Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
501 results · page 1 of 11
Oct 29, 2026Link Library: Does not verify that a requested link belongs to the settings set whose display template is used to render itCVE-2026-78396 · WordPress plugins & themes · reported by WPScan
The Link Library WordPress plugin before 7.10.0 does not verify that a requested link belongs to the settings set whose display template is used to render it, allowing unauthenticated users to disclose the telephone number, e-mail address and submitter name stored with links that the settings set is configured not to display.
- Product
- Link Library
- Fixed in
- 7.10.0
- What to do
- Update Link Library to 7.10.0 or newer.
Oct 29, 2026Link Library: Does not re-check the selected library's own login requirementCVE-2026-78395 · WordPress plugins & themes · reported by WPScan
The Link Library WordPress plugin before 7.10.0 does not re-check the selected library's own login requirement when processing its front-end link submission, allowing unauthenticated users to submit links to a library configured to require login by reusing a form token obtained from another library that does not.
- Product
- Link Library
- Fixed in
- 7.10.0
- What to do
- Update Link Library to 7.10.0 or newer.
Oct 29, 2026Enable SVG, WebP, and ICO Upload: Does not prevent animation elements in uploaded SVG files from changing a link's target to a javascript: URICVE-2026-110505 · WordPress plugins & themes · reported by WPScan
The Enable SVG, WebP, and ICO Upload WordPress plugin before 1.1.6 does not prevent animation elements in uploaded SVG files from changing a link's target to a javascript: URI, which could allow users with the author role and above to bypass its SVG sanitization and perform Stored Cross-Site Scripting attacks that execute in WebKit-based browsers such as Safari.
- Product
- Enable SVG, WebP, and ICO Upload
- Fixed in
- 1.1.6
- What to do
- Update Enable SVG, WebP, and ICO Upload to 1.1.6 or newer.
Oct 28, 2026GeoDirectory: Does not properly sanitise or escape a post badge click-through link value before outputting it in an anchor element on a listingCVE-2026-113487 · WordPress plugins & themes · reported by WPScanMedium 6.8
The GeoDirectory WordPress plugin before 2.8.196 does not properly sanitise or escape a post badge click-through link value before outputting it in an anchor element on a listing, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks against higher-privileged users who view the listing, including an administrator reviewing moderated content.
- Product
- GeoDirectory
- Fixed in
- 2.8.196
- What to do
- Update GeoDirectory to 2.8.196 or newer.
Oct 28, 2026Payconiq: Does not check that a visitor is allowed to see an order before returning its confirmation linkCVE-2026-103372 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Payconiq WordPress plugin through 1.0.4 does not check that a visitor is allowed to see an order before returning its confirmation link, allowing unauthenticated users to obtain any paid order's key and, for recent guest orders, view the customer's personal details.
- Product
- Payconiq
- Affected
- up to 1.0.4
- What to do
- Affects up to 1.0.4. Update Payconiq to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 24, 2026Download Monitor: Does not properly validate that a clicked link belongs to the site before fetching it client-side and rendering part of the response in the pageCVE-2026-112207 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Download Monitor WordPress plugin before 5.3.4 does not properly validate that a clicked link belongs to the site before fetching it client-side and rendering part of the response in the page, which allows unauthenticated attackers to execute arbitrary JavaScript in the browser of any user who is tricked into clicking a crafted link.
- Product
- Download Monitor
- Fixed in
- 5.3.4
- What to do
- Update Download Monitor to 5.3.4 or newer.
Oct 22, 2026JetBackup: Symlink-based arbitrary file writeCVE-2026-104068 · WordPress plugins & themes · reported by VulnCheckHigh 8.6
JetBackup plugin for WordPress before 3.1.24.10 contains a symlink-based arbitrary file write vulnerability that allows an authenticated WordPress administrator to write attacker-controlled file contents outside the intended restore destination during backup import and restore. Attackers can craft a backup archive containing a symbolic link that archive extraction follows without validating targets or enforcing destination containment, potentially leading to server-side code execution depending on the writable destination and server configuration.
