Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
24,091 results · page 9 of 482
Oct 21, 2026Paid Videochat Turnkey Site: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-111840 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VideoWhisper.com Paid Videochat Turnkey Site ppv-live-webcams allows Reflected XSS.This issue affects Paid Videochat Turnkey Site: from n/a through 7.5.14.
- Product
- Paid Videochat Turnkey Site
- Affected
- up to 7.5.14
- What to do
- Affects up to 7.5.14. Update Paid Videochat Turnkey Site to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 21, 2026ThemeHunk Customizer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-111838 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeHunk ThemeHunk Customizer themehunk-customizer allows Reflected XSS.This issue affects ThemeHunk Customizer: from n/a through 2.8.7.
- Product
- ThemeHunk Customizer
- Affected
- up to 2.8.7
- What to do
- Affects up to 2.8.7. Update ThemeHunk Customizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 21, 2026Contest Gallery: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-111837 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wasiliy Strecker Contest Gallery contest-gallery allows Stored XSS.This issue affects Contest Gallery: from n/a through 34.0.1.
- Product
- Contest Gallery
- Affected
- up to 34.0.1
- What to do
- Affects up to 34.0.1. Update Contest Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 21, 2026BjornTech Swish for WooCommerce: Missing AuthorizationCVE-2026-111835 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in bjorntech BjornTech Swish for WooCommerce woo-swish-e-commerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BjornTech Swish for WooCommerce: from n/a through 3.7.8.
- Product
- BjornTech Swish for WooCommerce
- Affected
- up to 3.7.8
- What to do
- Affects up to 3.7.8. Update BjornTech Swish for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 21, 2026weForms: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2026-111833 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Bold Grid weForms weforms allows Path Traversal.This issue affects weForms: from n/a through 1.6.28.
- Product
- weForms
- Affected
- up to 1.6.28
- What to do
- Affects up to 1.6.28. Update weForms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 21, 2026SchedulePress before 5.3.5 contains a missing authorization vulnerability that allows authenticated Contributor-level users to change any post's status and publCVE-2026-114120 · WordPress plugins & themes · reported by VulnCheckMedium 5.3
SchedulePress before 5.3.5 contains a missing authorization vulnerability that allows authenticated Contributor-level users to change any post's status and publish date via the wpsp_el_editor_form AJAX action. Attackers can reuse the wpsp-el-editor nonce from the Elementor modal to unpublish or reschedule administrator posts, or publish other users' pending or draft posts.
- Fixed in
- 5.3.5
- What to do
- Update the plugin to 5.3.5 or newer.
Oct 21, 2026WpTravelly: Missing AuthorizationCVE-2026-111849 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Magepeople inc. WpTravelly tour-booking-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WpTravelly: from n/a through 2.3.5.
- Product
- WpTravelly
- Affected
- up to 2.3.5
- What to do
- Affects up to 2.3.5. Update WpTravelly to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 21, 2026Live Summary for Gravity Forms: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-110884 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in geekontheroad Live Summary for Gravity Forms live-summary-for-gravity-forms allows Reflected XSS.This issue affects Live Summary for Gravity Forms: from n/a through 1.2.10.
- Product
- Live Summary for Gravity Forms
- Affected
- up to 1.2.10
- What to do
- Affects up to 1.2.10. Update Live Summary for Gravity Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 21, 2026GS Pins for Pinterest: Deserialization of Untrusted DataCVE-2026-110370 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in GS Plugins GS Pins for Pinterest gs-pinterest-portfolio allows Object Injection.This issue affects GS Pins for Pinterest: from n/a through 1.9.2.
- Product
- GS Pins for Pinterest
- Affected
- up to 1.9.2
- What to do
- Affects up to 1.9.2. Update GS Pins for Pinterest to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 21, 2026WordPress Team Members – GS: Deserialization of Untrusted DataCVE-2026-110369 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in GS Plugins WordPress Team Members – GS Plugins gs-team-members allows Object Injection.This issue affects WordPress Team Members – GS Plugins: from n/a through 2.8.2.
- Product
- WordPress Team Members – GS
- Affected
- up to 2.8.2
- What to do
- Affects up to 2.8.2. Update WordPress Team Members – GS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 21, 2026HappyForms: Does not sanitise or escape a user-controlled referral value before embedding it in the form notification emailCVE-2026-14556 · WordPress plugins & themes · reported by WPScanMedium 5.4
The HappyForms WordPress plugin before 1.26.15 does not sanitise or escape a user-controlled referral value before embedding it in the form notification email, allowing unauthenticated attackers to inject arbitrary HTML into the emails site administrators receive.
