Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
4,580 results · page 9 of 92
Sep 30, 2026Unauthenticated Sensitive Data Exposure in MPG <= 4.2.3 versions.CVE-2026-97302 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Sensitive Data Exposure in MPG <= 4.2.3 versions.
- Affected
- up to 4.2.3
- What to do
- Affects up to 4.2.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 30, 2026Unauthenticated Cross Site Request Forgery (CSRF) in Razorpay Payment Links for WooCommerce <= 2.1.5 versions.CVE-2026-97299 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Unauthenticated Cross Site Request Forgery (CSRF) in Razorpay Payment Links for WooCommerce <= 2.1.5 versions.
- Affected
- up to 2.1.5
- What to do
- Affects up to 2.1.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 30, 2026Unauthenticated Insecure Direct Object References (IDOR) in Review Schema <= 3.1.0 versions.CVE-2026-97282 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Insecure Direct Object References (IDOR) in Review Schema <= 3.1.0 versions.
- Affected
- up to 3.1.0
- What to do
- Affects up to 3.1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 30, 2026OAuth Single Sign On – SSO: Unauthenticated BypassCVE-2026-97274 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated Bypass Vulnerability in OAuth Single Sign On – SSO (OAuth Client) <= 7.1.2 versions.
- Product
- OAuth Single Sign On – SSO
- Affected
- up to 7.1.2
- What to do
- Affects up to 7.1.2. Update OAuth Single Sign On – SSO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 30, 2026Unauthenticated Cross Site Scripting (XSS) in Premmerce Permalink Manager for WooCommerce <= 2.3.13 versions.CVE-2026-97272 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Premmerce Permalink Manager for WooCommerce <= 2.3.13 versions.
- Affected
- up to 2.3.13
- What to do
- Affects up to 2.3.13. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 30, 2026Unauthenticated Cross Site Scripting (XSS) in WPFunnels <= 3.13.1 versions.CVE-2026-97271 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in WPFunnels <= 3.13.1 versions.
- Affected
- up to 3.13.1
- What to do
- Affects up to 3.13.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 30, 2026Unauthenticated Sensitive Data Exposure in Notivo <= 1.4.2 versions.CVE-2026-97261 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Sensitive Data Exposure in Notivo <= 1.4.2 versions.
- Affected
- up to 1.4.2
- What to do
- Affects up to 1.4.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 30, 2026Unauthenticated Cross Site Scripting (XSS) in Geo Mashup <= 1.13.21 versions.CVE-2026-97250 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Geo Mashup <= 1.13.21 versions.
- Affected
- up to 1.13.21
- What to do
- Affects up to 1.13.21. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 30, 2026Unauthenticated Bypass Vulnerability in Paid Member Subscriptions <= 3.0.9 versions.CVE-2026-97249 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Bypass Vulnerability in Paid Member Subscriptions <= 3.0.9 versions.
- Affected
- up to 3.0.9
- What to do
- Affects up to 3.0.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 30, 2026Unauthenticated PHP Object Injection in Booking Activities <= 1.18.7.1 versions.CVE-2026-97248 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in Booking Activities <= 1.18.7.1 versions.
- Affected
- up to 1.18.7.1
- What to do
- Affects up to 1.18.7.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 30, 2026Unauthenticated Broken Access Control in Blocksy Companion <= 2.1.55 versions.CVE-2026-97247 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Broken Access Control in Blocksy Companion <= 2.1.55 versions.
- Affected
- up to 2.1.55
- What to do
- Affects up to 2.1.55. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 30, 2026Unauthenticated Sensitive Data Exposure in BackupEase <= 2.2.2 versions.CVE-2026-97241 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Sensitive Data Exposure in BackupEase <= 2.2.2 versions.
- Affected
- up to 2.2.2
- What to do
- Affects up to 2.2.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 30, 2026Unauthenticated Sensitive Data Exposure in StifLi Backup Tools <= 2.2.7 versions.CVE-2026-97240 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Sensitive Data Exposure in StifLi Backup Tools <= 2.2.7 versions.
- Affected
- up to 2.2.7
- What to do
- Affects up to 2.2.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 30, 2026Unauthenticated Cross Site Scripting (XSS) in ThemeREX Addons < 2.45.0 versions.CVE-2026-97235 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in ThemeREX Addons < 2.45.0 versions.
- What to do
- Update the plugin to the newest version.
Sep 30, 2026Unauthenticated Broken Access Control in WordPress Backup & Migration <= 1.6.0 versions.CVE-2026-97197 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in WordPress Backup & Migration <= 1.6.0 versions.
- Affected
- up to 1.6.0
- What to do
- Affects up to 1.6.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 30, 2026Unauthenticated Insecure Direct Object References (IDOR) in Client Invoicing by Sprout Invoices <= 20.8.17 versions.CVE-2026-97078 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Insecure Direct Object References (IDOR) in Client Invoicing by Sprout Invoices <= 20.8.17 versions.
- Affected
- up to 20.8.17
- What to do
- Affects up to 20.8.17. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 30, 2026Unauthenticated Cross Site Scripting (XSS) in Ad Inserter <= 2.8.18 versions.CVE-2026-97077 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Ad Inserter <= 2.8.18 versions.
