Updated 11 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

343new WordPress flaws this week

390,080entries in the database

225,703 results · page 1 of 4515

Oct 29, 2026Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI: Sensitive Information ExposureCVE-2026-91153 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.6.2 via the process. This makes it possible for unauthenticated attackers to extract arbitrary WordPress post meta values — including license keys, API tokens, SMTP credentials, and Stripe or AWS secrets stored on any post type — via form submission notification emails or stored entries. The submission nonce is publicly rendered in every embedded form and can additionally be minted anonymously via the nopriv everest_forms_get_form_update_nonce action, meaning no account or prior authentication of any kind is required to complete the exploit.
Product
Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI
Affected
up to 3.6.2
What to do
Affects up to 3.6.2. Update Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Oct 29, 2026JoomSport – for Sports: Team & League, Football, Hockey & more: Generic SQL InjectionCVE-2026-118192 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to generic SQL Injection via the 'team_id' parameter in all versions up to, and including, 5.7.11 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The vulnerable code path is reached when the season has no associated joomsport_tournament term, which is the default state for newly created seasons.
Product
JoomSport – for Sports: Team & League, Football, Hockey & more
Affected
up to 5.7.11
What to do
Affects up to 5.7.11. Update JoomSport – for Sports: Team & League, Football, Hockey & more to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 29, 2026Improper certificate validation in Checkmk <2.5.0p18, <2.4.0p39, <2.3.0p52 and 2.2.0 (EOL): the Certificate Authority stores bundled with "certifi" and "webpki-CVE-2026-117611 · Other software · Checkmk GmbH · reported by security@checkmk.comHigh 7.1
Improper certificate validation in Checkmk <2.5.0p18, <2.4.0p39, <2.3.0p52 and 2.2.0 (EOL): the Certificate Authority stores bundled with "certifi" and "webpki-roots" include a root CA that trusts eMudhra (emSign) intermediate certificates whose private keys are public.
Product
Checkmk
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record checkmk.com checkmk.com
Oct 29, 2026A sensitive information exposure vulnerability exists on the Foxit official website because JavaScript code contains third-party authorization information.CVE-2026-111419 · Other software · Foxit Software Inc. · reported by 14984358-7092-470d-8f34-ade47a7658a2High 8.6
A sensitive information exposure vulnerability exists on the Foxit official website because JavaScript code contains third-party authorization information. This may allow unauthorized parties to obtain or misuse the exposed credentials.
Product
foxit.com
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record foxit.com
Oct 29, 2026A server-side request forgery (SSRF) vulnerability exists in the Foxit official website’s HTML-to-PDF conversion service.CVE-2026-111418 · Other software · Foxit Software Inc. · reported by 14984358-7092-470d-8f34-ade47a7658a2High 7.5
A server-side request forgery (SSRF) vulnerability exists in the Foxit official website’s HTML-to-PDF conversion service. Support for ZIP-formatted input can bypass restrictions on requests to internal IP addresses, potentially allowing discovery of internal network resources.
Product
foxit.com
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record foxit.com
Oct 29, 2026A broken access control vulnerability exists in the Foxit official website’s HTML-to-PDF conversion service due to the use of a shared token for submitted conveCVE-2026-111417 · Other software · Foxit Software Inc. · reported by 14984358-7092-470d-8f34-ade47a7658a2High 7.5
A broken access control vulnerability exists in the Foxit official website’s HTML-to-PDF conversion service due to the use of a shared token for submitted conversion documents. This may allow unauthorized users to access documents submitted by other users.
Product
foxit.com
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record foxit.com
Oct 29, 2026Greenshift – animation and page builder blocks: Stored DOM-Based Cross-Site ScriptingCVE-2026-107629 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 13.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the affected post page to include an Advanced HTML Element block with Split Text animation enabled wrapping a Latest Comments block that displays comment excerpts, as this configuration causes splittext.js to be enqueued and to process the comment content container.
Product
Greenshift – animation and page builder blocks
Affected
up to 13.2.1
What to do
Affects up to 13.2.1. Update Greenshift – animation and page builder blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 29, 2026Greenshift – animation and page builder blocks: Stored DOM-Based Cross-Site ScriptingCVE-2026-107627 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 13.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires an administrator to have published a page containing a Text Animated block with Content set to Blocks, a Latest Comments block with excerpts enabled nested inside it, and at least one Animated Texts value configured — conditions that cause the gs-textanimate script to be enqueued and process the comment excerpts.
