Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
470 results · page 1 of 10
Oct 28, 2026Media Library Assistant: Does not verify a CSRF nonce on its Empty Trash media actionCVE-2026-113486 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Media Library Assistant WordPress plugin before 3.42 does not verify a CSRF nonce on its Empty Trash media action, so a forged cross-site request can cause a logged-in user with the Editor role or above to permanently delete every trashed attachment on the site.
- Product
- Media Library Assistant
- Fixed in
- 3.42
- What to do
- Update Media Library Assistant to 3.42 or newer.
Oct 27, 2026Analytics Insights – Google Analytics Dashboard for: Stored Cross-Site ScriptingCVE-2026-111820 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Analytics Insights – Google Analytics Dashboard for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Page Title in all versions up to, and including, 6.3.12 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Analytics Insights – Google Analytics Dashboard for
- Affected
- up to 6.3.12
- What to do
- Affects up to 6.3.12. Update Analytics Insights – Google Analytics Dashboard for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Oct 26, 2026Geo Mashup: Missing AuthorizationCVE-2026-115954 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Dylan Kuhn Geo Mashup geo-mashup allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Geo Mashup: from n/a through 1.13.22.
- Product
- Geo Mashup
- Affected
- up to 1.13.22
- What to do
- Affects up to 1.13.22. Update Geo Mashup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 26, 2026Geo Mashup: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-115953 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dylan Kuhn Geo Mashup geo-mashup allows Stored XSS.This issue affects Geo Mashup: from n/a through 1.13.22.
- Product
- Geo Mashup
- Affected
- up to 1.13.22
- What to do
- Affects up to 1.13.22. Update Geo Mashup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 24, 2026aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder: Privilege EscalationCVE-2026-110018 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.17.0 via the `/ablocks/v1/form-builder/registration` REST endpoint. The vulnerability exists because the endpoint is registered with `permission_callback => __return_true` and the `register()` handler reads `roleSlug` directly from attacker-controlled block attributes in `post_content` without ever verifying that the block's `formType` is `registration` — a condition that `RegistrationFormSanitizer::verify()` imposes only at save-time, meaning a Contributor can preserve an arbitrary `roleSlug` by saving a block with `formType='login'` and then triggering the endpoint via a valid `wp_rest` nonce and post-ownership check. This makes it possible for authenticated attackers, with Contributor-level access and above, to escalate their WordPress role to Editor or any other non-administrator role and receive a fully authenticated session at the elevated privilege level via `WP_User::set_role()` and `wp_set_auth_cookie()`. Escalation is bounded below administrator-tier roles because `is_safe
- Product
- aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder
- Affected
- up to 2.17.0
- What to do
- Affects up to 2.17.0. Update aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 24, 2026SureDash: Missing AuthorizationCVE-2026-110892 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Brainstorm Force SureDash suredash allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SureDash: from n/a through 1.12.2.
- Product
- SureDash
- Affected
- up to 1.12.2
- What to do
- Affects up to 1.12.2. Update SureDash to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 23, 2026Popup Builder: Does not perform authorization checks before trashing popup content in a maintenance routine that runs on unauthenticated requestsCVE-2026-112230 · WordPress plugins & themes · reported by WPScanLow 3.7
The Popup Builder WordPress plugin before 4.4.6 does not perform authorization checks before trashing popup content in a maintenance routine that runs on unauthenticated requests, allowing unauthenticated attackers to move affected popups into the Trash and overwrite their stored preview data.
- Product
- Popup Builder
- Fixed in
- 4.4.6
- What to do
- Update Popup Builder to 4.4.6 or newer.
Oct 22, 2026SureDash: Missing AuthorizationCVE-2026-110894 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Brainstorm Force SureDash suredash allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SureDash: from n/a through 1.12.2.
- Product
- SureDash
- Affected
- up to 1.12.2
- What to do
- Affects up to 1.12.2. Update SureDash to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2026SureDash: Missing AuthorizationCVE-2026-110893 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Brainstorm Force SureDash suredash allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SureDash: from n/a through 1.12.2.
- Product
- SureDash
- Affected
- up to 1.12.2
- What to do
- Affects up to 1.12.2. Update SureDash to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2026Photo Engine (Media Organizer & Lightroom): Does not sanitise and escape collection and gallery names before storing them and outputting them in an administrative dashboardCVE-2026-111971 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.5.8 does not sanitise and escape collection and gallery names before storing them and outputting them in an administrative dashboard, allowing authenticated users with the author role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Photo Engine (Media Organizer & Lightroom)
- Fixed in
- 6.5.8
- What to do
- Update Photo Engine (Media Organizer & Lightroom) to 6.5.8 or newer.
