Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
11,363 results · page 9 of 228
Oct 15, 2026WP Chill Download Monitor download-monitor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-110375 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Download Monitor download-monitor allows Stored XSS.This issue affects Download Monitor: from n/a through 5.3.3.
- Product
- WP Chill Download Monitor download-monitor
- Affected
- up to 5.3.3
- What to do
- Affects up to 5.3.3. Update WP Chill Download Monitor download-monitor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 15, 2026Hamid Alinia Login with phone number login-with-phone-number: Missing AuthorizationCVE-2026-110374 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Hamid Alinia Login with phone number login-with-phone-number allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Login with phone number: from n/a through 1.8.77.
- Product
- Hamid Alinia Login with phone number login-with-phone-number
- Affected
- up to 1.8.77
- What to do
- Affects up to 1.8.77. Update Hamid Alinia Login with phone number login-with-phone-number to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 15, 2026WP Desk Flexible Quantity – Measurement Price Calculator for WooCommerce flexible-quantity-measurement-price-calculator-for-woocommerce: Missing AuthorizationCVE-2026-110364 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WP Desk Flexible Quantity – Measurement Price Calculator for WooCommerce flexible-quantity-measurement-price-calculator-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Flexible Quantity – Measurement Price Calculator for WooCommerce: from n/a through 2.3.23.
- Product
- WP Desk Flexible Quantity – Measurement Price Calculator for WooCommerce flexible-quantity-measurement-price-calculator-for-woocommerce
- Affected
- up to 2.3.23
- What to do
- Affects up to 2.3.23. Update WP Desk Flexible Quantity – Measurement Price Calculator for WooCommerce flexible-quantity-measurement-price-calculator-for-woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 15, 2026Planet studio PlanetStudio Payment Gateway planetstudio-payment-gateway: Missing AuthorizationCVE-2026-110362 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Planet studio PlanetStudio Payment Gateway planetstudio-payment-gateway allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PlanetStudio Payment Gateway: from n/a through 1.3.3.
- Product
- Planet studio PlanetStudio Payment Gateway planetstudio-payment-gateway
- Affected
- up to 1.3.3
- What to do
- Affects up to 1.3.3. Update Planet studio PlanetStudio Payment Gateway planetstudio-payment-gateway to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 15, 2026ClikIT Infinite Uploads infinite-uploads: Insertion of Sensitive Information Into Sent DataCVE-2026-110361 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Insertion of Sensitive Information Into Sent Data vulnerability in ClikIT Infinite Uploads infinite-uploads allows Retrieve Embedded Sensitive Data.This issue affects Infinite Uploads: from n/a through 3.4.1.
- Product
- ClikIT Infinite Uploads infinite-uploads
- Affected
- up to 3.4.1
- What to do
- Affects up to 3.4.1. Update ClikIT Infinite Uploads infinite-uploads to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 15, 2026WPdreams Ajax Search Lite ajax-search-lite: Missing AuthorizationCVE-2026-110360 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WPdreams Ajax Search Lite ajax-search-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ajax Search Lite: from n/a through 4.14.5.
- Product
- WPdreams Ajax Search Lite ajax-search-lite
- Affected
- up to 4.14.5
- What to do
- Affects up to 4.14.5. Update WPdreams Ajax Search Lite ajax-search-lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 15, 2026WP Chill Strong Testimonials strong-testimonials: Missing AuthorizationCVE-2026-109897 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in WP Chill Strong Testimonials strong-testimonials allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Strong Testimonials: from n/a through 3.3.12.
- Product
- WP Chill Strong Testimonials strong-testimonials
- Affected
- up to 3.3.12
- What to do
- Affects up to 3.3.12. Update WP Chill Strong Testimonials strong-testimonials to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 15, 2026Brainstorm Force Presto Player presto-player: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-109893 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force Presto Player presto-player allows Stored XSS.This issue affects Presto Player: from n/a through 4.5.3.
- Product
- Brainstorm Force Presto Player presto-player
- Affected
- up to 4.5.3
- What to do
- Affects up to 4.5.3. Update Brainstorm Force Presto Player presto-player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 15, 2026WP Sunshine Sunshine Photo Cart sunshine-photo-cart: Missing AuthorizationCVE-2026-109689 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WP Sunshine Sunshine Photo Cart sunshine-photo-cart allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sunshine Photo Cart: from n/a through 3.7.4.
