Updated 3 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

344new WordPress flaws this week

390,080entries in the database

2,789 results · page 1 of 56

Oct 29, 2026WP Photo Album Plus: Does not verify the origin or a security token for one of its comment-management requestsCVE-2026-110983 · WordPress plugins & themes · reported by WPScan
The WP Photo Album Plus WordPress plugin before 9.3.04.004 does not verify the origin or a security token for one of its comment-management requests, allowing attackers to delete photo comments by tricking a logged-in user who holds comment-moderation rights into loading a crafted page.
Product
WP Photo Album Plus
Fixed in
9.3.04.004
What to do
Update WP Photo Album Plus to 9.3.04.004 or newer.
Full record and what to do →NVD record wpscan.com
Oct 28, 2026Advanced Ads – Tracking: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-115603 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Advanced Ads GmbH Advanced Ads – Tracking advanced-ads-tracking allows Blind SQL Injection.This issue affects Advanced Ads – Tracking: from n/a before 4.0.0.
Product
Advanced Ads – Tracking
Fixed in
4.0.0
What to do
Update Advanced Ads – Tracking to 4.0.0 or newer.
Full record and what to do →NVD record patchstack.com
Oct 28, 2026DXP ToolKit: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-115607 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Crowd Favorite DXP ToolKit dxp-toolkit allows SQL Injection.This issue affects DXP ToolKit: from n/a through 2.0.1.
Product
DXP ToolKit
Affected
up to 2.0.1
What to do
Affects up to 2.0.1. Update DXP ToolKit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 28, 2026BuddyPress: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-111850 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in BuddyPress BuddyPress buddypress allows SQL Injection.This issue affects BuddyPress: from n/a through 14.5.2.
Product
BuddyPress
Affected
up to 14.5.2
What to do
Affects up to 14.5.2. Update BuddyPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 28, 2026FunnelKit Automations: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-111411 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Aman FunnelKit Automations wp-marketing-automations allows Blind SQL Injection.This issue affects FunnelKit Automations: from n/a through 3.8.5.2.
Product
FunnelKit Automations
Affected
up to 3.8.5.2
What to do
Affects up to 3.8.5.2. Update FunnelKit Automations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 28, 2026WP Inventory Manager: Time-based SQL InjectionCVE-2026-76005 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The WP Inventory Manager plugin for WordPress is vulnerable to time-based SQL Injection via 'sort_order' Shortcode Attribute in all versions up to, and including, 2.5.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This can be exploited by a Contributor via the [wpinventory_categories] shortcode embedded in a draft post rendered through preview, without requiring the post to be published.
Product
WP Inventory Manager
Affected
up to 2.5.5
What to do
Affects up to 2.5.5. Update WP Inventory Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 28, 2026VikRentCar Car Rental Management System: Blind SQL InjectionCVE-2026-116750 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to blind SQL Injection via the 'catid' parameter in all versions up to, and including, 1.4.10 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. A Contributor-level user can store a malicious block via the REST API in a pending post and trigger server-side rendering by previewing that post, bypassing wp_magic_quotes since the attribute is sourced from post_content via parse_blocks rather than a superglobal.
Product
VikRentCar Car Rental Management System
Affected
up to 1.4.10
What to do
Affects up to 1.4.10. Update VikRentCar Car Rental Management System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 28, 2026VikRentCar Car Rental Management System: Stored Cross-Site ScriptingCVE-2026-116749 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'className' parameter in all versions up to, and including, 1.4.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. wp_kses_post() applied at save time does not neutralize the payload because the injection lands in an HTML-attribute context where only a raw double-quote is needed to break out, and block-comment JSON encoding of that quote is decoded back to a literal character by do_blocks() at render time.
Product
VikRentCar Car Rental Management System
Affected
up to 1.4.10
What to do
Affects up to 1.4.10. Update VikRentCar Car Rental Management System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 28, 2026Travelly – Tour & Travel Booking Manager for WooCommerce: Authorization bypassCVE-2026-111213 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Travelly – Tour & Travel Booking Manager for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.3.6 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to duplicate arbitrary posts — including private, draft, and pending posts authored by Administrators and Editors — into drafts they own, thereby exposing the original post's content, excerpt, title, taxonomies, and metadata. A Contributor can harvest a valid nonce from the Duplicate row-action on their own posts list and reuse it against any victim post ID, since the nonce action is the static string 'TTBM_Admin.php' and is not bound to any specific post.