Oct 21, 2026Geo Mashup: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-111848 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dylan Kuhn Geo Mashup geo-mashup allows Reflected XSS.This issue affects Geo Mashup: from n/a through 1.13.22.
- Product
- Geo Mashup
- Affected
- up to 1.13.22
- What to do
- Affects up to 1.13.22. Update Geo Mashup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 21, 2026HireZoot: Does not sanitise and escape some of its stored data before outputting it in the admin dashboardCVE-2026-107790 · WordPress plugins & themes · reported by WPScanMedium 6.8
The HireZoot WordPress plugin before 4.1.1 does not sanitise and escape some of its stored data before outputting it in the admin dashboard, and additionally reverses the HTML-entity encoding that would otherwise neutralise it, allowing users with the Author role to perform Stored Cross-Site Scripting attacks that execute in the context of a logged-in administrator.
- Product
- HireZoot
- Fixed in
- 4.1.1
- What to do
- Update HireZoot to 4.1.1 or newer.
Oct 21, 2026Uncanny Toolkit for LearnDash: Does not verify that the acting user is permitted to manage the targeted accounts before changing their verification stateCVE-2026-107128 · WordPress plugins & themes · reported by WPScanMedium 5
The Uncanny Toolkit for LearnDash WordPress plugin before 3.8.2 does not verify that the acting user is permitted to manage the targeted accounts before changing their verification state, allowing a subsite administrator on a multisite network to mark arbitrary network users outside their own site as unverified and prevent those users from logging in.
- Product
- Uncanny Toolkit for LearnDash
- Fixed in
- 3.8.2
- What to do
- Update Uncanny Toolkit for LearnDash to 3.8.2 or newer.
Oct 21, 2026Uncanny Toolkit for LearnDash: Does not validate the origin of a password-reset requestCVE-2026-107127 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Uncanny Toolkit for LearnDash WordPress plugin before 3.8.2 does not validate the origin of a password-reset request, allowing an unauthenticated attacker to set the password of a user who is partway through a password reset to an attacker-chosen value through a forged request, resulting in full account takeover.
- Product
- Uncanny Toolkit for LearnDash
- Fixed in
- 3.8.2
- What to do
- Update Uncanny Toolkit for LearnDash to 3.8.2 or newer.
Oct 16, 2026SureDash – Community, Courses & Member Dashboard: Stored Cross-Site ScriptingCVE-2026-96870 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The SureDash – Community, Courses & Member Dashboard plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'display_name' parameter in all versions up to, and including, 1.12.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit is triggered when any user hovers over a comment's like counter on a community page, as the plugin's tooltip handler assigns the attacker-controlled data-tooltip-description attribute value directly to innerHTML, re-parsing the browser-decoded entity payload as live HTML.
- Product
- SureDash – Community, Courses & Member Dashboard
- Affected
- up to 1.12.0
- What to do
- Affects up to 1.12.0. Update SureDash – Community, Courses & Member Dashboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 16, 2026Visual Form Builder: Does not perform an authorization check before displaying recent form submission data in a dashboard widgetCVE-2026-105974 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Visual Form Builder WordPress plugin through 3.1 does not perform an authorization check before displaying recent form submission data in a dashboard widget, allowing any authenticated user (Subscriber and above) to read other users' submitted contact information, including names, email addresses, form titles and timestamps.
- Product
- Visual Form Builder
- Affected
- up to 3.1
- What to do
- Affects up to 3.1. Update Visual Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 16, 2026Image Hub – Free Images from Unsplash, Pixabay, Pexels, Openverse & Giphy: Sensitive Information ExposureCVE-2026-109191 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Image Hub – Free Images from Unsplash, Pixabay, Pexels, Openverse & Giphy plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.2.0 via the 'image_hub_api_keys_* (6 options)' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract the plaintext API credentials for six third-party services — Giphy, Openverse (client ID and secret), Pexels, Pixabay, and Unsplash — emitted verbatim into every admin page's HTML via wp_localize_script. The leaked page HTML also contains a valid image_hub_nonce AJAX nonce, which — combined with the absence of any capability check in the image_hub_update_settings AJAX handler — allows the same Subscriber-level attacker to overwrite all six stored API credential options via update_option().