- Product
- WP Sunshine Sunshine Photo Cart sunshine-photo-cart
- Affected
- up to 3.7.4
- What to do
- Affects up to 3.7.4. Update WP Sunshine Sunshine Photo Cart sunshine-photo-cart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 15, 2026WebberZone Knowledge Base knowledgebase: Missing AuthorizationCVE-2026-108499 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WebberZone Knowledge Base knowledgebase allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Knowledge Base: from n/a through 3.2.0.
- Product
- WebberZone Knowledge Base knowledgebase
- Affected
- up to 3.2.0
- What to do
- Affects up to 3.2.0. Update WebberZone Knowledge Base knowledgebase to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 15, 2026YITH YITH WooCommerce Compare yith-woocommerce-compare: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-106604 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in YITH YITH WooCommerce Compare yith-woocommerce-compare allows Stored XSS.This issue affects YITH WooCommerce Compare: from n/a through 3.15.0.
- Product
- YITH YITH WooCommerce Compare yith-woocommerce-compare
- Affected
- up to 3.15.0
- What to do
- Affects up to 3.15.0. Update YITH YITH WooCommerce Compare yith-woocommerce-compare to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 15, 2026ELEXtensions ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes elex-bulk-edit-products-prices-attributes-for-woocommerce-basic: Authorization Bypass Through User-Controlled KeyCVE-2026-103083 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Authorization Bypass Through User-Controlled Key vulnerability in ELEXtensions ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes elex-bulk-edit-products-prices-attributes-for-woocommerce-basic allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes: from n/a through 1.5.3.
- Product
- ELEXtensions ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes elex-bulk-edit-products-prices-attributes-for-woocommerce-basic
- Affected
- up to 1.5.3
- What to do
- Affects up to 1.5.3. Update ELEXtensions ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes elex-bulk-edit-products-prices-attributes-for-woocommerce-basic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 15, 2026WordLift Srl WordLift wordlift: Missing AuthorizationCVE-2026-110891 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in WordLift Srl WordLift wordlift allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WordLift: from n/a through 3.54.15.
- Product
- WordLift Srl WordLift wordlift
- Affected
- up to 3.54.15
- What to do
- Affects up to 3.54.15. Update WordLift Srl WordLift wordlift to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 15, 2026Crocoblock JetSmartFilters jet-smart-filters: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-110890 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetSmartFilters jet-smart-filters allows Stored XSS.This issue affects JetSmartFilters: from n/a through 3.8.6.
- Product
- Crocoblock JetSmartFilters jet-smart-filters
- Affected
- up to 3.8.6
- What to do
- Affects up to 3.8.6. Update Crocoblock JetSmartFilters jet-smart-filters to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 15, 2026Meow Apps AI Engine ai-engine: Missing AuthorizationCVE-2026-110888 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Meow Apps AI Engine ai-engine allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AI Engine: from n/a through 3.8.3.
- Product
- Meow Apps AI Engine ai-engine
- Affected
- up to 3.8.3
- What to do
- Affects up to 3.8.3. Update Meow Apps AI Engine ai-engine to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 15, 2026NSquared Simply Schedule Appointments simply-schedule-appointments: Authorization Bypass Through User-Controlled KeyCVE-2026-110381 · WordPress plugins & themes · reported by PatchstackMedium 6.3
Authorization Bypass Through User-Controlled Key vulnerability in NSquared Simply Schedule Appointments simply-schedule-appointments allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simply Schedule Appointments: from n/a through 1.6.12.35.
- Product
- NSquared Simply Schedule Appointments simply-schedule-appointments
- Affected
- up to 1.6.12.35
- What to do
- Affects up to 1.6.12.35. Update NSquared Simply Schedule Appointments simply-schedule-appointments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 15, 2026WP Chill Strong Testimonials strong-testimonials: Missing AuthorizationCVE-2026-110371 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WP Chill Strong Testimonials strong-testimonials allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Strong Testimonials: from n/a through 3.3.12.
- Product
- WP Chill Strong Testimonials strong-testimonials
- Affected
- up to 3.3.12
- What to do
- Affects up to 3.3.12. Update WP Chill Strong Testimonials strong-testimonials to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 15, 2026WPExperts APIExperts Square for WooCommerce woosquare: Missing AuthorizationCVE-2026-110367 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WPExperts APIExperts Square for WooCommerce woosquare allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects APIExperts Square for WooCommerce: from n/a through 4.7.5.
