Updated 7 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

456new WordPress flaws this week

390,714entries in the database

496 results · page 1 of 10

Oct 29, 2026Subscriber PHP Object Injection in BuddyPress Xprofile Custom Field Types <= 1.3.1 versions.CVE-2026-116868 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Subscriber PHP Object Injection in BuddyPress Xprofile Custom Field Types <= 1.3.1 versions.
Affected
up to 1.3.1
What to do
Affects up to 1.3.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 29, 2026Contact Form by Supsystic: Does not strip CR/LF characters or re-validate submitted field values before concatenating them into outgoing email headersCVE-2026-115303 · WordPress plugins & themes · reported by WPScanLow 3.7
The Contact Form by Supsystic WordPress plugin before 1.11.1 does not strip CR/LF characters or re-validate submitted field values before concatenating them into outgoing email headers when a form is configured to map a submitted field into its Reply-To, From or Cc header, allowing unauthenticated users to inject arbitrary email headers such as additional Bcc or Cc recipients into the notification email.
Product
Contact Form by Supsystic
Fixed in
1.11.1
What to do
Update Contact Form by Supsystic to 1.11.1 or newer.
Full record and what to do →NVD record wpscan.com
Oct 28, 2026Royal Elementor Addons: Does not validate submitted form field values before substituting them into the recipient addresses of its form notification emailsCVE-2026-106648 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Royal Elementor Addons WordPress plugin before 1.7.1070 does not validate submitted form field values before substituting them into the recipient addresses of its form notification emails, allowing unauthenticated attackers to replace the recipient list and relay attacker-composed email from the site's own domain when a recipient field is configured to echo a submitted value.
Product
Royal Elementor Addons
Fixed in
1.7.1070
What to do
Update Royal Elementor Addons to 1.7.1070 or newer.
Full record and what to do →NVD record wpscan.com
Oct 28, 2026Advanced Custom Fields: Extended: Unauthorized access of data and triggering of server-side actionsCVE-2026-2839 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to unauthorized access of data and triggering of server-side actions in all versions up to, and including, 0.9.2.7. This is due to multiple AJAX handlers registered for unauthenticated users (`wp_ajax_nopriv_*`) that fail to implement proper `current_user_can()` authorization checks. While these handlers use ACF's `acf_verify_ajax()` function to validate cryptographic nonces, the `acf_nonce` values are generated for guest users and publicly exposed in the page source of any frontend page utilizing an ACF form. This makes it possible for unauthenticated attackers to extract the guest nonce and bypass WordPress visibility permissions, leading to the unauthorized disclosure of post titles and internal Flexible Content layout structures. The vulnerability was partially patched in version 0.9.2.4.
Product
Advanced Custom Fields: Extended
Affected
up to 0.9.2.7
What to do
Affects up to 0.9.2.7. Update Advanced Custom Fields: Extended to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 28, 2026Product Addons for Woocommerce – Product Options with Custom Fields: Stored Cross-Site ScriptingCVE-2026-109988 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Product Addons for Woocommerce – Product Options with Custom Fields plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'fields[section][fields][row][col][type]' parameter in all versions up to, and including, 3.1.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with shop manager-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Product Addons for Woocommerce – Product Options with Custom Fields
Affected
up to 3.1.8
What to do
Affects up to 3.1.8. Update Product Addons for Woocommerce – Product Options with Custom Fields to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 27, 2026Advanced Custom Fields: Extended: Authorization bypassCVE-2026-10752 · WordPress plugins & themes · reported by WordfenceMedium 4.8
The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 0.9.2.6. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to permanently delete arbitrary WordPress media library attachments by supplying a numeric attachment ID in the form submission without any ownership or capability verification. Exploitation requires a site administrator to have configured a public-facing ACFE form with an Email action whose attachment row uses a dynamic {field:...} source bound to a submittable field with the Delete option enabled.
