Updated 33 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

36added in the last 30 days

479new WordPress flaws this week

390,525entries in the database

723 results · page 1 of 15

Oct 29, 2026the load_popup_content REST endpoint that: Bricks Theme 2.4 and before for WordPress contains an unauthenticated broken access controlCVE-2026-119325 · WordPress plugins & themes · reported by VulnCheckHigh 7.5
Bricks Theme 2.4 and before for WordPress contains an unauthenticated broken access control vulnerability in the load_popup_content REST endpoint that allows anonymous attackers to read draft and unpublished page content by supplying a popupId parameter without any status or capability checks. Attackers can obtain a public nonce via the bricks_regenerate_query_nonce action and then increment the popupId value in requests to the /wp-json/bricks/v1/load_popup_content endpoint to enumerate and disclose confidential content from any unpublished post on the site.
Product
the load_popup_content REST endpoint that
What to do
Update the load_popup_content REST endpoint that to the newest version.
Full record and what to do →NVD record bricksbuilder.io vulncheck.com
Oct 29, 2026Contact Form by Supsystic: Does not sandbox the template engine used to render its forms and allows stored form-editor content to reach that engineCVE-2026-115301 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Contact Form by Supsystic WordPress plugin before 1.11.1 does not sandbox the template engine used to render its forms and allows stored form-editor content to reach that engine as executable template code, enabling an administrator to perform server-side template injection and execute arbitrary code on the server. The injected template is compiled and executed whenever any visitor loads a page containing the form, so the stored payload also lets an unauthenticated visitor read server-side secrets such as authentication salts and database credentials.
Product
Contact Form by Supsystic
Fixed in
1.11.1
What to do
Update Contact Form by Supsystic to 1.11.1 or newer.
Full record and what to do →NVD record wpscan.com
Oct 29, 2026Enable SVG, WebP, and ICO Upload: Does not sanitize uploaded SVG files whose content is not detectedCVE-2026-110504 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Enable SVG, WebP, and ICO Upload WordPress plugin before 1.1.6 does not sanitize uploaded SVG files whose content is not detected as SVG, while still storing and serving them as SVG images, which could allow users with the author role and above to perform Stored Cross-Site Scripting attacks.
Product
Enable SVG, WebP, and ICO Upload
Fixed in
1.1.6
What to do
Update Enable SVG, WebP, and ICO Upload to 1.1.6 or newer.
Full record and what to do →NVD record wpscan.com
Oct 29, 2026Appointment Booking: Does not escape several booking-form step content settings before rendering them on the public booking formCVE-2026-105258 · WordPress plugins & themes · reported by WPScanLow 3.5
The Appointment Booking Plugin WordPress plugin before 5.7.6 does not escape several booking-form step content settings before rendering them on the public booking form, allowing high-privilege users such as administrators to inject JavaScript that executes in the browser of any visitor who loads the form; on multisite, where administrators do not hold the unfiltered_html capability, this crosses a privilege boundary to unauthenticated visitors.
Product
Appointment Booking
Fixed in
5.7.6
What to do
Update Appointment Booking to 5.7.6 or newer.
Full record and what to do →NVD record wpscan.com
Oct 28, 2026Bricks Builder 2.4.3 and before contains a broken access control vulnerability that allows unauthenticated attackers to access restricted post content by submitCVE-2026-118804 · WordPress plugins & themes · reported by VulnCheckHigh 7.5
Bricks Builder 2.4.3 and before contains a broken access control vulnerability that allows unauthenticated attackers to access restricted post content by submitting crafted post_status and post_type values in the originalQueryVars parameter to the POST /wp-json/bricks/v1/query_result REST endpoint using a publicly obtainable nonce. Attackers can set post_status to draft or private, or post_type to shop_coupon, to disclose unpublished posts, private content, and WooCommerce coupon data that is otherwise blocked by the standard WordPress REST API routes.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record bricksbuilder.io vulncheck.com
Oct 28, 2026If-So Dynamic Content – Elementor & All Page Builders Personalization: Stored Cross-Site ScriptingCVE-2026-118164 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The If-So Dynamic Content – Elementor & All Page Builders Personalization plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'repeater[*][version_uid] (and many sibling fields: freeze-mode, cookie-input, ip-input, compare, utm-value, page-url-compare, group-name, custom, …)' parameter in all versions up to, and including, 1.10.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
If-So Dynamic Content – Elementor & All Page Builders Personalization
Affected
up to 1.10.2
What to do
Affects up to 1.10.2. Update If-So Dynamic Content – Elementor & All Page Builders Personalization to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 28, 2026MxChat – AI Chatbot & Content Generation for: Stored DOM-Based Cross-Site ScriptingCVE-2026-110662 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The MxChat – AI Chatbot & Content Generation for WordPress plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'feedback' parameter in all versions up to, and including, 3.2.25 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The stored payload is written by any unauthenticated visitor via a single POST to admin-ajax.php and detonates automatically when any administrator next loads the Transcripts page.