Product
Greenshift – animation and page builder blocks
Affected
up to 13.2.1
What to do
Affects up to 13.2.1. Update Greenshift – animation and page builder blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 29, 2026Extensions for Leaflet Map: Stored DOM-Based Cross-Site ScriptingCVE-2026-103485 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Extensions for Leaflet Map plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'feature.properties[<template-token>]' parameter in all versions up to, and including, 5.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that a site administrator has previously configured a public map using the [leaflet-map]+[leaflet-geojson]+[choropleth] shortcode combination whose GeoJSON src URL is one the attacker controls — for example, through compromise of an external data host, a subdomain takeover, or a site intentionally pointing at an attacker-hosted feed.
Product
Extensions for Leaflet Map
Affected
up to 5.4
What to do
Affects up to 5.4. Update Extensions for Leaflet Map to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record downloads.wordpress.org plugins.trac.wordpress.org
Oct 29, 2026A cross-site scripting (XSS) vulnerability in the ICTBroadcast software, which affects the demo environment.CVE-2026-7190 · Other software · ICT Innovations · reported by cve-coordination@incibe.esMedium 5.1
A cross-site scripting (XSS) vulnerability in the ICTBroadcast software, which affects the demo environment. The vulnerability is found in the ‘login.php’ endpoint, where the ‘editForm[extension_username]’ parameter is reflected in the response without proper filtering. Successful exploitation of this vulnerability could allow an attacker to execute arbitrary JavaScript code in the victim’s browser once the victim accesses the malicious URL.
Product
ICT Innovations’ PHP-CGI/PHP-FPM configuration
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record incibe.es
Oct 29, 2026This vulnerability exists in the Radius Xenia M2M Platform due to insufficient validation of user supplied input in the password recovery functionality in the wCVE-2026-114358 · Other software · Radius Synergies · reported by vdisclose@cert-in.org.inCritical 9.3
This vulnerability exists in the Radius Xenia M2M Platform due to insufficient validation of user supplied input in the password recovery functionality in the web management interface. An unauthenticated remote attacker could exploit this vulnerability by supplying crafted SQL query through input fields to the targeted system. Successful exploitation of this vulnerability could allow the attacker to gain unauthorized access to sensitive information, enumerate database structure or modify database records on the targeted system.
Product
Radius Xenia M2M Platform
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cert-in.org.in
Oct 29, 2026A flaw was found in the HOTP authentication mechanism of the keycloak-services component, which provides identity and access management services.CVE-2026-118030 · Other software · Red Hat · reported by Red HatMedium 4.2
A flaw was found in the HOTP authentication mechanism of the keycloak-services component, which provides identity and access management services. The issue occurs because the system validates a one-time password and updates its internal counter in two separate steps without proper locking. An attacker with a users password could exploit this timing gap to use a single one-time code to log in multiple times simultaneously.
Product
Red Hat Build of Keycloak
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record access.redhat.com bugzilla.redhat.com
Oct 29, 2026A flaw was found in the Pushed Authorization Request PAR implementation of the keycloak-services component.CVE-2026-117859 · Other software · Red Hat · reported by Red HatMedium 5.4
A flaw was found in the Pushed Authorization Request PAR implementation of the keycloak-services component. The issue occurs when an authentication flow is restarted, which incorrectly clears the internal markers used to track PAR consumption while leaving the request active. This allows an attacker to reuse the same authorization request to obtain multiple access tokens, bypassing security requirements for single-use requests.
Product
Red Hat Build of Keycloak
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record access.redhat.com bugzilla.redhat.com
Oct 29, 2026A flaw was found in the client registration component of Keycloak, an open-source identity and access management solution.CVE-2026-117688 · Other software · Red Hat · reported by Red HatMedium 5.3
A flaw was found in the client registration component of Keycloak, an open-source identity and access management solution. When a vault provider is used to store sensitive information, an authenticated client owner can use a specially crafted reference to trick the system into revealing secrets. By updating a client secret to point to a vault entry and then requesting the client configuration, the owner can see the secret value in plain text. This could lead to the exposure of sensitive credentials that the user should not be able to access.
