Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
14,742 results · page 9 of 295
Oct 13, 2026Link Whisper Free: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-109687 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Link Whisper INC Link Whisper Free link-whisper allows Blind SQL Injection.This issue affects Link Whisper Free: from n/a through 0.9.7.
- Product
- Link Whisper Free
- Affected
- up to 0.9.7
- What to do
- Affects up to 0.9.7. Update Link Whisper Free to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 13, 2026Premium Addons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-108490 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LeapWorx Premium Addons for Elementor premium-addons-for-elementor allows Stored XSS.This issue affects Premium Addons for Elementor: from n/a through 4.11.110.
- Product
- Premium Addons for Elementor
- Affected
- up to 4.11.110
- What to do
- Affects up to 4.11.110. Update Premium Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 13, 2026Active Products Tables for WooCommerce: Insertion of Sensitive Information Into Sent DataCVE-2026-108489 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Insertion of Sensitive Information Into Sent Data vulnerability in PluginUs.Net Active Products Tables for WooCommerce profit-products-tables-for-woocommerce allows Retrieve Embedded Sensitive Data.This issue affects Active Products Tables for WooCommerce: from n/a through 2.1.3.
- Product
- Active Products Tables for WooCommerce
- Affected
- up to 2.1.3
- What to do
- Affects up to 2.1.3. Update Active Products Tables for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 13, 2026PowerPack Addons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-108488 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in IdeaBox Creations PowerPack Addons for Elementor powerpack-lite-for-elementor allows Stored XSS.This issue affects PowerPack Addons for Elementor: from n/a through 3.1.0.
- Product
- PowerPack Addons for Elementor
- Affected
- up to 3.1.0
- What to do
- Affects up to 3.1.0. Update PowerPack Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 13, 2026Books Gallery: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-108487 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Hossni Mubarak Books Gallery wp-books-gallery allows Stored XSS.This issue affects Books Gallery: from n/a through 4.8.4.
- Product
- Books Gallery
- Affected
- up to 4.8.4
- What to do
- Affects up to 4.8.4. Update Books Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 13, 2026WOLF: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-108179 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in PluginUs.Net WOLF bulk-editor allows Blind SQL Injection.This issue affects WOLF: from n/a through 1.1.1.
- Product
- WOLF
- Affected
- up to 1.1.1
- What to do
- Affects up to 1.1.1. Update WOLF to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 13, 2026WP-BusinessDirectory: Does not restrict the type or destination of files saved by an unauthenticated upload handlerCVE-2026-89271 · WordPress plugins & themes · reported by WPScanMedium 5.3
The WP-BusinessDirectory WordPress plugin through 4.0.2 does not restrict the type or destination of files saved by an unauthenticated upload handler, allowing unauthenticated attackers to write files with arbitrary content to arbitrary locations, though not to execute code on a default server configuration.
- Product
- WP-BusinessDirectory
- Affected
- up to 4.0.2
- What to do
- Affects up to 4.0.2. Update WP-BusinessDirectory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 13, 2026FV Simpler SEO: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-54868 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FolioVision FV Simpler SEO fv-all-in-one-seo-pack allows Stored XSS.This issue affects FV Simpler SEO: from n/a through 1.9.7.
- Product
- FV Simpler SEO
- Affected
- up to 1.9.7
- What to do
- Affects up to 1.9.7. Update FV Simpler SEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 12, 2026Premium Addons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-108482 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LeapWorx Premium Addons for Elementor premium-addons-for-elementor allows Stored XSS.This issue affects Premium Addons for Elementor: from n/a through 4.11.110.
- Product
- Premium Addons for Elementor
- Affected
- up to 4.11.110
- What to do
- Affects up to 4.11.110. Update Premium Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 12, 2026Salevo: External Control of Assumed-Immutable Web ParameterCVE-2026-103080 · WordPress plugins & themes · reported by PatchstackMedium 5.3
External Control of Assumed-Immutable Web Parameter vulnerability in VillaTheme Salevo woo-boost-sales allows Input Data Manipulation.This issue affects Salevo: from n/a through 1.3.0.
