a routine that outputs its stored remote storage settings into admin pagCVE-2026-82841 · WordPress plugins & themes · reported by WPScanMedium 5.3
The UpdraftPlus: WP Backup & Migration Plugin WordPress plugin before 1.26.8, UpdraftPlus: WP Backup & Migration Plugin WordPress plugin before 2.26.8.26 does not have any capability check in a routine that outputs its stored remote storage settings into admin pages when the site is left in a particular post-migration state, allowing any authenticated user, such as a subscriber, to retrieve the credentials of the configured backup destinations, such as passwords and secret keys.
- Product
- UpdraftPlus: WP Backup & Migration Plugin WordPress plugin before 1.26.8, UpdraftPlus: WP Backup & Migration
- Fixed in
- 1.26.8
- What to do
- Update UpdraftPlus: WP Backup & Migration Plugin WordPress plugin before 1.26.8, UpdraftPlus: WP Backup & Migration to 1.26.8 or newer.
Sep 26, 2026heym before 0.0.91 contains a sandbox escape vulnerability in the expression engine's DotList map/filter and fallback resolver that allows authenticated users tCVE-2026-100864 · Other software · heymrun · reported by VulnCheckHigh 8.7
heym before 0.0.91 contains a sandbox escape vulnerability in the expression engine's DotList map/filter and fallback resolver that allows authenticated users to execute arbitrary Python code. Attackers can craft workflow expressions using dunder attribute access through item expressions or the fallback resolver to access os.system and execute commands as the backend process.
- Product
- heym
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Sep 26, 2026heym, a workflow automation platform, stores and returns multiple capability secrets in plaintext in versions prior to 0.0.91.CVE-2026-100862 · Other software · heymrun · reported by VulnCheckMedium 6.9
heym, a workflow automation platform, stores and returns multiple capability secrets in plaintext in versions prior to 0.0.91. Affected secrets include webhook header-auth values (returned in cleartext by GET /api/workflows/{id} and persisted unsanitized into execution history), MCP API keys (stored as a plaintext column, returned in config/list responses, and accepted via the ?key= query string so they leak into logs, proxies and Referer headers), portal session tokens (stored and validated by plaintext equality with a 168-hour TTL), workflow execution JWTs (stored in full and re-listed by GET .../execution-tokens), Discord interaction tokens (the full interaction body is stored in execution history), and global variables. A user with read access to a workflow, share/team membership, or anyone able to read the database, a backup, or logs can recover these secrets and replay them to execute workflows or act as the secret owner.
- Product
- heym
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Sep 26, 2026Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130)CVE-2026-94408 · Other software · Elastic · reported by security@elastic.coMedium 4.9
Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130)
- Product
- Elasticsearch
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 26, 2026Uncontrolled Resource Consumption (CWE-400) in Kibana can lead denial of service via Excessive Allocation (CAPEC-130)CVE-2026-94400 · Other software · Elastic · reported by security@elastic.coMedium 6.5
Uncontrolled Resource Consumption (CWE-400) in Kibana can lead denial of service via Excessive Allocation (CAPEC-130)
- Product
- Kibana
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.