Product
Red Hat Build of Keycloak
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record access.redhat.com bugzilla.redhat.com
Oct 29, 2026A flaw was found in the JWT Authorization Grant implementation of the keycloak-services component.CVE-2026-117627 · Other software · Red Hat · reported by Red HatMedium 5.4
A flaw was found in the JWT Authorization Grant implementation of the keycloak-services component. When an OIDC or Google identity provider is configured with specific login restrictions, such as claim filtering, these checks are correctly applied during standard browser logins but are skipped during the JWT-based grant flow. This allows an authenticated client to obtain access tokens for a user even if their identity provider claims should have blocked the login.
Product
Red Hat Build of Keycloak
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record access.redhat.com bugzilla.redhat.com
Oct 29, 2026PAYCOMET for WooCommerce: Does not verify the cryptographic signature on its payment notification endpointCVE-2026-88928 · WordPress plugins & themes · reported by WPScan
The PAYCOMET for WooCommerce WordPress plugin before 5.46 does not verify the cryptographic signature on its payment notification endpoint when the request references a tokenisation operation, allowing unauthenticated attackers to overwrite the stored payment token associated with existing orders and delete saved card records.
Product
PAYCOMET for WooCommerce
Fixed in
5.46
What to do
Update PAYCOMET for WooCommerce to 5.46 or newer.
Full record and what to do →NVD record wpscan.com
Oct 29, 2026Community Events: Does not have authorisation or nonce checksCVE-2026-86794 · WordPress plugins & themes · reported by WPScan
The Community Events WordPress plugin before 1.6.0 does not have authorisation or nonce checks when processing public event submissions, and does not escape several of the submitted values before outputting them in the administration dashboard and on the public calendar, allowing unauthenticated users to inject arbitrary web scripts that will execute in the browser of an administrator reviewing the submission.
Product
Community Events
Fixed in
1.6.0
What to do
Update Community Events to 1.6.0 or newer.
Full record and what to do →NVD record wpscan.com
Oct 29, 2026A flaw was found in the platform-mbean component of JBoss EAP, which provides management access to JVM-level metrics and configurations.CVE-2026-19610 · Other software · Red Hat · reported by Red HatMedium 6.5
A flaw was found in the platform-mbean component of JBoss EAP, which provides management access to JVM-level metrics and configurations. The issue occurs because the handler for the read-resource operation on the runtime management resource fails to perform required Role-Based Access Control (RBAC) checks. This allows an authenticated user with low-privileged access, such as the Monitor role, to view sensitive system properties and JVM configuration details that should be restricted.
Product
Red Hat JBoss Enterprise Application Platform 7
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record access.redhat.com bugzilla.redhat.com
Oct 29, 2026Wildfly's IIOP listener may permit deserialization of input streams before authentication is performed.CVE-2026-15564 · Other software · Red Hat · reported by Red HatHigh 7.4
Wildfly's IIOP listener may permit deserialization of input streams before authentication is performed. An attacker who can gain access to the IIOP port may be able to construct and send malicious objects and achieve deserialization, if the target EJB allows untyped method parameters, and depending on the potential gadget chains available in the running classpath.
