Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
261 results · page 1 of 6
Oct 29, 2026Video Player for YouTube: Does not perform a capability check on its player-preset AJAX handlerCVE-2026-85007 · WordPress plugins & themes · reported by WPScanLow 3.8
The Video Player for YouTube WordPress plugin before 2.1.4 does not perform a capability check on its player-preset AJAX handler, allowing users with the Contributor role and above to read the site-wide player-preset configuration, and in versions before 2.1.1 to modify and delete it as well.
- Product
- Video Player for YouTube
- Fixed in
- 2.1.4
- What to do
- Update Video Player for YouTube to 2.1.4 or newer.
Oct 29, 2026Hide Price Until Login: Does not restrict a guest-registration handler and does not honour the site's user-registration settingCVE-2026-110030 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Hide Price Until Login WordPress plugin before 1.1.2 does not restrict a guest-registration handler and does not honour the site's user-registration setting, allowing anyone to create a WordPress account and obtain a logged-in session even when registration is disabled.
- Product
- Hide Price Until Login
- Fixed in
- 1.1.2
- What to do
- Update Hide Price Until Login to 1.1.2 or newer.
Oct 29, 2026Wallet System for WooCommerce: Does not restrict its KYC document submission handler to the current user's own accountCVE-2026-108763 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Wallet System for WooCommerce WordPress plugin before 2.8.2 does not restrict its KYC document submission handler to the current user's own account, taking the target user ID from a client-supplied request field with no ownership or capability check, allowing authenticated users with minimal privileges such as Subscriber or Customer to overwrite the KYC documents and verification status of any other user, including an administrator.
- Product
- Wallet System for WooCommerce
- Fixed in
- 2.8.2
- What to do
- Update Wallet System for WooCommerce to 2.8.2 or newer.
Oct 28, 2026the update_fees AJAX handler that: PiWeb Disable payment method / Partial payment for WooCommerce before 1.1.10.9 contains a missing authorizationCVE-2026-118757 · WordPress plugins & themes · reported by VulnCheckMedium 6.9
PiWeb Disable payment method / Partial payment for WooCommerce before 1.1.10.9 contains a missing authorization vulnerability in the update_fees AJAX handler that allows unauthenticated attackers to modify and read other customers' orders. Attackers can reuse a nonce from their own order-pay page and supply sequential order_id values to change payment methods, recalculate fees, and disclose order line items and totals.
- Product
- the update_fees AJAX handler that
- Fixed in
- 1.1.10.9
- What to do
- Update the update_fees AJAX handler that to 1.1.10.9 or newer.
Full record and what to do →NVD recordplugins.svn.wordpress.orgplugins.trac.wordpress.org
Oct 28, 2026GeoDirectory: Does not properly escape a post badge shortcode attribute for a JavaScript context before placing it in an inline event handlerCVE-2026-113488 · WordPress plugins & themes · reported by WPScanMedium 6.8
The GeoDirectory WordPress plugin before 2.8.196 does not properly escape a post badge shortcode attribute for a JavaScript context before placing it in an inline event handler, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks against anyone who clicks the badge, including administrators.
- Product
- GeoDirectory
- Fixed in
- 2.8.196
- What to do
- Update GeoDirectory to 2.8.196 or newer.
Oct 28, 2026Media Library Assistant: Does not consistently validate its CSRF nonce on the Media Library bulk-action handlerCVE-2026-113485 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Media Library Assistant WordPress plugin before 3.42 does not consistently validate its CSRF nonce on the Media Library bulk-action handler, checking the nonce only when its field is present, so a forged request that omits the field can cause a logged-in user with the Author role or above to trash or delete attachments.
- Product
- Media Library Assistant
- Fixed in
- 3.42
- What to do
- Update Media Library Assistant to 3.42 or newer.
Oct 26, 2026Bopo – WooCommerce Product Bundle Builder: Missing AuthorizationCVE-2026-110377 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in VillaTheme Bopo – WooCommerce Product Bundle Builder bopo-woo-product-bundle-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Bopo – WooCommerce Product Bundle Builder: from n/a through 1.2.3.
