Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
3,860 results · page 1 of 78
Oct 30, 2026Unauthenticated Cross Site Scripting (XSS) in All In One Login <= 2.4.1 versions.CVE-2026-94175 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in All In One Login <= 2.4.1 versions.
- Affected
- up to 2.4.1
- What to do
- Affects up to 2.4.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 30, 2026Unauthenticated PHP Object Injection in LeadSnap <= 1.25 versions.CVE-2026-90888 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in LeadSnap <= 1.25 versions.
- Affected
- up to 1.25
- What to do
- Affects up to 1.25. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 30, 2026Unauthenticated Cross Site Scripting (XSS) in Profile Builder <= 4.0.5 versions.CVE-2026-54855 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Profile Builder <= 4.0.5 versions.
- Affected
- up to 4.0.5
- What to do
- Affects up to 4.0.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 30, 2026Unauthenticated Cross Site Scripting (XSS) in Fast Velocity Minify <= 3.5.7 versions.CVE-2026-48201 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Fast Velocity Minify <= 3.5.7 versions.
- Affected
- up to 3.5.7
- What to do
- Affects up to 3.5.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 30, 2026Unauthenticated Cross Site Scripting (XSS) in BA Book Everything <= 1.8.33 versions.CVE-2026-39786 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in BA Book Everything <= 1.8.33 versions.
- Affected
- up to 1.8.33
- What to do
- Affects up to 1.8.33. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 30, 2026Unauthenticated PHP Object Injection in FunnelKit Automations <= 3.8.6.1 versions.CVE-2026-39738 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in FunnelKit Automations <= 3.8.6.1 versions.
- Affected
- up to 3.8.6.1
- What to do
- Affects up to 3.8.6.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 30, 2026Unauthenticated Path Traversal in WP EasyPay <= 4.5.4 versions.CVE-2026-39734 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Path Traversal in WP EasyPay <= 4.5.4 versions.
- Affected
- up to 4.5.4
- What to do
- Affects up to 4.5.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 30, 2026Unauthenticated SQL Injection in Transliterator <= 2.5.13 versions.CVE-2026-39732 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in Transliterator <= 2.5.13 versions.
- Affected
- up to 2.5.13
- What to do
- Affects up to 2.5.13. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 30, 2026Unauthenticated Cross Site Scripting (XSS) in VikRentCar <= 1.4.10 versions.CVE-2026-28160 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in VikRentCar <= 1.4.10 versions.
- Affected
- up to 1.4.10
- What to do
- Affects up to 1.4.10. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 30, 2026Unauthenticated Broken Access Control in WP REST Cache <= 2026.3.1 versions.CVE-2026-116862 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in WP REST Cache <= 2026.3.1 versions.
- Affected
- up to 2026.3.1
- What to do
- Affects up to 2026.3.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 30, 2026Unauthenticated Sensitive Data Exposure in Flexible Chat <= 1.1.0 versions.CVE-2026-116861 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Sensitive Data Exposure in Flexible Chat <= 1.1.0 versions.
- Affected
- up to 1.1.0
- What to do
- Affects up to 1.1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 30, 2026Unauthenticated Broken Access Control in GiveWP <= 4.19.0.1 versions.CVE-2026-116853 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Broken Access Control in GiveWP <= 4.19.0.1 versions.
- Affected
- up to 4.19.0.1
- What to do
- Affects up to 4.19.0.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 30, 2026Unauthenticated Cross Site Scripting (XSS) in eCommerce Product Catalog <= 3.6.5 versions.CVE-2026-116851 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in eCommerce Product Catalog <= 3.6.5 versions.
- Affected
- up to 3.6.5
- What to do
- Affects up to 3.6.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 30, 2026Unauthenticated Cross Site Scripting (XSS) in Mang Board WP <= 2.4.6 versions.CVE-2026-116847 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Mang Board WP <= 2.4.6 versions.
- Affected
- up to 2.4.6
- What to do
- Affects up to 2.4.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 30, 2026Unauthenticated Arbitrary Content Deletion in Masteriyo - LMS <= 3.4.3 versions.CVE-2026-116410 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Arbitrary Content Deletion in Masteriyo - LMS <= 3.4.3 versions.
- Affected
- up to 3.4.3
- What to do
- Affects up to 3.4.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 30, 2026Unauthenticated Cross Site Scripting (XSS) in VikRentCar <= 1.4.9 versions.CVE-2026-116405 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in VikRentCar <= 1.4.9 versions.
- Affected
- up to 1.4.9
- What to do
- Affects up to 1.4.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 30, 2026Unauthenticated Broken Access Control in HUSKY <= 1.4.6 versions.CVE-2026-116401 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in HUSKY <= 1.4.6 versions.
- Affected
- up to 1.4.6
- What to do
- Affects up to 1.4.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 30, 2026Unauthenticated Privilege Escalation in SMS Alert Order Notifications <= 4.0.2 versions.CVE-2026-116386 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated Privilege Escalation in SMS Alert Order Notifications <= 4.0.2 versions.