- Product
- WPExperts APIExperts Square for WooCommerce woosquare
- Affected
- up to 4.7.5
- What to do
- Affects up to 4.7.5. Update WPExperts APIExperts Square for WooCommerce woosquare to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 15, 2026PluginUs: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-108175 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PluginUs.Net MDTF wp-meta-data-filter-and-taxonomy-filter allows Stored XSS.This issue affects MDTF: from n/a through 1.4.0.
- Product
- PluginUs
- Affected
- up to 1.4.0
- What to do
- Affects up to 1.4.0. Update PluginUs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 15, 2026Magepeople inc: Improper Validation of Specified Quantity in InputCVE-2026-103350 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Improper Validation of Specified Quantity in Input vulnerability in Magepeople inc. Booking and Rental Manager booking-and-rental-manager-for-woocommerce allows Removing Important Client Functionality.This issue affects Booking and Rental Manager: from n/a through 2.8.0.
- Product
- Magepeople inc
- Affected
- up to 2.8.0
- What to do
- Affects up to 2.8.0. Update Magepeople inc to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 15, 20268theme: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-105065 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 8theme.com XStore xstore allows Reflected XSS.This issue affects XStore: from n/a before 9.7.9.
- Product
- 8theme
- Fixed in
- 9.7.9
- What to do
- Update 8theme to 9.7.9 or newer.
Oct 15, 2026Shabti Kaplan Frontend Admin by DynamiApps acf-frontend-form-element: Incorrect Privilege AssignmentCVE-2026-109892 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Incorrect Privilege Assignment vulnerability in Shabti Kaplan Frontend Admin by DynamiApps acf-frontend-form-element allows Privilege Escalation.This issue affects Frontend Admin by DynamiApps: from n/a through 3.29.13.
- Product
- Shabti Kaplan Frontend Admin by DynamiApps acf-frontend-form-element
- Affected
- up to 3.29.13
- What to do
- Affects up to 3.29.13. Update Shabti Kaplan Frontend Admin by DynamiApps acf-frontend-form-element to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 15, 2026maxfoundry Social Share Buttons share-button: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-109702 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in maxfoundry Social Share Buttons share-button allows Stored XSS.This issue affects Social Share Buttons: from n/a through 1.31.
- Product
- maxfoundry Social Share Buttons share-button
- Affected
- up to 1.31
- What to do
- Affects up to 1.31. Update maxfoundry Social Share Buttons share-button to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 15, 2026Kitae Park Mang Board WP mangboard: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-109698 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Kitae Park Mang Board WP mangboard allows SQL Injection.This issue affects Mang Board WP: from n/a through 2.4.4.
- Product
- Kitae Park Mang Board WP mangboard
- Affected
- up to 2.4.4
- What to do
- Affects up to 2.4.4. Update Kitae Park Mang Board WP mangboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 15, 2026WP ManageNinja LLC Fluent CRM fluent-crm: Incorrect Privilege AssignmentCVE-2026-109693 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Incorrect Privilege Assignment vulnerability in WP ManageNinja LLC Fluent CRM fluent-crm allows Privilege Escalation.This issue affects Fluent CRM: from n/a through 3.2.5.
- Product
- WP ManageNinja LLC Fluent CRM fluent-crm
- Affected
- up to 3.2.5
- What to do
- Affects up to 3.2.5. Update WP ManageNinja LLC Fluent CRM fluent-crm to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 15, 2026ThemeGrill User Registration user-registration: Missing AuthorizationCVE-2026-109692 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Missing Authorization vulnerability in ThemeGrill User Registration user-registration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Registration: from n/a through 5.2.8.
- Product
- ThemeGrill User Registration user-registration
- Affected
- up to 5.2.8
- What to do
- Affects up to 5.2.8. Update ThemeGrill User Registration user-registration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 15, 2026Link Whisper INC Link Whisper Free link-whisper: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-109688 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Link Whisper INC Link Whisper Free link-whisper allows Blind SQL Injection.This issue affects Link Whisper Free: from n/a through 0.9.7.