Product
MxChat – AI Chatbot & Content Generation for
Affected
up to 3.2.25
What to do
Affects up to 3.2.25. Update MxChat – AI Chatbot & Content Generation for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 28, 2026s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions: Stored Cross-Site ScriptingCVE-2026-109972 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'date_format' parameter in all versions up to, and including, <= 261011 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload bypasses wp_kses_post() on save because it contains no literal angle brackets — only backslash-escaped sequences that PHP's date() materializes into HTML tag characters at render time after WordPress's shortcode_parse_atts() applies stripcslashes() to the attribute value.
Product
s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions
Affected
up to 261011
What to do
Affects up to 261011. Update s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 28, 2026If-So Dynamic Content – Elementor & All Page Builders Personalization: Stored Cross-Site ScriptingCVE-2026-104740 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The If-So Dynamic Content – Elementor & All Page Builders Personalization plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'conversion' Shortcode Attribute in all versions up to, and including, 1.10.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
If-So Dynamic Content – Elementor & All Page Builders Personalization
Affected
up to 1.10.2
What to do
Affects up to 1.10.2. Update If-So Dynamic Content – Elementor & All Page Builders Personalization to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 28, 2026If-So Dynamic Content – Elementor & All Page Builders Personalization: Stored Cross-Site ScriptingCVE-2026-103996 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The If-So Dynamic Content – Elementor & All Page Builders Personalization plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'url' parameter in all versions up to, and including, 1.10.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected script executes specifically in the administrator's browser session, as the vulnerable branch only renders when an administrator previews or opens the post containing the crafted shortcode.
Product
If-So Dynamic Content – Elementor & All Page Builders Personalization
Affected
up to 1.10.2
What to do
Affects up to 1.10.2. Update If-So Dynamic Content – Elementor & All Page Builders Personalization to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 28, 2026Royal Addons for Elementor: Does not verify that a requested post is publicly viewable before returning its content via an unauthenticated AJAX actionCVE-2026-107100 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Royal Addons for Elementor WordPress plugin before 1.7.1070 does not verify that a requested post is publicly viewable before returning its content via an unauthenticated AJAX action, relying only on the published status and not on the post type's visibility, allowing unauthenticated users to disclose the content of posts stored in non-public post types, for example captured contact-form submissions containing names, email addresses and messages.
Product
Royal Addons for Elementor
Fixed in
1.7.1070
What to do
Update Royal Addons for Elementor to 1.7.1070 or newer.
Full record and what to do →NVD record wpscan.com
Oct 27, 2026The AI Marketing Expert — AI Email Marketing, AI Content Generator, SEO Analyzer, AI Workflow Automation, Social Media & Ai Chatbot plugin for WordPress is vulnCVE-2026-109999 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The AI Marketing Expert — AI Email Marketing, AI Content Generator, SEO Analyzer, AI Workflow Automation, Social Media & Ai Chatbot plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'name' parameter in all versions up to, and including, 1.2.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires only that the chatbot module is active with at least one configured bot; the attacker stores the payload via three unauthenticated REST calls, and the JavaScript widget auto-poll then delivers it to any administrator who opens wp-admin/index.php.
Affected
up to 1.2.8
What to do
Affects up to 1.2.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 27, 2026Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership: Stored Cross-Site ScriptingCVE-2026-107625 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'user_url' parameter in all versions up to, and including, 2.14.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires a visitor to click the attacker's Website URL link on their public Ultimate Member profile, a condition that is trivially met since the redirect-confirmation onclick handler is enabled by default on all new installations.
