Updated 8 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

584new WordPress flaws this week

391,288entries in the database

12,185 results · page 9 of 244

Oct 10, 2026Forminator: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-102388 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPMU DEV Forminator forminator allows Stored XSS.This issue affects Forminator: from n/a through 1.57.3.
Product
Forminator
Affected
up to 1.57.3
What to do
Affects up to 1.57.3. Update Forminator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 10, 2026PeproDev Ultimate Profile Solutions: Stored Cross-Site ScriptingCVE-2026-4791 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The PeproDev Ultimate Profile Solutions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `logout-url` shortcode's 'button' attribute in all versions up to, and including, 8.2.36 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
PeproDev Ultimate Profile Solutions
Affected
up to 8.2.36
What to do
Affects up to 8.2.36. Update PeproDev Ultimate Profile Solutions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 10, 2026HivePress – Business Directory, Listings & Classified Ads: Stored Cross-Site ScriptingCVE-2026-107657 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The HivePress – Business Directory, Listings & Classified Ads Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '<custom user attribute field name, e.g. profile_test>' parameter in all versions up to, and including, 1.7.31 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires an administrator to have configured a text-type custom user attribute whose display format places %value% inside an HTML attribute context (e.g., the documented pattern <a href="%value%">Custom link</a>), and for front-end user profiles to be enabled — both of which reflect the plugin's standard, documented configuration.
Product
HivePress – Business Directory, Listings & Classified Ads
Affected
up to 1.7.31
What to do
Affects up to 1.7.31. Update HivePress – Business Directory, Listings & Classified Ads to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Oct 10, 2026Email Marketing for WordPress and WooCommerce – Retainful: Stored Cross-Site ScriptingCVE-2026-97396 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Email Marketing for WordPress and WooCommerce – Retainful plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data' parameter in all versions up to, and including, 1.0.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Email Marketing for WordPress and WooCommerce – Retainful
Affected
up to 1.0.10
What to do
Affects up to 1.0.10. Update Email Marketing for WordPress and WooCommerce – Retainful to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 10, 2026Avada | Website Builder For WordPress & WooCommerce: Stored Cross-Site ScriptingCVE-2026-97340 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Stored Cross-Site Scripting via the user profile 'Author Page' social link contact-method fields (author_facebook, author_twitter, author_linkedin, author_dribble, author_whatsapp, author_email) in versions up to, and including, 7.16.1. Avada registers these fields through the user_contactmethods filter and, on the author archive, emits them inside an anchor href using only esc_attr() in Fusion_Social_Icon::get_markup(), which escapes HTML metacharacters but does not reject dangerous URL schemes such as javascript:. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses their author page and clicks the injected social icon (a click is required, and the site must have 'Open Social Icons in a New Window' set to Off so the browser doesn't block the javascript: URL from opening in a new tab).
Product
Avada | Website Builder For WordPress & WooCommerce
Affected
up to 7.16.1
What to do
Affects up to 7.16.1. Update Avada | Website Builder For WordPress & WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record avada.com wordfence.com
Oct 10, 2026WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN): Stored Cross-Site ScriptingCVE-2026-96765 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id_token' parameter in all versions up to, and including, 44.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload is stored in the wpo365_errors transient for up to three days by submitting a crafted unauthenticated request with a forged id_token whose base64url-decoded unique_name or iss claim contains malicious HTML, requiring no prior authentication or user interaction beyond an administrator later visiting the WPO365 wizard page.
Product
WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN)
Affected
up to 44.1
What to do
Affects up to 44.1. Update WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 10, 2026Motors – Car Dealership & Classified Listings: Stored Cross-Site ScriptingCVE-2026-96563 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'stm_f_s' parameter in all versions up to, and including, 1.4.124 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The nonce required by the stm_ajax_add_a_car AJAX handler is emitted in wp_footer on every page, making it accessible to any authenticated user and removing any practical barrier to exploitation at the Subscriber level.
Product
Motors – Car Dealership & Classified Listings
Affected
up to 1.4.124
What to do
Affects up to 1.4.124. Update Motors – Car Dealership & Classified Listings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 10, 2026WP Photo Album Plus: Stored Cross-Site ScriptingCVE-2026-96278 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The WP Photo Album Plus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REQUEST_URI Session History in all versions up to, and including, 9.3.03.002 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The bypass works because esc_url_raw() strips literal angle brackets but retains HTML entities, which wppaEntityDecode() silently converts back to live HTML tags before jQuery('#wppa-modal-container').html() renders them.