Product
Travelly – Tour & Travel Booking Manager for WooCommerce
Affected
up to 2.3.6
What to do
Affects up to 2.3.6. Update Travelly – Tour & Travel Booking Manager for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Oct 28, 2026VikRentCar Car Rental Management System: Cross-Site Request ForgeryCVE-2026-111120 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.8. This is due to missing or incorrect nonce validation on the condtext_update_tmpl function. This makes it possible for unauthenticated attackers to write arbitrary PHP code to the plugin's executable template files such as site/helpers/email_tmpl.php, which are later include()d by loadEmailTemplate() and loadPdfTemplate(), achieving remote code execution on the server via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. The injected PHP payload bypasses sanitization because the plugin's own __PHP_OPEN__/__PHP_CLOSE__ placeholder expansion and cleanPHPSourceCode() logic explicitly reverse both sanitize_text_field filtering and saveHTML() HTML-encoding, restoring a literal <?php...?> payload to live PHP before it is written to disk. Successful exploitation additionally requires an action by an administrator — the attacker cannot trigger the vulnerability on their own.
Product
VikRentCar Car Rental Management System
Affected
up to 1.4.8
What to do
Affects up to 1.4.8. Update VikRentCar Car Rental Management System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 28, 2026Mang Board: Stored Cross-Site ScriptingCVE-2026-110071 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Mang Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'align' parameter in all versions up to, and including, 2.4.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Because the payload contains no angle brackets, wp_kses_post leaves the shortcode intact on save, allowing the malicious attribute value to survive post submission and fire in any viewer's browser — including an administrator previewing a pending post.
Product
Mang Board
Affected
up to 2.4.5
What to do
Affects up to 2.4.5. Update Mang Board to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 28, 2026Tour Booking Manager: Stored Cross-Site ScriptingCVE-2026-109590 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Tour Booking Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'width', 'height' and 'zoom' shortcode attributes of the [ttbm-hotel-map] shortcode in versions up to, and including, 2.3.6 This is due to insufficient input sanitization and output escaping on user supplied attributes in the ttbm_hotel_map_shortcode() function, which concatenates the raw attribute values into double-quoted HTML attributes of an <iframe> tag. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Tour Booking Manager
Affected
up to 2.3.6
What to do
Affects up to 2.3.6. Update Tour Booking Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Oct 28, 2026Contact Manager: Arbitrary File UploadCVE-2026-109218 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Contact Manager plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 9.1.2 via the add_message function. This is due to an incomplete extension blacklist that fails to detect dangerous extensions when a trailing dot causes the extension-derivation routine to return an empty string, which sanitize_file_name() then silently removes before the file is written to disk. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. Successful code execution additionally requires the server to use Apache with libapache2-mod-php (which maps .phar to PHP by default) and the attacker to retrieve the uploaded file within the brief window before it is removed by unlink() at end of request.
Product
Contact Manager
Affected
up to 9.1.2
What to do
Affects up to 9.1.2. Update Contact Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record fr.wordpress.org plugins.trac.wordpress.org
Oct 28, 2026GoSMTP: Does not perform a settings-management authorization check on its SMTP configuration pageCVE-2026-111577 · WordPress plugins & themes · reported by WPScanHigh 7.2
The GoSMTP WordPress plugin before 1.2.5 does not perform a settings-management authorization check on its SMTP configuration page, which is gated only on the GoSMTP WordPress plugin before 1.2.5-activation capability, allowing users with a delegated role below administrator to change outbound mail delivery and achieve administrator account takeover.
Product
GoSMTP
Fixed in
1.2.5
What to do
Update GoSMTP to 1.2.5 or newer.
Full record and what to do →NVD record wpscan.com
Oct 28, 2026Court Reservation: Does not perform any authorisation or nonce verification on one of its challenge-management actionsCVE-2026-106002 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Court Reservation WordPress plugin before 1.12.4 does not perform any authorisation or nonce verification on one of its challenge-management actions, allowing unauthenticated users to delete arbitrary tournament-ladder challenge records, along with the linked court-booking event when one was scheduled.