- Product
- Salevo
- Affected
- up to 1.3.0
- What to do
- Affects up to 1.3.0. Update Salevo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 12, 2026Element Pack Elementor Addons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-108478 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BdThemes Element Pack Elementor Addons bdthemes-element-pack-lite allows Stored XSS.This issue affects Element Pack Elementor Addons: from n/a through 8.8.8.
- Product
- Element Pack Elementor Addons
- Affected
- up to 8.8.8
- What to do
- Affects up to 8.8.8. Update Element Pack Elementor Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 12, 2026Flexible Subscriptions: Missing AuthorizationCVE-2026-107869 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WP Desk Flexible Subscriptions flexible-subscriptions allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Flexible Subscriptions: from n/a through 1.8.4.
- Product
- Flexible Subscriptions
- Affected
- up to 1.8.4
- What to do
- Affects up to 1.8.4. Update Flexible Subscriptions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 12, 2026JetElements For Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-107866 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetElements For Elementor jet-elements allows Stored XSS.This issue affects JetElements For Elementor: from n/a through 2.9.2.3.
- Product
- JetElements For Elementor
- Affected
- up to 2.9.2.3
- What to do
- Affects up to 2.9.2.3. Update JetElements For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 12, 2026Event post: Authorization Bypass Through User-Controlled KeyCVE-2026-107427 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Authorization Bypass Through User-Controlled Key vulnerability in NOUS Ouvert Utile et Simple Event post event-post allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event post: from n/a through 6.1.1.
- Product
- Event post
- Affected
- up to 6.1.1
- What to do
- Affects up to 6.1.1. Update Event post to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 12, 2026Flexible Quantity – Measurement Price Calculator for WooCommerce: Improper Validation of Specified Quantity in InputCVE-2026-106605 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Improper Validation of Specified Quantity in Input vulnerability in WP Desk Flexible Quantity – Measurement Price Calculator for WooCommerce flexible-quantity-measurement-price-calculator-for-woocommerce allows Input Data Manipulation.This issue affects Flexible Quantity – Measurement Price Calculator for WooCommerce: from n/a through 2.3.22.
- Product
- Flexible Quantity – Measurement Price Calculator for WooCommerce
- Affected
- up to 2.3.22
- What to do
- Affects up to 2.3.22. Update Flexible Quantity – Measurement Price Calculator for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 12, 2026Hotel Booking: Does not implement CSRF protection on its administrative booking order managementCVE-2026-84166 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Hotel Booking WordPress plugin through 3.8 does not implement CSRF protection on its administrative booking order management, allowing attackers to trick a logged-in administrator into creating, deleting, or modifying arbitrary booking order records via a forged request.
- Product
- Hotel Booking
- Affected
- up to 3.8
- What to do
- Affects up to 3.8. Update Hotel Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 12, 2026WP Comment Cleaner: Does not perform a capability check or validate a nonce on one of its bulk comment-deletion routinesCVE-2026-107791 · WordPress plugins & themes · reported by WPScanMedium 6.5
The WP Comment Cleaner WordPress plugin before 7.2 does not perform a capability check or validate a nonce on one of its bulk comment-deletion routines, allowing authenticated users with minimal permissions, such as subscribers, to permanently delete all comments on the site.
- Product
- WP Comment Cleaner
- Fixed in
- 7.2
- What to do
- Update WP Comment Cleaner to 7.2 or newer.
Oct 12, 2026HireZoot: Does not sanitise and escape one of its job specification settings before it is reflected back into an admin-area settings pageCVE-2025-15703 · WordPress plugins & themes · reported by WPScanLow 3.5
The HireZoot WordPress plugin before 4.0.0 does not sanitise and escape one of its job specification settings before it is reflected back into an admin-area settings page, allowing users with the HireZoot WordPress plugin before 4.0.0's management capability (Administrator by default) to store a payload that is executed in the browser of any administrator who later opens that page. As the unfiltered_html capability is not available to administrators on multisite (or where DISALLOW_UNFILTERED_HTML is set), this leads to Stored Cross-Site Scripting.
