Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
4,270 results · page 1 of 86
Oct 30, 2026Booktics: Missing AuthorizationCVE-2026-62122 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Arraytics Booktics booktics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booktics: from n/a through 1.0.31.
- Product
- Booktics
- Affected
- up to 1.0.31
- What to do
- Affects up to 1.0.31. Update Booktics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 30, 2026Fluent CRM: Missing AuthorizationCVE-2026-62056 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WP ManageNinja LLC Fluent CRM fluent-crm allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Fluent CRM: from n/a through 3.2.6.
- Product
- Fluent CRM
- Affected
- up to 3.2.6
- What to do
- Affects up to 3.2.6. Update Fluent CRM to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 30, 2026Event Tickets: Missing AuthorizationCVE-2026-62047 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Tickets: from n/a through 5.30.2.
- Product
- Event Tickets
- Affected
- up to 5.30.2
- What to do
- Affects up to 5.30.2. Update Event Tickets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 30, 2026Unlimited Elements For Elementor (Free Widgets, Addons, Templates): Missing AuthorizationCVE-2026-62023 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 2.0.26.
- Product
- Unlimited Elements For Elementor (Free Widgets, Addons, Templates)
- Affected
- up to 2.0.26
- What to do
- Affects up to 2.0.26. Update Unlimited Elements For Elementor (Free Widgets, Addons, Templates) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 30, 2026BookIt: Missing AuthorizationCVE-2026-62019 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Liquid Web / StellarWP BookIt bookit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BookIt: from n/a through 2.6.0.6.
- Product
- BookIt
- Affected
- up to 2.6.0.6
- What to do
- Affects up to 2.6.0.6. Update BookIt to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 30, 2026Booktics: Missing AuthorizationCVE-2026-104674 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Arraytics Booktics booktics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booktics: from n/a through 1.0.31.
- Product
- Booktics
- Affected
- up to 1.0.31
- What to do
- Affects up to 1.0.31. Update Booktics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 30, 2026Event Tickets: Missing AuthorizationCVE-2026-62055 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Tickets: from n/a through 5.30.2.
- Product
- Event Tickets
- Affected
- up to 5.30.2
- What to do
- Affects up to 5.30.2. Update Event Tickets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 30, 2026The Events Calendar: Missing AuthorizationCVE-2026-119367 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Liquid Web / StellarWP The Events Calendar the-events-calendar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects The Events Calendar: from n/a through 6.18.2.
- Product
- The Events Calendar
- Affected
- up to 6.18.2
- What to do
- Affects up to 6.18.2. Update The Events Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 30, 2026Fluent CRM: Missing AuthorizationCVE-2026-62141 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in WP ManageNinja LLC Fluent CRM fluent-crm allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Fluent CRM: from n/a through 3.2.6.
- Product
- Fluent CRM
- Affected
- up to 3.2.6
- What to do
- Affects up to 3.2.6. Update Fluent CRM to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 30, 2026Webba Booking: Missing AuthorizationCVE-2026-116407 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Webba Plugins Webba Booking webba-booking-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Webba Booking: from n/a through 6.5.4.
- Product
- Webba Booking
- Affected
- up to 6.5.4
- What to do
- Affects up to 6.5.4. Update Webba Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 30, 2026JetFormBuilder: Missing AuthorizationCVE-2026-119482 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Crocoblock JetFormBuilder jetformbuilder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JetFormBuilder: from n/a through 3.6.7.1.
- Product
- JetFormBuilder
- Affected
- up to 3.6.7.1
- What to do
- Affects up to 3.6.7.1. Update JetFormBuilder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 30, 2026The Events Calendar: Missing AuthorizationCVE-2026-119368 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Liquid Web / StellarWP The Events Calendar the-events-calendar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects The Events Calendar: from n/a through 6.18.2.
- Product
- The Events Calendar
- Affected
- up to 6.18.2
- What to do
- Affects up to 6.18.2. Update The Events Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 30, 2026Timetics: Missing AuthorizationCVE-2026-116860 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Arraytics Timetics timetics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Timetics: from n/a through 1.0.65.
- Product
- Timetics
- Affected
- up to 1.0.65
- What to do
- Affects up to 1.0.65. Update Timetics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 30, 2026AI Engine – The Chatbot, AI Framework & MCP for: Missing AuthorizationCVE-2026-110732 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.8.6 This is due to the MCP module's OAuth 2.1 Dynamic Client Registration endpoint (/wp-json/mcp/v1/oauth/register) being registered with a permission_callback of __return_true, allowing an unauthenticated user to register an active OAuth client with an attacker-controlled redirect URI. This makes it possible for unauthenticated attackers to obtain an administrator-bound MCP access token, and thereby full administrator-level control through the MCP tools (including user creation and option updates), once an administrator approves the attacker's client on the OAuth consent screen. The consent page is additionally served without X-Frame-Options or Content-Security-Policy frame-ancestors, so that approval can be obtained via clickjacking.