- Product
- JetBackup
- Fixed in
- 3.1.24.10
- What to do
- Update JetBackup to 3.1.24.10 or newer.
Full record and what to do →NVD recordwordpress.orgvulncheck.com
Oct 22, 2026Link Library: Does not sanitise and escape a link field before outputting it inside an attribute of a link previewCVE-2026-78392 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Link Library WordPress plugin before 7.9.6 does not sanitise and escape a link field before outputting it inside an attribute of a link preview, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks. The preview is generated without authentication and without checking whether the link has been published, so an unapproved submission is enough to reach any visitor who opens it.
- Product
- Link Library
- Fixed in
- 7.9.6
- What to do
- Update Link Library to 7.9.6 or newer.
Oct 22, 2026Royal MCP: Does not limit a preview-link token to the single preview it was issued forCVE-2026-111958 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Royal MCP WordPress plugin before 1.5.7 does not limit a preview-link token to the single preview it was issued for, so any party that obtains a valid token is authenticated as the token's owning user, an administrator in the default configuration, across the entire REST API with no nonce, leading to full site takeover.
- Product
- Royal MCP
- Fixed in
- 1.5.7
- What to do
- Update Royal MCP to 1.5.7 or newer.
Oct 18, 2026WP Photo Album Plus: Does not properly escape a category navigation value before reflecting it into a JavaScript event handler on its gallery breadcrumb linksCVE-2026-110981 · WordPress plugins & themes · reported by WPScanHigh 7.1
The WP Photo Album Plus WordPress plugin before 9.2.11.002 does not properly escape a category navigation value before reflecting it into a JavaScript event handler on its gallery breadcrumb links, allowing unauthenticated attackers to inject arbitrary script that executes in the browser of anyone who follows a crafted gallery link and clicks the breadcrumb, including a logged-in administrator.
- Product
- WP Photo Album Plus
- Fixed in
- 9.2.11.002
- What to do
- Update WP Photo Album Plus to 9.2.11.002 or newer.
Oct 17, 2026ThirstyAffiliates: Does not check the status or type of the object requested by its link redirect tracking handlerCVE-2026-97314 · WordPress plugins & themes · reported by WPScanMedium 6.5
The ThirstyAffiliates WordPress plugin before 3.12.1 does not check the status or type of the object requested by its link redirect tracking handler, allowing unauthenticated attackers to disclose the destination URLs of unpublished affiliate links and to record fabricated click statistics.
- Product
- ThirstyAffiliates
- Fixed in
- 3.12.1
- What to do
- Update ThirstyAffiliates to 3.12.1 or newer.
Oct 16, 2026The Broken Link Checker: Arbitrary shortcode executionCVE-2026-96562 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The The Broken Link Checker plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.4.14.1. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. Exploitation requires that a submitted comment containing the shortcode payload in an href or src attribute is approved through the site's normal comment moderation workflow; once approved, the shortcode is executed automatically via WP-Cron without any further attacker interaction.
- Product
- The Broken Link Checker
- Affected
- up to 2.4.14.1
- What to do
- Affects up to 2.4.14.1. Update The Broken Link Checker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 15, 2026Link Whisper Free: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-109688 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Link Whisper INC Link Whisper Free link-whisper allows Blind SQL Injection.This issue affects Link Whisper Free: from n/a through 0.9.7.
- Product
- Link Whisper Free
- Affected
- up to 0.9.7
- What to do
- Affects up to 0.9.7. Update Link Whisper Free to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 15, 2026Link Whisper Free: Deserialization of Untrusted DataCVE-2026-109686 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in Link Whisper INC Link Whisper Free link-whisper allows Object Injection.This issue affects Link Whisper Free: from n/a through 0.9.7.
- Product
- Link Whisper Free
- Affected
- up to 0.9.7
- What to do
- Affects up to 0.9.7. Update Link Whisper Free to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 15, 2026Link Whisper Free: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-109685 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Link Whisper INC Link Whisper Free link-whisper allows Reflected XSS.This issue affects Link Whisper Free: from n/a through 0.9.7.