- Affected
- up to 4.0.2
- What to do
- Affects up to 4.0.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 30, 2026Unauthenticated Sensitive Data Exposure in HUSKY <= 1.4.6 versions.CVE-2026-115947 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Sensitive Data Exposure in HUSKY <= 1.4.6 versions.
- Affected
- up to 1.4.6
- What to do
- Affects up to 1.4.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 30, 2026Unauthenticated Bypass Vulnerability in YITH WooCommerce Product Add-Ons <= 4.34.0 versions.CVE-2026-107868 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Bypass Vulnerability in YITH WooCommerce Product Add-Ons <= 4.34.0 versions.
- Affected
- up to 4.34.0
- What to do
- Affects up to 4.34.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 30, 2026Unauthenticated Cross Site Scripting (XSS) in Ad Inserter <= 2.8.19 versions.CVE-2026-105077 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Ad Inserter <= 2.8.19 versions.
- Affected
- up to 2.8.19
- What to do
- Affects up to 2.8.19. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 30, 2026My Calendar WordPress plugin 3.8.8 before 3.8.11 contains a shortcode injection vulnerability that allows unauthenticated attackers to execute registered shortcCVE-2026-119714 · WordPress plugins & themes · reported by VulnCheckMedium 6.9
My Calendar WordPress plugin 3.8.8 before 3.8.11 contains a shortcode injection vulnerability that allows unauthenticated attackers to execute registered shortcodes via the mcs search parameter. The mcs value reaches mc_search_results() in src/my-calendar-search.php without bracket encoding before do_shortcode runs, so a GET request triggers shortcodes on any page or post, enabling content injection and spoofing.
- Fixed in
- 3.8.11
- What to do
- Update the plugin to 3.8.11 or newer.
Oct 30, 2026Content Egg: Unauthorized modification of dataCVE-2026-119059 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Content Egg plugin for WordPress is vulnerable to unauthorized modification of data due to a missing per-post capability check on the ajaxUpdateProducts() function in versions up to, and including, 12.0.0. The handler verifies a static nonce ('contentegg_metabox') and the generic 'edit_posts' capability, but trusts the attacker-supplied $_POST['post_id'] verbatim and never calls current_user_can('edit_post', $post_id) — the per-object check that its sibling save_post handler saveMeta() correctly performs. This makes it possible for authenticated attackers, with contributor-level access and above, to modify Content Egg product data (_cegg_data_*) and update-timestamp post meta on arbitrary posts, including those owned by administrators.
- Product
- Content Egg
- Affected
- up to 12.0.0
- What to do
- Affects up to 12.0.0. Update Content Egg to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 29, 2026the load_popup_content REST endpoint that: Bricks Theme 2.4 and before for WordPress contains an unauthenticated broken access controlCVE-2026-119325 · WordPress plugins & themes · reported by VulnCheckHigh 7.5
Bricks Theme 2.4 and before for WordPress contains an unauthenticated broken access control vulnerability in the load_popup_content REST endpoint that allows anonymous attackers to read draft and unpublished page content by supplying a popupId parameter without any status or capability checks. Attackers can obtain a public nonce via the bricks_regenerate_query_nonce action and then increment the popupId value in requests to the /wp-json/bricks/v1/load_popup_content endpoint to enumerate and disclose confidential content from any unpublished post on the site.
- Product
- the load_popup_content REST endpoint that
- What to do
- Update the load_popup_content REST endpoint that to the newest version.
Full record and what to do →NVD recordbricksbuilder.iovulncheck.com
Oct 29, 2026Unauthenticated PHP Object Injection in Zoho Flow <= 2.14.5 versions.CVE-2026-62131 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in Zoho Flow <= 2.14.5 versions.
- Affected
- up to 2.14.5
- What to do
- Affects up to 2.14.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2026Unauthenticated PHP Object Injection in Gunslinger <= 1.11 versions.CVE-2026-62018 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in Gunslinger <= 1.11 versions.
- Affected
- up to 1.11
- What to do
- Affects up to 1.11. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2026Unauthenticated PHP Object Injection in Good Homes <= 1.3.13 versions.CVE-2026-62017 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in Good Homes <= 1.3.13 versions.
- Affected
- up to 1.3.13
- What to do
- Affects up to 1.3.13. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2026Unauthenticated PHP Object Injection in Gamic <= 1.19 versions.CVE-2026-62016 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in Gamic <= 1.19 versions.
- Affected
- up to 1.19
- What to do
- Affects up to 1.19. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2026Unauthenticated PHP Object Injection in Gamezone <= 1.1.11 versions.CVE-2026-62015 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in Gamezone <= 1.1.11 versions.
- Affected
- up to 1.1.11
- What to do
- Affects up to 1.1.11. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2026Unauthenticated PHP Object Injection in EmojiNation <= 1.0.12 versions.CVE-2026-62014 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in EmojiNation <= 1.0.12 versions.
- Affected
- up to 1.0.12
- What to do
- Affects up to 1.0.12. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2026Unauthenticated PHP Object Injection in Edge Decor <= 2.9 versions.CVE-2026-62013 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in Edge Decor <= 2.9 versions.