- Product
- Bopo – WooCommerce Product Bundle Builder
- Affected
- up to 1.2.3
- What to do
- Affects up to 1.2.3. Update Bopo – WooCommerce Product Bundle Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 24, 2026Advanced Twenty Seventeen: Does not perform any capability or nonce check on the action that creates and activates its bundled childCVE-2026-107887 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Advanced Twenty Seventeen WordPress plugin through 1.3.1 does not perform any capability or nonce check on the action that creates and activates its bundled child , allowing any authenticated user such as a subscriber to switch the site's active site-wide, and allowing the same action to be triggered against any logged-in user including an administrator via CSRF.
- Product
- Advanced Twenty Seventeen
- Affected
- up to 1.3.1
- What to do
- Affects up to 1.3.1. Update Advanced Twenty Seventeen to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 23, 2026LiteSpeed Cache: Does not perform a capability check on its admin-notice dismissal handlerCVE-2026-113501 · WordPress plugins & themes · reported by WPScanLow 3.1
The LiteSpeed Cache WordPress plugin before 7.9.2 does not perform a capability check on its admin-notice dismissal handler, and the nonce it relies on is not bound to the specific notice being dismissed, so on sites in certain configurations a low-privileged authenticated user (Subscriber) can dismiss administrative notices the LiteSpeed Cache WordPress plugin before 7.9.2 marks as non-dismissible, including a warning that sensitive files may be publicly accessible.
- Product
- LiteSpeed Cache
- Fixed in
- 7.9.2
- What to do
- Update LiteSpeed Cache to 7.9.2 or newer.
Oct 22, 2026WebP Express: Does not escape values that its bundled HTML parser re-emits into element attributesCVE-2026-97328 · WordPress plugins & themes · reported by WPScanHigh 7.5
The WebP Express WordPress plugin before 0.25.16 does not escape values that its bundled HTML parser re-emits into element attributes when a non-default image delivery mode is enabled, allowing unauthenticated users to submit content that is stored and later executed as Cross-Site Scripting in the browser of any user viewing an affected page, including administrators.
- Product
- WebP Express
- Fixed in
- 0.25.16
- What to do
- Update WebP Express to 0.25.16 or newer.
Oct 21, 2026Jane Menu: Does not have any capability or nonce checks on one of its form handlersCVE-2026-85683 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Jane Menu WordPress plugin before 1.5.1 does not have any capability or nonce checks on one of its form handlers, which is reachable by unauthenticated users, allowing them to bind any published page to a remote document of their choosing. The plugin then fetches that document and outputs its head and body into the page without escaping, so an unauthenticated attacker can run arbitrary JavaScript in the browser of any visitor to that page, including an administrator.
- Product
- Jane Menu
- Fixed in
- 1.5.1
- What to do
- Update Jane Menu to 1.5.1 or newer.
Oct 21, 2026Click n Chat (Chat Widget Integration): Does not perform any authorization check on a lead-export handlerCVE-2026-92999 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Click n Chat (Chat Widget Integration) WordPress plugin before 1.1.3 does not perform any authorization check on a lead-export handler, allowing unauthenticated users to download every captured contact record (names, email addresses and phone numbers).
- Product
- Click n Chat (Chat Widget Integration)
- Fixed in
- 1.1.3
- What to do
- Update Click n Chat (Chat Widget Integration) to 1.1.3 or newer.
Oct 21, 2026Backup and Staging by WP Time Capsule: Does not perform capability or nonce checks on the handler that deploys a staging site to the live siteCVE-2026-107237 · WordPress plugins & themes · reported by WPScanHigh 8.2
The Backup and Staging by WP Time Capsule WordPress plugin before 1.22.28 does not perform capability or nonce checks on the handler that deploys a staging site to the live site, allowing any authenticated user with a Subscriber account on a WP Time Capsule staging site to overwrite the separate live site's database and configuration and take it offline.
- Product
- Backup and Staging by WP Time Capsule
- Fixed in
- 1.22.28
- What to do
- Update Backup and Staging by WP Time Capsule to 1.22.28 or newer.
Oct 19, 2026Sensei LMS: Contains a broken access control vulnerability in the legacy save_new_message handler hooked on the init actionCVE-2026-112329 · WordPress plugins & themes · reported by VulnCheckMedium 5.3
The Sensei LMS WordPress plugin before 4.26.4 contains a broken access control vulnerability in the legacy save_new_message handler hooked on the init action, which validates only a generic nonce without verifying course enrollment or restricting post_id to valid post types. Authenticated attackers, including unprivileged Subscribers, can supply an arbitrary post_id for any course, lesson, or quiz to create a private message addressed to that post's author, bypassing the enrollment checks enforced by the newer REST send-message controller.