Product
Court Reservation
Fixed in
1.12.4
What to do
Update Court Reservation to 1.12.4 or newer.
Full record and what to do →NVD record wpscan.com
Oct 26, 2026Typing Text – Give your texts many typing effects: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-115966 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Typing Text – Give your texts many typing effects text-typing allows Stored XSS.This issue affects Typing Text – Give your texts many typing effects: from n/a through 2.2.0.
Product
Typing Text – Give your texts many typing effects
Affected
up to 2.2.0
What to do
Affects up to 2.2.0. Update Typing Text – Give your texts many typing effects to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 26, 2026Media LIbrary Assistant: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-115948 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in David Lingren Media LIbrary Assistant media-library-assistant allows Blind SQL Injection.This issue affects Media LIbrary Assistant: from n/a through 3.42.
Product
Media LIbrary Assistant
Affected
up to 3.42
What to do
Affects up to 3.42. Update Media LIbrary Assistant to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 26, 2026JetEngine: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-115608 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Crocoblock JetEngine jet-engine allows SQL Injection.This issue affects JetEngine: from n/a through 3.9.0.
Product
JetEngine
Affected
up to 3.9.0
What to do
Affects up to 3.9.0. Update JetEngine to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 26, 2026Booking and Rental Manager: Missing AuthorizationCVE-2026-115614 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Magepeople inc. Booking and Rental Manager booking-and-rental-manager-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booking and Rental Manager: from n/a through 2.8.2.
Product
Booking and Rental Manager
Affected
up to 2.8.2
What to do
Affects up to 2.8.2. Update Booking and Rental Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 24, 2026VOD Infomaniak: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-114695 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Infomaniak Network VOD Infomaniak vod-infomaniak allows Stored XSS.This issue affects VOD Infomaniak: from n/a through 1.5.14.
Product
VOD Infomaniak
Affected
up to 1.5.14
What to do
Affects up to 1.5.14. Update VOD Infomaniak to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 24, 2026Events Manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-114694 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pixelite Events Manager events-manager allows Reflected XSS.This issue affects Events Manager: from n/a through 7.4.8.
Product
Events Manager
Affected
up to 7.4.8
What to do
Affects up to 7.4.8. Update Events Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 24, 2026Product Filter by WBW: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-112866 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPFactory Product Filter by WBW woo-product-filter allows Blind SQL Injection.This issue affects Product Filter by WBW: from n/a through 3.4.6.
Product
Product Filter by WBW
Affected
up to 3.4.6
What to do
Affects up to 3.4.6. Update Product Filter by WBW to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 24, 2026Newsletters: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-111402 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tribulant Software Newsletters newsletters-lite allows SQL Injection.This issue affects Newsletters: from n/a through 4.18.1.
Product
Newsletters
Affected
up to 4.18.1
What to do
Affects up to 4.18.1. Update Newsletters to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 24, 2026Pixel Tag Manager for WooCommerce: Does not perform a capability check in one of its AJAX actionsCVE-2026-105199 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Pixel Tag Manager for WooCommerce WordPress plugin before 2.2.3 does not perform a capability check in one of its AJAX actions, and exposes the nonce protecting it to any user able to access the admin dashboard, allowing users with a role as low as Contributor to overwrite the Pixel Tag Manager for WooCommerce WordPress plugin before 2.2.3's tracking configuration and have arbitrary JavaScript executed in the browsers of all visitors, including administrators.
Product
Pixel Tag Manager for WooCommerce
Fixed in
2.2.3
What to do
Update Pixel Tag Manager for WooCommerce to 2.2.3 or newer.
Full record and what to do →NVD record wpscan.com
Oct 23, 2026Participants Database: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-112860 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in xnau webdesign Participants Database participants-database allows Blind SQL Injection.This issue affects Participants Database: from n/a through 2.7.8.5.
Product
Participants Database
Affected
up to 2.7.8.5
What to do
Affects up to 2.7.8.5. Update Participants Database to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 23, 2026GamiPress: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-112837 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ruben Garcia GamiPress gamipress allows Blind SQL Injection.This issue affects GamiPress: from n/a through 8.0.7.