Product
WP Photo Album Plus
Affected
up to 9.3.03.002
What to do
Affects up to 9.3.03.002. Update WP Photo Album Plus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 10, 2026Zeinet: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-93951 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bracketweb Zeinet zeinet allows Reflected XSS.This issue affects Zeinet: from n/a through 1.0.0.
Product
Zeinet
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Zeinet to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 10, 2026Premium Packages – Sell Digital Products Securely: Stored Cross-Site ScriptingCVE-2026-103478 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'checkout[billing][phone] (and state / taxid / email)' parameter in all versions up to, and including, 7.2.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Premium Packages – Sell Digital Products Securely
Affected
up to 7.2.6
What to do
Affects up to 7.2.6. Update Premium Packages – Sell Digital Products Securely to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 10, 2026SureDash – Community, Courses & Member Dashboard: Stored DOM-Based Cross-Site ScriptingCVE-2026-102774 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The SureDash – Community, Courses & Member Dashboard plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via Image 'alt' Attribute in Community Post Content in all versions up to, and including, 1.12.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The entity-encoded payload bypasses server-side wp_kses filtering because kses permits the img/alt tag combination and does not normalize entities inside attribute values; the decode occurs client-side when GLightbox reads the .alt DOM property and assigns the result to innerHTML.
Product
SureDash – Community, Courses & Member Dashboard
Affected
up to 1.12.1
What to do
Affects up to 1.12.1. Update SureDash – Community, Courses & Member Dashboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 10, 2026WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More: Reflected Cross-Site ScriptingCVE-2026-101921 · WordPress plugins & themes · reported by WordfenceMedium 4.7
The WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'attacker-chosen key referenced by the smart tag (e.g. "x")' parameter in all versions up to, and including, 2.0.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Exploitation requires that a site administrator has previously saved a form whose description embeds a {query_var} Smart Tag inside an iframe srcdoc attribute and has enabled Show Description on a public-facing page.
Product
WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More
Affected
up to 2.0.2.1
What to do
Affects up to 2.0.2.1. Update WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 10, 2026Molongui Authorship – Author Boxes, Guest Authors & Co-Authors for: Stored DOM-Based Cross-Site ScriptingCVE-2026-101920 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Molongui Authorship – Author Boxes, Guest Authors & Co-Authors for WordPress plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'comment (href attribute inside comment content)' parameter in all versions up to, and including, 5.2.12 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable in the free build because the plugin's author-filter rewriter never appends the ?m_bm=true marker to its own anchors (Plugin::has_pro() returns false), meaning every href the byline script selects and rewrites is fully attacker-controlled.
Product
Molongui Authorship – Author Boxes, Guest Authors & Co-Authors for
Affected
up to 5.2.12
What to do
Affects up to 5.2.12. Update Molongui Authorship – Author Boxes, Guest Authors & Co-Authors for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 10, 2026WPAdverts – Classifieds: Stored Cross-Site ScriptingCVE-2026-100178 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The WPAdverts – Classifieds Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'adverts_location' parameter in all versions up to, and including, 2.3.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WPAdverts – Classifieds
Affected
up to 2.3.4
What to do
Affects up to 2.3.4. Update WPAdverts – Classifieds to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 10, 2026FunnelKit – Funnel Builder for WooCommerce Checkout: Stored Cross-Site ScriptingCVE-2026-100147 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The FunnelKit – Funnel Builder for WooCommerce Checkout plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'shipping_first_name' parameter in all versions up to, and including, 3.16.0.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
FunnelKit – Funnel Builder for WooCommerce Checkout
Affected
up to 3.16.0.5
What to do
Affects up to 3.16.0.5. Update FunnelKit – Funnel Builder for WooCommerce Checkout to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 10, 2026Post Grid Gutenberg Blocks – PostX: Stored Cross-Site ScriptingCVE-2026-96840 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Post Grid Gutenberg Blocks – PostX plugin for WordPress is vulnerable to Stored Cross-Site Scripting via display_name User Field in all versions up to, and including, 5.1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. WordPress core's pre_user_display_name filter encodes &, <, and > but leaves double-quotes intact (ENT_NOQUOTES), allowing a Subscriber-level user to store a double-quote in their display_name via /wp-admin/profile.php that subsequently breaks out of the alt="" attribute at Archive_Title.php:144.