Product
Advanced Custom Fields: Extended
Affected
up to 0.9.2.6
What to do
Affects up to 0.9.2.6. Update Advanced Custom Fields: Extended to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 23, 2026The Advanced Custom Fields: Extended and Advanced Custom Fields: Extended PRO WordPress plugins from 0.9.2.4 to 0.9.2.7 do not consistently disable shortcode prCVE-2026-94263 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Advanced Custom Fields: Extended and Advanced Custom Fields: Extended PRO WordPress plugins from 0.9.2.4 to 0.9.2.7 do not consistently disable shortcode processing in the confirmation message of their front-end forms, allowing unauthenticated visitors to have arbitrary shortcodes executed server-side when they submit a form whose stored configuration does not carry the relevant setting.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record wpscan.com
Oct 23, 2026Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO: Does not resolve the target of the update-user action in its front-end Forms module consistently between the stage tCVE-2026-94268 · WordPress plugins & themes · reported by WPScanHigh 8.1
The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not resolve the target of the update-user action in its front-end Forms module consistently between the stage that authorises the request and the stage that carries it out, which allows unauthenticated visitors to bypass the guard protecting administrator accounts, take over the site administrator's account and be issued a valid session for it. Exploitation requires the site to publish two separate front-end form configurations whose targets are mapped to visitor-submitted values.
Product
Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO
Fixed in
0.9.2.8
What to do
Update Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO to 0.9.2.8 or newer.
Full record and what to do →NVD record wpscan.com
Oct 23, 2026Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO: Does not perform any capability checkCVE-2026-94267 · WordPress plugins & themes · reported by WPScanCritical 9
The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not perform any capability check when updating a post through one of its front-end form actions, allowing unauthenticated visitors to overwrite arbitrary posts, including the ones in which the site stores its own field definitions, which in turn leads to arbitrary code execution on the server. Exploitation requires the site to publish a form whose post-update action maps both its target and its content to visitor-submitted values.
Product
Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO
Fixed in
0.9.2.8
What to do
Update Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO to 0.9.2.8 or newer.
Full record and what to do →NVD record wpscan.com
Oct 23, 2026Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO: Does not validate or escape some of its form shortcode attributesCVE-2026-94264 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not validate or escape some of its form shortcode attributes, which can be pointed at values taken from the visitor's own request and are then output without escaping, allowing users with a role as low as contributor to have arbitrary script run in the browser of anyone led to open a crafted link or page, including a logged-in administrator. This is an incomplete fix for CVE-2023-5292, whose deny-list covers only the three HTML wrapper attributes.
Product
Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO
Fixed in
0.9.2.8
What to do
Update Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO to 0.9.2.8 or newer.
Full record and what to do →NVD record wpscan.com
Oct 23, 2026Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO: Does not verify that the requester is authorised to edit the targeted user account in the update-user action of its CVE-2026-94262 · WordPress plugins & themes · reported by WPScanHigh 8.1
The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not verify that the requester is authorised to edit the targeted user account in the update-user action of its front-end Forms module, performing that check only when the target account holds an administrator role, which allows unauthenticated visitors to overwrite any non-administrator account's credentials and obtain a session for that account. Exploitation requires the site to publish a form whose user-update action maps its target to a visitor-submitted value rather than to the default current user.
Product
Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO
Fixed in
0.9.2.8
What to do
Update Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO to 0.9.2.8 or newer.
Full record and what to do →NVD record wpscan.com
Oct 22, 2026Link Library: Does not sanitise and escape a link field before outputting it inside an attribute of a link previewCVE-2026-78392 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Link Library WordPress plugin before 7.9.6 does not sanitise and escape a link field before outputting it inside an attribute of a link preview, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks. The preview is generated without authentication and without checking whether the link has been published, so an unapproved submission is enough to reach any visitor who opens it.
Product
Link Library
Fixed in
7.9.6
What to do
Update Link Library to 7.9.6 or newer.
Full record and what to do →NVD record wpscan.com
Oct 22, 2026WP Ultimate Review: Does not neutralise shortcodes in all of the review fields submitted through its public review formCVE-2026-103234 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Ultimate Review WordPress plugin before 2.4.5 does not neutralise shortcodes in all of the review fields submitted through its public review form, which is available to unauthenticated visitors, allowing them to execute arbitrary shortcodes when the affected field is displayed, provided user reviews and that field's display are enabled.
Product
WP Ultimate Review
Fixed in
2.4.5
What to do
Update WP Ultimate Review to 2.4.5 or newer.
Full record and what to do →NVD record wpscan.com
Oct 20, 2026Meta Box – WordPress Custom Fields Framework: Missing AuthorizationCVE-2026-109700 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in eLightUp Meta Box – WordPress Custom Fields Framework meta-box allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Meta Box – WordPress Custom Fields Framework: from n/a through 5.15.2.