- Product
- Link Whisper Free
- Affected
- up to 0.9.7
- What to do
- Affects up to 0.9.7. Update Link Whisper Free to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 15, 2026Broken Link Checker: Improper Control of Generation of Code ('Code Injection')CVE-2026-102389 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Control of Generation of Code ('Code Injection') vulnerability in WPMU DEV Broken Link Checker broken-link-checker allows Code Injection.This issue affects Broken Link Checker: from n/a through 2.4.14.1.
- Product
- Broken Link Checker
- Affected
- up to 2.4.14.1
- What to do
- Affects up to 2.4.14.1. Update Broken Link Checker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 15, 2026Link Library: Time-based SQL InjectionCVE-2026-15090 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Link Library plugin for WordPress is vulnerable to time-based SQL Injection via the 'link_url' parameter in all versions up to, and including, 7.9.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- Link Library
- Affected
- up to 7.9.2
- What to do
- Affects up to 7.9.2. Update Link Library to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 14, 2026Gallery Custom Links: Stored Cross-Site ScriptingCVE-2026-107757 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The Gallery Custom Links plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'display_name (profile.php) + comment (wp-comments-post.php)' parameter in all versions up to, and including, 2.3.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit requires two coordinated inputs from the same authenticated attacker: an HTML comment payload stored in a comment body (preserved verbatim by WordPress comment kses) and a matching simple_html_dom noise key placed in the attacker's display_name (which survives esc_attr() intact), with substitution occurring after both filters have run during the plugin's default-on output-buffering pass over the full rendered page.
- Product
- Gallery Custom Links
- Affected
- up to 2.3.3
- What to do
- Affects up to 2.3.3. Update Gallery Custom Links to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 14, 2026Pricing Table: Does not validate the scheme of a user-supplied link value in one of its blocks before rendering itCVE-2026-86797 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Pricing Table WordPress plugin before 2.1.5 does not validate the scheme of a user-supplied link value in one of its blocks before rendering it, allowing users with contributor-level access and above to store malicious scripts that execute when another user views and interacts with the affected content.
- Product
- Pricing Table
- Fixed in
- 2.1.5
- What to do
- Update Pricing Table to 2.1.5 or newer.
Oct 13, 2026Link Whisper Free: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-109687 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Link Whisper INC Link Whisper Free link-whisper allows Blind SQL Injection.This issue affects Link Whisper Free: from n/a through 0.9.7.
- Product
- Link Whisper Free
- Affected
- up to 0.9.7
- What to do
- Affects up to 0.9.7. Update Link Whisper Free to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 11, 2026ngx_cache_purge before 3.0.4 can allow file deletion via a symlink attack in certain situations where nginx and a served application (e.g., WordPress) run underCVE-2026-108981 · WordPress plugins & themes · reported by MITRELow 3.6
ngx_cache_purge before 3.0.4 can allow file deletion via a symlink attack in certain situations where nginx and a served application (e.g., WordPress) run under the same user account. The attacker must be able to create a symlink inside the cache path. Version 3.0.4 fixes this for the case of a symlink created at an arbitrary earlier time, but does not resolve an applicable TOCTOU race condition. (The ngx_cache_purge module follows symlinks while walking the cache directory tree during purge operations. The module relies on nginx's ngx_walk_tree(), which relies on stat() and therefore follows symlinks.)
- Fixed in
- 3.0.4
- What to do
- Update the plugin to 3.0.4 or newer.
Oct 11, 2026Subscribe to Comments: Does not properly validate a parameter before reflecting it into a link targetCVE-2026-91829 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Subscribe to Comments WordPress plugin before 2.3.3 does not properly validate a parameter before reflecting it into a link target, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting via a crafted URL against anyone who clicks it, including administrators.
- Product
- Subscribe to Comments
- Fixed in
- 2.3.3
- What to do
- Update Subscribe to Comments to 2.3.3 or newer.