- Affected
- up to 2.8.18
- What to do
- Affects up to 2.8.18. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 30, 2026Unauthenticated Insecure Direct Object References (IDOR) in GiveWP <= 4.16.9 versions.CVE-2026-97066 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Insecure Direct Object References (IDOR) in GiveWP <= 4.16.9 versions.
- Affected
- up to 4.16.9
- What to do
- Affects up to 4.16.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 30, 2026Unauthenticated Cross Site Scripting (XSS) in Happyforms <= 1.26.15 versions.CVE-2026-97065 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Happyforms <= 1.26.15 versions.
- Affected
- up to 1.26.15
- What to do
- Affects up to 1.26.15. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 30, 2026Unauthenticated Cross Site Request Forgery (CSRF) in Blacklist Manager – WooCommerce Anti-Fraud, Blacklist & Checkout Verification <= 2.3.1 versions.CVE-2026-96838 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Unauthenticated Cross Site Request Forgery (CSRF) in Blacklist Manager – WooCommerce Anti-Fraud, Blacklist & Checkout Verification <= 2.3.1 versions.
- Affected
- up to 2.3.1
- What to do
- Affects up to 2.3.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 30, 2026Unauthenticated Cross Site Scripting (XSS) in Parsi Date <= 6.3 versions.CVE-2026-96836 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Parsi Date <= 6.3 versions.
- Affected
- up to 6.3
- What to do
- Affects up to 6.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 30, 2026Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.16.9 versions.CVE-2026-96830 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.16.9 versions.
- Affected
- up to 4.16.9
- What to do
- Affects up to 4.16.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 30, 2026Administrator SQL Injection in Category Discount Woocommerce <= 5.18 versions.CVE-2026-96828 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Administrator SQL Injection in Category Discount Woocommerce <= 5.18 versions.
- Affected
- up to 5.18
- What to do
- Affects up to 5.18. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 30, 2026Unauthenticated Arbitrary Content Deletion in Customer Reviews for WooCommerce <= 5.120.0 versions.CVE-2026-96823 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Arbitrary Content Deletion in Customer Reviews for WooCommerce <= 5.120.0 versions.
- Affected
- up to 5.120.0
- What to do
- Affects up to 5.120.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 30, 2026Unauthenticated SQL Injection in Books Gallery <= 4.8.3 versions.CVE-2026-96822 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in Books Gallery <= 4.8.3 versions.
- Affected
- up to 4.8.3
- What to do
- Affects up to 4.8.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 30, 2026Unauthenticated Broken Access Control in WP Express Checkout (Accept PayPal Payments) <= 2.4.9 versions.CVE-2026-96818 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in WP Express Checkout (Accept PayPal Payments) <= 2.4.9 versions.
- Affected
- up to 2.4.9
- What to do
- Affects up to 2.4.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 30, 2026Unauthenticated Cross Site Scripting (XSS) in Trusted Shops Easy Integration for WooCommerce <= 2.0.6 versions.CVE-2026-96816 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Trusted Shops Easy Integration for WooCommerce <= 2.0.6 versions.
- Affected
- up to 2.0.6
- What to do
- Affects up to 2.0.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 30, 2026Unauthenticated Cross Site Scripting (XSS) in WooCommerce Product Table Lite <= 5.6.7 versions.CVE-2026-96814 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in WooCommerce Product Table Lite <= 5.6.7 versions.
- Affected
- up to 5.6.7
- What to do
- Affects up to 5.6.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 30, 2026Unauthenticated Cross Site Scripting (XSS) in YITH WooCommerce Ajax Search <= 2.28.0 versions.CVE-2026-96352 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in YITH WooCommerce Ajax Search <= 2.28.0 versions.
- Affected
- up to 2.28.0
- What to do
- Affects up to 2.28.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 30, 2026Unauthenticated Cross Site Scripting (XSS) in Classified Listing <= 6.1.3 versions.CVE-2026-96351 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Classified Listing <= 6.1.3 versions.
- Affected
- up to 6.1.3
- What to do
- Affects up to 6.1.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 30, 2026Unauthenticated Remote Code Execution (RCE) in SiteSkite <= 2.1.8 versions.CVE-2026-96349 · WordPress plugins & themes · reported by PatchstackCritical 10
Unauthenticated Remote Code Execution (RCE) in SiteSkite <= 2.1.8 versions.
- Affected
- up to 2.1.8
- What to do
- Affects up to 2.1.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 30, 2026Unauthenticated Broken Access Control in Bookly <= 28.2 versions.CVE-2026-96348 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in Bookly <= 28.2 versions.
- Affected
- up to 28.2
- What to do
- Affects up to 28.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 30, 2026Custom role PHP Object Injection in eCommerce Product Catalog <= 3.6.0 versions.CVE-2026-96344 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Custom role PHP Object Injection in eCommerce Product Catalog <= 3.6.0 versions.