Product
Red Hat JBoss Enterprise Application Platform 7
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record access.redhat.com bugzilla.redhat.com
Oct 29, 2026Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions.CVE-2026-118905 · Other software · nvm-sh · reported by 7ffcee3d-2c14-4c3e-b844-86c6a321a158High 7.1
Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.31.2 through 0.40.5, `nvm_ls` filters installed versions with a sed program that embeds the requested version pattern in a `\#...#` address, escaping `.` (and, since 0.40.4, `#`) but not backslash. A version string containing `#` (or `\#`) therefore closes the address early, and the rest of it is parsed as sed commands: with GNU sed, the `e` command runs a shell command as the user; with BSD sed, the `w` and `r` commands write and read files. This is reachable whenever an attacker-influenced version string is passed to `nvm use`, `nvm which`, `nvm ls`, `nvm version`, `nvm run`, or `nvm exec`, or to `nvm-exec` via `NODE_VERSION`, and at least one version is installed. nvm's own `.nvmrc` parser strips comments, so a bare `nvm use` is not affected; however, the bash `cdnvm` and zsh `load-nvmrc` auto-switch hooks documented in the README read `.nvmrc` as-is and pass it to `nvm ls` and `nvm version`, so a user with one of those hooks installed runs the attacker's command just by changing into a directory under a malicious `.nvmrc`; scripts that run `nvm use "$(cat .nvmrc)
Product
nvm
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Oct 29, 2026Contact Form by Supsystic: Does not restrict access to an AJAX action that deletes stored form statistics recordsCVE-2026-115302 · WordPress plugins & themes · reported by WPScan
The Contact Form by Supsystic WordPress plugin before 1.11.1 does not restrict access to an AJAX action that deletes stored form statistics records, allowing unauthenticated attackers to delete arbitrary statistics entries.
Product
Contact Form by Supsystic
Fixed in
1.11.1
What to do
Update Contact Form by Supsystic to 1.11.1 or newer.
Full record and what to do →NVD record wpscan.com
Oct 29, 2026Contact Form by Supsystic: Does not validate a CSRF token or request origin on two administrator-only actions that bulk-delete captured form submissions and wipe a form's statisticsCVE-2026-115300 · WordPress plugins & themes · reported by WPScan
The Contact Form by Supsystic WordPress plugin before 1.11.1 does not validate a CSRF token or request origin on two administrator-only actions that bulk-delete captured form submissions and wipe a form's statistics, allowing attackers to permanently destroy a site's stored contact leads and analytics by tricking a logged-in administrator into sending a forged request.
Product
Contact Form by Supsystic
Fixed in
1.11.1
What to do
Update Contact Form by Supsystic to 1.11.1 or newer.
Full record and what to do →NVD record wpscan.com
Oct 29, 2026Recipe Card Blocks Lite: Does not perform an authorization check before rendering posts through its recipe print featureCVE-2026-115282 · WordPress plugins & themes · reported by WPScan
The Recipe Card Blocks Lite WordPress plugin before 3.6.4 does not perform an authorization check before rendering posts through its recipe print feature, allowing unauthenticated users to disclose the title, ID and recipe content of unpublished posts, including drafts, pending, private and password-protected posts, that contain a recipe card block. Its optional "print only published posts" protection does not prevent this, because the status check is applied to a different post than the one ultimately rendered.
Product
Recipe Card Blocks Lite
Fixed in
3.6.4
What to do
Update Recipe Card Blocks Lite to 3.6.4 or newer.
Full record and what to do →NVD record wpscan.com
Oct 29, 2026Photo Engine (Media Organizer & Lightroom): Does not have proper authorization checksCVE-2026-115259 · WordPress plugins & themes · reported by WPScan
The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.6.0 does not have proper authorization checks when updating post data through one of its REST API routes in all versions up to, and including, 6.5.8. This makes it possible for authenticated attackers, with Author-level access and above, to modify the title, content, excerpt and other fields of arbitrary posts, pages and attachments, including those belonging to other users.
Product
Photo Engine (Media Organizer & Lightroom)
Affected
up to 6.5.8
Fixed in
6.6.0
What to do
Update Photo Engine (Media Organizer & Lightroom) to 6.6.0 or newer.
Full record and what to do →NVD record wpscan.com
Oct 29, 2026GeoDirectory: Does not honour post password protectionCVE-2026-114270 · WordPress plugins & themes · reported by WPScan
The GeoDirectory WordPress plugin before 2.8.197 does not honour post password protection when rendering a listing, allowing unauthenticated users to disclose the content and custom fields of published listings that are protected by a post password.
Product
GeoDirectory
Fixed in
2.8.197
What to do
Update GeoDirectory to 2.8.197 or newer.
Full record and what to do →NVD record wpscan.com
Oct 29, 2026Two Factor Authentication WordPress plugin before 1.17.0, All-In-One Security (AIOS): Do not bind the account whose two-factor code is verified to the account being authenticatedCVE-2026-111739 · WordPress plugins & themes · reported by WPScan
The Two Factor Authentication WordPress plugin before 1.17.0, All-In-One Security (AIOS) WordPress plugin before 5.5.0 do not bind the account whose two-factor code is verified to the account being authenticated, allowing an attacker who knows a victim's password and holds their own two-factor-enabled account to satisfy the victim's second-factor check with their own code and obtain the victim's session.