- Product
- HireZoot
- Fixed in
- 4.0.0
- What to do
- Update HireZoot to 4.0.0 or newer.
Oct 11, 2026ngx_cache_purge before 3.0.4 can allow file deletion via a symlink attack in certain situations where nginx and a served application (e.g., WordPress) run underCVE-2026-108981 · WordPress plugins & themes · reported by MITRELow 3.6
ngx_cache_purge before 3.0.4 can allow file deletion via a symlink attack in certain situations where nginx and a served application (e.g., WordPress) run under the same user account. The attacker must be able to create a symlink inside the cache path. Version 3.0.4 fixes this for the case of a symlink created at an arbitrary earlier time, but does not resolve an applicable TOCTOU race condition. (The ngx_cache_purge module follows symlinks while walking the cache directory tree during purge operations. The module relies on nginx's ngx_walk_tree(), which relies on stat() and therefore follows symlinks.)
- Fixed in
- 3.0.4
- What to do
- Update the plugin to 3.0.4 or newer.
Oct 11, 2026WP-Invoice: Does not perform capability checks in several of its AJAX handlersCVE-2026-97183 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WP-Invoice WordPress plugin through 4.3.1 does not perform capability checks in several of its AJAX handlers, allowing any authenticated user, such as a Subscriber, to retrieve the email addresses, display names and profile details of all registered users.
- Product
- WP-Invoice
- Affected
- up to 4.3.1
- What to do
- Affects up to 4.3.1. Update WP-Invoice to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 11, 2026Piotnet Forms: Does not authenticate or validate a form-submission file-upload request and permits browser-renderable file types to be storedCVE-2026-96227 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Piotnet Forms WordPress plugin through 1.0.30 does not authenticate or validate a form-submission file-upload request and permits browser-renderable file types to be stored, allowing unauthenticated attackers to store a file that executes arbitrary JavaScript in the site's origin when it is opened (Stored XSS).
- Product
- Piotnet Forms
- Affected
- up to 1.0.30
- What to do
- Affects up to 1.0.30. Update Piotnet Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 11, 2026Subscribe to Comments: Does not properly validate a parameter before reflecting it into a link targetCVE-2026-91829 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Subscribe to Comments WordPress plugin before 2.3.3 does not properly validate a parameter before reflecting it into a link target, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting via a crafted URL against anyone who clicks it, including administrators.
- Product
- Subscribe to Comments
- Fixed in
- 2.3.3
- What to do
- Update Subscribe to Comments to 2.3.3 or newer.
Oct 11, 2026WP Posts Password Batch Manager: Does not perform any capability or nonce check on a bulk post-password action that runs on an always-loaded admin handlerCVE-2026-89283 · WordPress plugins & themes · reported by WPScanHigh 8.6
The WP Posts Password Batch Manager WordPress plugin through 1.1 does not perform any capability or nonce check on a bulk post-password action that runs on an always-loaded admin handler, allowing unauthenticated attackers to reset or overwrite the password of every published post, disclosing password-protected content or locking all posts behind an attacker-chosen password.
- Product
- WP Posts Password Batch Manager
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update WP Posts Password Batch Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 11, 2026KeyWord Collector: Does not have any authorisation or nonce checkCVE-2026-88905 · WordPress plugins & themes · reported by WPScanHigh 8.8
The KeyWord Collector WordPress plugin through 1.4 does not have any authorisation or nonce check when saving its settings, and does not escape them before output, allowing unauthenticated attackers to store malicious JavaScript that executes when an administrator opens the KeyWord Collector WordPress plugin through 1.4's settings page or when a visitor loads a page displaying its output.
- Product
- KeyWord Collector
- Affected
- up to 1.4
- What to do
- Affects up to 1.4. Update KeyWord Collector to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 11, 2026Topcontent: Does not properly authorise one of its request handlers and disables HTML sanitisation before storing the submitted contentCVE-2026-88903 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Topcontent WordPress plugin through 1.2.1 does not properly authorise one of its request handlers and disables HTML sanitisation before storing the submitted content, allowing unauthenticated attackers to publish arbitrary posts containing malicious JavaScript on any site where its API key has never been configured.