Product
Meta Box – WordPress Custom Fields Framework
Affected
up to 5.15.2
What to do
Affects up to 5.15.2. Update Meta Box – WordPress Custom Fields Framework to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 17, 2026Contact Form 7 Signature Addon: Does not sanitize a signature field value before building an email attachment path from itCVE-2026-104246 · WordPress plugins & themes · reported by WPScanMedium 5.9
The Contact Form 7 Signature Addon WordPress plugin through 4.2.2 does not sanitize a signature field value before building an email attachment path from it, allowing unauthenticated users to attach arbitrary files (bounded to wp-content on current Contact Form 7) to a form's outgoing email via path traversal; when a form is configured to email a copy to a submitter-controlled address, the attacker can read the targeted file.
Product
Contact Form 7 Signature Addon
Affected
up to 4.2.2
What to do
Affects up to 4.2.2. Update Contact Form 7 Signature Addon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Oct 15, 2026Checkout Field Manager (Checkout Manager) for WooCommerce: Authorization bypassCVE-2026-17031 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Checkout Field Manager (Checkout Manager) for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.9.6 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary Media Library attachments.
Product
Checkout Field Manager (Checkout Manager) for WooCommerce
Affected
up to 7.9.6
What to do
Affects up to 7.9.6. Update Checkout Field Manager (Checkout Manager) for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 10, 2026PPOM – Product Addons & Custom Fields for WooCommerce: Arbitrary file deletionCVE-2026-104801 · WordPress plugins & themes · reported by WordfenceCritical 9.1
The PPOM – Product Addons & Custom Fields for WooCommerce plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the rename_files function in all versions up to, and including, 34.0.10 This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). The relocated file is moved byte-identically into the publicly accessible wp-content/uploads/ppom_files/confirmed/ directory, meaning the attack also results in arbitrary file read for any web-readable file on the server.
Product
PPOM – Product Addons & Custom Fields for WooCommerce
Affected
up to 34.0.10
What to do
Affects up to 34.0.10. Update PPOM – Product Addons & Custom Fields for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 10, 2026Table Field Add-on for ACF and SCF: Stored Cross-Site ScriptingCVE-2026-78068 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Table Field Add-on for ACF and SCF plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Table Cell Content in all versions up to, and including, 1.3.35 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Table Field Add-on for ACF and SCF
Affected
up to 1.3.35
What to do
Affects up to 1.3.35. Update Table Field Add-on for ACF and SCF to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 10, 2026Table Field Add-on for ACF and SCF: Stored Cross-Site ScriptingCVE-2026-96743 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Table Field Add-on for ACF and SCF plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Table Field Value in all versions up to, and including, 1.4.1-RC2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Table Field Add-on for ACF and SCF
Affected
up to 1.4.1-RC2
What to do
Affects up to 1.4.1-RC2. Update Table Field Add-on for ACF and SCF to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 10, 2026Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection): Arbitrary File UploadCVE-2026-94589 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection) plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.4.5 via the extcf7_submit function. This is due to missing file extension, MIME type, and size validation in the signature field's validation_filter(), combined with the absence of PHP-execution guards in the upload directory and a sanitize_file_name() bypass that converts shell.php- into shell.php. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible.
Product
Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection)
Affected
up to 3.4.5
What to do
Affects up to 3.4.5. Update Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 7, 2026MetForm: Does not sanitize or escape submitted form-field values before inserting them into the HTML body of its email notificationsCVE-2026-86833 · WordPress plugins & themes · reported by WPScanMedium 5.4
The MetForm WordPress plugin before 4.3.1 does not sanitize or escape submitted form-field values before inserting them into the HTML body of its email notifications, allowing unauthenticated attackers to inject arbitrary markup into the administrator and submitter notification emails the site sends.
Product
MetForm
Fixed in
4.3.1
What to do
Update MetForm to 4.3.1 or newer.
Full record and what to do →NVD record wpscan.com
Oct 6, 2026Subscriber Cross Site Scripting (XSS) in WC Fields Factory <= 4.1.12 versions.CVE-2026-39727 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Subscriber Cross Site Scripting (XSS) in WC Fields Factory <= 4.1.12 versions.