- Product
- Image Hub – Free Images from Unsplash, Pixabay, Pexels, Openverse & Giphy
- Affected
- up to 1.2.0
- What to do
- Affects up to 1.2.0. Update Image Hub – Free Images from Unsplash, Pixabay, Pexels, Openverse & Giphy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 14, 2026Frontend Dashboard: Incorrect Privilege AssignmentCVE-2026-107424 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Incorrect Privilege Assignment vulnerability in M A Vinoth Kumar Frontend Dashboard frontend-dashboard allows Privilege Escalation.This issue affects Frontend Dashboard: from n/a through 3.0.7.
- Product
- Frontend Dashboard
- Affected
- up to 3.0.7
- What to do
- Affects up to 3.0.7. Update Frontend Dashboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 14, 2026Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories: Does not enforce a safe HTML-element allowlist on a shortcode attribute and does not neutralise attacker-controlCVE-2026-105261 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories WordPress plugin before 4.10.6 does not enforce a safe HTML-element allowlist on a shortcode attribute and does not neutralise attacker-controlled text placed inside the resulting element, allowing users with the Contributor role and above to store JavaScript that executes in the session of any higher-privileged user who views the content.
- Product
- Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories
- Fixed in
- 4.10.6
- What to do
- Update Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories to 4.10.6 or newer.
Oct 10, 2026Bayarcash WooCommerce: Missing AuthorizationCVE-2026-106609 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in Web Impian Bayarcash WooCommerce bayarcash-wc allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Bayarcash WooCommerce: from n/a through 4.4.2.
- Product
- Bayarcash WooCommerce
- Affected
- up to 4.4.2
- What to do
- Affects up to 4.4.2. Update Bayarcash WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026Smash: Deserialization of Untrusted DataCVE-2026-93931 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeREX Group Smash smash allows Object Injection.This issue affects Smash: from n/a through 1.12.0.
- Product
- Smash
- Affected
- up to 1.12.0
- What to do
- Affects up to 1.12.0. Update Smash to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026SureDash – Community, Courses & Member Dashboard: Stored DOM-Based Cross-Site ScriptingCVE-2026-102774 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The SureDash – Community, Courses & Member Dashboard plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via Image 'alt' Attribute in Community Post Content in all versions up to, and including, 1.12.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The entity-encoded payload bypasses server-side wp_kses filtering because kses permits the img/alt tag combination and does not normalize entities inside attribute values; the decode occurs client-side when GLightbox reads the .alt DOM property and assigns the result to innerHTML.
- Product
- SureDash – Community, Courses & Member Dashboard
- Affected
- up to 1.12.1
- What to do
- Affects up to 1.12.1. Update SureDash – Community, Courses & Member Dashboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 9, 2026Dashboard Notes: Cross-Site Request Forgery (CSRF)CVE-2026-62026 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in MIGHTYminnow Dashboard Notes dashboard-notes allows Cross Site Request Forgery.This issue affects Dashboard Notes: from n/a through 1.0.3.
- Product
- Dashboard Notes
- Affected
- up to 1.0.3
- What to do
- Affects up to 1.0.3. Update Dashboard Notes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 8, 2026Booking Calendar: Does not generate its per-booking access hashes with sufficient entropyCVE-2026-105193 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Booking Calendar WordPress plugin before 11.8 does not generate its per-booking access hashes with sufficient entropy, deriving each from a low-entropy time-seeded value, which can allow unauthenticated attackers who are able to determine a booking's creation time to predict the hash and then read that booking's personal data or modify the booking in place.
- Product
- Booking Calendar
- Fixed in
- 11.8
- What to do
- Update Booking Calendar to 11.8 or newer.
Oct 8, 2026Frontend Dashboard: Does not perform any authorisation or nonce check on actions available to unauthenticated users that call an attacker-chosen PHP function or class method with the request dataCVE-2026-103692 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Frontend Dashboard WordPress plugin before 3.0.5 does not perform any authorisation or nonce check on actions available to unauthenticated users that call an attacker-chosen PHP function or class method with the request data, allowing unauthenticated users to take over any account, including administrators.
- Product
- Frontend Dashboard
- Fixed in
- 3.0.5
- What to do
- Update Frontend Dashboard to 3.0.5 or newer.