- Product
- HappyForms
- Fixed in
- 1.26.15
- What to do
- Update HappyForms to 1.26.15 or newer.
Oct 21, 2026Contest Gallery: Does not reliably validate the visitor identity used to enforce its one-vote-per-entry restrictionCVE-2026-107447 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Contest Gallery WordPress plugin before 34.0.1 does not reliably validate the visitor identity used to enforce its one-vote-per-entry restriction, trusting a client-supplied request header and an unbound client-generated token, which allows unauthenticated users to bypass the restriction and cast multiple votes for the same contest entry, inflating its vote total.
- Product
- Contest Gallery
- Fixed in
- 34.0.1
- What to do
- Update Contest Gallery to 34.0.1 or newer.
Oct 21, 2026Simple Shopping Cart: Does not verify that a PayPal payment notification is for a payment received by the site owner's PayPal account in its default configurationCVE-2026-104641 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Simple Shopping Cart WordPress plugin before 5.3.3 does not verify that a PayPal payment notification is for a payment received by the site owner's PayPal account in its default configuration, allowing unauthenticated attackers to have their orders marked as paid using a payment made to an account they control.
- Product
- Simple Shopping Cart
- Fixed in
- 5.3.3
- What to do
- Update Simple Shopping Cart to 5.3.3 or newer.
Oct 21, 2026Payment Gateway for Telcell: Does not verify the authenticity of incoming payment notificationsCVE-2026-103301 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Payment Gateway for Telcell WordPress plugin before 2.0.5 does not verify the authenticity of incoming payment notifications, because the secret used to sign them is empty by default, allowing unauthenticated attackers to forge a valid notification and mark arbitrary WooCommerce orders as paid. The same handler also marks an attacker-chosen order as failed when given an invalid signature.
- Product
- Payment Gateway for Telcell
- Fixed in
- 2.0.5
- What to do
- Update Payment Gateway for Telcell to 2.0.5 or newer.
Oct 21, 2026Ninja Forms: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-110899 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kevin Stover Ninja Forms ninja-forms allows Stored XSS.This issue affects Ninja Forms: from n/a through 3.15.5.
- Product
- Ninja Forms
- Affected
- up to 3.15.5
- What to do
- Affects up to 3.15.5. Update Ninja Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 21, 2026Strong Testimonials: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-107435 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Strong Testimonials strong-testimonials allows Stored XSS.This issue affects Strong Testimonials: from n/a through 3.3.12.
- Product
- Strong Testimonials
- Affected
- up to 3.3.12
- What to do
- Affects up to 3.3.12. Update Strong Testimonials to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 21, 2026Click n Chat (Chat Widget Integration): Does not perform any authorization check on a lead-export handlerCVE-2026-92999 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Click n Chat (Chat Widget Integration) WordPress plugin before 1.1.3 does not perform any authorization check on a lead-export handler, allowing unauthenticated users to download every captured contact record (names, email addresses and phone numbers).
- Product
- Click n Chat (Chat Widget Integration)
- Fixed in
- 1.1.3
- What to do
- Update Click n Chat (Chat Widget Integration) to 1.1.3 or newer.
Oct 21, 2026Click n Chat (Chat Widget Integration): Does not sanitise sort parameters before using them in a SQL ORDER BY clauseCVE-2026-92998 · WordPress plugins & themes · reported by WPScanHigh 8.6
The Click n Chat (Chat Widget Integration) WordPress plugin before 1.1.3 does not sanitise sort parameters before using them in a SQL ORDER BY clause, allowing unauthenticated attackers to perform SQL injection attacks.
- Product
- Click n Chat (Chat Widget Integration)
- Fixed in
- 1.1.3
- What to do
- Update Click n Chat (Chat Widget Integration) to 1.1.3 or newer.
Oct 21, 2026Click n Chat (Chat Widget Integration): Does not properly validate a parameter before using itCVE-2026-92997 · WordPress plugins & themes · reported by WPScanHigh 8.6
The Click n Chat (Chat Widget Integration) WordPress plugin before 1.1.3 does not properly validate a parameter before using it as a column identifier in a SQL query, allowing unauthenticated attackers to perform SQL injection attacks.