Product
Post Grid Gutenberg Blocks – PostX
Affected
up to 5.1.0
What to do
Affects up to 5.1.0. Update Post Grid Gutenberg Blocks – PostX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 10, 2026WP Meteor Website Speed Optimization Addon: Stored Cross-Site ScriptingCVE-2026-96572 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The WP Meteor Website Speed Optimization Addon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Author Name in all versions up to, and including, 3.4.18 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload is delivered via the comment author name field, which must clear WordPress's comment moderation workflow before being displayed, though this represents a display prerequisite rather than any sanitization control.
Product
WP Meteor Website Speed Optimization Addon
Affected
up to 3.4.18
What to do
Affects up to 3.4.18. Update WP Meteor Website Speed Optimization Addon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 10, 2026Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker: Stored DOM-Based Cross-Site ScriptingCVE-2026-96558 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'qsm_hidden_questions' parameter in all versions up to, and including, 11.2.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the attacker to force the mlw_results INSERT to fail by submitting an over-length or duplicate qsm_unique_key value, which triggers the audit trail code branch that writes the unescaped payload to wp_mlw_qm_audit_trail.form_data.
Product
Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker
Affected
up to 11.2.6
What to do
Affects up to 11.2.6. Update Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 10, 2026VikBooking Hotel Booking Engine & PMS: Stored Cross-Site ScriptingCVE-2026-95684 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'attachments[name]' Parameter in all versions up to, and including, 1.8.15 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
VikBooking Hotel Booking Engine & PMS
Affected
up to 1.8.15
What to do
Affects up to 1.8.15. Update VikBooking Hotel Booking Engine & PMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 10, 2026Payment Plugins for Stripe WooCommerce: Reflected Cross-Site ScriptingCVE-2026-89100 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Payment Plugins for Stripe WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via '#response' URL Fragment in all versions up to, and including, 4.0.17 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that the 'Generic Errors' setting is unchecked, causing getErrorMessage() to return the raw Stripe error string unchanged rather than substituting a mapped safe message.
Product
Payment Plugins for Stripe WooCommerce
Affected
up to 4.0.17
What to do
Affects up to 4.0.17. Update Payment Plugins for Stripe WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 10, 2026Frontend Admin by DynamiApps: Stored Cross-Site ScriptingCVE-2026-6243 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via kses bypass / mutation XSS in all versions up to, and including, 3.28.36. This is due to the 'get_dynamic_values' function performing text-level find-and-replace operations on post content without HTML-aware parsing. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Frontend Admin by DynamiApps
Affected
up to 3.28.36
What to do
Affects up to 3.28.36. Update Frontend Admin by DynamiApps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 10, 2026Favicon Rotator: Reflected Cross-Site ScriptingCVE-2026-5725 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Favicon Rotator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'fvrt_' prefixed request parameters in all versions up to, and including, 1.2.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Favicon Rotator
Affected
up to 1.2.11
What to do
Affects up to 1.2.11. Update Favicon Rotator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 10, 202610Web Booster – Website speed optimization, Cache & Page Speed optimizer: Stored Cross-Site ScriptingCVE-2026-107742 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'author' parameter in all versions up to, and including, 2.34.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable because a comment author Name value containing ' src=' and an event-handler payload contains no HTML tags or quote characters, allowing it to survive WordPress core's sanitize_text_field and land verbatim inside the alt attribute, where the plugin's own str_replace subsequently injects the single quote that breaks out of the attribute context.
Product
10Web Booster – Website speed optimization, Cache & Page Speed optimizer
Affected
up to 2.34.8
What to do
Affects up to 2.34.8. Update 10Web Booster – Website speed optimization, Cache & Page Speed optimizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 10, 2026Responsive Lightbox & Gallery: Stored Cross-Site ScriptingCVE-2026-103897 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Responsive Lightbox & Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 2.7.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with editor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the plugin's 'Comments' lightbox setting to be enabled (disabled by default), a moderator to approve the injected comment, and a site visitor to click the affected image to open the lightbox.
Product
Responsive Lightbox & Gallery
Affected
up to 2.7.9
What to do
Affects up to 2.7.9. Update Responsive Lightbox & Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 10, 2026Simple Membership: Stored Cross-Site ScriptingCVE-2026-103427 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Simple Membership plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'country' parameter in all versions up to, and including, 4.8.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Unauthenticated attackers may also exploit this vulnerability when the plugin's Enable Free Membership feature is turned on, as it permits anonymous front-end registration and profile submission.
