Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
60 results · page 1 of 2
Oct 29, 2026Contact Form by Supsystic: Does not validate a CSRF token or request origin on two administrator-only actions that bulk-delete captured form submissions and wipe a form's statisticsCVE-2026-115300 · WordPress plugins & themes · reported by WPScan
The Contact Form by Supsystic WordPress plugin before 1.11.1 does not validate a CSRF token or request origin on two administrator-only actions that bulk-delete captured form submissions and wipe a form's statistics, allowing attackers to permanently destroy a site's stored contact leads and analytics by tricking a logged-in administrator into sending a forged request.
- Product
- Contact Form by Supsystic
- Fixed in
- 1.11.1
- What to do
- Update Contact Form by Supsystic to 1.11.1 or newer.
Oct 29, 2026WP Photo Album Plus: Does not verify the origin or a security token for one of its comment-management requestsCVE-2026-110983 · WordPress plugins & themes · reported by WPScan
The WP Photo Album Plus WordPress plugin before 9.3.04.004 does not verify the origin or a security token for one of its comment-management requests, allowing attackers to delete photo comments by tricking a logged-in user who holds comment-moderation rights into loading a crafted page.
- Product
- WP Photo Album Plus
- Fixed in
- 9.3.04.004
- What to do
- Update WP Photo Album Plus to 9.3.04.004 or newer.
Oct 28, 2026Page Builder by SiteOrigin: Does not restrict the query arguments users can add to its Post Loop widget or limit the loop to posts they are allowed to readCVE-2026-110507 · WordPress plugins & themes · reported by WPScanLow 2.7
The Page Builder by SiteOrigin WordPress plugin before 2.38.0 does not restrict the query arguments users can add to its Post Loop widget or limit the loop to posts they are allowed to read, which could allow users with the contributor role and above to read the content of other users' draft, pending, scheduled and private posts and pages.
- Product
- Page Builder by SiteOrigin
- Fixed in
- 2.38.0
- What to do
- Update Page Builder by SiteOrigin to 2.38.0 or newer.
Oct 28, 2026Page Builder by SiteOrigin: Does not sanitize or escape a widget property before storing it and outputting it in the page builder interfaceCVE-2026-110506 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Page Builder by SiteOrigin WordPress plugin before 2.38.0 does not sanitize or escape a widget property before storing it and outputting it in the page builder interface, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks against higher-privileged users who open the affected post in the editor.
- Product
- Page Builder by SiteOrigin
- Fixed in
- 2.38.0
- What to do
- Update Page Builder by SiteOrigin to 2.38.0 or newer.
Oct 26, 2026OPay Payment Gateway for WooCommerce: Does not properly verify that payment notifications originate from the payment providerCVE-2026-103319 · WordPress plugins & themes · reported by WPScanMedium 5.3
The OPay Payment Gateway for WooCommerce WordPress plugin through 2.5.5 does not properly verify that payment notifications originate from the payment provider, as the secret used to validate their signature is empty by default, allowing unauthenticated attackers to forge a valid notification and mark arbitrary orders as paid, cancelled or failed.
- Product
- OPay Payment Gateway for WooCommerce
- Affected
- up to 2.5.5
- What to do
- Affects up to 2.5.5. Update OPay Payment Gateway for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 26, 2026Eurobank WooCommerce Payment Gateway: Does not verify that a payment-confirmation request genuinely originates from the payment providerCVE-2026-103300 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Eurobank WooCommerce Payment Gateway WordPress plugin through 2.1.1 does not verify that a payment-confirmation request genuinely originates from the payment provider, and ships with the secret that would authenticate it empty by default, allowing unauthenticated attackers to mark any pending order as paid, and to force any order into a failed status without any secret at all.