Affected
up to 4.1.12
What to do
Affects up to 4.1.12. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 4, 2026Five Star Business Profile and Schema: Does not properly restrict the callbacks used to resolve schema field default valuesCVE-2026-86817 · WordPress plugins & themes · reported by WPScanMedium 4.9
The Five Star Business Profile and Schema WordPress plugin before 2.4.0 does not properly restrict the callbacks used to resolve schema field default values, allowing authenticated users with Author-level access and above to store input that discloses sensitive data, including other users' password hashes and arbitrary site option values, in public output readable by unauthenticated visitors.
Product
Five Star Business Profile and Schema
Fixed in
2.4.0
What to do
Update Five Star Business Profile and Schema to 2.4.0 or newer.
Full record and what to do →NVD record wpscan.com
Oct 4, 2026Simple Shopping Cart: Does not escape some of its settings field values before outputting them on an admin settings pageCVE-2026-104119 · WordPress plugins & themes · reported by WPScanLow 3.5
The Simple Shopping Cart WordPress plugin before 5.2.6 does not escape some of its settings field values before outputting them on an admin settings page, allowing high-privilege users such as administrators to perform Stored Cross-Site Scripting attacks, which is notably impactful on multisite installations where administrators do not have the unfiltered_html capability.
Product
Simple Shopping Cart
Fixed in
5.2.6
What to do
Update Simple Shopping Cart to 5.2.6 or newer.
Full record and what to do →NVD record wpscan.com
Oct 3, 2026Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More: Reflected DOM-Based Cross-Site ScriptingCVE-2026-103909 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More plugin for WordPress is vulnerable to Reflected DOM-Based Cross-Site Scripting via the 'arbitrary (whichever names the admin bound via url.<name>)' parameter in all versions up to, and including, 5.5.1.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Exploitation requires the targeted site to host a publicly accessible form in which an administrator has configured at least two fields with url.<name> predefined values that are used together in a concatenation equation — a plausible but not universal configuration.
Product
Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More
Affected
up to 5.5.1.5
What to do
Affects up to 5.5.1.5. Update Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 1, 2026Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More: Reflected DOM-Based Cross-Site ScriptingCVE-2026-100184 · WordPress plugins & themes · reported by WordfenceMedium 4.7
The Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More plugin for WordPress is vulnerable to Reflected DOM-Based Cross-Site Scripting via the 'x (attacker-chosen name matching the form's url.<name> predefined value)' parameter in all versions up to, and including, 5.5.1.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Exploitation requires that the targeted form has a Text Area field configured with a 'url.<name>' Predefined Value and predefinedClick disabled, which is a documented and commonly used plugin feature.
Product
Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More
Affected
up to 5.5.1.3
What to do
Affects up to 5.5.1.3. Update Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 1, 2026Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More: Reflected DOM-Based Cross-Site ScriptingCVE-2026-100179 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More plugin for WordPress is vulnerable to Reflected DOM-Based Cross-Site Scripting via the 'x (any URL parameter consumed by the form's calculated equation)' parameter in all versions up to, and including, 5.5.1.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Exploitation requires the target site to have a public form configured with a Select2-enabled dropdown whose choices are populated via a calculated equation that pipes a URL parameter through GETURLPARAMETER() into setChoices({texts:[...]}); given that configuration, exploitation requires only a single crafted link.
Product
Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More
Affected
up to 5.5.1.3
What to do
Affects up to 5.5.1.3. Update Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 30, 2026Shop manager PHP Object Injection in Extra Product Options For WooCommerce | Custom Product Addons and Fields <= 3.3.8 versions.CVE-2026-102392 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Shop manager PHP Object Injection in Extra Product Options For WooCommerce | Custom Product Addons and Fields <= 3.3.8 versions.
Affected
up to 3.3.8
What to do
Affects up to 3.3.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 30, 2026EWWW Image Optimizer: Does not prevent authenticated users with author-level permissions from storing a serialized value in a post meta field that is deserializedCVE-2026-91051 · WordPress plugins & themes · reported by WPScanMedium 6.6
The EWWW Image Optimizer WordPress plugin before 8.8.0 does not prevent authenticated users with author-level permissions from storing a serialized value in a post meta field that is deserialized when the post is rendered, allowing them to perform PHP Object Injection, which can lead to remote code execution when a suitable gadget chain is present via another installed EWWW Image Optimizer WordPress plugin before 8.8.0 or .