- Product
- AI Engine – The Chatbot, AI Framework & MCP for
- Affected
- up to 3.8.6
- What to do
- Affects up to 3.8.6. Update AI Engine – The Chatbot, AI Framework & MCP for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 30, 2026WP Visitor Statistics (Real Time Traffic): Does not sanitize and escape a parameter before using it in a SQL statementCVE-2026-117572 · WordPress plugins & themes · reported by WPScanMedium 4.1
The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 8.8 does not sanitize and escape a parameter before using it in a SQL statement, allowing high-privilege users such as administrators to perform SQL injection attacks.
- Product
- WP Visitor Statistics (Real Time Traffic)
- Fixed in
- 8.8
- What to do
- Update WP Visitor Statistics (Real Time Traffic) to 8.8 or newer.
Oct 29, 2026Happy Addons for Elementor: Missing AuthorizationCVE-2026-109891 · WordPress plugins & themes · reported by PatchstackMedium 6.4
Missing Authorization vulnerability in weDevs Happy Addons for Elementor happy-elementor-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Happy Addons for Elementor: from n/a through 3.50.1.
- Product
- Happy Addons for Elementor
- Affected
- up to 3.50.1
- What to do
- Affects up to 3.50.1. Update Happy Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2026myCred: Missing AuthorizationCVE-2026-97073 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in myCred myCred mycred allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects myCred: from n/a through 4.0.2.
- Product
- myCred
- Affected
- up to 4.0.2
- What to do
- Affects up to 4.0.2. Update myCred to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2026MasterStudy LMS: Missing authorizationCVE-2026-80069 · WordPress plugins & themes · reported by VulnCheckMedium 5.3
MasterStudy LMS plugin for WordPress before 3.7.50 contains a missing authorization vulnerability that allows any authenticated user, including Subscribers, to trigger the stm_lms_send_test_email_ajax AJAX action without capability or nonce validation. Attackers can invoke this handler directly or via cross-site request forgery to cause an uncaught PHP fatal error that, when display_errors is enabled, discloses the absolute filesystem path of the plugin.
- Product
- MasterStudy LMS
- Fixed in
- 3.7.50
- What to do
- Update MasterStudy LMS to 3.7.50 or newer.
Full record and what to do →NVD recorddocs.stylemixthemes.comwordpress.org
Oct 29, 2026ShopBuilder – Elementor WooCommerce Builder Addons: Missing AuthorizationCVE-2026-54871 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Mamunur Rashid ShopBuilder – Elementor WooCommerce Builder Addons shopbuilder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ShopBuilder – Elementor WooCommerce Builder Addons: from n/a through 3.4.2.
- Product
- ShopBuilder – Elementor WooCommerce Builder Addons
- Affected
- up to 3.4.2
- What to do
- Affects up to 3.4.2. Update ShopBuilder – Elementor WooCommerce Builder Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2026Profile Builder: Missing AuthorizationCVE-2026-54853 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Cozmoslabs Profile Builder profile-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Profile Builder: from n/a through 4.0.5.
- Product
- Profile Builder
- Affected
- up to 4.0.5
- What to do
- Affects up to 4.0.5. Update Profile Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2026Page Restriction WordPress (WP): Missing AuthorizationCVE-2026-54852 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in miniOrange Page Restriction WordPress (WP) page-and-post-restriction allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Page Restriction WordPress (WP): from n/a through 1.6.1.
- Product
- Page Restriction WordPress (WP)
- Affected
- up to 1.6.1
- What to do
- Affects up to 1.6.1. Update Page Restriction WordPress (WP) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2026WP User Frontend: Missing AuthorizationCVE-2026-52708 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in weDevs WP User Frontend wp-user-frontend allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP User Frontend: from n/a through 4.3.13.
- Product
- WP User Frontend
- Affected
- up to 4.3.13
- What to do
- Affects up to 4.3.13. Update WP User Frontend to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2026WP User Frontend: Missing AuthorizationCVE-2026-48884 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in weDevs WP User Frontend wp-user-frontend allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP User Frontend: from n/a through 4.3.13.
- Product
- WP User Frontend
- Affected
- up to 4.3.13
- What to do
- Affects up to 4.3.13. Update WP User Frontend to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2026Kit (formerly ConvertKit): Missing AuthorizationCVE-2026-27063 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Kit Kit (formerly ConvertKit) convertkit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kit (formerly ConvertKit): from n/a through 3.4.7.
- Product
- Kit (formerly ConvertKit)
- Affected
- up to 3.4.7
- What to do
- Affects up to 3.4.7. Update Kit (formerly ConvertKit) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2026User Registration: Missing AuthorizationCVE-2026-25450 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in ThemeGrill User Registration user-registration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Registration: from n/a through 5.3.0.