Product
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership
Affected
up to 2.14.0
What to do
Affects up to 2.14.0. Update Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Oct 26, 2026Content Slider Block: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-116398 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Content Slider Block content-slider-block allows Stored XSS.This issue affects Content Slider Block: from n/a through 3.2.1.
Product
Content Slider Block
Affected
up to 3.2.1
What to do
Affects up to 3.2.1. Update Content Slider Block to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 24, 2026WPVR: Does not properly sanitise and escape some of its tour hotspot content before storing it and outputting it on the front endCVE-2026-114429 · WordPress plugins & themes · reported by WPScanMedium 6.8
The WPVR WordPress plugin before 9.0.3 does not properly sanitise and escape some of its tour hotspot content before storing it and outputting it on the front end, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks that execute in the browser of any user viewing the affected tour.
Product
WPVR
Fixed in
9.0.3
What to do
Update WPVR to 9.0.3 or newer.
Full record and what to do →NVD record wpscan.com
Oct 23, 2026LiteSpeed Cache: Does not limit one of its HTML optimization routines to stylesheet contentCVE-2026-113500 · WordPress plugins & themes · reported by WPScanHigh 7.5
The LiteSpeed Cache WordPress plugin before 7.9.2 does not limit one of its HTML optimization routines to stylesheet content, so it can delete the markup that closes an attribute in the rendered page, and combined with unescaped comment author output this allows unauthenticated users whose comments are published to inject event-handler attributes that run JavaScript in the browser of any visitor, including a logged-in administrator, viewing front-end pages while the optimization is enabled.
Product
LiteSpeed Cache
Fixed in
7.9.2
What to do
Update LiteSpeed Cache to 7.9.2 or newer.
Full record and what to do →NVD record wpscan.com
Oct 23, 2026LiteSpeed Cache: Does not restrict one of its HTML rewriting routines to stylesheet contentCVE-2026-113499 · WordPress plugins & themes · reported by WPScanHigh 7.5
The LiteSpeed Cache WordPress plugin before 7.9.2 does not restrict one of its HTML rewriting routines to stylesheet content, so it removes a quote that terminates an attribute in the rendered page, and combined with unescaped comment author output this allows unauthenticated users whose comment is published to inject attributes that execute JavaScript in the browser of any visitor, including a logged-in administrator, who views front-end pages while the affected option is enabled.
Product
LiteSpeed Cache
Fixed in
7.9.2
What to do
Update LiteSpeed Cache to 7.9.2 or newer.
Full record and what to do →NVD record wpscan.com
Oct 23, 2026Popup Builder: Does not perform authorization checks before trashing popup content in a maintenance routine that runs on unauthenticated requestsCVE-2026-112230 · WordPress plugins & themes · reported by WPScanLow 3.7
The Popup Builder WordPress plugin before 4.4.6 does not perform authorization checks before trashing popup content in a maintenance routine that runs on unauthenticated requests, allowing unauthenticated attackers to move affected popups into the Trash and overwrite their stored preview data.
Product
Popup Builder
Fixed in
4.4.6
What to do
Update Popup Builder to 4.4.6 or newer.
Full record and what to do →NVD record wpscan.com
Oct 23, 2026Otter Blocks: Does not correctly bound a pattern it uses to rewrite its dynamic-content tokens while rendering blocksCVE-2026-109936 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Otter Blocks WordPress plugin before 3.2.8 does not correctly bound a pattern it uses to rewrite its dynamic-content tokens while rendering blocks, so the pattern can consume the quote that closes an HTML attribute and pull adjacent unescaped data into the markup as new attributes. This allows unauthenticated users to achieve stored Cross-Site Scripting that executes in the browser of any visitor who views an affected page, including a logged-in administrator.
Product
Otter Blocks
Fixed in
3.2.8
What to do
Update Otter Blocks to 3.2.8 or newer.
Full record and what to do →NVD record wpscan.com
Oct 21, 2026Elementor Website Builder: Does not sanitize the text content of SVG filesCVE-2026-81813 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Elementor Website Builder WordPress plugin before 4.3.5 does not sanitize the text content of SVG files, checking only their elements and attributes, allowing users with the Contributor role and above to store a payload which breaks out when the SVG is rendered inline in a page and executes in the browser of any user viewing it. Execution is specific to Chromium-based browsers; Firefox is not affected.
Product
Elementor Website Builder
Fixed in
4.3.5
What to do
Update Elementor Website Builder to 4.3.5 or newer.