- Product
- Link Whisper INC Link Whisper Free link-whisper
- Affected
- up to 0.9.7
- What to do
- Affects up to 0.9.7. Update Link Whisper INC Link Whisper Free link-whisper to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 15, 2026Link Whisper INC Link Whisper Free link-whisper: Deserialization of Untrusted DataCVE-2026-109686 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in Link Whisper INC Link Whisper Free link-whisper allows Object Injection.This issue affects Link Whisper Free: from n/a through 0.9.7.
- Product
- Link Whisper INC Link Whisper Free link-whisper
- Affected
- up to 0.9.7
- What to do
- Affects up to 0.9.7. Update Link Whisper INC Link Whisper Free link-whisper to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 15, 2026Link Whisper INC Link Whisper Free link-whisper: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-109685 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Link Whisper INC Link Whisper Free link-whisper allows Reflected XSS.This issue affects Link Whisper Free: from n/a through 0.9.7.
- Product
- Link Whisper INC Link Whisper Free link-whisper
- Affected
- up to 0.9.7
- What to do
- Affects up to 0.9.7. Update Link Whisper INC Link Whisper Free link-whisper to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 15, 2026Webba Plugins Webba Booking webba-booking-lite: Authorization Bypass Through User-Controlled KeyCVE-2026-107416 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Authorization Bypass Through User-Controlled Key vulnerability in Webba Plugins Webba Booking webba-booking-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Webba Booking: from n/a through 6.5.2.
- Product
- Webba Plugins Webba Booking webba-booking-lite
- Affected
- up to 6.5.2
- What to do
- Affects up to 6.5.2. Update Webba Plugins Webba Booking webba-booking-lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 15, 2026ThemeGrill User Registration user-registration: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-105882 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGrill User Registration user-registration allows Stored XSS.This issue affects User Registration: from n/a through 5.2.8.
- Product
- ThemeGrill User Registration user-registration
- Affected
- up to 5.2.8
- What to do
- Affects up to 5.2.8. Update ThemeGrill User Registration user-registration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 15, 2026WPMU DEV Broken Link Checker broken-link-checker: Improper Control of Generation of Code ('Code Injection')CVE-2026-102389 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Control of Generation of Code ('Code Injection') vulnerability in WPMU DEV Broken Link Checker broken-link-checker allows Code Injection.This issue affects Broken Link Checker: from n/a through 2.4.14.1.
- Product
- WPMU DEV Broken Link Checker broken-link-checker
- Affected
- up to 2.4.14.1
- What to do
- Affects up to 2.4.14.1. Update WPMU DEV Broken Link Checker broken-link-checker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 15, 2026WholesaleX – B2B & Wholesale Plugin for WooCommerce with Wholesale Prices: Limited Privilege EscalationCVE-2026-8145 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The WholesaleX – B2B & Wholesale Plugin for WooCommerce with Wholesale Prices plugin for WordPress is vulnerable to Limited Privilege Escalation in all versions up to, and including, 3.0.8 via the 'process_registration' due to missing validation on the 'wholesalex_registration_role' parameter. This makes it possible for unauthenticated attackers to register as any existing WholesaleX role. The vulnerability was partially patched in version 2.3.8.
- Product
- WholesaleX – B2B & Wholesale Plugin for WooCommerce with Wholesale Prices
- Affected
- up to 3.0.8
- What to do
- Affects up to 3.0.8. Update WholesaleX – B2B & Wholesale Plugin for WooCommerce with Wholesale Prices to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 15, 2026WPManageNinja FluentCart fluent-cart: Insertion of Sensitive Information Into Sent DataCVE-2026-109695 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Insertion of Sensitive Information Into Sent Data vulnerability in WPManageNinja FluentCart fluent-cart allows Retrieve Embedded Sensitive Data.This issue affects FluentCart: from n/a through 1.7.1.
- Product
- WPManageNinja FluentCart fluent-cart
- Affected
- up to 1.7.1
- What to do
- Affects up to 1.7.1. Update WPManageNinja FluentCart fluent-cart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 15, 2026WP ManageNinja LLC Fluent CRM fluent-crm: Incorrect Privilege AssignmentCVE-2026-109694 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Incorrect Privilege Assignment vulnerability in WP ManageNinja LLC Fluent CRM fluent-crm allows Privilege Escalation.This issue affects Fluent CRM: from n/a through 3.2.5.