- Product
- Click n Chat (Chat Widget Integration)
- Fixed in
- 1.1.3
- What to do
- Update Click n Chat (Chat Widget Integration) to 1.1.3 or newer.
Oct 21, 2026Wava Payment: Does not perform any authorisationCVE-2026-87838 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Wava Payment Plugin WordPress plugin before 0.3.10 does not perform any authorisation, nonce or origin verification on one of its public REST endpoints, allowing unauthenticated attackers to overwrite the stored credential that identifies the merchant account the store's payments are created against, to force the integration into a verified state the site owner never completed, and to remove the payment method from the store's checkout.
- Product
- Wava Payment
- Fixed in
- 0.3.10
- What to do
- Update Wava Payment to 0.3.10 or newer.
Oct 21, 2026Wava Payment: Does not verify the authenticity of incoming payment-provider notificationsCVE-2026-87837 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Wava Payment Plugin WordPress plugin before 0.3.10 does not verify the authenticity of incoming payment-provider notifications, nor restrict who may send them, allowing unauthenticated attackers to change the status of any WooCommerce order in the store, including marking an unpaid order as paid and completed, and cancelling other customers' orders. In versions up to 0.3.7 the response additionally returns the affected order's billing details, disclosing customer names, addresses, email addresses and phone numbers to the same unauthenticated caller.
- Product
- Wava Payment
- Affected
- up to 0.3.7
- Fixed in
- 0.3.10
- What to do
- Update Wava Payment to 0.3.10 or newer.
Oct 21, 2026Formidable Forms: Does not verify the identity of the caller before recording the timestamp it uses to rate limit payment gateway verification requestsCVE-2026-85642 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Formidable Forms WordPress plugin before 7.0 does not verify the identity of the caller before recording the timestamp it uses to rate limit payment gateway verification requests, allowing unauthenticated attackers to consume the daily allowance and cause legitimate verification attempts to be refused for the next 24 hours.
- Product
- Formidable Forms
- Fixed in
- 7.0
- What to do
- Update Formidable Forms to 7.0 or newer.
Oct 21, 2026WholesaleX: Does not protect or remove the user-import file it keeps in a publicly accessible location under a predictable nameCVE-2026-111956 · WordPress plugins & themes · reported by WPScanMedium 5.9
The WholesaleX WordPress plugin before 3.0.9 does not protect or remove the user-import file it keeps in a publicly accessible location under a predictable name, allowing unauthenticated users to download the most recently imported user data, including any account passwords and customer contact and address details it contains.
- Product
- WholesaleX
- Fixed in
- 3.0.9
- What to do
- Update WholesaleX to 3.0.9 or newer.
Oct 21, 2026WholesaleX: Does not check that a stored account confirmation code is set before comparing it with the one supplied in a requestCVE-2026-111955 · WordPress plugins & themes · reported by WPScanMedium 6.5
The WholesaleX WordPress plugin before 3.0.9 does not check that a stored account confirmation code is set before comparing it with the one supplied in a request, allowing unauthenticated users to activate pending accounts and bypass the administrator approval required before login.
- Product
- WholesaleX
- Fixed in
- 3.0.9
- What to do
- Update WholesaleX to 3.0.9 or newer.
Oct 21, 2026miniOrange 2FA: Does not prevent a pending passkey login from registering an additional passkey on an account that already has one configuredCVE-2026-111949 · WordPress plugins & themes · reported by WPScanHigh 7.5
The miniOrange 2FA WordPress plugin before 6.3.1 does not prevent a pending passkey login from registering an additional passkey on an account that already has one configured, allowing an attacker who knows a user's password to add their own authenticator and bypass the second factor.
- Product
- miniOrange 2FA
- Fixed in
- 6.3.1
- What to do
- Update miniOrange 2FA to 6.3.1 or newer.
Oct 21, 2026Pricing Table: Does not perform authorisation checksCVE-2026-111947 · WordPress plugins & themes · reported by WPScanMedium 5.5
The Pricing Table WordPress Plugin WordPress plugin before 4.1.3 does not perform authorisation checks when duplicating a legacy pricing table, allowing users with the contributor role and above to clone and publish any post or page on the site, including private and draft content belonging to other users.
- Product
- Pricing Table
- Fixed in
- 4.1.3
- What to do
- Update Pricing Table to 4.1.3 or newer.