- Product
- Eurobank WooCommerce Payment Gateway
- Affected
- up to 2.1.1
- What to do
- Affects up to 2.1.1. Update Eurobank WooCommerce Payment Gateway to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 26, 2026CCAvenue Payment Gateway for WooCommerce: Does not verify that a payment-confirmation request genuinely originates from the payment providerCVE-2026-103298 · WordPress plugins & themes · reported by WPScanMedium 5.3
The CCAvenue Payment Gateway for WooCommerce WordPress plugin through 3.1 does not verify that a payment-confirmation request genuinely originates from the payment provider, and derives its verification key from a value that is empty on a default install, allowing unauthenticated attackers to forge a confirmation and mark any WooCommerce order as paid without payment.
- Product
- CCAvenue Payment Gateway for WooCommerce
- Affected
- up to 3.1
- What to do
- Affects up to 3.1. Update CCAvenue Payment Gateway for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 25, 2026Chikkili- Google Pay India for Woocommerce: Does not verify that a payment notification actually originated from the payment provider before marking the associated orderCVE-2026-94295 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Chikkili- Google Pay India for Woocommerce WordPress plugin through 1.0.6 does not verify that a payment notification actually originated from the payment provider before marking the associated order as paid, allowing unauthenticated attackers to mark arbitrary orders as paid without any payment being made.
- Product
- Chikkili- Google Pay India for Woocommerce
- Affected
- up to 1.0.6
- What to do
- Affects up to 1.0.6. Update Chikkili- Google Pay India for Woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 25, 2026Datawiza Proxy Auth: Does not verify that the user-identity and role HTTP request headers it trusts originate from a trusted reverse proxyCVE-2026-115214 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Datawiza Proxy Auth Plugin WordPress plugin before 1.1.1 does not verify that the user-identity and role HTTP request headers it trusts originate from a trusted reverse proxy, allowing unauthenticated attackers to create and authenticate as a WordPress administrator.
- Product
- Datawiza Proxy Auth
- Fixed in
- 1.1.1
- What to do
- Update Datawiza Proxy Auth to 1.1.1 or newer.
Oct 21, 2026Uncanny Toolkit for LearnDash: Does not validate the origin of a password-reset requestCVE-2026-107127 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Uncanny Toolkit for LearnDash WordPress plugin before 3.8.2 does not validate the origin of a password-reset request, allowing an unauthenticated attacker to set the password of a user who is partway through a password reset to an attacker-chosen value through a forged request, resulting in full account takeover.
- Product
- Uncanny Toolkit for LearnDash
- Fixed in
- 3.8.2
- What to do
- Update Uncanny Toolkit for LearnDash to 3.8.2 or newer.
Oct 16, 2026SiteOrigin CSS: Stored DOM-Based Cross-Site ScriptingCVE-2026-111122 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The SiteOrigin CSS plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'href' parameter in all versions up to, and including, 1.6.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires the malicious comment to be approved and an administrator to subsequently open the Visual Inspector and click the attacker's anchor link, both of which are plausible interactions during routine comment triage.
- Product
- SiteOrigin CSS
- Affected
- up to 1.6.7
- What to do
- Affects up to 1.6.7. Update SiteOrigin CSS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.complugins.trac.wordpress.org
Oct 16, 2026SiteOrigin CSS: Stored DOM-Based Cross-Site ScriptingCVE-2026-107764 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The SiteOrigin CSS plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'url (comment_author_url)' parameter in all versions up to, and including, 1.6.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is possible because WordPress core's esc_url() preserves HTML entity-encoded characters, allowing a crafted entity-encoded payload in the comment 'Website' field to survive storage and be DOM-decoded by the browser into executable markup at the sink.
- Product
- SiteOrigin CSS
- Affected
- up to 1.6.7
- What to do
- Affects up to 1.6.7. Update SiteOrigin CSS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.complugins.trac.wordpress.org
Oct 10, 2026Unauthenticated PHP Object Injection in Original <= 1.9.0 versions.CVE-2026-66568 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in Original <= 1.9.0 versions.