Product
GamiPress
Affected
up to 8.0.7
What to do
Affects up to 8.0.7. Update GamiPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 23, 2026Car Rental Manager: Missing AuthorizationCVE-2026-112825 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Magepeople inc. Car Rental Manager car-rental-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Car Rental Manager: from n/a through 1.5.3.
Product
Car Rental Manager
Affected
up to 1.5.3
What to do
Affects up to 1.5.3. Update Car Rental Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 23, 2026Download Monitor: Does not correctly restrict management of the list of filesystem locations it may serve files from to network administrators on multisiteCVE-2026-112219 · WordPress plugins & themes · reported by WPScanMedium 4.9
The Download Monitor WordPress plugin before 5.3.5 does not correctly restrict management of the list of filesystem locations it may serve files from to network administrators on multisite, allowing a subsite administrator who is not trusted at the network level to approve arbitrary locations and have the Download Monitor WordPress plugin before 5.3.5 serve readable files from outside the uploads directory, including files belonging to other subsites, to unauthenticated visitors; single-site installations are unaffected.
Product
Download Monitor
Fixed in
5.3.5
What to do
Update Download Monitor to 5.3.5 or newer.
Full record and what to do →NVD record wpscan.com
Oct 23, 2026Essential Addons for Elementor: Does not verify that an administrator may manage the specific user accounts targeted by its login-approval featureCVE-2026-110537 · WordPress plugins & themes · reported by WPScanLow 3.8
The Essential Addons for Elementor WordPress plugin before 6.8.7 does not verify that an administrator may manage the specific user accounts targeted by its login-approval feature, checking only a site-level capability, which on WordPress Multisite could allow a subsite administrator to change the approval and login state of accounts belonging to other sites on the network.
Product
Essential Addons for Elementor
Fixed in
6.8.7
What to do
Update Essential Addons for Elementor to 6.8.7 or newer.
Full record and what to do →NVD record wpscan.com
Oct 22, 2026Workreap Core: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-112822 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AmentoTech Workreap Core workreap_core allows Blind SQL Injection.This issue affects Workreap Core: from n/a before 3.4.4.
Product
Workreap Core
Fixed in
3.4.4
What to do
Update Workreap Core to 3.4.4 or newer.
Full record and what to do →NVD record patchstack.com
Oct 22, 2026Amelia: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-112327 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TMS Amelia ameliabooking allows SQL Injection.This issue affects Amelia: from n/a through 2.4.11.
Product
Amelia
Affected
up to 2.4.11
What to do
Affects up to 2.4.11. Update Amelia to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 21, 2026Ajax Search Lite: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-111852 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPdreams Ajax Search Lite ajax-search-lite allows Blind SQL Injection.This issue affects Ajax Search Lite: from n/a through 4.14.6.
Product
Ajax Search Lite
Affected
up to 4.14.6
What to do
Affects up to 4.14.6. Update Ajax Search Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 21, 2026Mang Board WP: Unrestricted Upload of File with Dangerous TypeCVE-2026-111834 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in Kitae Park Mang Board WP mangboard allows Upload a Web Shell to a Web Server.This issue affects Mang Board WP: from n/a through 2.4.4.
Product
Mang Board WP
Affected
up to 2.4.4
What to do
Affects up to 2.4.4. Update Mang Board WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 21, 2026CMP – Coming Soon & Maintenance: Does not correctly apply maintenance mode to pages added to its page whitelist by manually entered URL patternCVE-2026-101138 · WordPress plugins & themes · reported by WPScanMedium 5.3
The CMP – Coming Soon & Maintenance WordPress plugin before 4.1.21 does not correctly apply maintenance mode to pages added to its page whitelist by manually entered URL pattern, allowing unauthenticated visitors to view the content of those pages while maintenance mode is active.
Product
CMP – Coming Soon & Maintenance
Fixed in
4.1.21
What to do
Update CMP – Coming Soon & Maintenance to 4.1.21 or newer.