Full record and what to do →NVD record wpscan.com
Oct 18, 2026The Bootstrap Shortcodes plugin for WordPress before 3.4.6 is vulnerable to stored XSS via the id attribute of the [bs_tcontent] shortcode.CVE-2026-112111 · WordPress plugins & themes · reported by MITREMedium 5.1
The Bootstrap Shortcodes plugin for WordPress before 3.4.6 is vulnerable to stored XSS via the id attribute of the [bs_tcontent] shortcode. The bs_tcontent() shortcode handler in inc/bs_tabs.php emits the id attribute value into an unquoted HTML attribute. esc_attr() is applied, but it does not encode space characters, so a space in the supplied value terminates the attribute and any following text is parsed as additional HTML attributes, including JavaScript event handlers. This allows authenticated attackers with Contributor-level access and above to inject arbitrary web script that executes in the browser of any user who views the page and interacts with the injected element.
Product
Bootstrap Shortcodes
Fixed in
3.4.6
What to do
Update Bootstrap Shortcodes to 3.4.6 or newer.
Full record and what to do →NVD record github.com github.com
Oct 17, 2026The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin CVE-2026-96660 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Checkbox Field Value in all versions up to, and including, 5.2.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The nopriv AJAX action user_registration_user_form_submit reaches ur_process_registration() without nonce validation, meaning any unauthenticated request can reach the vulnerable code path.
Affected
up to 5.2.8
What to do
Affects up to 5.2.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 17, 2026The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin CVE-2026-92978 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.2.8 This is due to missing or incorrect nonce validation on the trigger_bulk_action function. This makes it possible for unauthenticated attackers to force administrators to approve pending user registrations or deny arbitrary user accounts, locking targeted users out of the site via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. An attacker can bypass the earlier nonce check in trigger_query_actions() by supplying an empty new_role parameter, which causes that handler to return early and cede control to the unprotected trigger_bulk_action() handler; the exit() call at the end of that handler additionally prevents WordPress core's own bulk-users nonce validation from executing.
Affected
up to 5.2.8
What to do
Affects up to 5.2.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 16, 2026The The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder pluCVE-2026-15222 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.2.8. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for authenticated attackers, with subscriber-level access and above, to execute arbitrary shortcodes.
Affected
up to 5.2.8
What to do
Affects up to 5.2.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 16, 2026NotificationX: Missing Authorization leading to arbitrary content injectionCVE-2026-110721 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The NotificationX plugin for WordPress is vulnerable to Missing Authorization leading to arbitrary content injection in versions up to, and including, 3.3.3 The /notificationx/v1/popup-submit REST route is registered with permission_callback => '__return_true', and the handler at PopupNotification::handle_popup_submission() accepts an attacker-controlled nx_id, loads whichever NotificationX campaign that id points to, and copies that campaign's own source into the new entry without verifying that the campaign is a Popup Notification or Exit Intent Popup (the two sources this form is intended to serve). This makes it possible for unauthenticated attackers to inject forged social-proof entries (name, title, message, email, theme) into any enabled non-popup NotificationX campaign — WP Comments, WooCommerce/EDD/Give sales, reviews, etc.
Product
NotificationX
Affected
up to 3.3.3
What to do
Affects up to 3.3.3. Update NotificationX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 13, 2026WP Testimonials: Does not properly escape testimonial content and reverses WordPress's HTML sanitizationCVE-2026-89269 · WordPress plugins & themes · reported by WPScanMedium 6.8
The WP Testimonials WordPress plugin through 1.4.13 does not properly escape testimonial content and reverses WordPress's HTML sanitization when rendering it, allowing users with the Author role and above to store JavaScript that executes in the session of any user viewing the testimonials, including administrators.
Product
WP Testimonials
Affected
up to 1.4.13
What to do
Affects up to 1.4.13. Update WP Testimonials to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Oct 11, 2026Topcontent: Does not properly authorise one of its request handlers and disables HTML sanitisation before storing the submitted contentCVE-2026-88903 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Topcontent WordPress plugin through 1.2.1 does not properly authorise one of its request handlers and disables HTML sanitisation before storing the submitted content, allowing unauthenticated attackers to publish arbitrary posts containing malicious JavaScript on any site where its API key has never been configured.