Oct 8, 2026Ultimate Multisite: Does not require authentication before a logged-out checkout is linked toCVE-2026-103646 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Ultimate Multisite WordPress plugin before 2.17.0 does not require authentication before a logged-out checkout is linked to, and logged in as, an existing WordPress account matching the submitted email address, and its duplicate-account check normalizes that address differently from the lookup used to create the customer, so an unauthenticated attacker can log in as any existing user, including a Network Super Admin, whose email address they know. This bypass is not addressed by the 2.15.1 fix for CVE-2026-75957 and remains exploitable in all versions up to and including 2.16.1, the releases that fix was expected to cover. Exploitation requires a checkout form configured without a password field (auto-generated password) and a target account that has no existing customer record in the Ultimate Multisite WordPress plugin before 2.17.0.
- Product
- Ultimate Multisite
- Affected
- up to 2.16.1
- Fixed in
- 2.17.0
- What to do
- Update Ultimate Multisite to 2.17.0 or newer.
Oct 7, 2026If-So Dynamic Content: Does not validate the URL scheme of a request-supplied value before reflecting it into a link on an admin pageCVE-2026-87971 · WordPress plugins & themes · reported by WPScanHigh 7.1
The If-So Dynamic Content WordPress plugin before 1.10.2 does not validate the URL scheme of a request-supplied value before reflecting it into a link on an admin page, allowing attackers to execute arbitrary JavaScript in the browser of a logged-in user who opens a crafted link.
- Product
- If-So Dynamic Content
- Fixed in
- 1.10.2
- What to do
- Update If-So Dynamic Content to 1.10.2 or newer.
Oct 7, 2026Koinonia Link: Does not check that a user is allowed to change roles before saving a role selection submitted with a profile updateCVE-2026-87782 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Koinonia Link WordPress plugin before 1.1.5 does not check that a user is allowed to change roles before saving a role selection submitted with a profile update, allowing any authenticated user, such as a subscriber, to grant themselves the Administrator role.
- Product
- Koinonia Link
- Fixed in
- 1.1.5
- What to do
- Update Koinonia Link to 1.1.5 or newer.
Oct 2, 2026No External Links: Stored Cross-Site ScriptingCVE-2026-95670 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The No External Links plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Log URL via /goto/{base64} Redirect in all versions up to, and including, 5.2.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is only exploitable when the administrator has enabled the 'Link Encoding: Base64' option in the plugin settings.
- Product
- No External Links
- Affected
- up to 5.2.0
- What to do
- Affects up to 5.2.0. Update No External Links to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 30, 2026Unauthenticated Cross Site Request Forgery (CSRF) in Razorpay Payment Links for WooCommerce <= 2.1.5 versions.CVE-2026-97299 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Unauthenticated Cross Site Request Forgery (CSRF) in Razorpay Payment Links for WooCommerce <= 2.1.5 versions.
- Affected
- up to 2.1.5
- What to do
- Affects up to 2.1.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 30, 2026Unauthenticated Cross Site Scripting (XSS) in Premmerce Permalink Manager for WooCommerce <= 2.3.13 versions.CVE-2026-97272 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Premmerce Permalink Manager for WooCommerce <= 2.3.13 versions.
- Affected
- up to 2.3.13
- What to do
- Affects up to 2.3.13. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 30, 2026Broken Link Notifier: Does not re-validate the destination of redirectsCVE-2026-97316 · WordPress plugins & themes · reported by WPScanMedium 5.8
The Broken Link Notifier WordPress plugin before 2.0.0.1 does not re-validate the destination of redirects when checking links, allowing unauthenticated attackers to bypass its internal-address filter and make the server send requests to internal services.
- Product
- Broken Link Notifier
- Fixed in
- 2.0.0.1
- What to do
- Update Broken Link Notifier to 2.0.0.1 or newer.