Oct 21, 2026Kliken: Ads + Pixel for Meta: Does not verify that a visitor holds an order's key before outputting that order's details on the order confirmation pageCVE-2026-111596 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Kliken: Ads + Pixel for Meta WordPress plugin before 1.2.3 does not verify that a visitor holds an order's key before outputting that order's details on the order confirmation page, allowing unauthenticated users to retrieve the billing location, purchased products and totals of other customers' orders by enumerating order IDs.
- Product
- Kliken: Ads + Pixel for Meta
- Fixed in
- 1.2.3
- What to do
- Update Kliken: Ads + Pixel for Meta to 1.2.3 or newer.
Oct 21, 2026Redirection for Contact Form 7: Does not sanitise or escape submitted form data storedCVE-2026-111574 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Redirection for Contact Form 7 WordPress plugin before 3.2.12 does not sanitise or escape submitted form data stored as lead entries before outputting it in the lead debug metabox, allowing unauthenticated attackers to store a malicious script that executes when a logged-in user views the entry with the Redirection for Contact Form 7 WordPress plugin before 3.2.12's debug mode enabled.
- Product
- Redirection for Contact Form 7
- Fixed in
- 3.2.12
- What to do
- Update Redirection for Contact Form 7 to 3.2.12 or newer.
Oct 21, 2026WP User Manager: Does not keep its paid-registration capability restrictions in force once the payment gateway is disconnectedCVE-2026-110523 · WordPress plugins & themes · reported by WPScanHigh 8.1
The WP User Manager WordPress plugin before 2.9.26 does not keep its paid-registration capability restrictions in force once the payment gateway is disconnected, while a published paid registration form continues to assign its configured role, allowing unauthenticated users to register and immediately obtain a privileged administrator-equivalent role without completing the payment meant to gate it.
- Product
- WP User Manager
- Fixed in
- 2.9.26
- What to do
- Update WP User Manager to 2.9.26 or newer.
Oct 21, 2026Productive Commerce: Does not perform a capability check in one of its AJAX actions and exposes the nonce that guards it on every admin-area pageCVE-2026-109926 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Productive Commerce WordPress plugin before 1.1.49 does not perform a capability check in one of its AJAX actions and exposes the nonce that guards it on every admin-area page, allowing any authenticated user such as a subscriber to activate arbitrary Productive Commerce WordPress plugin before 1.1.49 already installed on the site.
- Product
- Productive Commerce
- Fixed in
- 1.1.49
- What to do
- Update Productive Commerce to 1.1.49 or newer.
Oct 21, 2026SmartyParcel: Does not perform authorisation checksCVE-2026-107789 · WordPress plugins & themes · reported by WPScanMedium 5.3
The SmartyParcel WordPress plugin before 1.23.4 does not perform authorisation checks when serving shipping label downloads, allowing unauthenticated users to obtain the shipping labels of arbitrary orders, which contain customer names, addresses and phone numbers.
- Product
- SmartyParcel
- Fixed in
- 1.23.4
- What to do
- Update SmartyParcel to 1.23.4 or newer.
Oct 21, 2026SmartyParcel: Does not perform authorisation checksCVE-2026-107788 · WordPress plugins & themes · reported by WPScanMedium 4.3
The SmartyParcel WordPress plugin before 1.23.4 does not perform authorisation checks when deleting shipping label records, allowing any authenticated user such as a subscriber to delete the shipping label and tracking records of arbitrary orders store-wide.
- Product
- SmartyParcel
- Fixed in
- 1.23.4
- What to do
- Update SmartyParcel to 1.23.4 or newer.
Oct 21, 2026Uncanny Toolkit for LearnDash: Does not verify that the acting user is permitted to manage the targeted accounts before changing their verification stateCVE-2026-107128 · WordPress plugins & themes · reported by WPScanMedium 5
The Uncanny Toolkit for LearnDash WordPress plugin before 3.8.2 does not verify that the acting user is permitted to manage the targeted accounts before changing their verification state, allowing a subsite administrator on a multisite network to mark arbitrary network users outside their own site as unverified and prevent those users from logging in.
- Product
- Uncanny Toolkit for LearnDash
- Fixed in
- 3.8.2
- What to do
- Update Uncanny Toolkit for LearnDash to 3.8.2 or newer.
