Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
520 results · page 1 of 11
Oct 29, 2026the load_popup_content REST endpoint that: Bricks Theme 2.4 and before for WordPress contains an unauthenticated broken access controlCVE-2026-119325 · WordPress plugins & themes · reported by VulnCheckHigh 7.5
Bricks Theme 2.4 and before for WordPress contains an unauthenticated broken access control vulnerability in the load_popup_content REST endpoint that allows anonymous attackers to read draft and unpublished page content by supplying a popupId parameter without any status or capability checks. Attackers can obtain a public nonce via the bricks_regenerate_query_nonce action and then increment the popupId value in requests to the /wp-json/bricks/v1/load_popup_content endpoint to enumerate and disclose confidential content from any unpublished post on the site.
- Product
- the load_popup_content REST endpoint that
- What to do
- Update the load_popup_content REST endpoint that to the newest version.
Full record and what to do →NVD recordbricksbuilder.iovulncheck.com
Oct 29, 2026Subscriber Broken Access Control in LearnPress <= 4.4.10 versions.CVE-2026-42690 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Subscriber Broken Access Control in LearnPress <= 4.4.10 versions.
- Affected
- up to 4.4.10
- What to do
- Affects up to 4.4.10. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2026Broadcast Live Video: Missing AuthorizationCVE-2026-115963 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Missing Authorization vulnerability in VideoWhisper.com Broadcast Live Video videowhisper-live-streaming-integration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Broadcast Live Video: from n/a through 7.3.9.
- Product
- Broadcast Live Video
- Affected
- up to 7.3.9
- What to do
- Affects up to 7.3.9. Update Broadcast Live Video to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 28, 2026Bricks Builder 2.4.3 and before contains a broken access control vulnerability that allows unauthenticated attackers to access restricted post content by submitCVE-2026-118804 · WordPress plugins & themes · reported by VulnCheckHigh 7.5
Bricks Builder 2.4.3 and before contains a broken access control vulnerability that allows unauthenticated attackers to access restricted post content by submitting crafted post_status and post_type values in the originalQueryVars parameter to the POST /wp-json/bricks/v1/query_result REST endpoint using a publicly obtainable nonce. Attackers can set post_status to draft or private, or post_type to shop_coupon, to disclose unpublished posts, private content, and WooCommerce coupon data that is otherwise blocked by the standard WordPress REST API routes.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordbricksbuilder.iovulncheck.com
Oct 22, 2026Broadstreet Ad Widget: Local file inclusionCVE-2017-20289 · WordPress plugins & themes · reported by VulnCheckHigh 7.7
Broadstreet Ad Widget plugin for WordPress 2.2.0 before 2.12.0 contains a local file inclusion vulnerability that allows authenticated users to execute attacker-chosen PHP files by passing unsanitized input to require in views/modal/index.php. Attackers can supply directory traversal sequences in the 'step' parameter, optionally with a null byte, to include local files and execute PHP code. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.
- Product
- Broadstreet Ad Widget
- Fixed in
- 2.12.0
- What to do
- Update Broadstreet Ad Widget to 2.12.0 or newer.
Full record and what to do →NVD recordcxsecurity.comgithub.com
Oct 19, 2026Sensei LMS: Contains a broken access control vulnerability in the legacy save_new_message handler hooked on the init actionCVE-2026-112329 · WordPress plugins & themes · reported by VulnCheckMedium 5.3
The Sensei LMS WordPress plugin before 4.26.4 contains a broken access control vulnerability in the legacy save_new_message handler hooked on the init action, which validates only a generic nonce without verifying course enrollment or restricting post_id to valid post types. Authenticated attackers, including unprivileged Subscribers, can supply an arbitrary post_id for any course, lesson, or quiz to create a private message addressed to that post's author, bypassing the enrollment checks enforced by the newer REST send-message controller.
- Product
- Sensei LMS
- Fixed in
- 4.26.4
- What to do
- Update Sensei LMS to 4.26.4 or newer.
Full record and what to do →NVD recordsenseilms.comvulncheck.com
Oct 19, 2026Sensei LMS: Contains a broken access control vulnerability in the add_new_module_term AJAX handler that allows authenticated Teacher-role attackers to assign module taxonomy terms to arbitrary courses by supplying a crafCVE-2026-112328 · WordPress plugins & themes · reported by VulnCheckMedium 5.3
The Sensei LMS WordPress plugin before 4.26.4 contains a broken access control vulnerability in the add_new_module_term AJAX handler that allows authenticated Teacher-role attackers to assign module taxonomy terms to arbitrary courses by supplying a crafted course_id, since the handler validates only a generic nonce and checks manage_options solely for slug prefixing rather than verifying course edit permissions. Attackers can reuse a nonce obtained from their own course metabox to call wp_set_object_terms against courses owned by other teachers or administrators, enabling unauthorized modification of course content they do not own.