Sep 25, 2026Link Library: Does not validate the destination of a user-supplied URL before falling back to an unprotected fetchCVE-2026-78397 · WordPress plugins & themes · reported by WPScanMedium 4
The Link Library WordPress plugin before 7.9.6 does not validate the destination of a user-supplied URL before falling back to an unprotected fetch when its safe request is rejected, allowing unauthenticated visitors to make the site issue requests to hosts on its internal network and to learn from the response whether an internal service answered. Versions below 7.8.8 are covered by CVE-2025-68600; this entry covers 7.8.8 through 7.9.5, where that fix was incomplete. Exploitation requires the site owner to have published the Link Library WordPress plugin before 7.9.6's public link submission form with reciprocal-link validation enabled.
- Product
- Link Library
- Affected
- up to 7.9.5
- Fixed in
- 7.9.6
- What to do
- Update Link Library to 7.9.6 or newer.
Sep 25, 2026Link Library: Does not sanitize a user-supplied destination folder before writing a generated image to diskCVE-2026-78394 · WordPress plugins & themes · reported by WPScanMedium 4.1
The Link Library WordPress plugin before 7.9.6 does not sanitize a user-supplied destination folder before writing a generated image to disk, allowing users with the Contributor role and above to create directories and write or overwrite image files anywhere the web server can write, including outside the site's document root. The written file name is always numeric with a fixed image extension, so executable code cannot be planted this way.
- Product
- Link Library
- Fixed in
- 7.9.6
- What to do
- Update Link Library to 7.9.6 or newer.
Sep 25, 2026Link Library: Does not properly escape some parameters before outputting them in the addresses of links it generates on its front-end directory pagesCVE-2026-78393 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Link Library WordPress plugin before 7.9.6 does not properly escape some parameters before outputting them in the addresses of links it generates on its front-end directory pages, leading to Reflected Cross-Site Scripting which could be used against any visitor, including logged-in administrators.
- Product
- Link Library
- Fixed in
- 7.9.6
- What to do
- Update Link Library to 7.9.6 or newer.
Sep 23, 2026Events Calendar: Does not check the post status of linked records before embedding their stored details into a public REST API responseCVE-2026-84741 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Events Calendar WordPress plugin before 6.17.5 does not check the post status of linked records before embedding their stored details into a public REST API response, allowing unauthenticated users to read the contents of records that have never been published.
- Product
- Events Calendar
- Fixed in
- 6.17.5
- What to do
- Update Events Calendar to 6.17.5 or newer.
Sep 20, 2026SAML Single Sign On: Does not honour the configured criterion for linking an incoming single sign-on identity to a WordPress accountCVE-2026-82842 · WordPress plugins & themes · reported by WPScanHigh 8.1
The SAML Single Sign On WordPress plugin before 6.0.0 does not honour the configured criterion for linking an incoming single sign-on identity to a WordPress account, always resolving the identity by login name whatever the site has chosen, which allows an attacker who can have the site's identity provider assert a login name of their choosing to authenticate as any account, including an administrator, without proving ownership of that account.
- Product
- SAML Single Sign On
- Fixed in
- 6.0.0
- What to do
- Update SAML Single Sign On to 6.0.0 or newer.
Sep 18, 2026Easy Appointments: Does not use an unguessable token to authorize its mail-link appointment cancellation and confirmation actionCVE-2026-87965 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Easy Appointments WordPress plugin before 4.0.2.2 does not use an unguessable token to authorize its mail-link appointment cancellation and confirmation action, deriving the token from a hardcoded source-embedded salt and the appointment's creation timestamp, so unauthenticated attackers who know or guess that timestamp can cancel or confirm arbitrary appointments.
- Product
- Easy Appointments
- Fixed in
- 4.0.2.2
- What to do
- Update Easy Appointments to 4.0.2.2 or newer.
Sep 18, 2026wp shortcut link and advertisement baner: Does not sanitize and escape a parameter before using it in a SQL query on an AJAX action available to unauthenticated usersCVE-2026-87767 · WordPress plugins & themes · reported by WPScanHigh 8.6
The wp shortcut link and advertisement baner WordPress plugin through 1.2.0 does not sanitize and escape a parameter before using it in a SQL query on an AJAX action available to unauthenticated users, allowing unauthenticated attackers to perform SQL injection attacks and extract sensitive data from the database.