Oct 7, 2026Optimole: Does not perform a capability check before exposing its stored image-optimization account data in a dashboard widgetCVE-2026-96530 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Optimole WordPress plugin before 4.2.15 does not perform a capability check before exposing its stored image-optimization account data in a dashboard widget, allowing any authenticated user, including Subscribers, to read the site's third-party service credentials.
- Product
- Optimole
- Fixed in
- 4.2.15
- What to do
- Update Optimole to 4.2.15 or newer.
Oct 7, 2026Frontend Dashboard: Does not perform a capability check in one of its AJAX actionsCVE-2026-103681 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Frontend Dashboard WordPress plugin before 3.0.0 does not perform a capability check in one of its AJAX actions, allowing authenticated users with low privileges, such as subscribers, to delete the Frontend Dashboard WordPress plugin before 3.0.0's configured profile and post form fields.
- Product
- Frontend Dashboard
- Fixed in
- 3.0.0
- What to do
- Update Frontend Dashboard to 3.0.0 or newer.
Oct 2, 2026Smash Balloon Social Post Feed – Simple Social Feeds for: Stored Cross-Site ScriptingCVE-2026-93756 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Smash Balloon Social Post Feed – Simple Social Feeds for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Facebook Comment Message via v-html in Admin Builder Preview in all versions up to, and including, 4.13.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that will execute whenever an administrator accesses the feed builder preview page. This attack requires only a Facebook account to post a comment on the connected Facebook Page, with no WordPress credentials needed; additionally, the use of v-show rather than v-if means injected HTML — including onerror handlers — is evaluated in the DOM even when the comment section is not visually displayed. When combined with the lack of URL validation in the cff_install_addon AJAX handler (admin/addon-functions.php), an injected script running in an administrator's session can trigger arbitrary plugin installation from an attacker-controlled URL, which may result in server-side code execution.
- Product
- Smash Balloon Social Post Feed – Simple Social Feeds for
- Affected
- up to 4.13.0
- What to do
- Affects up to 4.13.0. Update Smash Balloon Social Post Feed – Simple Social Feeds for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 1, 2026Mamunur Rashid Review Schema review-schema: Missing AuthorizationCVE-2026-97280 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Mamunur Rashid Review Schema review-schema allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Review Schema: 3.1.0.
- Product
- Mamunur Rashid Review Schema review-schema
- What to do
- Update Mamunur Rashid Review Schema review-schema to the newest version.
Sep 30, 2026Unauthenticated Cross Site Scripting (XSS) in Geo Mashup <= 1.13.21 versions.CVE-2026-97250 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Geo Mashup <= 1.13.21 versions.
- Affected
- up to 1.13.21
- What to do
- Affects up to 1.13.21. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 25, 2026Knit Pay – Cashfree, Instamojo, Razorpay, PayPal and more: Privilege EscalationCVE-2026-89426 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Knit Pay – Cashfree, Instamojo, Razorpay, PayPal and more plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 9.6.1.0. This is due to the `maybe_update_user_role()` function reading the target role directly from an attacker-controlled Gravity Forms entry field — configured via the feed's `user_role_field_id` — and passing it to `WP_User::set_role()` without validating the supplied value against an allowlist of permitted roles. This makes it possible for authenticated attackers, with Subscriber-level access and above, to elevate their privileges to administrator by tampering with the hidden role field value at form submission time. Exploitation is further enabled by the fact that $0 orders are synchronously marked as SUCCESS during form submission without requiring a real payment, and when no GF User Registration user can be resolved, the role assignment target falls back to `$lead['created_by']` — the currently authenticated submitter's own user ID — making any authenticated form submitter an eligible exploitation target.
- Product
- Knit Pay – Cashfree, Instamojo, Razorpay, PayPal and more
- Affected
- up to 9.6.1.0
- What to do
- Affects up to 9.6.1.0. Update Knit Pay – Cashfree, Instamojo, Razorpay, PayPal and more to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 23, 2026divi-dash: Does not validate the source of the client IP address it uses for rate limiting and banningCVE-2026-14321 · WordPress plugins & themes · reported by WPScanHigh 8.2
The divi-dash WordPress plugin before 1.0.7 does not validate the source of the client IP address it uses for rate limiting and banning, allowing unauthenticated attackers to spoof arbitrary IP addresses in order to bypass rate limiting, ban chosen addresses from the feature, and grow a stored option without bound, resulting in denial of service.