Oct 21, 2026Moloni: Does not perform capability or nonce checks on several of its authenticated AJAX actionsCVE-2026-106932 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Moloni WordPress plugin before 5.0.14 does not perform capability or nonce checks on several of its authenticated AJAX actions, relying only on whether the site holds a stored connection to its external invoicing provider, allowing any authenticated user such as a Subscriber to generate fiscal invoices for arbitrary orders, discard arbitrary orders, and create or modify products and stock.
- Product
- Moloni
- Fixed in
- 5.0.14
- What to do
- Update Moloni to 5.0.14 or newer.
Oct 21, 2026Booking Package: Does not perform authorization checks before returning calendar-account configuration in a responseCVE-2026-105999 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Booking Package WordPress plugin before 1.7.31 does not perform authorization checks before returning calendar-account configuration in a response, allowing unauthenticated users to disclose sensitive settings including the administrator's notification email addresses.
- Product
- Booking Package
- Fixed in
- 1.7.31
- What to do
- Update Booking Package to 1.7.31 or newer.
Oct 21, 2026Booking Package: Does not perform any authorization or validity check before resetting its premium subscription stateCVE-2026-105998 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Booking Package WordPress plugin before 1.7.31 does not perform any authorization or validity check before resetting its premium subscription state, allowing unauthenticated attackers to disable the Booking Package WordPress plugin before 1.7.31's paid features.
- Product
- Booking Package
- Fixed in
- 1.7.31
- What to do
- Update Booking Package to 1.7.31 or newer.
Oct 21, 2026Booking Package: Does not generate booking cancellation tokens using a secure source of randomnessCVE-2026-105996 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Booking Package WordPress plugin before 1.7.31 does not generate booking cancellation tokens using a secure source of randomness, deriving them instead from values it exposes publicly, so an unauthenticated attacker can reconstruct an arbitrary booking's token, disclose that booking's personal data and, where visitor cancellation is enabled, cancel the booking.
- Product
- Booking Package
- Fixed in
- 1.7.31
- What to do
- Update Booking Package to 1.7.31 or newer.
Oct 21, 2026Payment Gateway for Idram: Does not verify the authenticity of incoming payment notificationsCVE-2026-103302 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Payment Gateway for Idram WordPress plugin before 2.1.6 does not verify the authenticity of incoming payment notifications, because the merchant credentials used to compute their checksum are empty by default, allowing unauthenticated attackers to forge a valid payment confirmation and mark arbitrary orders as paid, and to force arbitrary orders into a failed state regardless of the gateway's configuration.
- Product
- Payment Gateway for Idram
- Fixed in
- 2.1.6
- What to do
- Update Payment Gateway for Idram to 2.1.6 or newer.
Oct 20, 2026The Duplicator and Duplicator Pro plugins for WordPress are vulnerable to PHP Object Injection in all versions up to, and including, 1.5.17 and 4.6.10, respectiCVE-2026-82814 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Duplicator and Duplicator Pro plugins for WordPress are vulnerable to PHP Object Injection in all versions up to, and including, 1.5.17 and 4.6.10, respectively, via deserialization of untrusted database content in DUPX_UpdateEngine::unserializeTest() during migration. This allows unauthenticated attackers to store a serialized object in public site content before an administrator builds a package and later performs a migration or import that runs database search-and-replace. Duplicator Free bundles a Requests 1.7 POP chain that permits attacker-selected callbacks, resulting in direct operating-system command execution. Duplicator Pro bundles an IndexList destructor gadget that permits deletion of an attacker-selected existing file when its containing directory is writable by the installer PHP process; deletion of wp-config.php can expose the setup wizard and lead to site takeover and code execution if the attacker reaches it first and supplies a reachable database they control. The package must be created after the carrier is stored, and a later administrator migration action is required.
- Affected
- up to 1.5.17
- What to do
- Affects up to 1.5.17. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordduplicator.complugins.trac.wordpress.org
Oct 20, 2026Issuu Panel: PHP file inclusionCVE-2016-20101 · WordPress plugins & themes · reported by VulnCheckCritical 9.2
Issuu Panel plugin for WordPress before 1.6.6 contains a PHP file inclusion vulnerability that allows unauthenticated attackers to include remote or local files through the 'abspath' parameter. Attackers can send GET requests to menu/documento/requests/ajax-docs.php with a crafted abspath value passed to require() to execute remote PHP code or include local files. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-20.