- Product
- Topcontent
- Affected
- up to 1.2.1
- What to do
- Affects up to 1.2.1. Update Topcontent to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 11, 2026Disable Users: Does not enforce its account-disabling control on all authentication pathsCVE-2026-88827 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Disable Users WordPress plugin through 1.0.5 does not enforce its account-disabling control on all authentication paths, allowing the holder of an account an administrator has disabled to continue authenticating with the account's full privileges.
- Product
- Disable Users
- Affected
- up to 1.0.5
- What to do
- Affects up to 1.0.5. Update Disable Users to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 11, 2026SmugMug Embed: Does not have authorisation or CSRF checks on an AJAX action that stores gallery dataCVE-2026-88826 · WordPress plugins & themes · reported by WPScanHigh 8.8
The SmugMug Embed WordPress plugin through 3.13 does not have authorisation or CSRF checks on an AJAX action that stores gallery data, and does not sanitise or escape that data before outputting it, allowing unauthenticated users to store arbitrary web scripts that execute when an administrator views the SmugMug Embed WordPress plugin through 3.13's settings screen.
- Product
- SmugMug Embed
- Affected
- up to 3.13
- What to do
- Affects up to 3.13. Update SmugMug Embed to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 11, 2026Simple Membership: Does not avoid transmitting a newly registered member's plaintext password in a URL query stringCVE-2026-88785 · WordPress plugins & themes · reported by WPScanMedium 4.7
The Simple Membership WordPress plugin before 4.8.3 does not avoid transmitting a newly registered member's plaintext password in a URL query string when an optional auto-login-after-registration feature is enabled, exposing the credential in browser history and in web server, proxy, and CDN access logs to anyone able to read them.
- Product
- Simple Membership
- Fixed in
- 4.8.3
- What to do
- Update Simple Membership to 4.8.3 or newer.
Oct 11, 2026Quick quotes: Does not perform any capability or nonce check on one of its AJAX actions and lets the caller chooseCVE-2026-86706 · WordPress plugins & themes · reported by WPScanCritical 9.1
The Quick quotes WordPress plugin through 1.0.0 does not perform any capability or nonce check on one of its AJAX actions and lets the caller choose which option is written, allowing unauthenticated users to alter arbitrary site settings and to make the site unavailable.
- Product
- Quick quotes
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Quick quotes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 11, 2026Robo Gallery: Does not sanitise and escape some of its gallery settings before outputting them on the gallery edit screenCVE-2026-81156 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Robo Gallery WordPress plugin before 5.2.6 does not sanitise and escape some of its gallery settings before outputting them on the gallery edit screen, allowing users with the Contributor role and above to store JavaScript that executes in the context of an administrator who opens the gallery for editing.
- Product
- Robo Gallery
- Fixed in
- 5.2.6
- What to do
- Update Robo Gallery to 5.2.6 or newer.
Oct 11, 2026Robo Gallery: Does not sanitise and escape a gallery setting before outputting it on a frontend pageCVE-2026-81155 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Robo Gallery WordPress plugin before 5.2.6 does not sanitise and escape a gallery setting before outputting it on a frontend page, allowing users with the Author role and above to perform Stored Cross-Site Scripting attacks that execute in the browser of any visitor viewing a gallery, including administrators.
- Product
- Robo Gallery
- Fixed in
- 5.2.6
- What to do
- Update Robo Gallery to 5.2.6 or newer.
Oct 11, 2026Robo Gallery: Does not sanitise and escape image alt text before outputting it in one of its gallery layoutsCVE-2026-81154 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Robo Gallery WordPress plugin before 5.2.6 does not sanitise and escape image alt text before outputting it in one of its gallery layouts, allowing users with the Author role and above to perform Stored Cross-Site Scripting attacks that execute in the browser of any user viewing the affected gallery, including administrators.