- Product
- divi-dash
- Fixed in
- 1.0.7
- What to do
- Update divi-dash to 1.0.7 or newer.
Sep 22, 2026HashBar – WordPress Notification Bar: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-94117 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in DevItems HashBar – WordPress Notification Bar allows Blind SQL Injection. This issue affects HashBar – WordPress Notification Bar: from n/a through 2.0.3.
- Product
- HashBar – WordPress Notification Bar
- Affected
- up to 2.0.3
- What to do
- Affects up to 2.0.3. Update HashBar – WordPress Notification Bar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 17, 2026Contributor Cross Site Scripting (XSS) in Geo Mashup <= 1.13.21 versions.CVE-2026-78294 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Cross Site Scripting (XSS) in Geo Mashup <= 1.13.21 versions.
- Affected
- up to 1.13.21
- What to do
- Affects up to 1.13.21. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 17, 2026Newsletter: Does not generate its email tracking signing key with sufficient entropy and signs its tracking links with an unkeyed hashCVE-2026-86824 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Newsletter WordPress plugin before 9.3.8 does not generate its email tracking signing key with sufficient entropy and signs its tracking links with an unkeyed hash, allowing an unauthenticated attacker who recovers that key offline to forge tracking links, obtain any subscriber's session token, and read and modify that subscriber's stored personal data.
- Product
- Newsletter
- Fixed in
- 9.3.8
- What to do
- Update Newsletter to 9.3.8 or newer.
Sep 5, 2026MemberDash: Insecure Direct Object ReferenceCVE-2026-16310 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The MemberDash plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.8.5 via the 'id' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to change the password of any WordPress user, including administrators, by supplying an arbitrary user ID during registration, and take over their account without any notification sent to the victim.
- Product
- MemberDash
- Affected
- up to 1.8.5
- What to do
- Affects up to 1.8.5. Update MemberDash to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordmemberdashwp.comwordfence.com
Sep 5, 2026LearnDash LMS: Authorization bypassCVE-2026-12843 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The LearnDash LMS plugin for WordPress is vulnerable to authorization bypass in versions 4.25.0 - 5.1.6. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to enroll arbitrary users in paid courses without payment verification, bypassing the entire payment system and gaining unauthorized access to premium educational content.
- Product
- LearnDash LMS
- Affected
- 4.25.0 to 5.1.6
- What to do
- Affects 4.25.0 to 5.1.6. Update LearnDash LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recorddocs.nexcess.comwordfence.com
Sep 4, 2026LearnDash LMS: Unrestricted File Type UploadCVE-2026-12483 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The LearnDash LMS plugin for WordPress is vulnerable to Unrestricted File Type Upload in versions up to and including 5.1.5. This is due to insufficient input validation in the 'learndash_fileupload_process' function, which iterates through an entire array and validates only the first file. This makes it possible for authenticated attackers, with subscriber-level access and above who are enrolled in a course with assignment uploads enabled, to upload arbitrary disallowed files, including PHP files, to the server's wp-content/uploads/learndash/assignments/ directory. The uploaded files can only be used for Remote Code Execution if default server configurations have been changed to allow for execution.
- Product
- LearnDash LMS
- Affected
- up to 5.1.5
- What to do
- Affects up to 5.1.5. Update LearnDash LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordliquidweb.comwordfence.com
Aug 31, 2026Unauthenticated Arbitrary File Upload in Hash Form <= 1.4.2 versions.CVE-2026-81780 · WordPress plugins & themes · reported by PatchstackCritical 10
Unauthenticated Arbitrary File Upload in Hash Form <= 1.4.2 versions.
- Affected
- up to 1.4.2
- What to do
- Affects up to 1.4.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 30, 2026MW WP Form: Does not sanitise and escape some of its form settings before outputting them back in an admin dashboard pageCVE-2026-78364 · WordPress plugins & themes · reported by WPScanLow 3.5
The MW WP Form WordPress plugin before 5.1.6 does not sanitise and escape some of its form settings before outputting them back in an admin dashboard page, which could allow users with a role as low as Editor to perform Stored Cross-Site Scripting attacks against high privilege users such as admin.
- Product
- MW WP Form
- Fixed in
- 5.1.6
- What to do
- Update MW WP Form to 5.1.6 or newer.