- Product
- Sensei LMS
- Fixed in
- 4.26.4
- What to do
- Update Sensei LMS to 4.26.4 or newer.
Full record and what to do →NVD recordsenseilms.comvulncheck.com
Oct 19, 2026Broadcast Live Video: Missing AuthorizationCVE-2026-111839 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in VideoWhisper.com Broadcast Live Video videowhisper-live-streaming-integration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Broadcast Live Video: from n/a through 7.3.7.
- Product
- Broadcast Live Video
- Affected
- up to 7.3.7
- What to do
- Affects up to 7.3.7. Update Broadcast Live Video to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 16, 2026The Broken Link Checker: Arbitrary shortcode executionCVE-2026-96562 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The The Broken Link Checker plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.4.14.1. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. Exploitation requires that a submitted comment containing the shortcode payload in an href or src attribute is approved through the site's normal comment moderation workflow; once approved, the shortcode is executed automatically via WP-Cron without any further attacker interaction.
- Product
- The Broken Link Checker
- Affected
- up to 2.4.14.1
- What to do
- Affects up to 2.4.14.1. Update The Broken Link Checker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 15, 2026Broken Link Checker: Improper Control of Generation of Code ('Code Injection')CVE-2026-102389 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Control of Generation of Code ('Code Injection') vulnerability in WPMU DEV Broken Link Checker broken-link-checker allows Code Injection.This issue affects Broken Link Checker: from n/a through 2.4.14.1.
- Product
- Broken Link Checker
- Affected
- up to 2.4.14.1
- What to do
- Affects up to 2.4.14.1. Update Broken Link Checker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 14, 2026Broadcast Live Video: Session FixationCVE-2026-107421 · WordPress plugins & themes · reported by PatchstackHigh 7.3
Session Fixation vulnerability in VideoWhisper.com Broadcast Live Video videowhisper-live-streaming-integration allows Session Hijacking.This issue affects Broadcast Live Video: from n/a through 7.3.2.
- Product
- Broadcast Live Video
- Affected
- up to 7.3.2
- What to do
- Affects up to 7.3.2. Update Broadcast Live Video to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 14, 2026Gutenverse Form: Does not sanitize SVG icon markup stored in its form blocks before it is decoded and inserted into the page in the browserCVE-2026-106469 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Gutenverse Form WordPress plugin before 3.0.11 does not sanitize SVG icon markup stored in its form blocks before it is decoded and inserted into the page in the browser, allowing authenticated users with Contributor-level access and above to store malicious SVG that executes JavaScript in the session of any user who views or previews the affected form, such as an administrator reviewing a pending post.
- Product
- Gutenverse Form
- Fixed in
- 3.0.11
- What to do
- Update Gutenverse Form to 3.0.11 or newer.
Oct 13, 2026IMPress for IDX Broker: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-54869 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in IDX Broker IMPress for IDX Broker idx-broker-platinum allows Stored XSS.This issue affects IMPress for IDX Broker: from n/a through 3.3.1.
- Product
- IMPress for IDX Broker
- Affected
- up to 3.3.1
- What to do
- Affects up to 3.3.1. Update IMPress for IDX Broker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 12, 2026Broadcast Live Video: Missing AuthorizationCVE-2026-108475 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in VideoWhisper.com Broadcast Live Video videowhisper-live-streaming-integration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Broadcast Live Video: from n/a through 7.3.6.
- Product
- Broadcast Live Video
- Affected
- up to 7.3.6
- What to do
- Affects up to 7.3.6. Update Broadcast Live Video to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 11, 2026Piotnet Forms: Does not authenticate or validate a form-submission file-upload request and permits browser-renderable file types to be storedCVE-2026-96227 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Piotnet Forms WordPress plugin through 1.0.30 does not authenticate or validate a form-submission file-upload request and permits browser-renderable file types to be stored, allowing unauthenticated attackers to store a file that executes arbitrary JavaScript in the site's origin when it is opened (Stored XSS).
- Product
- Piotnet Forms
- Affected
- up to 1.0.30
- What to do
- Affects up to 1.0.30. Update Piotnet Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 11, 2026Recordbrowser: Does not sanitise and escape a parameter before using it in a SQL queryCVE-2026-89232 · WordPress plugins & themes · reported by WPScanHigh 8.6
The Recordbrowser WordPress plugin through 1.1.7 does not sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated attackers to append additional SQL queries and extract sensitive information from the database.
- Product
- Recordbrowser
- Affected
- up to 1.1.7
- What to do
- Affects up to 1.1.7. Update Recordbrowser to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026Unauthenticated Broken Access Control in Barcode Scanner with Inventory & Order Manager <= 1.13.1 versions.CVE-2026-62118 · WordPress plugins & themes · reported by PatchstackHigh 7.3
Unauthenticated Broken Access Control in Barcode Scanner with Inventory & Order Manager <= 1.13.1 versions.