- Product
- WP ManageNinja LLC Fluent CRM fluent-crm
- Affected
- up to 3.2.5
- What to do
- Affects up to 3.2.5. Update WP ManageNinja LLC Fluent CRM fluent-crm to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 15, 2026bannersky BSK PDF Manager bsk-pdf-manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-108498 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bannersky BSK PDF Manager bsk-pdf-manager allows Stored XSS.This issue affects BSK PDF Manager: from n/a through 3.8.1.
- Product
- bannersky BSK PDF Manager bsk-pdf-manager
- Affected
- up to 3.8.1
- What to do
- Affects up to 3.8.1. Update bannersky BSK PDF Manager bsk-pdf-manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 15, 2026TMS Amelia ameliabooking: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-108497 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TMS Amelia ameliabooking allows SQL Injection.This issue affects Amelia: from n/a through 2.4.10.
- Product
- TMS Amelia ameliabooking
- Affected
- up to 2.4.10
- What to do
- Affects up to 2.4.10. Update TMS Amelia ameliabooking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 15, 2026Everest Forms Everest Forms everest-forms: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-108491 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Everest Forms Everest Forms everest-forms allows Stored XSS.This issue affects Everest Forms: from n/a through 3.6.1.
- Product
- Everest Forms Everest Forms everest-forms
- Affected
- up to 3.6.1
- What to do
- Affects up to 3.6.1. Update Everest Forms Everest Forms everest-forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 15, 2026Blog2Social – Social Media Auto Post & Scheduler: Insecure Direct Object ReferenceCVE-2026-108092 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Blog2Social – Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 9.1.4. This is due to the b2s_ship_item and b2s_ship_item_reload_url AJAX handlers lacking per-object authorization on the postId parameter. This makes it possible for authenticated attackers with Contributor-level access and above to read the title and content of any post, including private and pending posts belonging to other users.
- Product
- Blog2Social – Social Media Auto Post & Scheduler
- Affected
- up to 9.1.4
- What to do
- Affects up to 9.1.4. Update Blog2Social – Social Media Auto Post & Scheduler to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 15, 2026Tutor LMS: Does not perform a capability check in a routine that regenerates its managed pagesCVE-2026-96537 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Tutor LMS WordPress plugin before 4.1.1 does not perform a capability check in a routine that regenerates its managed pages, allowing unauthenticated users to force-publish unpublished pages and overwrite their content, create missing ones, and change the options that reference them.
- Product
- Tutor LMS
- Fixed in
- 4.1.1
- What to do
- Update Tutor LMS to 4.1.1 or newer.
Oct 15, 2026Rede Itaú for WooCommerce: Does not verify the authenticity of a payment gateway webhook before updating an order's statusCVE-2026-92429 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Rede Itaú for WooCommerce WordPress plugin before 5.5.3 does not verify the authenticity of a payment gateway webhook before updating an order's status, allowing unauthenticated attackers to change the status of arbitrary WooCommerce orders, including marking unpaid orders as paid and cancelling completed orders.
- Product
- Rede Itaú for WooCommerce
- Fixed in
- 5.5.3
- What to do
- Update Rede Itaú for WooCommerce to 5.5.3 or newer.
Oct 15, 2026Rede Itaú for WooCommerce: Does not verify the authenticity of a payment gateway webhook before updating an order's statusCVE-2026-92428 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Rede Itaú for WooCommerce WordPress plugin before 5.5.3 does not verify the authenticity of a payment gateway webhook before updating an order's status, allowing unauthenticated attackers to change the status of arbitrary WooCommerce orders, including orders that were already paid or completed.
- Product
- Rede Itaú for WooCommerce
- Fixed in
- 5.5.3
- What to do
- Update Rede Itaú for WooCommerce to 5.5.3 or newer.
Oct 15, 2026Email Customizer for WooCommerce (Pro): Remote Code ExecutionCVE-2026-81534 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Email Customizer for WooCommerce (Pro) plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 3.9.5. This is due to insufficient authorization and input sanitization in the send_test_mail() function, which allows user-controlled PHP code to be written to executable files in the uploads directory. This makes it possible for authenticated attackers, with subscriber-level access and above, to execute arbitrary PHP code on the server, leading to full site compromise.