Product
Simple Membership
Affected
up to 4.8.4
What to do
Affects up to 4.8.4. Update Simple Membership to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record downloads.wordpress.org plugins.trac.wordpress.org
Oct 10, 2026Team – Team Members Showcase: Stored Cross-Site ScriptingCVE-2026-102402 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Team – Team Members Showcase Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ttp_filter_taxonomy (meta of the attacker-chosen post)' parameter in all versions up to, and including, 6.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Team – Team Members Showcase
Affected
up to 6.0.2
What to do
Affects up to 6.0.2. Update Team – Team Members Showcase to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 10, 2026LazyLoad Plugin – Lazy Load Images, Videos, and Iframes: Stored Cross-Site ScriptingCVE-2026-100196 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The LazyLoad Plugin – Lazy Load Images, Videos, and Iframes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment_content (rendered inline into the page HTML)' parameter in all versions up to, and including, 2.4.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. WordPress core's wp_kses_data allow-list does not strip the crafted payload on save because it uses only permitted tags and attributes; the event handler is concealed inside a broken attribute region and is only promoted to a real DOM attribute by the plugin's render-time str_replace transformation. Additionally, a site administrator must approve the crafted comment before the payload is served to other visitors.
Product
LazyLoad Plugin – Lazy Load Images, Videos, and Iframes
Affected
up to 2.4.0
What to do
Affects up to 2.4.0. Update LazyLoad Plugin – Lazy Load Images, Videos, and Iframes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 10, 2026Photo Reviews for WooCommerce: Stored DOM-Based Cross-Site ScriptingCVE-2026-100161 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Photo Reviews for WooCommerce plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'wcpr_image_upload_id' parameter in all versions up to, and including, 1.2.30 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The publicly-emitted `wcpr_image_upload` nonce printed on every product review form is the only gate, and no capability, authentication, or attachment ownership check is performed, allowing the payload to be stored in comment meta — which is not subject to `wp_kses` — by any unauthenticated visitor; the XSS fires once the review is visible on the frontend.
Product
Photo Reviews for WooCommerce
Affected
up to 1.2.30
What to do
Affects up to 1.2.30. Update Photo Reviews for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 10, 2026GiveWP – Donation Plugin and Fundraising Platform: Stored Cross-Site ScriptingCVE-2026-97643 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `givewp_campaign_grid` shortcode in versions up to, and including, 4.17.0 This is due to insufficient input sanitization and output escaping on user supplied shortcode attributes (`filter_by`, `layout`, `sort_by`, `order_by`) in the CampaignGridShortcode::parseAttributes() function combined with the render template emitting `json_encode($attributes)` inside a single-quoted HTML attribute without esc_attr() — json_encode() does not escape single quotes by default, so a `'` in an attribute value breaks out of the enclosing attribute. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
GiveWP – Donation Plugin and Fundraising Platform
Affected
up to 4.17.0
What to do
Affects up to 4.17.0. Update GiveWP – Donation Plugin and Fundraising Platform to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Oct 10, 2026Presto Player: Stored Cross-Site ScriptingCVE-2026-96682 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Presto Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via <presto-player> Tag in all versions up to, and including, 4.5.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires an initial comment approval, though WordPress default settings will auto-approve all subsequent comments from the same author, allowing a patient unauthenticated attacker to land the payload without further admin intervention.
Product
Presto Player
Affected
up to 4.5.1
What to do
Affects up to 4.5.1. Update Presto Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 10, 2026Real Estate Manager – Property Listing and Agent Management: Stored Cross-Site ScriptingCVE-2026-96667 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Real Estate Manager – Property Listing and Agent Management plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'first_name' parameter in all versions up to, and including, 7.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The reCAPTCHA check is trivially bypassed by omitting the g-recaptcha-response parameter entirely, since validation only runs when that parameter is present.