Product
Two Factor Authentication WordPress plugin before 1.17.0, All-In-One Security (AIOS)
Fixed in
1.17.0
What to do
Update Two Factor Authentication WordPress plugin before 1.17.0, All-In-One Security (AIOS) to 1.17.0 or newer.
Full record and what to do →NVD record wpscan.com
Oct 29, 2026Enable SVG, WebP, and ICO Upload: Does not prevent animation elements in uploaded SVG files from changing a link's target to a javascript: URICVE-2026-110505 · WordPress plugins & themes · reported by WPScan
The Enable SVG, WebP, and ICO Upload WordPress plugin before 1.1.6 does not prevent animation elements in uploaded SVG files from changing a link's target to a javascript: URI, which could allow users with the author role and above to bypass its SVG sanitization and perform Stored Cross-Site Scripting attacks that execute in WebKit-based browsers such as Safari.
Product
Enable SVG, WebP, and ICO Upload
Fixed in
1.1.6
What to do
Update Enable SVG, WebP, and ICO Upload to 1.1.6 or newer.
Full record and what to do →NVD record wpscan.com
Oct 29, 2026Hide Price Until Login: Does not restrict a guest-registration handler and does not honour the site's user-registration settingCVE-2026-110030 · WordPress plugins & themes · reported by WPScan
The Hide Price Until Login WordPress plugin before 1.1.2 does not restrict a guest-registration handler and does not honour the site's user-registration setting, allowing anyone to create a WordPress account and obtain a logged-in session even when registration is disabled.
Product
Hide Price Until Login
Fixed in
1.1.2
What to do
Update Hide Price Until Login to 1.1.2 or newer.
Full record and what to do →NVD record wpscan.com
Oct 29, 2026Wallet System for WooCommerce: Does not restrict its KYC document submission handler to the current user's own accountCVE-2026-108763 · WordPress plugins & themes · reported by WPScan
The Wallet System for WooCommerce WordPress plugin before 2.8.2 does not restrict its KYC document submission handler to the current user's own account, taking the target user ID from a client-supplied request field with no ownership or capability check, allowing authenticated users with minimal privileges such as Subscriber or Customer to overwrite the KYC documents and verification status of any other user, including an administrator.
Product
Wallet System for WooCommerce
Fixed in
2.8.2
What to do
Update Wallet System for WooCommerce to 2.8.2 or newer.
Full record and what to do →NVD record wpscan.com
Oct 29, 2026WP Post Author: Does not restrict the integration settings it returns to visitorsCVE-2026-108686 · WordPress plugins & themes · reported by WPScan
The WP Post Author WordPress plugin before 4.2.0 does not restrict the integration settings it returns to visitors, allowing unauthenticated users to read the reCAPTCHA secret key when one has been saved.
Product
WP Post Author
Fixed in
4.2.0
What to do
Update WP Post Author to 4.2.0 or newer.
Full record and what to do →NVD record wpscan.com
Oct 29, 2026WP Post Author: Does not check that the account was created before updating its profile during front-end registrationCVE-2026-108685 · WordPress plugins & themes · reported by WPScan
The WP Post Author WordPress plugin before 4.2.0 does not check that the account was created before updating its profile during front-end registration, allowing unauthenticated users to overwrite the display name, nickname and website of the first user account, which is normally the administrator, when a registration form declares one of those fields.
Product
WP Post Author
Fixed in
4.2.0
What to do
Update WP Post Author to 4.2.0 or newer.
Full record and what to do →NVD record wpscan.com
Oct 29, 2026SSL Wireless SMS Notification for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 3.8.1.CVE-2026-96228 · WordPress plugins & themes · reported by WordfenceHigh 8.1
SSL Wireless SMS Notification for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 3.8.1. The public final_login_ajax_action handler resolves a user and issues an authenticated session by matching the wp_sslcare_otp table on only the attacker-supplied phone and cap_data, without verifying the SMS OTP or any server-side single-use state. Because cap_data was chosen by the attacker in the public otp_login_ajax_action step (which stores the row before sending the SMS), the finalize step trivially matches and the user is looked up solely by the sslcare_login_phone meta. This makes it possible for unauthenticated attackers who know a phone-linked user's number to take over that account.