Product
EWWW Image Optimizer
Fixed in
8.8.0
What to do
Update EWWW Image Optimizer to 8.8.0 or newer.
Full record and what to do →NVD record wpscan.com
Sep 28, 2026The WPForms Lite WordPress plugin from 1.5.0.1 to 2.0.2 does not remove shortcode delimiters from submitted field values before writing them back into the rendeCVE-2026-84744 · WordPress plugins & themes · reported by WPScanMedium 6.5
The WPForms Lite WordPress plugin from 1.5.0.1 to 2.0.2 does not remove shortcode delimiters from submitted field values before writing them back into the rendered form, allowing unauthenticated users to execute arbitrary shortcodes registered on the site and read the details of attachments belonging to non-public posts.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record wpscan.com
Sep 26, 2026WP Directory Kit: Does not sanitize and escape some of its category and location fields before outputting them in page attributesCVE-2026-16591 · WordPress plugins & themes · reported by WPScanHigh 7.2
The WP Directory Kit WordPress plugin before 1.5.8 does not sanitize and escape some of its category and location fields before outputting them in page attributes, allowing users with a WP Directory Kit WordPress plugin before 1.5.8-specific listing-management role (and without the unfiltered_html capability) to perform Stored Cross-Site Scripting attacks that execute for any visitor of the affected page.
Product
WP Directory Kit
Fixed in
1.5.8
What to do
Update WP Directory Kit to 1.5.8 or newer.
Full record and what to do →NVD record wpscan.com
Sep 25, 2026Repeater Fields for Elementor Forms: Stored Cross-Site ScriptingCVE-2026-94573 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Repeater Fields for Elementor Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Repeater Field Value in all versions up to, and including, 2.2.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Repeater Fields for Elementor Forms
Affected
up to 2.2.7
What to do
Affects up to 2.2.7. Update Repeater Fields for Elementor Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 24, 2026WPeMatico RSS Feed Fetcher: Does not sanitise and escape one of its campaign configuration fieldsCVE-2026-89005 · WordPress plugins & themes · reported by WPScanMedium 6.8
The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.26 does not sanitise and escape one of its campaign configuration fields when a certain feature is enabled, which allows users with the Contributor role and above to perform Stored Cross-Site Scripting attacks that execute in the session of any higher-privileged user who later views the campaign.
Product
WPeMatico RSS Feed Fetcher
Fixed in
2.8.26
What to do
Update WPeMatico RSS Feed Fetcher to 2.8.26 or newer.
Full record and what to do →NVD record wpscan.com
Sep 23, 2026Unauthenticated Cross Site Scripting (XSS) in Calculated Fields Form <= 5.5.1.1 versions.CVE-2026-95529 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Calculated Fields Form <= 5.5.1.1 versions.
Affected
up to 5.5.1.1
What to do
Affects up to 5.5.1.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 23, 2026WC Fields Factory: Does not properly restrict access to its field-management AJAX actionCVE-2026-93508 · WordPress plugins & themes · reported by WPScanHigh 8.1
The WC Fields Factory WordPress plugin before 4.1.11 does not properly restrict access to its field-management AJAX action, allowing authenticated users with Subscriber-level access and above to create, modify and delete arbitrary post meta on any post, including WooCommerce products, regardless of ownership, and to manipulate stored pricing rules on a product to reduce its checkout price.
Product
WC Fields Factory
Fixed in
4.1.11
What to do
Update WC Fields Factory to 4.1.11 or newer.
Full record and what to do →NVD record wpscan.com
Sep 23, 2026WC Fields Factory: Does not properly restrict access toCVE-2026-93507 · WordPress plugins & themes · reported by WPScanLow 3.3
The WC Fields Factory WordPress plugin before 4.1.11 does not properly restrict access to, or verify a nonce for, a post-cloning action, allowing Contributor-level users and above to duplicate arbitrary posts of any type or status, including other users' private or draft content, and gain read access to the resulting copy.
Product
WC Fields Factory
Fixed in
4.1.11
What to do
Update WC Fields Factory to 4.1.11 or newer.
Full record and what to do →NVD record wpscan.com
Sep 23, 2026Post Grid Gutenberg Blocks: Does not perform an authorization or post-visibility check on a REST API route that returns the custom field keys of a given postCVE-2026-86783 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Post Grid Gutenberg Blocks WordPress plugin before 5.0.41 does not perform an authorization or post-visibility check on a REST API route that returns the custom field keys of a given post, allowing unauthenticated users to disclose the custom field key names of arbitrary posts, including private, draft, pending, scheduled and password-protected posts.