- Product
- Robo Gallery
- Fixed in
- 5.2.6
- What to do
- Update Robo Gallery to 5.2.6 or newer.
Oct 11, 2026Robo Gallery: Does not sanitise and escape some of its image settings before outputting them in a gallery pageCVE-2026-81153 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Robo Gallery WordPress plugin before 5.2.6 does not sanitise and escape some of its image settings before outputting them in a gallery page, allowing users with the Author role and above to perform Stored Cross-Site Scripting attacks that execute in the browser of any visitor viewing the gallery, including administrators, even where the unfiltered_html capability is disallowed such as on multisite.
- Product
- Robo Gallery
- Fixed in
- 5.2.6
- What to do
- Update Robo Gallery to 5.2.6 or newer.
Oct 11, 2026Post Snippets: Does not properly escape variable values substituted into snippets before outputting themCVE-2026-12980 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Post Snippets WordPress plugin through 4.2.4 does not properly escape variable values substituted into snippets before outputting them, allowing users with the Contributor role and above to inject arbitrary web scripts that execute when the content is viewed.
- Product
- Post Snippets
- Affected
- up to 4.2.4
- What to do
- Affects up to 4.2.4. Update Post Snippets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 11, 2026WeddingCity Lite: Does not perform any authorisation or validity checks before deleting postsCVE-2026-106029 · WordPress plugins & themes · reported by WPScanHigh 7.5
The WeddingCity Lite WordPress plugin through 1.0.4 does not perform any authorisation or validity checks before deleting posts, pages and media attachments, allowing unauthenticated attackers to permanently delete arbitrary content site-wide.
- Product
- WeddingCity Lite
- Affected
- up to 1.0.4
- What to do
- Affects up to 1.0.4. Update WeddingCity Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 11, 2026Envira Gallery: Does not verify that a user is authorized to read a gallery before rendering itCVE-2026-104684 · WordPress plugins & themes · reported by WPScanLow 2.7
The Envira Gallery WordPress plugin before 1.16.2 does not verify that a user is authorized to read a gallery before rendering it, allowing authors to embed and expose other users' non-public gallery metadata to unauthenticated visitors.
- Product
- Envira Gallery
- Fixed in
- 1.16.2
- What to do
- Update Envira Gallery to 1.16.2 or newer.
Oct 11, 2026Envira Gallery: Does not correctly check authorization on its gallery-conversion featureCVE-2026-104682 · WordPress plugins & themes · reported by WPScanLow 2.7
The Envira Gallery WordPress plugin before 1.16.2 does not correctly check authorization on its gallery-conversion feature, verifying that the requester can edit an arbitrary post they name rather than that they are allowed to create the Envira Gallery WordPress plugin before 1.16.2's own gallery content, allowing users with contributor-level access to create and publish gallery posts that the Envira Gallery WordPress plugin before 1.16.2's settings otherwise withhold from them.
- Product
- Envira Gallery
- Fixed in
- 1.16.2
- What to do
- Update Envira Gallery to 1.16.2 or newer.
Oct 11, 2026Envira Gallery: Does not verify that an image identifier added to a gallery refers to a media attachment the caller is permitted to viewCVE-2026-104681 · WordPress plugins & themes · reported by WPScanLow 2.7
The Envira Gallery WordPress plugin before 1.16.2 does not verify that an image identifier added to a gallery refers to a media attachment the caller is permitted to view, allowing any user able to create and edit a gallery (Author and above by default) to disclose the title and excerpt of other users' private, draft, pending and trashed posts that WordPress would otherwise withhold from them.
- Product
- Envira Gallery
- Fixed in
- 1.16.2
- What to do
- Update Envira Gallery to 1.16.2 or newer.