- Product
- wp shortcut link and advertisement baner
- Affected
- up to 1.2.0
- What to do
- Affects up to 1.2.0. Update wp shortcut link and advertisement baner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 17, 2026Newsletter: Does not generate its email tracking signing key with sufficient entropy and signs its tracking links with an unkeyed hashCVE-2026-86824 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Newsletter WordPress plugin before 9.3.8 does not generate its email tracking signing key with sufficient entropy and signs its tracking links with an unkeyed hash, allowing an unauthenticated attacker who recovers that key offline to forge tracking links, obtain any subscriber's session token, and read and modify that subscriber's stored personal data.
- Product
- Newsletter
- Fixed in
- 9.3.8
- What to do
- Update Newsletter to 9.3.8 or newer.
Sep 16, 2026Xpro Addons — 140+ Widgets for Elementor: Does not validate or sanitize a widget link setting before storing and using it in a JavaScript navigation callCVE-2026-84088 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Xpro Addons — 140+ Widgets for Elementor WordPress plugin before 1.7.9 does not validate or sanitize a widget link setting before storing and using it in a JavaScript navigation call, allowing users with the contributor role and above to inject and store JavaScript that executes in the browser of anyone who interacts with the affected widget.
- Product
- Xpro Addons — 140+ Widgets for Elementor
- Fixed in
- 1.7.9
- What to do
- Update Xpro Addons — 140+ Widgets for Elementor to 1.7.9 or newer.
Sep 12, 2026Booking for Appointments and Events Calendar: Does not verify that the user editing a customer or employee record is entitled to modify the WordPress account linked to itCVE-2026-77705 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Booking for Appointments and Events Calendar WordPress plugin before 2.4.10 does not verify that the user editing a customer or employee record is entitled to modify the WordPress account linked to it, allowing users holding Amelia's customer or employee management permissions to set the password and email address of other users' WordPress accounts and take them over.
- Product
- Booking for Appointments and Events Calendar
- Fixed in
- 2.4.10
- What to do
- Update Booking for Appointments and Events Calendar to 2.4.10 or newer.
Sep 5, 2026Bold Page Builder: Does not properly validate a link URL before outputting it in an HTML attributeCVE-2026-84021 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Bold Page Builder WordPress plugin before 5.9.8 does not properly validate a link URL before outputting it in an HTML attribute, relying on a filter that can be evaded, allowing users with the Contributor role and above to inject arbitrary web scripts that execute when a user clicks the affected link.
- Product
- Bold Page Builder
- Fixed in
- 5.9.8
- What to do
- Update Bold Page Builder to 5.9.8 or newer.
Sep 2, 2026Editor Server Side Request Forgery (SSRF) in Broken Link Checker <= 2.4.14 versions.CVE-2026-84772 · WordPress plugins & themes · reported by PatchstackMedium 5.5
Editor Server Side Request Forgery (SSRF) in Broken Link Checker <= 2.4.14 versions.
- Affected
- up to 2.4.14
- What to do
- Affects up to 2.4.14. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 2, 2026Broken Link Checker: Stored Cross-Site ScriptingCVE-2026-75528 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Broken Link Checker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Author URL / Link Log in all versions up to, and including, 2.4.13 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires an administrator to perform the plugin's standard dismiss-and-recheck workflow on a link submitted by the attacker via the WordPress comment author URL field, after which the attacker's HTTP server issues a redirect to a URL containing an HTML/JavaScript payload that is stored verbatim in the link log.