- Product
- Sensei LMS
- Fixed in
- 4.26.4
- What to do
- Update Sensei LMS to 4.26.4 or newer.
Full record and what to do →NVD recordsenseilms.comvulncheck.com
Oct 19, 2026Sensei LMS: Contains a broken access control vulnerability in the add_new_module_term AJAX handler that allows authenticated Teacher-role attackers to assign module taxonomy terms to arbitrary courses by supplying a crafCVE-2026-112328 · WordPress plugins & themes · reported by VulnCheckMedium 5.3
The Sensei LMS WordPress plugin before 4.26.4 contains a broken access control vulnerability in the add_new_module_term AJAX handler that allows authenticated Teacher-role attackers to assign module taxonomy terms to arbitrary courses by supplying a crafted course_id, since the handler validates only a generic nonce and checks manage_options solely for slug prefixing rather than verifying course edit permissions. Attackers can reuse a nonce obtained from their own course metabox to call wp_set_object_terms against courses owned by other teachers or administrators, enabling unauthorized modification of course content they do not own.
- Product
- Sensei LMS
- Fixed in
- 4.26.4
- What to do
- Update Sensei LMS to 4.26.4 or newer.
Full record and what to do →NVD recordsenseilms.comvulncheck.com
Oct 19, 2026YITH WooCommerce Product Bundles: Missing AuthorizationCVE-2026-111845 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in YITH YITH WooCommerce Product Bundles yith-woocommerce-product-bundles allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YITH WooCommerce Product Bundles: from n/a through 2.29.0.
- Product
- YITH WooCommerce Product Bundles
- Affected
- up to 2.29.0
- What to do
- Affects up to 2.29.0. Update YITH WooCommerce Product Bundles to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 19, 2026TrueBooker: Does not perform any capability check on one of its setup handlersCVE-2026-94228 · WordPress plugins & themes · reported by WPScanMedium 5.3
The TrueBooker WordPress plugin before 1.3.0 does not perform any capability check on one of its setup handlers, and the token it does check is issued to unauthenticated visitors, allowing anyone to overwrite the plugin's entire configuration and to discard any setting they do not supply.
- Product
- TrueBooker
- Fixed in
- 1.3.0
- What to do
- Update TrueBooker to 1.3.0 or newer.
Oct 19, 2026ElementsReady Addons for Elementor: Does not perform authorization checks that halt execution in several of its settings-save handlersCVE-2026-91046 · WordPress plugins & themes · reported by WPScanMedium 4.3
The ElementsReady Addons for Elementor WordPress plugin through 6.7.2 does not perform authorization checks that halt execution in several of its settings-save handlers, allowing users with subscriber-level access and above to overwrite the ElementsReady Addons for Elementor WordPress plugin through 6.7.2's stored settings, including its stored API credentials and its feature and template configuration.
- Product
- ElementsReady Addons for Elementor
- Affected
- up to 6.7.2
- What to do
- Affects up to 6.7.2. Update ElementsReady Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 19, 2026Gateway for Vantiv on WC: Does not verify the authenticity of the payment notification received on its hosted-payment return handlerCVE-2026-106014 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Gateway for Vantiv on WC WordPress plugin through 1.0.1 does not verify the authenticity of the payment notification received on its hosted-payment return handler, allowing unauthenticated attackers to mark orders as paid without actually paying.
- Product
- Gateway for Vantiv on WC
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update Gateway for Vantiv on WC to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 18, 2026WP Photo Album Plus: Does not properly escape a category navigation value before reflecting it into a JavaScript event handler on its gallery breadcrumb linksCVE-2026-110981 · WordPress plugins & themes · reported by WPScanHigh 7.1
The WP Photo Album Plus WordPress plugin before 9.2.11.002 does not properly escape a category navigation value before reflecting it into a JavaScript event handler on its gallery breadcrumb links, allowing unauthenticated attackers to inject arbitrary script that executes in the browser of anyone who follows a crafted gallery link and clicks the breadcrumb, including a logged-in administrator.
- Product
- WP Photo Album Plus
- Fixed in
- 9.2.11.002
- What to do
- Update WP Photo Album Plus to 9.2.11.002 or newer.