Aug 28, 2026WPMU DEV Dashboard: Authentication BypassCVE-2026-76581 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The WPMU DEV Dashboard plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.0.1. This is due to inconsistent and ambiguous HMAC message construction between the unauthenticated `wdpsso_step1` and `wdpsso_step2` AJAX actions, where step 1 signs and discloses an unseparated concatenation of the token, state, redirect, and domain values, while step 2 verifies an unseparated concatenation that omits the domain field. This makes it possible for unauthenticated attackers, on sites connected to WPMU DEV with Hub SSO enabled and mapped to an administrator, to obtain a valid HMAC from step 1 and replay it to step 2 by moving the domain value into the redirect field, resulting in an authenticated administrator session.
- Product
- WPMU DEV Dashboard
- Affected
- up to 5.0.1
- What to do
- Affects up to 5.0.1. Update WPMU DEV Dashboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwpmudev.comwordfence.com
Aug 27, 2026Unauthenticated PHP Object Injection in Hash Form <= 1.4.1 versions.CVE-2026-78292 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in Hash Form <= 1.4.1 versions.
- Affected
- up to 1.4.1
- What to do
- Affects up to 1.4.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 24, 2026Unauthenticated Cross Site Request Forgery (CSRF) in Hash Form <= 1.4.0 versions.CVE-2026-78280 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Unauthenticated Cross Site Request Forgery (CSRF) in Hash Form <= 1.4.0 versions.
- Affected
- up to 1.4.0
- What to do
- Affects up to 1.4.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 18, 2026HashBar – WordPress Notification Bar: Cross-Site Request Forgery (CSRF)CVE-2026-66602 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Cross-Site Request Forgery (CSRF) vulnerability in DevItems HashBar – WordPress Notification Bar allows Cross Site Request Forgery. This issue affects HashBar – WordPress Notification Bar: from n/a through 2.0.0.
- Product
- HashBar – WordPress Notification Bar
- Affected
- up to 2.0.0
- What to do
- Affects up to 2.0.0. Update HashBar – WordPress Notification Bar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 18, 2026Ultimate Dashboard Pro: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-66621 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ultimate Dashboard Ultimate Dashboard Pro ultimate-dashboard-pro allows DOM-Based XSS.This issue affects Ultimate Dashboard Pro: from n/a through 3.11.2.
- Product
- Ultimate Dashboard Pro
- Affected
- up to 3.11.2
- What to do
- Affects up to 3.11.2. Update Ultimate Dashboard Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 16, 2026SureDash – Community, Courses & Member Dashboard: Stored Cross-Site ScriptingCVE-2026-18402 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The SureDash – Community, Courses & Member Dashboard plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'draweropenverposition' Block/Shortcode Attribute in all versions up to, and including, 1.10.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload is stored inside the block-delimiter HTML comment's JSON, which wp_kses_post does not neutralize on save, and is only interpolated into the rendered style attribute at display time without esc_attr() escaping, allowing a double-quote to break out of the attribute and introduce arbitrary HTML event handlers.
- Product
- SureDash – Community, Courses & Member Dashboard
- Affected
- up to 1.10.3
- What to do
- Affects up to 1.10.3. Update SureDash – Community, Courses & Member Dashboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 16, 2026Smash Balloon Social Post Feed – Simple Social Feeds for: Stored Cross-Site ScriptingCVE-2026-16775 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Smash Balloon Social Post Feed – Simple Social Feeds for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'id' Shortcode Attribute in all versions up to, and including, 4.9.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Smash Balloon Social Post Feed – Simple Social Feeds for
- Affected
- up to 4.9.0
- What to do
- Affects up to 4.9.0. Update Smash Balloon Social Post Feed – Simple Social Feeds for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 13, 2026Unauthenticated Cross Site Scripting (XSS) in SureDash <= 1.10.1 versions.CVE-2026-66698 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in SureDash <= 1.10.1 versions.
- Affected
- up to 1.10.1
- What to do
- Affects up to 1.10.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 13, 2026Unauthenticated Local File Inclusion in Geo Mashup <= 1.13.18 versions.CVE-2026-66450 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Local File Inclusion in Geo Mashup <= 1.13.18 versions.
- Affected
- up to 1.13.18
- What to do
- Affects up to 1.13.18. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 13, 2026Unauthenticated Cross Site Scripting (XSS) in Geo Mashup <= 1.13.18 versions.CVE-2026-66449 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Geo Mashup <= 1.13.18 versions.
- Affected
- up to 1.13.18
- What to do
- Affects up to 1.13.18. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.