- Affected
- up to 1.9.0
- What to do
- Affects up to 1.9.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026SiteOrigin Widgets Bundle: Directory TraversalCVE-2026-97348 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.74.3 via the get_instance_css function. This makes it possible for authenticated attackers, with contributor-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. The widget's normal update()/sanitize_field_input() pipeline — which would reject non-hex color values — is bypassed entirely because the [siteorigin_widget] shortcode handler calls $the_widget->widget() directly on the attacker-supplied decoded JSON instance.
- Product
- SiteOrigin Widgets Bundle
- Affected
- up to 1.74.3
- What to do
- Affects up to 1.74.3. Update SiteOrigin Widgets Bundle to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.complugins.trac.wordpress.org
Oct 8, 2026BackWPup: Does not verify that a request to its cron-triggered backup execution handler actually originates from WordPress's internal scheduled-event dispatchCVE-2026-86827 · WordPress plugins & themes · reported by WPScanMedium 5.3
The BackWPup WordPress plugin before 5.7.7 does not verify that a request to its cron-triggered backup execution handler actually originates from WordPress's internal scheduled-event dispatch, allowing unauthenticated attackers to force any existing backup job to run immediately, independent of its configured trigger type or schedule.
- Product
- BackWPup
- Fixed in
- 5.7.7
- What to do
- Update BackWPup to 5.7.7 or newer.
Oct 2, 2026SiteOrigin Widgets Bundle: Local File InclusionCVE-2026-92174 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.73.2 via the 'theme' parameter parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. Exploitation requires sending a malicious widgetData payload containing a legacy top-level theme key alongside a non-empty columns array to the /wp-json/sowb/v1/widgets/previews REST endpoint, which bypasses field validation because update_fields() only processes declared form fields.
- Product
- SiteOrigin Widgets Bundle
- Affected
- up to 1.73.2
- What to do
- Affects up to 1.73.2. Update SiteOrigin Widgets Bundle to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 2, 2026Paytm Payment Gateway: Does not verify that payment callbacks genuinely originate from the payment providerCVE-2026-81740 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Paytm Payment Gateway WordPress plugin before 2.8.9 does not verify that payment callbacks genuinely originate from the payment provider when its secret key has not been configured, which is its state immediately after activation, allowing unauthenticated attackers to change the status of arbitrary orders, including marking unpaid orders as paid and reducing stock.
- Product
- Paytm Payment Gateway
- Fixed in
- 2.8.9
- What to do
- Update Paytm Payment Gateway to 2.8.9 or newer.
Sep 30, 2026Editor PHP Object Injection in Page Builder by SiteOrigin <= 2.36.0 versions.CVE-2026-97256 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Editor PHP Object Injection in Page Builder by SiteOrigin <= 2.36.0 versions.
- Affected
- up to 2.36.0
- What to do
- Affects up to 2.36.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 26, 2026File Manager WordPress plugin before 8.0.5, FileOrganizer WordPress plugin before 1.2.1, File Manager Pro: Do not correctly validate the origin of window messages received by the file browser they load on their admin scrCVE-2026-85081 · WordPress plugins & themes · reported by WPScanHigh 7.5
The File Manager WordPress plugin before 8.0.5, FileOrganizer WordPress plugin before 1.2.1, File Manager Pro WordPress plugin before 2.1.3 do not correctly validate the origin of window messages received by the file browser they load on their admin screens, accepting any origin that is a leading string prefix of the site's own address, which allows an unauthenticated attacker to run arbitrary JavaScript in the session of a logged-in administrator who visits a page under their control. The defect is in the file-manager library all three bundle, and every version below 2.1.70 carries it. Updating the bundled library closes it.
- Product
- File Manager WordPress plugin before 8.0.5, FileOrganizer WordPress plugin before 1.2.1, File Manager Pro
- Fixed in
- 8.0.5
- What to do
- Update File Manager WordPress plugin before 8.0.5, FileOrganizer WordPress plugin before 1.2.1, File Manager Pro to 8.0.5 or newer.