Full record and what to do →NVD record wpscan.com
Oct 21, 2026Download Manager WordPress plugin before 3.3.71, Download Manager: Does not have CSRF checks in some placesCVE-2026-86611 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Download Manager WordPress plugin before 3.3.71, Download Manager WordPress plugin before 7.5.9 does not have CSRF checks in some places, allowing attackers to make a logged in admin update its privacy and storage settings via a crafted link, including the credential that gates its unauthenticated maintenance endpoint.
Product
Download Manager WordPress plugin before 3.3.71, Download Manager
Fixed in
3.3.71
What to do
Update Download Manager WordPress plugin before 3.3.71, Download Manager to 3.3.71 or newer.
Full record and what to do →NVD record wpscan.com
Oct 21, 2026Advanced File Manager: Does not correctly determine whether a stored file is an SVG before sanitising itCVE-2026-79627 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Advanced File Manager WordPress plugin before 6.0.0 does not correctly determine whether a stored file is an SVG before sanitising it, allowing users granted file-manager access by an administrator to store a file containing script that is not stripped and that runs in the browser of anyone who opens it, including an administrator.
Product
Advanced File Manager
Fixed in
6.0.0
What to do
Update Advanced File Manager to 6.0.0 or newer.
Full record and what to do →NVD record wpscan.com
Oct 21, 2026Swift Performance Lite: Does not properly sanitize and escape a value before using it in a SQL statementCVE-2026-110651 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Swift Performance Lite WordPress plugin before 2.3.7.4 does not properly sanitize and escape a value before using it in a SQL statement, which could allow users with the author role and above to perform SQL injection attacks.
Product
Swift Performance Lite
Fixed in
2.3.7.4
What to do
Update Swift Performance Lite to 2.3.7.4 or newer.
Full record and what to do →NVD record wpscan.com
Oct 21, 2026WP User Manager: Does not keep its paid-registration capability restrictions in force once the payment gateway is disconnectedCVE-2026-110523 · WordPress plugins & themes · reported by WPScanHigh 8.1
The WP User Manager WordPress plugin before 2.9.26 does not keep its paid-registration capability restrictions in force once the payment gateway is disconnected, while a published paid registration form continues to assign its configured role, allowing unauthenticated users to register and immediately obtain a privileged administrator-equivalent role without completing the payment meant to gate it.
Product
WP User Manager
Fixed in
2.9.26
What to do
Update WP User Manager to 2.9.26 or newer.
Full record and what to do →NVD record wpscan.com
Oct 21, 2026Simple Banner: Does not correctly limit the capabilities it grants to the user roles an administrator allows to manage its bannersCVE-2026-107506 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Simple Banner WordPress plugin before 3.3.3 does not correctly limit the capabilities it grants to the user roles an administrator allows to manage its banners, granting such roles the full administrator capability, which allows users in a low-privileged role to escalate their privileges and fully compromise the site.
Product
Simple Banner
Fixed in
3.3.3
What to do
Update Simple Banner to 3.3.3 or newer.
Full record and what to do →NVD record wpscan.com
Oct 21, 2026Uncanny Toolkit for LearnDash: Does not verify that the acting user is permitted to manage the targeted accounts before changing their verification stateCVE-2026-107128 · WordPress plugins & themes · reported by WPScanMedium 5
The Uncanny Toolkit for LearnDash WordPress plugin before 3.8.2 does not verify that the acting user is permitted to manage the targeted accounts before changing their verification state, allowing a subsite administrator on a multisite network to mark arbitrary network users outside their own site as unverified and prevent those users from logging in.
Product
Uncanny Toolkit for LearnDash
Fixed in
3.8.2
What to do
Update Uncanny Toolkit for LearnDash to 3.8.2 or newer.
Full record and what to do →NVD record wpscan.com
Oct 20, 2026WP User Manager: Missing AuthorizationCVE-2026-112823 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WP User Manager WP User Manager wp-user-manager allows Manipulating User State.This issue affects WP User Manager: from n/a through 2.9.25.
Product
WP User Manager
Affected
up to 2.9.25
What to do
Affects up to 2.9.25. Update WP User Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 20, 2026Easy Property Listings: Does not perform authorisation checks on several of its contact-management read AJAX actionsCVE-2026-96903 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Easy Property Listings WordPress plugin before 3.5.27 does not perform authorisation checks on several of its contact-management read AJAX actions, allowing any authenticated user with a role as low as subscriber to read other users' CRM contact and lead records, including their private activity notes.