Oct 11, 2026Envira Gallery: Does not verify that a user holds the capability WordPress reserves for installing Envira Gallery WordPress plugin before 1CVE-2026-104680 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Envira Gallery WordPress plugin before 1.16.2 does not verify that a user holds the capability WordPress reserves for installing Envira Gallery WordPress plugin before 1.16.2 code before processing its setup-wizard Envira Gallery WordPress plugin before 1.16.2-installation request, and does not restrict the installation to its own curated list, allowing a Multisite subsite Administrator to install an arbitrary WordPress.org-published Envira Gallery WordPress plugin before 1.16.2 into the network-shared Envira Gallery WordPress plugin before 1.16.2 directory, a privilege Multisite reserves for the network Super Admin.
- Product
- Envira Gallery
- Fixed in
- 1.16.2
- What to do
- Update Envira Gallery to 1.16.2 or newer.
Oct 11, 2026Mobile builder: Does not sanitise and escape a parameter before using it in a SQL statementCVE-2026-103695 · WordPress plugins & themes · reported by WPScanHigh 8.6
The Mobile builder WordPress plugin through 1.4.2 does not sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks.
- Product
- Mobile builder
- Affected
- up to 1.4.2
- What to do
- Affects up to 1.4.2. Update Mobile builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 11, 2026Mobile builder: Does not properly restrictCVE-2026-103694 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Mobile builder WordPress plugin through 1.4.2 does not properly restrict which user meta keys a logged-in user can update through one of its REST routes, allowing any user with a self-registered account, such as a customer, to grant themselves the administrator role.
- Product
- Mobile builder
- Affected
- up to 1.4.2
- What to do
- Affects up to 1.4.2. Update Mobile builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026Subscriber Arbitrary File Deletion in FoodBakery <= 4.6 versions.CVE-2026-78530 · WordPress plugins & themes · reported by PatchstackHigh 7.7
Subscriber Arbitrary File Deletion in FoodBakery <= 4.6 versions.
- Affected
- up to 4.6
- What to do
- Affects up to 4.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026Unauthenticated Local File Inclusion in Ambient <= 1.7 versions.CVE-2026-66566 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Local File Inclusion in Ambient <= 1.7 versions.
- Affected
- up to 1.7
- What to do
- Affects up to 1.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026Author Arbitrary File Deletion in Presto Player Pro <= 3.0.1 versions.CVE-2026-66481 · WordPress plugins & themes · reported by PatchstackMedium 6.8
Author Arbitrary File Deletion in Presto Player Pro <= 3.0.1 versions.
- Affected
- up to 3.0.1
- What to do
- Affects up to 3.0.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026Unauthenticated Arbitrary Content Deletion in Forminator <= 1.57.3 versions.CVE-2026-65459 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Arbitrary Content Deletion in Forminator <= 1.57.3 versions.
- Affected
- up to 1.57.3
- What to do
- Affects up to 1.57.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026Contributor Arbitrary File Upload in Creator LMS <= 1.2.21 versions.CVE-2026-62129 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Contributor Arbitrary File Upload in Creator LMS <= 1.2.21 versions.
- Affected
- up to 1.2.21
- What to do
- Affects up to 1.2.21. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026Unauthenticated Local File Inclusion in KuteShop <= 4.2.9 versions.CVE-2026-62115 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Local File Inclusion in KuteShop <= 4.2.9 versions.
- Affected
- up to 4.2.9
- What to do
- Affects up to 4.2.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026Unauthenticated Local File Inclusion in Boutique <= 2.3.3 versions.CVE-2026-62099 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Local File Inclusion in Boutique <= 2.3.3 versions.
- Affected
- up to 2.3.3
- What to do
- Affects up to 2.3.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026Unauthenticated Local File Inclusion in Biolife <= 3.2.3 versions.CVE-2026-62096 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Local File Inclusion in Biolife <= 3.2.3 versions.
- Affected
- up to 3.2.3
- What to do
- Affects up to 3.2.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026Unauthenticated Local File Inclusion in TechOne <= 3.0.3 versions.CVE-2026-62094 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Local File Inclusion in TechOne <= 3.0.3 versions.
- Affected
- up to 3.0.3
- What to do
- Affects up to 3.0.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.