Sep 24, 2026YOP Poll: Origin Validation ErrorCVE-2026-85682 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The YOP Poll plugin for WordPress is vulnerable to Origin Validation Error in all versions up to, and including, 7.0.10. This is due to the plugin transmitting a wp_rest nonce to window.opener via postMessage() with a wildcard targetOrigin. This makes it possible for unauthenticated attackers to steal a REST nonce scoped to a logged-in Administrator and use it to change the Administrator's email address and password, resulting in full account takeover. The Administrator must open an attacker-controlled page in order to exploit this vulnerability.
- Product
- YOP Poll
- Affected
- up to 7.0.10
- What to do
- Affects up to 7.0.10. Update YOP Poll to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Sep 5, 2026IPGP Visitors Origin: Does not sanitise or escape user input before reflecting it back in the HTTP responseCVE-2026-81404 · WordPress plugins & themes · reported by WPScanHigh 7.1
The IPGP Visitors Origin WordPress plugin before 1.6 does not sanitise or escape user input before reflecting it back in the HTTP response, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting attacks against users who are tricked into submitting a crafted request.
- Product
- IPGP Visitors Origin
- Fixed in
- 1.6
- What to do
- Update IPGP Visitors Origin to 1.6 or newer.
Sep 4, 2026Restaurant Menu and Food Ordering: Does not verify that a PayPal payment notification genuinely originates from PayPalCVE-2026-84044 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Restaurant Menu and Food Ordering WordPress plugin before 2.4.12 does not verify that a PayPal payment notification genuinely originates from PayPal, allowing unauthenticated attackers to forge a payment notification and mark their own order as paid and completed without making any payment.
- Product
- Restaurant Menu and Food Ordering
- Fixed in
- 2.4.12
- What to do
- Update Restaurant Menu and Food Ordering to 2.4.12 or newer.
Sep 2, 2026Yoast SEO Premium: Does not sanitize control characters from redirect origins before writing them to the site's Apache configuration fileCVE-2026-10821 · WordPress plugins & themes · reported by WPScanMedium 6.6
The Yoast SEO Premium WordPress plugin before 27.6.1 does not sanitize control characters from redirect origins before writing them to the site's Apache configuration file when the file-based redirect mode is enabled, and the redirect-creation endpoint is reachable by users with only Author-level access. This allows such users to inject arbitrary newline-delimited Apache directives into the root .htaccess file. On Apache servers that honour PHP directives, the injection can be chained with the user's own media upload (a polyglot image carrying a PHP payload) and an auto_prepend_file directive to achieve Remote Code Execution.
- Product
- Yoast SEO Premium
- Fixed in
- 27.6.1
- What to do
- Update Yoast SEO Premium to 27.6.1 or newer.
Aug 14, 2026Epeken All Kurir for Woocommerce: Does not verify that a payment-confirmation request originates from the owner of the targeted orderCVE-2026-16739 · WordPress plugins & themes · reported by WPScanMedium 5.9
The Epeken All Kurir for Woocommerce WordPress plugin through 2.1.4 does not verify that a payment-confirmation request originates from the owner of the targeted order, nor that any payment actually occurred, allowing unauthenticated attackers to mark arbitrary orders as confirmed and, in a non-default configuration, paid.
- Product
- Epeken All Kurir for Woocommerce
- Affected
- up to 2.1.4
- What to do
- Affects up to 2.1.4. Update Epeken All Kurir for Woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 7, 2026WP Events Manager: Does not verify that an incoming payment notification originates from the site's configured merchant accountCVE-2026-15148 · WordPress plugins & themes · reported by WPScanMedium 5.3
The WP Events Manager WordPress plugin before 2.2.5 does not verify that an incoming payment notification originates from the site's configured merchant account, nor that the paid amount matches the booking total, allowing unauthenticated users to mark any booking as paid without a legitimate payment reaching the merchant, including other users' bookings.
- Product
- WP Events Manager
- Fixed in
- 2.2.5
- What to do
- Update WP Events Manager to 2.2.5 or newer.