- Product
- User Registration
- Affected
- up to 5.3.0
- What to do
- Affects up to 5.3.0. Update User Registration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2026WP ERP: Missing AuthorizationCVE-2026-25448 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in weDevs WP ERP erp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP ERP: from n/a through 1.17.10.
- Product
- WP ERP
- Affected
- up to 1.17.10
- What to do
- Affects up to 1.17.10. Update WP ERP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2026MasterStudy LMS: Missing AuthorizationCVE-2026-118092 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in StylemixThemes MasterStudy LMS masterstudy-lms-learning-management-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MasterStudy LMS: from n/a through 3.7.55.
- Product
- MasterStudy LMS
- Affected
- up to 3.7.55
- What to do
- Affects up to 3.7.55. Update MasterStudy LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2026WPFunnels: Missing AuthorizationCVE-2026-118091 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WPFunnels Team WPFunnels wpfunnels allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPFunnels: from n/a through 3.13.5.
- Product
- WPFunnels
- Affected
- up to 3.13.5
- What to do
- Affects up to 3.13.5. Update WPFunnels to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2026WPFunnels: Missing AuthorizationCVE-2026-118088 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WPFunnels Team WPFunnels wpfunnels allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPFunnels: from n/a through 3.13.5.
- Product
- WPFunnels
- Affected
- up to 3.13.5
- What to do
- Affects up to 3.13.5. Update WPFunnels to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2026Flexible Quantity – Measurement Price Calculator for WooCommerce: Missing AuthorizationCVE-2026-116856 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WP Desk Flexible Quantity – Measurement Price Calculator for WooCommerce flexible-quantity-measurement-price-calculator-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Flexible Quantity – Measurement Price Calculator for WooCommerce: from n/a through 2.3.24.
- Product
- Flexible Quantity – Measurement Price Calculator for WooCommerce
- Affected
- up to 2.3.24
- What to do
- Affects up to 2.3.24. Update Flexible Quantity – Measurement Price Calculator for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2026WP User Manager: Missing AuthorizationCVE-2026-116846 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WP User Manager WP User Manager wp-user-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP User Manager: from n/a through 2.9.26.
- Product
- WP User Manager
- Affected
- up to 2.9.26
- What to do
- Affects up to 2.9.26. Update WP User Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2026Webba Booking: Missing AuthorizationCVE-2026-116406 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Webba Plugins Webba Booking webba-booking-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Webba Booking: from n/a through 6.5.4.
- Product
- Webba Booking
- Affected
- up to 6.5.4
- What to do
- Affects up to 6.5.4. Update Webba Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2026SureForms: Missing AuthorizationCVE-2026-116387 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Brainstorm Force SureForms sureforms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SureForms: from n/a through 2.12.9.
- Product
- SureForms
- Affected
- up to 2.12.9
- What to do
- Affects up to 2.12.9. Update SureForms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2026SureDash: Missing AuthorizationCVE-2026-115605 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Brainstorm Force SureDash suredash allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SureDash: from n/a through 1.12.3.
- Product
- SureDash
- Affected
- up to 1.12.3
- What to do
- Affects up to 1.12.3. Update SureDash to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2026Custom Price for WooCommerce: Missing AuthorizationCVE-2026-115601 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WP Desk Custom Price for WooCommerce custom-price-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Custom Price for WooCommerce: from n/a through 1.1.29.
- Product
- Custom Price for WooCommerce
- Affected
- up to 1.1.29
- What to do
- Affects up to 1.1.29. Update Custom Price for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2026Taxi Booking Manager for WooCommerce: Missing AuthorizationCVE-2026-114181 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Magepeople inc. Taxi Booking Manager for WooCommerce ecab-taxi-booking-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Taxi Booking Manager for WooCommerce: from n/a through 2.1.6.
- Product
- Taxi Booking Manager for WooCommerce
- Affected
- up to 2.1.6
- What to do
- Affects up to 2.1.6. Update Taxi Booking Manager for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2026HivePress Claim Listings: Missing AuthorizationCVE-2026-42707 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in HivePress HivePress Claim Listings hivepress-claim-listings allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HivePress Claim Listings: from n/a through 1.1.4.
- Product
- HivePress Claim Listings
- Affected
- up to 1.1.4
- What to do
- Affects up to 1.1.4. Update HivePress Claim Listings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2026Kali Forms: Missing AuthorizationCVE-2026-39782 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Kaliforms Kali Forms kali-forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kali Forms: from n/a through 2.4.27.