- Product
- Broken Link Checker
- Affected
- up to 2.4.13
- What to do
- Affects up to 2.4.13. Update Broken Link Checker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 24, 2026BetterLinks – Link Shortener, Link Cloaking, Redirects, Affiliate Link Manager & MCP: Authorization bypassCVE-2026-19801 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The BetterLinks – Link Shortener, Link Cloaking, Redirects, Affiliate Link Manager & MCP plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.1.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to create arbitrary BetterLinks short URLs with attacker-controlled slugs and redirect destinations, enabling phishing and SEO abuse. Exploitation requires the Fluent Boards companion plugin to be installed and active (so that the FLUENT_BOARDS constant is defined), and is further facilitated by the betterlinks_admin_nonce nonce being emitted on every frontend page via wp_localize_script, making it accessible to any authenticated user.
- Product
- BetterLinks – Link Shortener, Link Cloaking, Redirects, Affiliate Link Manager & MCP
- Affected
- up to 3.1.0
- What to do
- Affects up to 3.1.0. Update BetterLinks – Link Shortener, Link Cloaking, Redirects, Affiliate Link Manager & MCP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 21, 2026Link Whisper Free: Does not properly sanitize and escape a parameter before using it in a SQL queryCVE-2026-14601 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Link Whisper Free WordPress plugin before 0.9.7 does not properly sanitize and escape a parameter before using it in a SQL query, allowing authenticated users with the Editor role or above to perform SQL injection attacks.
- Product
- Link Whisper Free
- Fixed in
- 0.9.7
- What to do
- Update Link Whisper Free to 0.9.7 or newer.
Aug 19, 2026Broken Link Checker: Does not limitCVE-2026-18937 · WordPress plugins & themes · reported by WPScanCritical 9
The Broken Link Checker WordPress plugin before 2.4.12 does not limit which query variables it accepts from user input on sites using plain permalinks, allowing unauthenticated users to overwrite arbitrary PHP global variables, and to execute arbitrary code on the server when a classic (non-block) is active.
- Product
- Broken Link Checker
- Fixed in
- 2.4.12
- What to do
- Update Broken Link Checker to 2.4.12 or newer.
Aug 16, 2026Divi: Does not properly escape some of its Social Media Follow module settings before outputting them in link attributesCVE-2026-13712 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Divi WordPress theme before 5.9.0 does not properly escape some of its Social Media Follow module settings before outputting them in link attributes, allowing users with a role as low as contributor to store JavaScript which will run when a higher privileged user, such as an administrator, views the post.
- Product
- Divi
- Fixed in
- 5.9.0
- What to do
- Update Divi to 5.9.0 or newer.
Aug 15, 2026Link Library: Arbitrary file deletionCVE-2026-18855 · WordPress plugins & themes · reported by WordfenceCritical 9.1
The Link Library plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the ll_delete_link_fields function in all versions up to, and including, 7.9.4 This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). Exploitation requires the administrator to have enabled the 'Delete local file on link deletion' plugin option (disabled by default) and to subsequently permanently delete the attacker-submitted link, which is a routine moderation action.
- Product
- Link Library
- Affected
- up to 7.9.4
- What to do
- Affects up to 7.9.4. Update Link Library to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 13, 2026Unauthenticated Broken Access Control in Internal Link Optimiser <= 5.2.7 versions.CVE-2026-66464 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Broken Access Control in Internal Link Optimiser <= 5.2.7 versions.
- Affected
- up to 5.2.7
- What to do
- Affects up to 5.2.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 13, 2026Unauthenticated Broken Access Control in Bitcoin Lightning Payment Gateway for WooCommerce (via CLINK) <= 1.0.7 versions.CVE-2026-66431 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in Bitcoin Lightning Payment Gateway for WooCommerce (via CLINK) <= 1.0.7 versions.
- Affected
- up to 1.0.7
- What to do
- Affects up to 1.0.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 13, 2026The Link Factory WordPress plugin is a backdoor.CVE-2026-15413 · WordPress plugins & themes · reported by WPScanCritical 10
The Link Factory WordPress plugin is a backdoor. Distributed as a "homepage sentence publisher", it exposes an operator-controlled REST API under /wp-json/link-factory/v1/ - authenticated by a detached Ed25519 signature verified against a hardcoded operator public key (except for the health check).
- What to do
- Update the plugin to the newest version.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.