Aug 5, 2026GDPR Cookie Compliance: Expires the visitor's cookies from an action that is reachable without authentication and performs no request-origin checkCVE-2026-16613 · WordPress plugins & themes · reported by WPScanMedium 4.3
The GDPR Cookie Compliance WordPress plugin before 5.1.0 expires the visitor's cookies from an action that is reachable without authentication and performs no request-origin check, allowing an attacker to log any user out and delete the site's cookies by luring them to a crafted link.
- Product
- GDPR Cookie Compliance
- Fixed in
- 5.1.0
- What to do
- Update GDPR Cookie Compliance to 5.1.0 or newer.
Aug 1, 2026YOP Poll: Does not validate the connection's origin IP address and instead trusts client-controlled forwarding headersCVE-2026-14840 · WordPress plugins & themes · reported by WPScanMedium 5.3
The YOP Poll WordPress plugin before 7.0.6 does not validate the connection's origin IP address and instead trusts client-controlled forwarding headers when enforcing its per-IP vote restriction, allowing unauthenticated attackers to bypass the vote limit and cast unlimited votes on a public poll.
- Product
- YOP Poll
- Fixed in
- 7.0.6
- What to do
- Update YOP Poll to 7.0.6 or newer.
Jun 27, 2026Page Builder by SiteOrigin: Stored Cross-Site ScriptingCVE-2026-13295 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Page Builder by SiteOrigin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via panels_data Parameter in all versions up to, and including, 2.34.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is possible because the nonce and edit_post capability checks enforced during save are both satisfied by Contributor-level users for their own posts, and the panels_data value is stored as post meta — outside the scope of WordPress's unfiltered_html carve-out — meaning no wp_kses fallback prevents the unsanitized WP_Widget_Custom_HTML content from being persisted and later rendered verbatim on the frontend.
- Product
- Page Builder by SiteOrigin
- Affected
- up to 2.34.3
- What to do
- Affects up to 2.34.3. Update Page Builder by SiteOrigin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 25, 2026InPost PL: Does not verify that the request originates from the legitimate buyer before allowing the WooCommerce order parcel-locker destination to be updatedCVE-2026-9702 · WordPress plugins & themes · reported by WPScanHigh 7.5
The InPost PL WordPress plugin before 1.9.1 does not verify that the request originates from the legitimate buyer before allowing the WooCommerce order parcel-locker destination to be updated, allowing unauthenticated attackers to silently redirect the shipping destination of any pending or processing order on the site.
- Product
- InPost PL
- Fixed in
- 1.9.1
- What to do
- Update InPost PL to 1.9.1 or newer.
May 27, 2026Livemesh SiteOrigin Widgets: Stored Cross-Site ScriptingCVE-2026-3896 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Livemesh SiteOrigin Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `lsow_admin_ajax` AJAX action in all versions up to, and including, 3.9.2 due to missing authorization checks and insufficient input sanitization. The AJAX handler verifies a nonce but does not check user capabilities. This makes it possible for authenticated attackers with Subscriber-level access and above to modify plugin settings and inject malicious scripts that execute when administrators access the plugin settings page or when any user visits the frontend.
- Product
- Livemesh SiteOrigin Widgets
- Affected
- up to 3.9.2
- What to do
- Affects up to 3.9.2. Update Livemesh SiteOrigin Widgets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 2, 2026Page Builder by SiteOrigin: Local File InclusionCVE-2026-2448 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Page Builder by SiteOrigin plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.33.5 via the locate_template() function. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
- Product
- Page Builder by SiteOrigin
- Affected
- up to 2.33.5
- What to do
- Affects up to 2.33.5. Update Page Builder by SiteOrigin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Feb 18, 2026SiteOrigin Widgets Bundle: Unauthorized arbitrary shortcode executionCVE-2026-2127 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to unauthorized arbitrary shortcode execution in all versions up to, and including, 1.70.4. This is due to a missing capability check on the `siteorigin_widget_preview_widget_action()` function which is registered via the `wp_ajax_so_widgets_preview` AJAX action. The function only verifies a nonce (`widgets_action`) but does not check user capabilities. This makes it possible for authenticated attackers, with Subscriber-level access and above, to execute arbitrary shortcodes by invoking the `SiteOrigin_Widget_Editor_Widget` via the preview endpoint. The required nonce is exposed on the public frontend when the Post Carousel widget is present on a page, embedded in the `data-ajax-url` HTML attribute.