Product
Topcontent
Affected
up to 1.2.1
What to do
Affects up to 1.2.1. Update Topcontent to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Oct 11, 2026AI Content Generator Marketing: Does not enforce a nonce or capability check on some of its AJAX actionsCVE-2026-85118 · WordPress plugins & themes · reported by WPScanCritical 9.8
The AI Content Generator Marketing WordPress plugin through 1.0.0 does not enforce a nonce or capability check on some of its AJAX actions, allowing unauthenticated users to update and delete arbitrary WordPress options, which can be used to gain administrator access to the site.
Product
AI Content Generator Marketing
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update AI Content Generator Marketing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Oct 11, 2026click5 CRM add-on to Contact Form 7: Does not sanitise and escape content submitted through an unauthenticated endpoint before outputting it back in an admin pageCVE-2026-84261 · WordPress plugins & themes · reported by WPScanHigh 8.8
The click5 CRM add-on to Contact Form 7 WordPress plugin through 1.0.4 does not sanitise and escape content submitted through an unauthenticated endpoint before outputting it back in an admin page, leading to Stored XSS which could be used against high privilege users such as admin.
Product
click5 CRM add-on to Contact Form 7
Affected
up to 1.0.4
What to do
Affects up to 1.0.4. Update click5 CRM add-on to Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Oct 11, 2026click5 CRM add-on to Gravity Forms: Does not sanitise and escape content submitted through an unauthenticated endpoint before outputting it back in an admin pageCVE-2026-84260 · WordPress plugins & themes · reported by WPScanHigh 8.8
The click5 CRM add-on to Gravity Forms WordPress plugin through 1.0.3 does not sanitise and escape content submitted through an unauthenticated endpoint before outputting it back in an admin page, leading to Stored XSS which could be used against high privilege users such as admin.
Product
click5 CRM add-on to Gravity Forms
Affected
up to 1.0.3
What to do
Affects up to 1.0.3. Update click5 CRM add-on to Gravity Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Oct 11, 2026click5 CRM add-on to WPForms: Does not sanitise and escape content submitted through an unauthenticated endpoint before outputting it back in an admin pageCVE-2026-84259 · WordPress plugins & themes · reported by WPScanHigh 8.8
The click5 CRM add-on to WPForms WordPress plugin through 1.0.3 does not sanitise and escape content submitted through an unauthenticated endpoint before outputting it back in an admin page, leading to Stored XSS which could be used against high privilege users such as admin.
Product
click5 CRM add-on to WPForms
Affected
up to 1.0.3
What to do
Affects up to 1.0.3. Update click5 CRM add-on to WPForms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Oct 11, 2026click5 CRM add-on to Ninja Forms: Does not sanitise and escape content submitted through an unauthenticated endpoint before outputting it back in an admin pageCVE-2026-84258 · WordPress plugins & themes · reported by WPScanHigh 8.8
The click5 CRM add-on to Ninja Forms WordPress plugin through 1.0.1 does not sanitise and escape content submitted through an unauthenticated endpoint before outputting it back in an admin page, leading to Stored XSS which could be used against high privilege users such as admin.
Product
click5 CRM add-on to Ninja Forms
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update click5 CRM add-on to Ninja Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Oct 10, 2026Unauthenticated Arbitrary Content Deletion in Forminator <= 1.57.3 versions.CVE-2026-65459 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Arbitrary Content Deletion in Forminator <= 1.57.3 versions.
Affected
up to 1.57.3
What to do
Affects up to 1.57.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 10, 2026Unauthenticated Content Injection in Boutique <= 2.3.3 versions.CVE-2026-62098 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Content Injection in Boutique <= 2.3.3 versions.
Affected
up to 2.3.3
What to do
Affects up to 2.3.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 10, 2026The User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission plugin for WordPress is vulnCVE-2026-96574 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpuf_payment_method' parameter in all versions up to, and including, 4.3.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The bypass technique involves appending a valid gateway keyword such as 'bank' to the HTML payload, causing sanitize_text_field() to yield only the keyword for routing purposes while the full malicious raw value is stored and later rendered unescaped.
Affected
up to 4.3.12
What to do
Affects up to 4.3.12. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 10, 2026Tutor LMS: Does not verify that the posts named in its course content ordering requests belong to a course the requester managesCVE-2026-85571 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Tutor LMS WordPress plugin before 4.1.1 does not verify that the posts named in its course content ordering requests belong to a course the requester manages, allowing users with instructor level access to reassign the parent of any post on the site, taking other instructors' course content into their own courses and making arbitrary published content unreachable.