Product
Real Estate Manager – Property Listing and Agent Management
Affected
up to 7.3
What to do
Affects up to 7.3. Update Real Estate Manager – Property Listing and Agent Management to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Oct 10, 2026Church Admin: Stored Cross-Site ScriptingCVE-2026-94421 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Church Admin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email' parameter in all versions up to, and including, 5.1.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Church Admin
Affected
up to 5.1.2
What to do
Affects up to 5.1.2. Update Church Admin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 10, 2026Podlove Podcast Publisher: Stored Cross-Site ScriptingCVE-2026-93775 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Podlove Podcast Publisher plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Auphonic Webhook in all versions up to, and including, 4.5.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injection is triggered by submitting a request to the Auphonic webhook endpoint with any POST body where the status_string field is not the literal string 'Done', causing the full raw POST superglobal to be stored in the plugin log before any authentication key validation is performed.
Product
Podlove Podcast Publisher
Affected
up to 4.5.6
What to do
Affects up to 4.5.6. Update Podlove Podcast Publisher to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Oct 10, 2026Getwid – Gutenberg Blocks: Stored Cross-Site ScriptingCVE-2026-91862 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data-image-points' parameter in all versions up to, and including, 3.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Getwid – Gutenberg Blocks
Affected
up to 3.0.1
What to do
Affects up to 3.0.1. Update Getwid – Gutenberg Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 10, 2026Table Field Add-on for ACF and SCF: Stored Cross-Site ScriptingCVE-2026-78068 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Table Field Add-on for ACF and SCF plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Table Cell Content in all versions up to, and including, 1.3.35 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Table Field Add-on for ACF and SCF
Affected
up to 1.3.35
What to do
Affects up to 1.3.35. Update Table Field Add-on for ACF and SCF to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 10, 2026Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files: Stored Cross-Site ScriptingCVE-2026-18558 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'embeddoc' shortcode in all versions up to, and including, 2.7.13 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files
Affected
up to 2.7.13
What to do
Affects up to 2.7.13. Update Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 10, 2026Graphene: Stored Cross-Site ScriptingCVE-2026-17025 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Graphene theme for WordPress is vulnerable to Stored Cross-Site Scripting via 'Current location' and 'Author profile image URL' Profile Fields in all versions up to, and including, 2.9.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Graphene
Affected
up to 2.9.4
What to do
Affects up to 2.9.4. Update Graphene to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themes.trac.wordpress.org themes.trac.wordpress.org
Oct 10, 2026MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar: Stored Cross-Site ScriptingCVE-2026-16776 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and including, 5.14.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. WordPress's save-time wp_kses_post does not neutralize the payload because the attack is delivered via shortcode attributes rather than raw HTML in post content, allowing the unescaped values to survive to render time.
Product
MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar
Affected
up to 5.14.2
What to do
Affects up to 5.14.2. Update MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 10, 2026Brizy – Page Builder: Stored Cross-Site ScriptingCVE-2026-14882 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Brizy – Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'brizy-compiled-sections' parameter in all versions up to, and including, 2.8.18 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Brizy – Page Builder
Affected
up to 2.8.18
What to do
Affects up to 2.8.18. Update Brizy – Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 10, 2026Data Tables Generator by Supsystic: Stored Cross-Site ScriptingCVE-2026-14877 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Data Tables Generator by Supsystic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the id attribute in all versions up to, and including, 1.12.03 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Data Tables Generator by Supsystic
Affected
up to 1.12.03
What to do
Affects up to 1.12.03. Update Data Tables Generator by Supsystic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 10, 2026GamiPress – Gamification plugin to reward points, achievements, badges & ranks in: Stored Cross-Site ScriptingCVE-2026-14379 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'video_id' parameter in all versions up to, and including, 7.9.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
GamiPress – Gamification plugin to reward points, achievements, badges & ranks in
Affected
up to 7.9.4
What to do
Affects up to 7.9.4. Update GamiPress – Gamification plugin to reward points, achievements, badges & ranks in to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 10, 2026Easy Digital Downloads – eCommerce Payments and Subscriptions made easy: Stored Cross-Site ScriptingCVE-2026-14335 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Easy Digital Downloads – eCommerce Payments and Subscriptions made easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via PayPal IPN Parameters in all versions up to, and including, 3.6.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Easy Digital Downloads – eCommerce Payments and Subscriptions made easy
Affected
up to 3.6.9
What to do
Affects up to 3.6.9. Update Easy Digital Downloads – eCommerce Payments and Subscriptions made easy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 10, 2026Download Manager: Reflected Cross-Site ScriptingCVE-2026-12054 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Download Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'REFERRER' parameter in all versions up to, and including, 3.3.57 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute in a victim's browser.