- Product
- Email Customizer for WooCommerce (Pro)
- Affected
- up to 3.9.5
- What to do
- Affects up to 3.9.5. Update Email Customizer for WooCommerce (Pro) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 15, 2026Document Gallery: Does not properly sanitise and escape user input before reflecting it inside an HTML attribute in the response of an unauthenticated AJAX actionCVE-2026-74920 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Document Gallery WordPress plugin through 5.1.1 does not properly sanitise and escape user input before reflecting it inside an HTML attribute in the response of an unauthenticated AJAX action, leading to a Reflected Cross-Site Scripting vulnerability which can be exploited against any visitor, including a logged-in administrator.
- Product
- Document Gallery
- Affected
- up to 5.1.1
- What to do
- Affects up to 5.1.1. Update Document Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 15, 2026Elementor Website Builder – more than just a page builder: Sensitive Information ExposureCVE-2026-11905 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Elementor Website Builder – more than just a page builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.2.3 via the 'keys_conversion_map' parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to extract the full post_content and plaintext post_password of private, draft, pending, and future posts belonging to any author, including Administrators and Editors.
- Product
- Elementor Website Builder – more than just a page builder
- Affected
- up to 4.2.3
- What to do
- Affects up to 4.2.3. Update Elementor Website Builder – more than just a page builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 15, 2026User Rights Access Manager: Does not restrict access to one of its AJAX account-registration handlers and assigns newly registered accounts a role that was createdCVE-2026-109145 · WordPress plugins & themes · reported by WPScanCritical 9.8
The User Rights Access Manager WordPress plugin through 1.1.3 does not restrict access to one of its AJAX account-registration handlers and assigns newly registered accounts a role that was created as a copy of the administrator role, allowing unauthenticated attackers to register an administrator-equivalent account and take over the site.
- Product
- User Rights Access Manager
- Affected
- up to 1.1.3
- What to do
- Affects up to 1.1.3. Update User Rights Access Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 15, 2026Spin Wheel: Does not verify that a visitor actually performed a legitimate spin before returning and consuming a configured prize couponCVE-2026-106031 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Spin Wheel WordPress plugin before 2.2.1 does not verify that a visitor actually performed a legitimate spin before returning and consuming a configured prize coupon, allowing unauthenticated users to disclose and drain the stored coupon codes of any campaign, including unpublished ones.
- Product
- Spin Wheel
- Fixed in
- 2.2.1
- What to do
- Update Spin Wheel to 2.2.1 or newer.
Oct 15, 2026Easy HTTPS Redirection (SSL): Does not perform capability checks in some of its AJAX actionsCVE-2026-104643 · WordPress plugins & themes · reported by WPScanMedium 4.2
The Easy HTTPS Redirection (SSL) WordPress plugin before 2.0.2 does not perform capability checks in some of its AJAX actions, allowing any authenticated user, such as a Subscriber, to read URLs its content scanner collected from private and draft posts and from site options, and to trigger a site-wide rewrite of those URLs, once an administrator has run a scan.
- Product
- Easy HTTPS Redirection (SSL)
- Fixed in
- 2.0.2
- What to do
- Update Easy HTTPS Redirection (SSL) to 2.0.2 or newer.
Oct 15, 2026Cardinity Payment Gateway for WooCommerce: Does not properly verify the authenticity of the payment notifications it receivesCVE-2026-103324 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Cardinity Payment Gateway for WooCommerce WordPress plugin before 3.4.2 does not properly verify the authenticity of the payment notifications it receives, as the secret used to sign them is empty by default, allowing unauthenticated attackers to forge an approved-payment notification and mark arbitrary orders as paid, or force them to failed.
- Product
- Cardinity Payment Gateway for WooCommerce
- Fixed in
- 3.4.2
- What to do
- Update Cardinity Payment Gateway for WooCommerce to 3.4.2 or newer.
Oct 15, 2026eaSYNC Booking: Does not perform authorization or nonce checks on several of its cancellation-related AJAX actionsCVE-2026-103304 · WordPress plugins & themes · reported by WPScanMedium 5.3
The eaSYNC Booking WordPress plugin before 1.3.31 does not perform authorization or nonce checks on several of its cancellation-related AJAX actions, allowing unauthenticated users to create booking cancellation requests, trigger booking notification emails, and overwrite the content of the emails the site sends.
- Product
- eaSYNC Booking
- Fixed in
- 1.3.31
- What to do
- Update eaSYNC Booking to 1.3.31 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. The WordPress, CMS and hosting-panel entries come from the National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan and others); we show who. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, a booking system, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.