- Product
- SiteOrigin Widgets Bundle
- Affected
- up to 1.70.4
- What to do
- Affects up to 1.70.4. Update SiteOrigin Widgets Bundle to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 13, 2025Livemesh SiteOrigin Widgets: Stored Cross-Site ScriptingCVE-2025-8780 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Livemesh SiteOrigin Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Hero Header and Pricing Table widgets in all versions up to, and including, 3.9.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Livemesh SiteOrigin Widgets
- Affected
- up to 3.9.1
- What to do
- Affects up to 3.9.1. Update Livemesh SiteOrigin Widgets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 24, 2025Originality.ai AI Checker: Unauthorized loss of dataCVE-2025-10902 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Originality.ai AI Checker plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'ai_scan_result_remove' function in all versions up to, and including, 1.0.15. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete all data in the wp_originalityai_log database table, which can include post titles, scan scores, credits used, and other data.
- Product
- Originality.ai AI Checker
- Affected
- up to 1.0.15
- What to do
- Affects up to 1.0.15. Update Originality.ai AI Checker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 24, 2025Originality.ai AI Checker: Unauthorized access of dataCVE-2025-10901 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Originality.ai AI Checker plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'ai_get_table' function in all versions up to, and including, 1.0.16. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read all data in the wp_originalityai_log database table, which can include post titles, scan scores, credits used, and other data.
- Product
- Originality.ai AI Checker
- Affected
- up to 1.0.16
- What to do
- Affects up to 1.0.16. Update Originality.ai AI Checker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jun 24, 2025SiteOrigin Widgets Bundle: Stored Cross-Site ScriptingCVE-2025-5585 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `data-url` DOM Element Attribute in all versions up to, and including, 1.68.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- SiteOrigin Widgets Bundle
- Affected
- up to 1.68.4
- What to do
- Affects up to 1.68.4. Update SiteOrigin Widgets Bundle to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.svn.wordpress.orgwordfence.com
Mar 11, 2025Delete Original Image: Cross-Site Request Forgery (CSRF)CVE-2025-28863 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Carlos Minatti Delete Original Image delete-original-image allows Cross Site Request Forgery.This issue affects Delete Original Image: from n/a through <= 0.4.
- Product
- Delete Original Image
- Affected
- up to 0.4
- What to do
- Affects up to 0.4. Update Delete Original Image to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 1, 2025Page Builder by SiteOrigin: Stored Cross-Site ScriptingCVE-2025-1459 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Page Builder by SiteOrigin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Embedded Video(PB) widget in all versions up to, and including, 2.31.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Page Builder by SiteOrigin
- Affected
- up to 2.31.4
- What to do
- Affects up to 2.31.4. Update Page Builder by SiteOrigin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jan 14, 2025Page Builder by SiteOrigin: Stored Cross-Site ScriptingCVE-2024-12240 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Page Builder by SiteOrigin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the row label parameter in all versions up to, and including, 2.31.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Page Builder by SiteOrigin
- Affected
- up to 2.31.0
- What to do
- Affects up to 2.31.0. Update Page Builder by SiteOrigin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Dec 25, 2024Jetpack: Does not properly checks the postmessage origin in its 13CVE-2024-10858 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Jetpack WordPress plugin before 14.1 does not properly checks the postmessage origin in its 13.x versions, allowing it to be bypassed and leading to DOM-XSS. The issue only affects websites hosted on WordPress.com.
- Product
- Jetpack
- Fixed in
- 14.1
- What to do
- Update Jetpack to 14.1 or newer.