Product
Post Grid Gutenberg Blocks
Fixed in
5.0.41
What to do
Update Post Grid Gutenberg Blocks to 5.0.41 or newer.
Full record and what to do →NVD record wpscan.com
Sep 23, 2026Real3D Flipbook: Does not sanitize or escape several flipbook editor fields before rendering them back in the admin editorCVE-2025-15696 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Real3D Flipbook WordPress plugin before 5.4 does not sanitize or escape several flipbook editor fields before rendering them back in the admin editor, allowing users with the Author role and above to inject arbitrary web scripts that execute in the browser of any user who later opens the affected flipbook for editing, including administrators.
Product
Real3D Flipbook
Fixed in
5.4
What to do
Update Real3D Flipbook to 5.4 or newer.
Full record and what to do →NVD record wpscan.com
Sep 22, 2026Custom Field Template: Insecure Direct Object ReferenceCVE-2026-12995 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Custom Field Template plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.7.8 via the edit_meta_value due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with contributor-level access and above, to delete arbitrary media attachments site-wide by supplying any numeric attachment ID in the file-field parameter alongside the corresponding delete flag, causing content loss and broken pages. Exploitation requires that the attacker's post is governed by a Custom Field Template containing at least one file-type field with the mediaRemove option not enabled, which is the default configuration for file fields.
Product
Custom Field Template
Affected
up to 2.7.8
What to do
Affects up to 2.7.8. Update Custom Field Template to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 22, 2026The Ninja Forms WordPress plugin 3.15.3 does not escape submitted form field values before outputting them on the submission edit screen in the admin area, whicCVE-2026-92438 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Ninja Forms WordPress plugin 3.15.3 does not escape submitted form field values before outputting them on the submission edit screen in the admin area, which could allow unauthenticated users to submit values through a public form that then execute in the browser of any high-privileged user who reviews the submission.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record wpscan.com
Sep 22, 2026The Ninja Forms WordPress plugin 3.15.3 does not prevent user-submitted form field values from being deserialised when an administrator later exports form submiCVE-2026-91827 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Ninja Forms WordPress plugin 3.15.3 does not prevent user-submitted form field values from being deserialised when an administrator later exports form submissions to CSV, allowing unauthenticated attackers to perform PHP Object Injection; if a suitable POP chain is present via another installed plugin or theme, this can lead to actions such as arbitrary file operations or remote code execution.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record wpscan.com
Sep 19, 2026Custom Field Template: Generic SQL InjectionCVE-2026-9855 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Custom Field Template plugin for WordPress is vulnerable to generic SQL Injection via the 'post_ID' parameter in all versions up to, and including, 2.7.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The capability check via current_user_can('edit_post', $id) is bypassable because WordPress internally casts $id to an integer for the permission evaluation while the full unsanitized string is preserved and passed to the SQL sink, and a valid nonce — which is also required — can be legitimately obtained by any Contributor-level user from the post edit screen.
Product
Custom Field Template
Affected
up to 2.7.8
What to do
Affects up to 2.7.8. Update Custom Field Template to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 19, 2026Secure Custom Fields: Does not properly verify that a front-end form submission corresponds to the form that was rendered to the visitorCVE-2026-92403 · WordPress plugins & themes · reported by WPScanLow 3.7
The Secure Custom Fields WordPress plugin before 6.9.4 does not properly verify that a front-end form submission corresponds to the form that was rendered to the visitor, allowing unauthenticated users to submit against a different registered form and modify the title and content of the post that form is bound to.
Product
Secure Custom Fields
Fixed in
6.9.4
What to do
Update Secure Custom Fields to 6.9.4 or newer.
Full record and what to do →NVD record wpscan.com
Sep 19, 2026Ultra Addons for Contact Form 7: Does not validate the type or extension of files uploaded through one of its form fieldsCVE-2026-84750 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Ultra Addons for Contact Form 7 WordPress plugin before 3.5.51 does not validate the type or extension of files uploaded through one of its form fields, and stores them at a predictable public path with the attacker-chosen extension intact, allowing unauthenticated users to upload arbitrary files. The PHP handler shipped by default with the Debian and Ubuntu Apache packages maps .phar to PHP alongside .php and .phtml, so on that stack the uploaded file is executed and the issue leads to Remote Code Execution and full site takeover. Where the host routes only .php to the PHP handler, the same file is instead served from the site's own origin with its script intact, leading to Stored Cross-Site Scripting.