Oct 17, 2026ThirstyAffiliates: Does not check the status or type of the object requested by its link redirect tracking handlerCVE-2026-97314 · WordPress plugins & themes · reported by WPScanMedium 6.5
The ThirstyAffiliates WordPress plugin before 3.12.1 does not check the status or type of the object requested by its link redirect tracking handler, allowing unauthenticated attackers to disclose the destination URLs of unpublished affiliate links and to record fabricated click statistics.
- Product
- ThirstyAffiliates
- Fixed in
- 3.12.1
- What to do
- Update ThirstyAffiliates to 3.12.1 or newer.
Oct 15, 2026User Rights Access Manager: Does not restrict access to one of its AJAX account-registration handlers and assigns newly registered accounts a role that was createdCVE-2026-109145 · WordPress plugins & themes · reported by WPScanCritical 9.8
The User Rights Access Manager WordPress plugin through 1.1.3 does not restrict access to one of its AJAX account-registration handlers and assigns newly registered accounts a role that was created as a copy of the administrator role, allowing unauthenticated attackers to register an administrator-equivalent account and take over the site.
- Product
- User Rights Access Manager
- Affected
- up to 1.1.3
- What to do
- Affects up to 1.1.3. Update User Rights Access Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 14, 2026affiliate-toolkit: Does not prevent a low-privileged user from supplying a template body that its bundled templating engine compiles and executesCVE-2026-86787 · WordPress plugins & themes · reported by WPScanHigh 7.2
The affiliate-toolkit WordPress plugin before 3.9.1 does not prevent a low-privileged user from supplying a template body that its bundled templating engine compiles and executes as PHP, allowing users with the Contributor role or above to run arbitrary PHP code on the server.
- Product
- affiliate-toolkit
- Fixed in
- 3.9.1
- What to do
- Update affiliate-toolkit to 3.9.1 or newer.
Oct 14, 2026WP Encryption: Does not perform a capability or nonce check on one of the handlers that drives its SSL certificate-provisioning routineCVE-2026-108064 · WordPress plugins & themes · reported by WPScanMedium 6.5
The WP Encryption WordPress plugin before 7.8.8.2 does not perform a capability or nonce check on one of the handlers that drives its SSL certificate-provisioning routine, allowing unauthenticated users to make the WP Encryption WordPress plugin before 7.8.8.2 overwrite the site's certificate private key and replace its pending Let's Encrypt order and challenge material with a single request. Repeated requests keep regenerating the material, preventing the administrator from completing certificate issuance.
- Product
- WP Encryption
- Fixed in
- 7.8.8.2
- What to do
- Update WP Encryption to 7.8.8.2 or newer.
Oct 13, 2026WP-BusinessDirectory: Does not restrict the type or destination of files saved by an unauthenticated upload handlerCVE-2026-89271 · WordPress plugins & themes · reported by WPScanMedium 5.3
The WP-BusinessDirectory WordPress plugin through 4.0.2 does not restrict the type or destination of files saved by an unauthenticated upload handler, allowing unauthenticated attackers to write files with arbitrary content to arbitrary locations, though not to execute code on a default server configuration.
- Product
- WP-BusinessDirectory
- Affected
- up to 4.0.2
- What to do
- Affects up to 4.0.2. Update WP-BusinessDirectory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 11, 2026WP-Invoice: Does not perform capability checks in several of its AJAX handlersCVE-2026-97183 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WP-Invoice WordPress plugin through 4.3.1 does not perform capability checks in several of its AJAX handlers, allowing any authenticated user, such as a Subscriber, to retrieve the email addresses, display names and profile details of all registered users.
- Product
- WP-Invoice
- Affected
- up to 4.3.1
- What to do
- Affects up to 4.3.1. Update WP-Invoice to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 11, 2026WP Posts Password Batch Manager: Does not perform any capability or nonce check on a bulk post-password action that runs on an always-loaded admin handlerCVE-2026-89283 · WordPress plugins & themes · reported by WPScanHigh 8.6
The WP Posts Password Batch Manager WordPress plugin through 1.1 does not perform any capability or nonce check on a bulk post-password action that runs on an always-loaded admin handler, allowing unauthenticated attackers to reset or overwrite the password of every published post, disclosing password-protected content or locking all posts behind an attacker-chosen password.
- Product
- WP Posts Password Batch Manager
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update WP Posts Password Batch Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 11, 2026Topcontent: Does not properly authorise one of its request handlers and disables HTML sanitisation before storing the submitted contentCVE-2026-88903 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Topcontent WordPress plugin through 1.2.1 does not properly authorise one of its request handlers and disables HTML sanitisation before storing the submitted content, allowing unauthenticated attackers to publish arbitrary posts containing malicious JavaScript on any site where its API key has never been configured.