Affected
up to 3.8.1
What to do
Affects up to 3.8.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.svn.wordpress.org wordfence.com
Oct 29, 2026Social Web Suite – Social Media Auto Post, Social Media Auto Publish: Generic SQL InjectionCVE-2026-93904 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Social Web Suite – Social Media Auto Post, Social Media Auto Publish plugin for WordPress is vulnerable to generic SQL Injection via the 'exclude_posts' parameter in all versions up to, and including, 4.1.12 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The HMAC authentication gate protecting the endpoint is bypassable on any freshly activated installation where an administrator has not yet visited the settings page, because the secret_key option remains empty until lazily generated at that point, allowing an attacker to compute a valid token using hash_hmac('sha256', '', $timestamp) with any chosen timestamp.
Product
Social Web Suite – Social Media Auto Post, Social Media Auto Publish
Affected
up to 4.1.12
What to do
Affects up to 4.1.12. Update Social Web Suite – Social Media Auto Post, Social Media Auto Publish to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 29, 2026SendPress Newsletters: Time-based SQL InjectionCVE-2026-93855 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The SendPress Newsletters plugin for WordPress is vulnerable to time-based SQL Injection via the 'subscriberid' parameter in all versions up to, and including, 1.26.1.20 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The nonce gating the handler uses the hardcoded action value 'sendpress-is-awesome', which is rendered on the same public page served by the [sp-form formid="manage"] shortcode, making it trivially obtainable by unauthenticated visitors and effectively bypassing the nonce as an access control.
Product
SendPress Newsletters
Affected
up to 1.26.1.20
What to do
Affects up to 1.26.1.20. Update SendPress Newsletters to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 29, 2026Wild Apricot Login: Authentication BypassCVE-2026-93757 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Wild Apricot Login plugin for WordPress is vulnerable to Authentication Bypass via SSO Email-Collision Account Binding in all versions up to, and including, 1.0.18. When no WildApricot contact-ID mapping is found for an incoming SSO login, the plugin falls back to a network-global `get_user_by('email', ...)` lookup in `Module.php` to resolve a WordPress user, then `UserSynchronizer::syncWaContact()` binds and `Controller::login()` issues a session cookie via `wp_set_auth_cookie()` for that resolved user — both guarded only by `is_super_admin()` — without ever requiring proof of ownership of the matched WordPress account such as a password, local account-linking confirmation, inbox verification, or administrator approval. This makes it possible for attackers with custom-level WildApricot membership access to authenticate as an existing WordPress subsite administrator on a path-based Multisite network, obtaining a valid network-global authentication cookie for the victim without their credentials. Exploitation requires that the attacker control a WildApricot contact whose email address matches the target WordPress administrator's email — achievable via a public zero-fee membershi
Product
Wild Apricot Login
Affected
up to 1.0.18
What to do
Affects up to 1.0.18. Update Wild Apricot Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 29, 2026A authorization bypass vulnerability exists in the /api/runscript functionality of FUXA (version(s): 1.3.2-2809).CVE-2026-42949 · Other software · frangoteam · reported by talos-cna@cisco.comMedium 5.6
A authorization bypass vulnerability exists in the /api/runscript functionality of FUXA (version(s): 1.3.2-2809). A specially crafted HTTP request can lead to execute priviledged operation. An attacker can make an unauthenticated HTTP request to trigger this vulnerability.
Product
Frangoteam
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record talosintelligence.com
Oct 29, 2026A authorization bypass vulnerability exists in the /nodered functionality of FUXA (version(s): 1.3.2-2809).CVE-2026-42922 · Other software · frangoteam · reported by talos-cna@cisco.comCritical 9.8
A authorization bypass vulnerability exists in the /nodered functionality of FUXA (version(s): 1.3.2-2809). A specially crafted HTTP request can lead to a arbitrary code execution. An attacker can make an unauthenticated HTTP request to trigger this vulnerability.