Product
Easy Property Listings
Fixed in
3.5.27
What to do
Update Easy Property Listings to 3.5.27 or newer.
Full record and what to do →NVD record wpscan.com
Oct 18, 2026Support Genix: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-110895 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in DevItems Support Genix support-genix-lite allows SQL Injection.This issue affects Support Genix: from n/a through 1.4.54.
Product
Support Genix
Affected
up to 1.4.54
What to do
Affects up to 1.4.54. Update Support Genix to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 18, 2026Advanced File Manager: Missing AuthorizationCVE-2026-110365 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in WPExperts Advanced File Manager file-manager-advanced allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Advanced File Manager: from n/a through 5.4.14.
Product
Advanced File Manager
Affected
up to 5.4.14
What to do
Affects up to 5.4.14. Update Advanced File Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 18, 2026Booktics: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-109894 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Arraytics Booktics booktics allows SQL Injection.This issue affects Booktics: from n/a through 1.0.29.
Product
Booktics
Affected
up to 1.0.29
What to do
Affects up to 1.0.29. Update Booktics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 18, 2026AI Engine: Does not verify that the user performing certain AI media management actions owns or is otherwise allowed to edit the targeted objectCVE-2026-111041 · WordPress plugins & themes · reported by WPScanMedium 4.9
The AI Engine WordPress plugin before 3.7.9 does not verify that the user performing certain AI media management actions owns or is otherwise allowed to edit the targeted object, allowing users with the Editor role or above to modify, or change the type of, arbitrary posts on the site, including content they are not permitted to edit.
Product
AI Engine
Fixed in
3.7.9
What to do
Update AI Engine to 3.7.9 or newer.
Full record and what to do →NVD record wpscan.com
Oct 18, 2026AI Engine: Does not check that the item passed to one of its media actions belongs to the requesting user before converting it to an attachment and permanently deleting itCVE-2026-110976 · WordPress plugins & themes · reported by WPScanMedium 4.9
The AI Engine WordPress plugin before 3.7.9 does not check that the item passed to one of its media actions belongs to the requesting user before converting it to an attachment and permanently deleting it, allowing users with the Editor role and above to delete arbitrary posts of any type, including content they cannot otherwise delete such as navigation menus, block templates and global styles.
Product
AI Engine
Fixed in
3.7.9
What to do
Update AI Engine to 3.7.9 or newer.
Full record and what to do →NVD record wpscan.com
Oct 17, 2026BSK PDF Manager: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2026-91074 · WordPress plugins & themes · reported by WPScanMedium 6.8
The BSK PDF Manager WordPress plugin through 3.8.1 does not properly sanitise and escape a parameter before using it in a SQL statement, which could allow authenticated users with contributor-level access and above to perform SQL injection attacks and read sensitive data such as administrator password hashes from the database.
Product
BSK PDF Manager
Affected
up to 3.8.1
What to do
Affects up to 3.8.1. Update BSK PDF Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Oct 17, 2026WP User Manager: Does not roll back the WordPress account it creates during payment-gated registrationCVE-2026-110527 · WordPress plugins & themes · reported by WPScanMedium 5.3
The WP User Manager WordPress plugin before 2.9.20 does not roll back the WordPress account it creates during payment-gated registration when the subsequent payment step fails, allowing unauthenticated users to create functional accounts without completing payment.
Product
WP User Manager
Fixed in
2.9.20
What to do
Update WP User Manager to 2.9.20 or newer.
Full record and what to do →NVD record wpscan.com
Oct 17, 2026xSpeed Cache: AI-Powered Performance Hub with MCP, Caching & CDN: Stored Cross-Site ScriptingCVE-2026-109985 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The xSpeed Cache: AI-Powered Performance Hub with MCP, Caching & CDN plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content' parameter in all versions up to, and including, 1.4.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
xSpeed Cache: AI-Powered Performance Hub with MCP, Caching & CDN
Affected
up to 1.4.2
What to do
Affects up to 1.4.2. Update xSpeed Cache: AI-Powered Performance Hub with MCP, Caching & CDN to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.