- Product
- Topcontent
- Affected
- up to 1.2.1
- What to do
- Affects up to 1.2.1. Update Topcontent to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026SiteOrigin Widgets Bundle: Directory TraversalCVE-2026-97348 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.74.3 via the get_instance_css function. This makes it possible for authenticated attackers, with contributor-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. The widget's normal update()/sanitize_field_input() pipeline — which would reject non-hex color values — is bypassed entirely because the [siteorigin_widget] shortcode handler calls $the_widget->widget() directly on the attacker-supplied decoded JSON instance.
- Product
- SiteOrigin Widgets Bundle
- Affected
- up to 1.74.3
- What to do
- Affects up to 1.74.3. Update SiteOrigin Widgets Bundle to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.complugins.trac.wordpress.org
Oct 8, 2026YITH WooCommerce Product Bundles: Missing AuthorizationCVE-2026-105878 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in YITH YITH WooCommerce Product Bundles yith-woocommerce-product-bundles allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YITH WooCommerce Product Bundles: from n/a through 2.29.0.
- Product
- YITH WooCommerce Product Bundles
- Affected
- up to 2.29.0
- What to do
- Affects up to 2.29.0. Update YITH WooCommerce Product Bundles to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 8, 2026TutorStarter: Does not respect the site's user registration setting in one of its AJAX registration handlersCVE-2026-104671 · WordPress plugins & themes · reported by WPScanMedium 5.3
The TutorStarter WordPress theme before 4.0.4 does not respect the site's user registration setting in one of its AJAX registration handlers, allowing unauthenticated visitors to create WordPress user accounts even when user registration is disabled.
- Product
- TutorStarter
- Fixed in
- 4.0.4
- What to do
- Update TutorStarter to 4.0.4 or newer.
Oct 8, 2026BackWPup: Does not verify that a request to its cron-triggered backup execution handler actually originates from WordPress's internal scheduled-event dispatchCVE-2026-86827 · WordPress plugins & themes · reported by WPScanMedium 5.3
The BackWPup WordPress plugin before 5.7.7 does not verify that a request to its cron-triggered backup execution handler actually originates from WordPress's internal scheduled-event dispatch, allowing unauthenticated attackers to force any existing backup job to run immediately, independent of its configured trigger type or schedule.
- Product
- BackWPup
- Fixed in
- 5.7.7
- What to do
- Update BackWPup to 5.7.7 or newer.
Oct 7, 2026CP Media Player: Does not perform a capability check on its settings-page handlerCVE-2026-104678 · WordPress plugins & themes · reported by WPScanLow 2.7
The CP Media Player WordPress plugin before 1.3.4 does not perform a capability check on its settings-page handler, allowing users with only Contributor-level access to create, modify, duplicate and delete the site-wide media player configurations and change a CP Media Player WordPress plugin before 1.3.4 option that should require administrator access.
- Product
- CP Media Player
- Fixed in
- 1.3.4
- What to do
- Update CP Media Player to 1.3.4 or newer.
Oct 3, 2026Loco Translate: Does not sanitise and escape some bundle configuration values before outputting them back in an admin pageCVE-2026-94239 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Loco Translate WordPress plugin before 2.8.9 does not sanitise and escape some bundle configuration values before outputting them back in an admin page, allowing users with the translator capability and above to perform Stored Cross-Site Scripting attacks against high privilege users such as administrators.
- Product
- Loco Translate
- Fixed in
- 2.8.9
- What to do
- Update Loco Translate to 2.8.9 or newer.
Oct 3, 2026Unlimited Elements for Elementor: Does not correctly handle a search value before rewriting an already prepared SQL statementCVE-2026-85568 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not correctly handle a search value before rewriting an already prepared SQL statement, allowing unauthenticated users to perform SQL injection attacks and to retrieve non-public content, when a related widget option is set away from its default.
- Product
- Unlimited Elements for Elementor
- Fixed in
- 2.0.21
- What to do
- Update Unlimited Elements for Elementor to 2.0.21 or newer.