Product
Frangoteam
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record talosintelligence.com
Oct 29, 2026A information disclosure vulnerability exists in the /nodered/fuxa/scripts functionality of FUXA (version(s): 1.3.2-2809).CVE-2026-40063 · Other software · frangoteam · reported by talos-cna@cisco.comMedium 5.3
A information disclosure vulnerability exists in the /nodered/fuxa/scripts functionality of FUXA (version(s): 1.3.2-2809). A specially crafted HTTP request can lead to an information leak. An attacker can make an unauthenticated HTTP request to trigger this vulnerability.
Product
Frangoteam
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record talosintelligence.com
Oct 29, 2026In affected versions of Octopus Server with the LDAP authentication provider enabled, any authenticated user could call the LDAP user search and LDAP group searCVE-2026-118426 · Other software · Octopus Deploy · reported by security@octopus.comMedium 5.3
In affected versions of Octopus Server with the LDAP authentication provider enabled, any authenticated user could call the LDAP user search and LDAP group search.
Product
Octopus Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record advisories.octopus.com
Oct 29, 2026Bot for Telegram on WooCommerce: Authentication Bypass leading to Account TakeoverCVE-2026-109516 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Bot for Telegram on WooCommerce plugin for WordPress is vulnerable to Authentication Bypass leading to Account Takeover in all versions up to, and including, 1.3.0. The `/wp-json/woo-telegram/v1/main/` REST endpoint is registered with `permission_callback => '__return_true'` and performs no Telegram webhook signature verification, allowing an unauthenticated attacker to POST a forged bot update with a `message.chat.id` set to any WordPress login name; `bftow_get_user_system_id()` resolves this attacker-supplied value to the targeted account via `get_user_by('login', $tgId)` with no ownership proof, and writes a login token computed as `md5($_SERVER['HTTP_USER_AGENT'] . time())` — both inputs are fully attacker-controlled or bounded within seconds using the response's own `Date` header. The resulting token is redeemable at the unauthenticated, capability-check-free, and nonce-less `?action=bftow_create_order&bftow_token=` endpoint, which calls `wp_set_auth_cookie()` unconditionally via `login_user_by_id`, issuing a persistent authenticated session cookie for the targeted account to the attacker. This makes it possible for unauthenticated attackers to log in as any WordPress user
Product
Bot for Telegram on WooCommerce
Affected
up to 1.3.0
What to do
Affects up to 1.3.0. Update Bot for Telegram on WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 28, 2026In openEQUELLA before 2026.2, the pre-login notice is stored as HTML and rendered on the legacy logon page without encoding or sanitisation.CVE-2026-66092 · Other software · Apereo Foundation · reported by 9c1820ae-fb77-4810-a8aa-ca46e7474d2fMedium 4.8
In openEQUELLA before 2026.2, the pre-login notice is stored as HTML and rendered on the legacy logon page without encoding or sanitisation. A user holding the EDIT_SYSTEM_SETTINGS permission can set a notice containing an arbitrary script (PUT /api/preloginnotice), resulting in stored cross-site scripting on the login page. Unauthenticated exploitation is possible where EDIT_SYSTEM_SETTINGS has been granted to the guest user or Everyone
Product
openEQUELLA
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com openequella.github.io
Oct 28, 2026In openEQUELLA before 2026.1, the GET /api/userquery/userinfobackup endpoint performs no authentication or authorisation check.CVE-2026-66091 · Other software · Apereo Foundation · reported by 9c1820ae-fb77-4810-a8aa-ca46e7474d2fMedium 6.9
In openEQUELLA before 2026.1, the GET /api/userquery/userinfobackup endpoint performs no authentication or authorisation check. An unauthenticated attacker who supplies another user's uniqueId can retrieve that user's stored personal details (username, first name, last name and email address) within the same institution.
Product
openEQUELLA
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com openequella.github.io
Oct 28, 2026In openEQUELLA before 2026.1, the XML parser used for item metadata does not disable external entity resolution.CVE-2026-66090 · Other software · Apereo Foundation · reported by 9c1820ae-fb77-4810-a8aa-ca46e7474d2fHigh 7.1
In openEQUELLA before 2026.1, the XML parser used for item metadata does not disable external entity resolution. A user permitted to create items (CREATE_ITEM) can submit crafted XML to POST /api/item and cause the server to read arbitrary files accessible to the openEQUELLA service, or make requests to attacker-specified locations (SSRF), including cloud instance metadata services.