Product
Tutor LMS
Fixed in
4.1.1
What to do
Update Tutor LMS to 4.1.1 or newer.
Full record and what to do →NVD record wpscan.com
Oct 7, 2026If-So Dynamic Content: Does not validate the URL scheme of a request-supplied value before reflecting it into a link on an admin pageCVE-2026-87971 · WordPress plugins & themes · reported by WPScanHigh 7.1
The If-So Dynamic Content WordPress plugin before 1.10.2 does not validate the URL scheme of a request-supplied value before reflecting it into a link on an admin page, allowing attackers to execute arbitrary JavaScript in the browser of a logged-in user who opens a crafted link.
Product
If-So Dynamic Content
Fixed in
1.10.2
What to do
Update If-So Dynamic Content to 1.10.2 or newer.
Full record and what to do →NVD record wpscan.com
Oct 6, 2026Contributor Broken Access Control in WDS MCP Content Manager <= 3.10.4 versions.CVE-2026-39599 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Contributor Broken Access Control in WDS MCP Content Manager <= 3.10.4 versions.
Affected
up to 3.10.4
What to do
Affects up to 3.10.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 5, 2026WP Dummy Content Generator: Missing AuthorizationCVE-2026-39763 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Deepak Anand WP Dummy Content Generator wp-dummy-content-generator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Dummy Content Generator: from n/a through 4.0.0.
Product
WP Dummy Content Generator
Affected
up to 4.0.0
What to do
Affects up to 4.0.0. Update WP Dummy Content Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 3, 2026Nelio Content – Editorial Calendar & Social Media Auto-Posting: Authorization bypassCVE-2026-94505 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Nelio Content – Editorial Calendar & Social Media Auto-Posting plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5.0 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to permanently delete any reusable social message (nc_reusable_social post), including those authored by administrators or other privileged users.
Product
Nelio Content – Editorial Calendar & Social Media Auto-Posting
Affected
up to 4.5.0
What to do
Affects up to 4.5.0. Update Nelio Content – Editorial Calendar & Social Media Auto-Posting to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 3, 2026WP Ultimate CSV Importer: Does not properly validate the file types contained in an uploaded archive nor sanitise their content before storing them in a publicly served locationCVE-2026-80517 · WordPress plugins & themes · reported by WPScanLow 3.5
The WP Ultimate CSV Importer WordPress plugin before 9.2 does not properly validate the file types contained in an uploaded archive nor sanitise their content before storing them in a publicly served location, allowing high privilege users such as administrators to achieve Stored Cross-Site Scripting. On Multisite installations a site Administrator does not hold the unfiltered_html capability, so this lets them run scripts in the session of users who view the file, including Network Super Admins.
Product
WP Ultimate CSV Importer
Fixed in
9.2
What to do
Update WP Ultimate CSV Importer to 9.2 or newer.
Full record and what to do →NVD record wpscan.com
Oct 3, 2026Photo Reviews for WooCommerce: Arbitrary Content DeletionCVE-2026-101923 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Photo Reviews for WooCommerce plugin for WordPress is vulnerable to Arbitrary Content Deletion in versions up to, and including, 1.2.30. This is due to the plugin storing attacker-controlled post IDs from the wcpr_image_upload_id parameter of a public review submission into the review's reviews-images comment meta without verifying that the IDs correspond to attachments owned by the submitter, combined with the delete_reviews_image() handler unconditionally calling wp_delete_post( $id, true ) on every stored ID when the review is deleted. This makes it possible for unauthenticated attackers to permanently delete arbitrary posts, pages, products, or media attachments on the site whenever an administrator subsequently deletes the attacker's review (or when WordPress's built-in wp_scheduled_delete cron empties the comment trash after 30 days).
Product
Photo Reviews for WooCommerce
Affected
up to 1.2.30
What to do
Affects up to 1.2.30. Update Photo Reviews for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 3, 2026WP Ultimate Review: Does not prevent unauthenticated users from storing crafted review content that makes the reviewed page fail with a fatal error on every subsequent visitCVE-2026-101161 · WordPress plugins & themes · reported by WPScanHigh 7.5
The WP Ultimate Review WordPress plugin before 2.4.4 does not prevent unauthenticated users from storing crafted review content that makes the reviewed page fail with a fatal error on every subsequent visit, resulting in a persistent denial of service when the WP Ultimate Review WordPress plugin before 2.4.4's review display settings have never been saved.