- Affected
- up to 1.13.1
- What to do
- Affects up to 1.13.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026Unauthenticated Broken Authentication in eRoom <= 1.7.1 versions.CVE-2026-62038 · WordPress plugins & themes · reported by PatchstackHigh 7.3
Unauthenticated Broken Authentication in eRoom <= 1.7.1 versions.
- Affected
- up to 1.7.1
- What to do
- Affects up to 1.7.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026Subscriber Broken Access Control in AWS S3 for WordPress Plugin – Upcasted <= 3.1.0 versions.CVE-2026-62035 · WordPress plugins & themes · reported by PatchstackMedium 6.3
Subscriber Broken Access Control in AWS S3 for WordPress Plugin – Upcasted <= 3.1.0 versions.
- Affected
- up to 3.1.0
- What to do
- Affects up to 3.1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026Unauthenticated Broken Access Control in DK <= 3.2.1 versions.CVE-2026-42706 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in DK <= 3.2.1 versions.
- Affected
- up to 3.2.1
- What to do
- Affects up to 3.2.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026Unauthenticated Broken Access Control in Grand News <= 3.4 versions.CVE-2026-42705 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in Grand News <= 3.4 versions.
- Affected
- up to 3.4
- What to do
- Affects up to 3.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026Subscriber Broken Access Control in Jetpack VideoPress <= 3.6 versions.CVE-2026-40808 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Subscriber Broken Access Control in Jetpack VideoPress <= 3.6 versions.
- Affected
- up to 3.6
- What to do
- Affects up to 3.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026Subscriber Broken Access Control in Wordable <= 8.2.10 versions.CVE-2026-40801 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Subscriber Broken Access Control in Wordable <= 8.2.10 versions.
- Affected
- up to 8.2.10
- What to do
- Affects up to 8.2.10. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026Subscriber Broken Access Control in WPSection <= 1.5.1 versions.CVE-2026-40777 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Subscriber Broken Access Control in WPSection <= 1.5.1 versions.
- Affected
- up to 1.5.1
- What to do
- Affects up to 1.5.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2026Unauthenticated Broken Access Control in BEAR <= 1.2.2 versions.CVE-2026-95526 · WordPress plugins & themes · reported by PatchstackHigh 7.3
Unauthenticated Broken Access Control in BEAR <= 1.2.2 versions.
- Affected
- up to 1.2.2
- What to do
- Affects up to 1.2.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2026Subscriber Broken Access Control in Progress Planner <= 1.10.0 versions.CVE-2026-62072 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Subscriber Broken Access Control in Progress Planner <= 1.10.0 versions.
- Affected
- up to 1.10.0
- What to do
- Affects up to 1.10.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2026Unauthenticated Broken Access Control in Sermon'e <= 1.0.2 versions.CVE-2026-48199 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in Sermon'e <= 1.0.2 versions.
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2026Unauthenticated Broken Access Control in WXD Backup Lite <= 1.0.2 versions.CVE-2026-41560 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in WXD Backup Lite <= 1.0.2 versions.
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2026Unauthenticated Broken Access Control in Advanced Posts Listing – Show Post List Easily <= 1.0.8 versions.CVE-2026-39796 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in Advanced Posts Listing – Show Post List Easily <= 1.0.8 versions.
- Affected
- up to 1.0.8
- What to do
- Affects up to 1.0.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2026Unauthenticated Broken Access Control in WooCommerce Multivendor Marketplace – REST API <= 1.6.3 versions.CVE-2026-39794 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in WooCommerce Multivendor Marketplace – REST API <= 1.6.3 versions.
- Affected
- up to 1.6.3
- What to do
- Affects up to 1.6.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2026Subscriber Broken Authentication in Simple JWT Login 4.0.0 versions.CVE-2026-39793 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Subscriber Broken Authentication in Simple JWT Login 4.0.0 versions.
- What to do
- Update the plugin to the newest version.
Oct 6, 2026Unauthenticated Broken Access Control in 10Web Social Photo Feed <= 1.4.35 versions.CVE-2026-39787 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Broken Access Control in 10Web Social Photo Feed <= 1.4.35 versions.
- Affected
- up to 1.4.35
- What to do
- Affects up to 1.4.35. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2026Unauthenticated Broken Access Control in PayPlug for WooCommerce (Official) <= 3.1.0 versions.CVE-2026-39751 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in PayPlug for WooCommerce (Official) <= 3.1.0 versions.
- Affected
- up to 3.1.0
- What to do
- Affects up to 3.1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2026Subscriber Broken Access Control in App for Cloudflare® <= 1.10.1 versions.CVE-2026-39749 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Subscriber Broken Access Control in App for Cloudflare® <= 1.10.1 versions.