Product
Download Manager
Affected
up to 3.3.57
What to do
Affects up to 3.3.57. Update Download Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 10, 2026Kadence Blocks — Page Builder Toolkit for Gutenberg Editor: Stored Cross-Site ScriptingCVE-2026-104762 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Kadence Blocks — Page Builder Toolkit for Gutenberg Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Block Font Family Attribute in all versions up to, and including, 3.7.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This encoding bypass is only triggered when the "Load Google Fonts Locally" site option (kadence_blocks_font_settings['load_fonts_local']) is enabled, which is not the default configuration.
Product
Kadence Blocks — Page Builder Toolkit for Gutenberg Editor
Affected
up to 3.7.12
What to do
Affects up to 3.7.12. Update Kadence Blocks — Page Builder Toolkit for Gutenberg Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 10, 2026JetFormBuilder — Dynamic Blocks Form Builder: Reflected DOM-Based Cross-Site ScriptingCVE-2026-103912 · WordPress plugins & themes · reported by WordfenceMedium 4.7
The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Reflected DOM-Based Cross-Site Scripting via the '<attacker-chosen query var name matching the preset's query_var setting>' parameter in all versions up to, and including, 3.6.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. This is only exploitable on pages embedding a form that has a text field configured with a query_var Dynamic Preset and a data-jfb-macro or JFB_FIELD:: macro reference targeting that field, both of which are standard, documented plugin features.
Product
JetFormBuilder — Dynamic Blocks Form Builder
Affected
up to 3.6.6
What to do
Affects up to 3.6.6. Update JetFormBuilder — Dynamic Blocks Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 10, 2026HivePress – Business Directory, Listings & Classified Ads: Stored Cross-Site ScriptingCVE-2026-103520 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The HivePress – Business Directory, Listings & Classified Ads Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'custom text attribute (user-defined field name)' parameter in all versions up to, and including, 1.7.31 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is only exploitable when an administrator has configured a Text attribute whose display format places the %value% token inside an HTML attribute (e.g., title="%value%"), which is a documented HivePress pattern.
Product
HivePress – Business Directory, Listings & Classified Ads
Affected
up to 1.7.31
What to do
Affects up to 1.7.31. Update HivePress – Business Directory, Listings & Classified Ads to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Oct 10, 2026Simple Newsletter Plugin – Noptin: Stored Cross-Site ScriptingCVE-2026-103482 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Simple Newsletter Plugin – Noptin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'noptin_fields[<custom_field_merge_tag>] (e.g. first_name)' parameter in all versions up to, and including, 4.3.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The attack chain requires a published campaign post whose body contains a [[subscriber.*]] merge tag; the unauthenticated attacker first POSTs the entity-encoded payload to the public manage_preferences form (which issues its own nonce on the same page), then pivots execution by embedding their confirm_key in a campaign preview URL sent to a privileged user via social engineering.
Product
Simple Newsletter Plugin – Noptin
Affected
up to 4.3.10
What to do
Affects up to 4.3.10. Update Simple Newsletter Plugin – Noptin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Oct 10, 2026Download Manager: Stored Cross-Site ScriptingCVE-2026-9696 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'not_found' parameter in all versions up to, and including, 3.3.58 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Download Manager
Affected
up to 3.3.58
What to do
Affects up to 3.3.58. Update Download Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 10, 2026FV Flowplayer Video Player: Stored Cross-Site ScriptingCVE-2026-97630 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Unquoted popup Shortcode Attribute in all versions up to, and including, 7.5.54.7212 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires the profile_videos_enable_bio option to be enabled, as script execution occurs on the author bio/archive page where the profile-video shortcode is rendered.
Product
FV Flowplayer Video Player
Affected
up to 7.5.54.7212
What to do
Affects up to 7.5.54.7212. Update FV Flowplayer Video Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 10, 2026Data Tables Generator by Supsystic: Stored Cross-Site ScriptingCVE-2026-96648 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Data Tables Generator by Supsystic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Table Cell 'data' Value via updateRows Action in all versions up to, and including, 1.15.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is only exploitable by Subscriber-level users when an administrator has added their role to the plugin's 'access_roles' setting, which is a documented and explicitly supported plugin feature that grants lower-privileged users access to the dtgs_nonce required to reach the vulnerable updateRows action handler.
Product
Data Tables Generator by Supsystic
Affected
up to 1.15.1
What to do
Affects up to 1.15.1. Update Data Tables Generator by Supsystic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.