- Product
- Kali Forms
- Affected
- up to 2.4.27
- What to do
- Affects up to 2.4.27. Update Kali Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2026Kali Forms: Missing AuthorizationCVE-2026-42703 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Kaliforms Kali Forms kali-forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kali Forms: from n/a through 2.4.27.
- Product
- Kali Forms
- Affected
- up to 2.4.27
- What to do
- Affects up to 2.4.27. Update Kali Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2026Simple Cloudflare Turnstile: Missing AuthorizationCVE-2026-39741 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in RelyWP Simple Cloudflare Turnstile simple-cloudflare-turnstile allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simple Cloudflare Turnstile: from n/a through 1.44.0.
- Product
- Simple Cloudflare Turnstile
- Affected
- up to 1.44.0
- What to do
- Affects up to 1.44.0. Update Simple Cloudflare Turnstile to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2026JetEngine: Missing AuthorizationCVE-2026-39735 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Crocoblock JetEngine jet-engine allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JetEngine: from n/a through 3.9.0.1.
- Product
- JetEngine
- Affected
- up to 3.9.0.1
- What to do
- Affects up to 3.9.0.1. Update JetEngine to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2026WP Job Portal: Missing AuthorizationCVE-2026-22386 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Ahmad WP Job Portal wp-job-portal allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Job Portal: from n/a through 2.7.1.
- Product
- WP Job Portal
- Affected
- up to 2.7.1
- What to do
- Affects up to 2.7.1. Update WP Job Portal to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2026Product Feed Manager: Missing AuthorizationCVE-2026-118093 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WPFunnels Team Product Feed Manager best-woocommerce-feed allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Product Feed Manager: from n/a through 7.14.1.
- Product
- Product Feed Manager
- Affected
- up to 7.14.1
- What to do
- Affects up to 7.14.1. Update Product Feed Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2026YITH PayPal Express Checkout for WooCommerce: Missing AuthorizationCVE-2026-27401 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in YITH YITH PayPal Express Checkout for WooCommerce yith-paypal-express-checkout-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YITH PayPal Express Checkout for WooCommerce: from n/a through 1.62.0.
- Product
- YITH PayPal Express Checkout for WooCommerce
- Affected
- up to 1.62.0
- What to do
- Affects up to 1.62.0. Update YITH PayPal Express Checkout for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2026Broadcast Live Video: Missing AuthorizationCVE-2026-115963 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Missing Authorization vulnerability in VideoWhisper.com Broadcast Live Video videowhisper-live-streaming-integration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Broadcast Live Video: from n/a through 7.3.9.
- Product
- Broadcast Live Video
- Affected
- up to 7.3.9
- What to do
- Affects up to 7.3.9. Update Broadcast Live Video to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2026LearnPress: Missing AuthorizationCVE-2026-115599 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LearnPress: from n/a through 4.4.11.
- Product
- LearnPress
- Affected
- up to 4.4.11
- What to do
- Affects up to 4.4.11. Update LearnPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2026GEO my: Missing AuthorizationCVE-2026-114193 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in Eyal Fitoussi GEO my WordPress geo-my-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GEO my WordPress: from n/a through 4.5.5.5.
- Product
- GEO my
- Affected
- up to 4.5.5.5
- What to do
- Affects up to 4.5.5.5. Update GEO my to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2026HANDMADE – Dropshipping for Etsy and WooCommerce: Missing AuthorizationCVE-2026-112827 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Missing Authorization vulnerability in VillaTheme HANDMADE – Dropshipping for Etsy and WooCommerce handmade-dropshipping-for-etsy-and-woo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HANDMADE – Dropshipping for Etsy and WooCommerce: from n/a through 1.0.10.
- Product
- HANDMADE – Dropshipping for Etsy and WooCommerce
- Affected
- up to 1.0.10
- What to do
- Affects up to 1.0.10. Update HANDMADE – Dropshipping for Etsy and WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2026vTables: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2026-89216 · WordPress plugins & themes · reported by WPScanHigh 8.6
The vTables WordPress plugin before 0.3 does not properly sanitise and escape a parameter before using it in a SQL statement, which allows unauthenticated attackers to perform SQL injection attacks and extract data from the database.
- Product
- vTables
- Fixed in
- 0.3
- What to do
- Update vTables to 0.3 or newer.
Oct 29, 2026Automated Import Products to Cart: Does not sanitize a user-supplied file path before using it to read and delete filesCVE-2026-113617 · WordPress plugins & themes · reported by WPScanCritical 9.9
The Automated Import Products to Cart WordPress plugin before 1.0.4 does not sanitize a user-supplied file path before using it to read and delete files, allowing users with minimal permissions, such as subscribers, to read arbitrary files (including ones containing the database credentials) and delete arbitrary files on the server.
- Product
- Automated Import Products to Cart
- Fixed in
- 1.0.4
- What to do
- Update Automated Import Products to Cart to 1.0.4 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.