- Affected
- up to 2.9
- What to do
- Affects up to 2.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2026Unauthenticated PHP Object Injection in Coinpress <= 1.0.15 versions.CVE-2026-62012 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in Coinpress <= 1.0.15 versions.
- Affected
- up to 1.0.15
- What to do
- Affects up to 1.0.15. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2026Unauthenticated PHP Object Injection in Bonbon <= 1.11 versions.CVE-2026-62011 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in Bonbon <= 1.11 versions.
- Affected
- up to 1.11
- What to do
- Affects up to 1.11. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2026Unauthenticated PHP Object Injection in Avventure <= 1.1.12 versions.CVE-2026-62010 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in Avventure <= 1.1.12 versions.
- Affected
- up to 1.1.12
- What to do
- Affects up to 1.1.12. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2026Unauthenticated PHP Object Injection in Filmax <= 1.1.11 versions.CVE-2026-62009 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in Filmax <= 1.1.11 versions.
- Affected
- up to 1.1.11
- What to do
- Affects up to 1.1.11. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2026Unauthenticated PHP Object Injection in Orpheus <= 1.8 versions.CVE-2026-62008 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in Orpheus <= 1.8 versions.
- Affected
- up to 1.8
- What to do
- Affects up to 1.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2026Unauthenticated PHP Object Injection in Nuts <= 1.12 versions.CVE-2026-62006 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in Nuts <= 1.12 versions.
- Affected
- up to 1.12
- What to do
- Affects up to 1.12. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2026Unauthenticated PHP Object Injection in Muzicon <= 1.15 versions.CVE-2026-62005 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in Muzicon <= 1.15 versions.
- Affected
- up to 1.15
- What to do
- Affects up to 1.15. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2026Unauthenticated PHP Object Injection in Motorix <= 1.11 versions.CVE-2026-62004 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in Motorix <= 1.11 versions.
- Affected
- up to 1.11
- What to do
- Affects up to 1.11. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2026Unauthenticated PHP Object Injection in Mission <= 1.22 versions.CVE-2026-62003 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in Mission <= 1.22 versions.
- Affected
- up to 1.22
- What to do
- Affects up to 1.22. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2026Unauthenticated PHP Object Injection in Meals & Wheels <= 1.1.13 versions.CVE-2026-62002 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in Meals & Wheels <= 1.1.13 versions.
- Affected
- up to 1.1.13
- What to do
- Affects up to 1.1.13. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2026Unauthenticated PHP Object Injection in Marcell <= 1.2.14 versions.CVE-2026-62001 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in Marcell <= 1.2.14 versions.
- Affected
- up to 1.2.14
- What to do
- Affects up to 1.2.14. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2026Unauthenticated PHP Object Injection in Le Truffe <= 1.1.7 versions.CVE-2026-61998 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in Le Truffe <= 1.1.7 versions.
- Affected
- up to 1.1.7
- What to do
- Affects up to 1.1.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2026Unauthenticated PHP Object Injection in Legal Stone <= 1.2.11 versions.CVE-2026-61997 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in Legal Stone <= 1.2.11 versions.
- Affected
- up to 1.2.11
- What to do
- Affects up to 1.2.11. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2026Unauthenticated Cross Site Scripting (XSS) in YouTube Showcase <= 4.1.0 versions.CVE-2026-61995 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in YouTube Showcase <= 4.1.0 versions.
- Affected
- up to 4.1.0
- What to do
- Affects up to 4.1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2026Unauthenticated Cross Site Scripting (XSS) in Blockonomics 3.11.0 versions.CVE-2026-61993 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Blockonomics 3.11.0 versions.
- What to do
- Update the plugin to the newest version.
Oct 29, 2026Unauthenticated PHP Object Injection in GEO my WordPress <= 4.5.5.3 versions.CVE-2026-61992 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in GEO my WordPress <= 4.5.5.3 versions.
- Affected
- up to 4.5.5.3
- What to do
- Affects up to 4.5.5.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2026Unauthenticated Remote Code Execution (RCE) in AjaxLoadMore Cache <= 3.1.1 versions.CVE-2026-61991 · WordPress plugins & themes · reported by PatchstackCritical 10
Unauthenticated Remote Code Execution (RCE) in AjaxLoadMore Cache <= 3.1.1 versions.
- Affected
- up to 3.1.1
- What to do
- Affects up to 3.1.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2026Unauthenticated Cross Site Scripting (XSS) in Easy Property Listings <= 3.5.25 versions.CVE-2026-61989 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Easy Property Listings <= 3.5.25 versions.
- Affected
- up to 3.5.25
- What to do
- Affects up to 3.5.25. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2026Unauthenticated Cross Site Scripting (XSS) in Auction Nudge – Your eBay on Your Site <= 8.4.0 versions.CVE-2026-61988 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Auction Nudge – Your eBay on Your Site <= 8.4.0 versions.
- Affected
- up to 8.4.0
- What to do
- Affects up to 8.4.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.