- Affected
- up to 1.10.1
- What to do
- Affects up to 1.10.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2026Subscriber Broken Access Control in ECPay Ecommerce for WooCommerce <= 1.1.2606090 versions.CVE-2026-32578 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Subscriber Broken Access Control in ECPay Ecommerce for WooCommerce <= 1.1.2606090 versions.
- Affected
- up to 1.1.2606090
- What to do
- Affects up to 1.1.2606090. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2026Subscriber Broken Access Control in WP2LEADS <= 3.5.7 versions.CVE-2026-25433 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Subscriber Broken Access Control in WP2LEADS <= 3.5.7 versions.
- Affected
- up to 3.5.7
- What to do
- Affects up to 3.5.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2026Unauthenticated Broken Access Control in picu <= 3.10.1 versions.CVE-2026-104406 · WordPress plugins & themes · reported by PatchstackHigh 7.3
Unauthenticated Broken Access Control in picu <= 3.10.1 versions.
- Affected
- up to 3.10.1
- What to do
- Affects up to 3.10.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2026Unauthenticated Broken Access Control in PowerPress Podcasting <= 11.17.9 versions.CVE-2026-104387 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Unauthenticated Broken Access Control in PowerPress Podcasting <= 11.17.9 versions.
- Affected
- up to 11.17.9
- What to do
- Affects up to 11.17.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2026Subscriber Broken Access Control in WPO365 <= 44.1 versions.CVE-2026-102915 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Subscriber Broken Access Control in WPO365 <= 44.1 versions.
- Affected
- up to 44.1
- What to do
- Affects up to 44.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2026Unauthenticated Broken Authentication in Advanced Google reCAPTCHA <= 5.40 versions.CVE-2026-100518 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Broken Authentication in Advanced Google reCAPTCHA <= 5.40 versions.
- Affected
- up to 5.40
- What to do
- Affects up to 5.40. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2026Unauthenticated Broken Access Control in WP Event Solution <= 4.1.25 versions.CVE-2026-97300 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Broken Access Control in WP Event Solution <= 4.1.25 versions.
- Affected
- up to 4.1.25
- What to do
- Affects up to 4.1.25. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2026Unauthenticated Broken Access Control in Fluent Affiliate Pro <= 1.6.4 versions.CVE-2026-39789 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in Fluent Affiliate Pro <= 1.6.4 versions.
- Affected
- up to 1.6.4
- What to do
- Affects up to 1.6.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2026Contributor Broken Access Control in WDS MCP Content Manager <= 3.10.4 versions.CVE-2026-39599 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Contributor Broken Access Control in WDS MCP Content Manager <= 3.10.4 versions.
- Affected
- up to 3.10.4
- What to do
- Affects up to 3.10.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2026Unauthenticated Broken Access Control in FluentBooking Pro < 2.5.0 versions.CVE-2026-105072 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in FluentBooking Pro < 2.5.0 versions.
- What to do
- Update the plugin to the newest version.
Oct 1, 2026Subscriber Broken Access Control in Gratisfaction <= 4.6.3 versions.CVE-2026-97297 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Subscriber Broken Access Control in Gratisfaction <= 4.6.3 versions.
- Affected
- up to 4.6.3
- What to do
- Affects up to 4.6.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 1, 2026Subscriber Broken Access Control in WP Project Manager <= 4.0.7 versions.CVE-2026-97281 · WordPress plugins & themes · reported by PatchstackMedium 6.3
Subscriber Broken Access Control in WP Project Manager <= 4.0.7 versions.
- Affected
- up to 4.0.7
- What to do
- Affects up to 4.0.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 1, 2026Subscriber Broken Access Control in Social Boost <= 3.6.2 versions.CVE-2026-97277 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Subscriber Broken Access Control in Social Boost <= 3.6.2 versions.
- Affected
- up to 3.6.2
- What to do
- Affects up to 3.6.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 1, 2026Subscriber Broken Access Control in Aruba Migration Tool <= 1.0.4 versions.CVE-2026-97258 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Subscriber Broken Access Control in Aruba Migration Tool <= 1.0.4 versions.
- Affected
- up to 1.0.4
- What to do
- Affects up to 1.0.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 1, 2026Unauthenticated Broken Access Control in WP Full Stripe Free <= 8.5.6 versions.CVE-2026-62073 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in WP Full Stripe Free <= 8.5.6 versions.
- Affected
- up to 8.5.6
- What to do
- Affects up to 8.5.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 30, 2026Unauthenticated Broken Access Control in Ultimate Maps by Supsystic <= 1.5.5 versions.CVE-2026-102397 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Broken Access Control in Ultimate Maps by Supsystic <= 1.5.5 versions.
- Affected
- up to 1.5.5
- What to do
- Affects up to 1.5.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.