Dec 13, 2024SiteOrigin Widgets Bundle: Missing AuthorizationCVE-2024-54268 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Greg - SiteOrigin SiteOrigin Widgets Bundle so-widgets-bundle allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SiteOrigin Widgets Bundle: from n/a through <= 1.64.0.
- Product
- SiteOrigin Widgets Bundle
- Affected
- up to 1.64.0
- What to do
- Affects up to 1.64.0. Update SiteOrigin Widgets Bundle to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 30, 2024SiteOrigin Widgets Bundle: Stored Cross-Site ScriptingCVE-2024-5901 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Image Grid widget in all versions up to, and including, 1.62.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- SiteOrigin Widgets Bundle
- Affected
- up to 1.62.2
- What to do
- Affects up to 1.62.2. Update SiteOrigin Widgets Bundle to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 10, 2024SiteOrigin Widgets Bundle: Stored Cross-Site ScriptingCVE-2024-5090 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's SiteOrigin Blog Widget in all versions up to, and including, 1.61.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- SiteOrigin Widgets Bundle
- Affected
- up to 1.61.1
- What to do
- Affects up to 1.61.1. Update SiteOrigin Widgets Bundle to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
May 22, 2024SiteOrigin Widgets Bundle: Stored Cross-Site ScriptingCVE-2024-4362 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'siteorigin_widget' shortcode in all versions up to, and including, 1.60.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- SiteOrigin Widgets Bundle
- Affected
- up to 1.60.0
- What to do
- Affects up to 1.60.0. Update SiteOrigin Widgets Bundle to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
May 21, 2024Page Builder by SiteOrigin: Stored Cross-Site ScriptingCVE-2024-4361 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Page Builder by SiteOrigin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'siteorigin_widget' shortcode in all versions up to, and including, 2.29.15 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Page Builder by SiteOrigin
- Affected
- up to 2.29.15
- What to do
- Affects up to 2.29.15. Update Page Builder by SiteOrigin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 22, 2024Page Builder by SiteOrigin: Stored Cross-Site ScriptingCVE-2024-2202 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Page Builder by SiteOrigin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the legacy Image widget in all versions up to, and including, 2.29.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Page Builder by SiteOrigin
- Affected
- up to 2.29.6
- What to do
- Affects up to 2.29.6. Update Page Builder by SiteOrigin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 13, 2024SiteOrigin Widgets Bundle: Stored Cross-Site ScriptingCVE-2024-1723 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several parameters in all versions up to, and including, 1.58.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access or above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Affected parameters include: $instance['fonts']['title_options']['tag'], $headline_tag, $sub_headline_tag, $feature['icon'].
- Product
- SiteOrigin Widgets Bundle
- Affected
- up to 1.58.7
- What to do
- Affects up to 1.58.7. Update SiteOrigin Widgets Bundle to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 28, 2024SiteOrigin Widgets Bundle: Stored Cross-Site ScriptingCVE-2024-1070 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the features attribute in all versions up to, and including, 1.58.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access or higher, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- SiteOrigin Widgets Bundle
- Affected
- up to 1.58.2
- What to do
- Affects up to 1.58.2. Update SiteOrigin Widgets Bundle to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 28, 2024SiteOrigin Widgets Bundle: Stored Cross-Site ScriptingCVE-2024-1058 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the onclick parameter in all versions up to, and including, 1.58.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with contributor access or higher to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. 1.58.3 offers a partial fix.
- Product
- SiteOrigin Widgets Bundle
- Affected
- up to 1.58.3
- What to do
- Affects up to 1.58.3. Update SiteOrigin Widgets Bundle to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 5, 2024SiteOrigin Widgets Bundle: Stored Cross-Site ScriptingCVE-2024-0961 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the code editor in all versions up to, and including, 1.58.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access or higher, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- SiteOrigin Widgets Bundle
- Affected
- up to 1.58.1
- What to do
- Affects up to 1.58.1. Update SiteOrigin Widgets Bundle to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.