- Product
- Issuu Panel
- Fixed in
- 1.6.6
- What to do
- Update Issuu Panel to 1.6.6 or newer.
Full record and what to do →NVD recordcxsecurity.comgithub.com
Oct 20, 2026Participants Database: Authorization Bypass Through User-Controlled KeyCVE-2026-112861 · WordPress plugins & themes · reported by PatchstackMedium 6.3
Authorization Bypass Through User-Controlled Key vulnerability in xnau webdesign Participants Database participants-database allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Participants Database: from n/a through 2.7.8.5.
- Product
- Participants Database
- Affected
- up to 2.7.8.5
- What to do
- Affects up to 2.7.8.5. Update Participants Database to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 20, 2026SureCart: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-112840 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force SureCart surecart allows Stored XSS.This issue affects SureCart: from n/a through 4.9.5.
- Product
- SureCart
- Affected
- up to 4.9.5
- What to do
- Affects up to 4.9.5. Update SureCart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 20, 2026Booktics: Missing AuthorizationCVE-2026-112829 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Arraytics Booktics booktics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booktics: from n/a through 1.0.30.
- Product
- Booktics
- Affected
- up to 1.0.30
- What to do
- Affects up to 1.0.30. Update Booktics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 20, 2026Bus Ticket Booking with Seat Reservation: Missing AuthorizationCVE-2026-112824 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Magepeople inc. Bus Ticket Booking with Seat Reservation bus-ticket-booking-with-seat-reservation allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Bus Ticket Booking with Seat Reservation: from n/a through 5.9.7.
- Product
- Bus Ticket Booking with Seat Reservation
- Affected
- up to 5.9.7
- What to do
- Affects up to 5.9.7. Update Bus Ticket Booking with Seat Reservation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 20, 2026WP User Manager: Missing AuthorizationCVE-2026-112823 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WP User Manager WP User Manager wp-user-manager allows Manipulating User State.This issue affects WP User Manager: from n/a through 2.9.25.
- Product
- WP User Manager
- Affected
- up to 2.9.25
- What to do
- Affects up to 2.9.25. Update WP User Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 20, 2026Rootblox: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-111843 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CozyThemes Rootblox rootblox allows Stored XSS.This issue affects Rootblox: from n/a through 1.0.7.
- Product
- Rootblox
- Affected
- up to 1.0.7
- What to do
- Affects up to 1.0.7. Update Rootblox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 20, 2026Meta Box – WordPress Custom Fields Framework: Missing AuthorizationCVE-2026-109700 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in eLightUp Meta Box – WordPress Custom Fields Framework meta-box allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Meta Box – WordPress Custom Fields Framework: from n/a through 5.15.2.
- Product
- Meta Box – WordPress Custom Fields Framework
- Affected
- up to 5.15.2
- What to do
- Affects up to 5.15.2. Update Meta Box – WordPress Custom Fields Framework to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 20, 2026Seriously Simple Podcasting: Missing AuthorizationCVE-2026-112834 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Castos Seriously Simple Podcasting seriously-simple-podcasting allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Seriously Simple Podcasting: from n/a through 3.17.0.
- Product
- Seriously Simple Podcasting
- Affected
- up to 3.17.0
- What to do
- Affects up to 3.17.0. Update Seriously Simple Podcasting to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 20, 2026Seriously Simple Podcasting: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-112833 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Castos Seriously Simple Podcasting seriously-simple-podcasting allows Stored XSS.This issue affects Seriously Simple Podcasting: from n/a through 3.17.0.
- Product
- Seriously Simple Podcasting
- Affected
- up to 3.17.0
- What to do
- Affects up to 3.17.0. Update Seriously Simple Podcasting to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 20, 2026LearnPress before 4.4.10 contains a missing authorization vulnerability in the admin_course_editor, admin_quiz_editor and admin_question_editor lp-ajax actions,CVE-2026-113353 · WordPress plugins & themes · reported by VulnCheckMedium 5.3
LearnPress before 4.4.10 contains a missing authorization vulnerability in the admin_course_editor, admin_quiz_editor and admin_question_editor lp-ajax actions, allowing instructors to modify other instructors' content. Authenticated instructors can reuse their own generic editor nonce with another object's id parameter to alter courses, change quiz answers, and trash questions.
- Fixed in
- 4.4.10
- What to do
- Update the plugin to 4.4.10 or newer.
Full record and what to do →NVD recordgithub.comlearnpresslms.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.