- Affected
- up to 3.6.0
- What to do
- Affects up to 3.6.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 30, 2026Unauthenticated Broken Access Control in Hostinger Migrator <= 1.0 versions.CVE-2026-95587 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in Hostinger Migrator <= 1.0 versions.
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 30, 2026Unauthenticated Denial of Service Attack in WP Store Locator < 3.0.0 versions.CVE-2026-94681 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Unauthenticated Denial of Service Attack in WP Store Locator < 3.0.0 versions.
- What to do
- Update the plugin to the newest version.
Sep 30, 2026Unauthenticated Insecure Direct Object References (IDOR) in Simply Schedule Appointments <= 1.6.12.31 versions.CVE-2026-94673 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Insecure Direct Object References (IDOR) in Simply Schedule Appointments <= 1.6.12.31 versions.
- Affected
- up to 1.6.12.31
- What to do
- Affects up to 1.6.12.31. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 30, 2026Unauthenticated Remote Code Execution (RCE) in AcyMailing SMTP Newsletter <= 11.0.5 versions.CVE-2026-94389 · WordPress plugins & themes · reported by PatchstackCritical 9
Unauthenticated Remote Code Execution (RCE) in AcyMailing SMTP Newsletter <= 11.0.5 versions.
- Affected
- up to 11.0.5
- What to do
- Affects up to 11.0.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 30, 2026Unauthenticated Arbitrary File Download in NextGEN Gallery <= 4.5.0 versions.CVE-2026-94123 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Arbitrary File Download in NextGEN Gallery <= 4.5.0 versions.
- Affected
- up to 4.5.0
- What to do
- Affects up to 4.5.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 30, 2026Unauthenticated Broken Access Control in GravityExport Lite for Gravity Forms <= 2.7.2 versions.CVE-2026-94120 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in GravityExport Lite for Gravity Forms <= 2.7.2 versions.
- Affected
- up to 2.7.2
- What to do
- Affects up to 2.7.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 30, 2026Author SQL Injection in Quiz Cat <= 3.1.1 versions.CVE-2026-94082 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Author SQL Injection in Quiz Cat <= 3.1.1 versions.
- Affected
- up to 3.1.1
- What to do
- Affects up to 3.1.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 30, 2026Unauthenticated Cross Site Scripting (XSS) in WordPress Persistent Login <= 3.1.3 versions.CVE-2026-94081 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in WordPress Persistent Login <= 3.1.3 versions.
- Affected
- up to 3.1.3
- What to do
- Affects up to 3.1.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 30, 2026Unauthenticated Cross Site Scripting (XSS) in Site Reviews <= 8.3.1 versions.CVE-2026-94078 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Site Reviews <= 8.3.1 versions.
- Affected
- up to 8.3.1
- What to do
- Affects up to 8.3.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 30, 2026Unauthenticated Broken Access Control in Simply Schedule Appointments <= 1.6.12.29 versions.CVE-2026-94074 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Broken Access Control in Simply Schedule Appointments <= 1.6.12.29 versions.
- Affected
- up to 1.6.12.29
- What to do
- Affects up to 1.6.12.29. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 30, 2026Unauthenticated Cross Site Scripting (XSS) in WP Statistics <= 14.16.13 versions.CVE-2026-93770 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in WP Statistics <= 14.16.13 versions.
- Affected
- up to 14.16.13
- What to do
- Affects up to 14.16.13. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 30, 2026Unauthenticated SQL Injection in WP Data Access <= 5.5.84 versions.CVE-2026-93621 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Unauthenticated SQL Injection in WP Data Access <= 5.5.84 versions.
- Affected
- up to 5.5.84
- What to do
- Affects up to 5.5.84. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 30, 2026Unauthenticated Cross Site Scripting (XSS) in Notification for Telegram <= 3.5.2 versions.CVE-2026-93514 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Notification for Telegram <= 3.5.2 versions.
- Affected
- up to 3.5.2
- What to do
- Affects up to 3.5.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 30, 2026Unauthenticated Cross Site Scripting (XSS) in JW Player for WordPress <= 2.3.11 versions.CVE-2026-93512 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in JW Player for WordPress <= 2.3.11 versions.
- Affected
- up to 2.3.11
- What to do
- Affects up to 2.3.11. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 30, 2026Unauthenticated Cross Site Scripting (XSS) in WPFunnels <= 3.13.1 versions.CVE-2026-27371 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in WPFunnels <= 3.13.1 versions.
- Affected
- up to 3.13.1
- What to do
- Affects up to 3.13.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 30, 2026Unauthenticated Cross Site Request Forgery (CSRF) in Photo Gallery by Supsystic <= 1.21.0 versions.CVE-2026-102399 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Unauthenticated Cross Site Request Forgery (CSRF) in Photo Gallery by Supsystic <= 1.21.0 versions.
- Affected
- up to 1.21.0
- What to do
- Affects up to 1.21.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 30, 2026Unauthenticated Cross Site Scripting (XSS) in Popup by Supsystic <= 1.13.1 versions.CVE-2026-102398 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Popup by Supsystic <= 1.13.1 versions.
- Affected
- up to 1.13.1
- What to do
- Affects up to 1.13.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.