Oct 2, 2026WP User Frontend: Does not enforce its subscription-purchase requirement in one of its post-creation handlersCVE-2026-79618 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WP User Frontend WordPress plugin before 4.3.12 does not enforce its subscription-purchase requirement in one of its post-creation handlers, allowing authenticated users with subscriber-level access and above to create and, depending on the form's configuration, immediately publish posts through forms restricted to paying subscribers.
- Product
- WP User Frontend
- Fixed in
- 4.3.12
- What to do
- Update WP User Frontend to 4.3.12 or newer.
Oct 2, 2026SiteOrigin Widgets Bundle: Local File InclusionCVE-2026-92174 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.73.2 via the 'theme' parameter parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. Exploitation requires sending a malicious widgetData payload containing a legacy top-level theme key alongside a non-empty columns array to the /wp-json/sowb/v1/widgets/previews REST endpoint, which bypasses field validation because update_fields() only processes declared form fields.
- Product
- SiteOrigin Widgets Bundle
- Affected
- up to 1.73.2
- What to do
- Affects up to 1.73.2. Update SiteOrigin Widgets Bundle to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 2, 2026Request a Quote: Does not perform an authorization check on one of its unauthenticated AJAX handlersCVE-2026-90988 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Request a Quote WordPress plugin through 2.5.6 does not perform an authorization check on one of its unauthenticated AJAX handlers, allowing unauthenticated users to read the contact records of quote-request submissions, including records the site has not published.
- Product
- Request a Quote
- Affected
- up to 2.5.6
- What to do
- Affects up to 2.5.6. Update Request a Quote to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 1, 2026WP Fusion Lite: Does not require authentication on a settings handler that runs during admin initializationCVE-2026-90974 · WordPress plugins & themes · reported by WPScanMedium 6.5
The WP Fusion Lite WordPress plugin before 3.48.0 does not require authentication on a settings handler that runs during admin initialization, allowing unauthenticated users to overwrite the site's CRM integration endpoint and credentials, after which synced user data is delivered to an attacker-chosen host.
- Product
- WP Fusion Lite
- Fixed in
- 3.48.0
- What to do
- Update WP Fusion Lite to 3.48.0 or newer.
Oct 1, 2026WP Fusion Lite: Does not perform a capability check on two of its admin AJAX handlersCVE-2026-90972 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Fusion Lite WordPress plugin before 3.48.0 does not perform a capability check on two of its admin AJAX handlers, allowing any authenticated subscriber to read other users' email addresses and to trigger a cross-user CRM re-sync.
- Product
- WP Fusion Lite
- Fixed in
- 3.48.0
- What to do
- Update WP Fusion Lite to 3.48.0 or newer.
Sep 30, 2026Robin Image Optimizer: Does not escape values that its bundled HTML parser re-emits into element attributesCVE-2026-89193 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Robin Image Optimizer WordPress plugin before 2.0.8 does not escape values that its bundled HTML parser re-emits into element attributes when a non-default image delivery mode is enabled, allowing unauthenticated users to submit content that is stored and later executed as Cross-Site Scripting in the browser of any user viewing an affected page, including administrators.
- Product
- Robin Image Optimizer
- Fixed in
- 2.0.8
- What to do
- Update Robin Image Optimizer to 2.0.8 or newer.
Sep 30, 2026Robin Image Optimizer: Does not check the user's capabilities before dispatching one of its bundled admin framework's request handlersCVE-2026-89190 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Robin Image Optimizer WordPress plugin before 2.0.8 does not check the user's capabilities before dispatching one of its bundled admin framework's request handlers, allowing users with a subscriber-level account to render admin-only Robin Image Optimizer WordPress plugin before 2.0.8 pages and disclose the Robin Image Optimizer WordPress plugin before 2.0.8's stored settings.
- Product
- Robin Image Optimizer
- Fixed in
- 2.0.8
- What to do
- Update Robin Image Optimizer to 2.0.8 or newer.
Sep 27, 2026Verge3D Publishing and E-Commerce: Does not restrict access to a file-download handlerCVE-2026-92995 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Verge3D Publishing and E-Commerce WordPress plugin through 4.13.0 does not restrict access to a file-download handler, allowing unauthenticated users to download the digital-goods files attached to any order without authorization.