Product
Ultra Addons for Contact Form 7
Fixed in
3.5.51
What to do
Update Ultra Addons for Contact Form 7 to 3.5.51 or newer.
Full record and what to do →NVD record wpscan.com
Sep 17, 2026Checkout Field Manager (Checkout Manager) for WooCommerce: Does not properly validate the ownership of an attachment before deleting itCVE-2026-87831 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Checkout Field Manager (Checkout Manager) for WooCommerce WordPress plugin before 7.9.7 does not properly validate the ownership of an attachment before deleting it, allowing any authenticated user such as a customer to delete arbitrary media attachments belonging to other users.
Product
Checkout Field Manager (Checkout Manager) for WooCommerce
Fixed in
7.9.7
What to do
Update Checkout Field Manager (Checkout Manager) for WooCommerce to 7.9.7 or newer.
Full record and what to do →NVD record wpscan.com
Sep 17, 2026Checkout Field Manager (Checkout Manager) for WooCommerce: Does not properly validate the ownership of an attachment before deleting itCVE-2026-87829 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Checkout Field Manager (Checkout Manager) for WooCommerce WordPress plugin before 7.9.7 does not properly validate the ownership of an attachment before deleting it, allowing any authenticated user such as a customer to delete arbitrary media attachments belonging to other users.
Product
Checkout Field Manager (Checkout Manager) for WooCommerce
Fixed in
7.9.7
What to do
Update Checkout Field Manager (Checkout Manager) for WooCommerce to 7.9.7 or newer.
Full record and what to do →NVD record wpscan.com
Sep 16, 2026WP Import Export Lite: Does not escape custom field names retrieved from the database before inserting them into the DOM of one of its administration screensCVE-2026-76558 · WordPress plugins & themes · reported by WPScanMedium 6.8
The WP Import Export Lite WordPress plugin before 3.9.33 does not escape custom field names retrieved from the database before inserting them into the DOM of one of its administration screens, allowing users with a role as low as contributor to perform Stored XSS attacks which will trigger in the browser of a high privileged user, such as an administrator, viewing that screen.
Product
WP Import Export Lite
Fixed in
3.9.33
What to do
Update WP Import Export Lite to 3.9.33 or newer.
Full record and what to do →NVD record wpscan.com
Sep 12, 2026BEAR: Does not verify a CSRF nonce before saving its meta field configurationCVE-2026-84024 · WordPress plugins & themes · reported by WPScanMedium 4.3
The BEAR WordPress plugin before 1.2.2 does not verify a CSRF nonce before saving its meta field configuration, allowing an attacker to overwrite that configuration by tricking a logged-in administrator into visiting a crafted page.
Product
BEAR
Fixed in
1.2.2
What to do
Update BEAR to 1.2.2 or newer.
Full record and what to do →NVD record wpscan.com
Sep 12, 2026Masteriyo LMS: Does not sanitise and escape one of its course fields before outputting it back in the course editorCVE-2026-82847 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Masteriyo LMS WordPress plugin before 3.4.1 does not sanitise and escape one of its course fields before outputting it back in the course editor, allowing users with the instructor role to perform Stored Cross-Site Scripting attacks against higher privileged users such as administrators.
Product
Masteriyo LMS
Fixed in
3.4.1
What to do
Update Masteriyo LMS to 3.4.1 or newer.
Full record and what to do →NVD record wpscan.com
Sep 11, 2026MIPL Grouped Checkout Fields for WooCommerce – Customize & Organize Checkout Fields.: Arbitrary file uploadsCVE-2026-8778 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The MIPL Grouped Checkout Fields for WooCommerce – Customize & Organize Checkout Fields. plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the `mipl_wc_upload_file` function in all versions up to, and including, 1.2.1. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
MIPL Grouped Checkout Fields for WooCommerce – Customize & Organize Checkout Fields.
Affected
up to 1.2.1
What to do
Affects up to 1.2.1. Update MIPL Grouped Checkout Fields for WooCommerce – Customize & Organize Checkout Fields. to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.