Product
WP Ultimate Review
Fixed in
2.4.4
What to do
Update WP Ultimate Review to 2.4.4 or newer.
Full record and what to do →NVD record wpscan.com
Oct 3, 2026Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress: Reflected Cross-Site ScriptingCVE-2026-92551 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via ppress_billing_address Filename Parameter in all versions up to, and including, 4.17.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. The vulnerability is exploitable via any page hosting the ProfilePress Tabbed Widget by supplying a malicious filename for the ppress_billing_address file upload field in a crafted POST request.
Product
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress
Affected
up to 4.17.4
What to do
Affects up to 4.17.4. Update Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record pastebin.com plugins.trac.wordpress.org
Oct 3, 2026Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress: Sensitive Information ExposureCVE-2026-92536 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.17.4 via the get_user_profile_structure. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract other users' email addresses, login names, and registration dates via the Member Directory's per-row user rebinding when attacker-controlled base64 payloads in the [pp-custom-html] shortcode invoke [profile-email], [profile-username], and [profile-date-registered]. When the WordPress users_can_register option is enabled, unauthenticated attackers can also exploit this vulnerability by supplying the split shortcode fragments through the plugin's own registration handler, which processes the reg_nickname and reg_bio fields without a nonce requirement.
Product
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress
Affected
up to 4.17.4
What to do
Affects up to 4.17.4. Update Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 2, 2026Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership: Stored Cross-Site ScriptingCVE-2026-96270 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'form_id' parameter in all versions up to, and including, 2.13.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload is stored in the registering user's 'submitted' usermeta via update_user_meta() and is only triggered when an administrator opens the affected user record in the wp-admin Users modal, which inserts the unescaped output via jQuery .html().
Product
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership
Affected
up to 2.13.1
What to do
Affects up to 2.13.1. Update Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Oct 2, 2026Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership: Authorization bypassCVE-2026-93428 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.13.1 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to view privacy-restricted member profile field values — including fields explicitly configured as owner-only, members-only, or role-restricted — by querying the publicly accessible wp_ajax_nopriv_um_get_members endpoint. The nonce required by the endpoint ('um-frontend-nonce') is emitted to all unauthenticated visitors via wp_localize_script, meaning it provides no meaningful access control and any anonymous visitor can satisfy the endpoint's authentication requirements.
Product
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership
Affected
up to 2.13.1
What to do
Affects up to 2.13.1. Update Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Oct 2, 2026Tabs Responsive: Does not sanitize the content of WooCommerce product tabs before storing and rendering itCVE-2026-13718 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Tabs Responsive WordPress plugin through 2.5 does not sanitize the content of WooCommerce product tabs before storing and rendering it, allowing a shop manager to store JavaScript that executes when any user, including an administrator, views the product page.
Product
Tabs Responsive
Affected
up to 2.5
What to do
Affects up to 2.5. Update Tabs Responsive to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Oct 1, 2026If-So Dynamic Content: Does not sanitize a conversion name before storing itCVE-2026-87973 · WordPress plugins & themes · reported by WPScanLow 3.1
The If-So Dynamic Content WordPress plugin before 1.10.2 does not sanitize a conversion name before storing it, nor escape it when rendering the analytics page, allowing users with editor-level access to store JavaScript that executes in the session of a higher-privileged user who views that page.
Product
If-So Dynamic Content
Fixed in
1.10.2
What to do
Update If-So Dynamic Content to 1.10.2 or newer.
Full record and what to do →NVD record wpscan.com
Oct 1, 2026If-So Dynamic Content: Does not escape a request-supplied value before reflecting it in an unauthenticated AJAX response that is servedCVE-2026-87970 · WordPress plugins & themes · reported by WPScanMedium 4.7
The If-So Dynamic Content WordPress plugin before 1.10.2 does not escape a request-supplied value before reflecting it in an unauthenticated AJAX response that is served as HTML, allowing attackers to execute arbitrary JavaScript in the browser of a visitor who opens a crafted link.
Product
If-So Dynamic Content
Fixed in
1.10.2
What to do
Update If-So Dynamic Content to 1.10.2 or newer.
Full record and what to do →NVD record wpscan.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.