- Product
- Verge3D Publishing and E-Commerce
- Affected
- up to 4.13.0
- What to do
- Affects up to 4.13.0. Update Verge3D Publishing and E-Commerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 27, 2026WebFacing™: Does not restrict access to one of its bundled scripts and does not validate a user-supplied path before using it to include a local fileCVE-2026-84069 · WordPress plugins & themes · reported by WPScanMedium 5.3
The WebFacing™ WordPress plugin before 5.4 does not restrict access to one of its bundled scripts and does not validate a user-supplied path before using it to include a local file, allowing unauthenticated users to perform Local File Inclusion.
- Product
- WebFacing™
- Fixed in
- 5.4
- What to do
- Update WebFacing™ to 5.4 or newer.
Sep 26, 2026wp-review-slider-pro: Does not sanitize a value stored through one of its AJAX handlersCVE-2026-84097 · WordPress plugins & themes · reported by WPScanMedium 6.5
The wp-review-slider-pro WordPress plugin before 12.7.12 does not sanitize a value stored through one of its AJAX handlers, which lacks a capability check, before using it in a SQL statement, allowing any authenticated user, such as a subscriber, to perform SQL injection attacks whose results are then returned to unauthenticated visitors.
- Product
- wp-review-slider-pro
- Fixed in
- 12.7.12
- What to do
- Update wp-review-slider-pro to 12.7.12 or newer.
Sep 26, 2026wp-review-slider-pro: Does not perform a capability check on the AJAX handler that saves its review submission formsCVE-2026-84096 · WordPress plugins & themes · reported by WPScanHigh 8
The wp-review-slider-pro WordPress plugin before 12.7.12 does not perform a capability check on the AJAX handler that saves its review submission forms, and the nonce protecting it is generated for every visitor, allowing any authenticated user, such as a subscriber, to overwrite a live form with field values that are output without escaping on public pages, leading to Stored Cross-Site Scripting.
- Product
- wp-review-slider-pro
- Fixed in
- 12.7.12
- What to do
- Update wp-review-slider-pro to 12.7.12 or newer.
Sep 26, 2026wp-review-slider-pro: Does not perform a capability check on one of its AJAX handlersCVE-2026-84095 · WordPress plugins & themes · reported by WPScanHigh 8
The wp-review-slider-pro WordPress plugin before 12.7.12 does not perform a capability check on one of its AJAX handlers, and the nonce protecting it is generated for every visitor, allowing any authenticated user, such as a subscriber, to store arbitrary review content which is later output without escaping on public pages, leading to Stored Cross-Site Scripting.
- Product
- wp-review-slider-pro
- Fixed in
- 12.7.12
- What to do
- Update wp-review-slider-pro to 12.7.12 or newer.
Sep 23, 2026Paid Membership Subscriptions: Does not verify the reCAPTCHA on its registration handlerCVE-2026-90950 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Paid Membership Subscriptions WordPress plugin before 3.1.0 does not verify the reCAPTCHA on its registration handler when a form field is absent from the request, allowing unauthenticated users to create accounts without solving the reCAPTCHA the site has enabled.
- Product
- Paid Membership Subscriptions
- Fixed in
- 3.1.0
- What to do
- Update Paid Membership Subscriptions to 3.1.0 or newer.
Sep 23, 2026Points and Rewards for WooCommerce: Does not validate the claimed reward amount or restrict who can call its Win Wheel claim handlerCVE-2026-93510 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Points and Rewards for WooCommerce WordPress plugin before 2.10.4 does not validate the claimed reward amount or restrict who can call its Win Wheel claim handler, allowing authenticated users, Subscriber and above, to credit their own account with an arbitrary and unlimited amount of loyalty points and, where a companion wallet Points and Rewards for WooCommerce WordPress plugin before 2.10.4 is active, wallet balance.
- Product
- Points and Rewards for WooCommerce
- Fixed in
- 2.10.4
- What to do
- Update Points and Rewards for WooCommerce to 2.10.4 or newer.
Sep 23, 2026JSM Show Post Metadata: Does not properly escape a post meta key before outputting it into an inline event-handler attribute in an admin-facing meta boxCVE-2026-88997 · WordPress plugins & themes · reported by WPScanMedium 6.8
The JSM Show Post Metadata WordPress plugin before 4.9.1 does not properly escape a post meta key before outputting it into an inline event-handler attribute in an admin-facing meta box, allowing users with contributor-level access and above to inject arbitrary JavaScript that executes in the session of a higher-privileged user who reviews the affected post.
- Product
- JSM Show Post Metadata
- Fixed in
- 4.9.1
- What to do
- Update JSM Show Post Metadata to 4.9.1 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.