Product
openEQUELLA
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com openequella.github.io
Oct 28, 2026In openEQUELLA before 2026.1, the SOAP API parses XML supplied in the stopEdit operation with a parser that resolves external entities.CVE-2026-66089 · Other software · Apereo Foundation · reported by 9c1820ae-fb77-4810-a8aa-ca46e7474d2fMedium 6.1
In openEQUELLA before 2026.1, the SOAP API parses XML supplied in the stopEdit operation with a parser that resolves external entities. This allows an attacker to read arbitrary files accessible to the openEQUELLA service or cause the server to issue requests to attacker-specified locations (SSRF).
Product
openEQUELLA
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com openequella.github.io
Oct 28, 2026In openEQUELLA before 2026.1, the system.execute() function available to the scripting engine runs supplied operating system commands without validation or an aCVE-2026-66088 · Other software · Apereo Foundation · reported by 9c1820ae-fb77-4810-a8aa-ca46e7474d2fCritical 9.4
In openEQUELLA before 2026.1, the system.execute() function available to the scripting engine runs supplied operating system commands without validation or an allow-list of permitted executables. A user able to create or edit scripts can use it to execute arbitrary commands with the privileges of the openEQUELLA service account.
Product
openEQUELLA
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com openequella.github.io
Oct 28, 2026In openEQUELLA before 2026.1, the pre-login notice image upload endpoint (PUT /api/preloginnotice/image/{name}) does not validate the type of uploaded files andCVE-2026-16889 · Other software · Apereo Foundation · reported by 9c1820ae-fb77-4810-a8aa-ca46e7474d2fMedium 4.8
In openEQUELLA before 2026.1, the pre-login notice image upload endpoint (PUT /api/preloginnotice/image/{name}) does not validate the type of uploaded files and serves them with a Content-Type derived from the supplied filename. A user holding the EDIT_SYSTEM_SETTINGS permission can upload an HTML file that is then served as text/html from the openEQUELLA origin, resulting in stored cross-site scripting. Unauthenticated exploitation is possible where EDIT_SYSTEM_SETTINGS has been granted to the guest user or everyone.
Product
openEQUELLA
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com openequella.github.io
Oct 28, 2026The Ortto plugin for WordPress before 1.0.25 did not authenticate configuration update requests, relying only on a secret exposed in public HTML.CVE-2026-113387 · WordPress plugins & themes · reported by 61adb53e-e4b3-47f7-8a93-4717c9e77dc6High 8.6
The Ortto plugin for WordPress before 1.0.25 did not authenticate configuration update requests, relying only on a secret exposed in public HTML. An unauthenticated threat actor could overwrite the plugin's configuration to serve arbitrary scripts.
Product
Ortto
Fixed in
1.0.25
What to do
Update Ortto to 1.0.25 or newer.
Full record and what to do →NVD record trust.canva.com
Oct 28, 2026Improper input validation in Bixby prior to version 4.0.85.6 allows privileged local attackers to launch arbitrary activity.CVE-2026-21157 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comHigh 8.3
Improper input validation in Bixby prior to version 4.0.85.6 allows privileged local attackers to launch arbitrary activity.
Product
Bixby
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.samsungmobile.com
Oct 28, 2026Domoticz is a free, open source home automation system for Linux, Windows, macOS, and Raspberry Pi.CVE-2026-75520 · Other software · domoticz · reported by GitHubMedium 5.4
Domoticz is a free, open source home automation system for Linux, Windows, macOS, and Raspberry Pi. Prior to 2026.3, the `udevices` JSON command handler, `Cmd_UpdateDevices` in `main/WebServerCmds.cpp`, performed no `session.rights` check before invoking a Lua parser script, while its sibling command handlers gate access by role. A low-privilege authenticated user could trigger execution of an existing operator-installed Lua parser script with attacker-controlled input through the `GET /json.htm` endpoint with `type=command` and `param=udevices`. The `script` parameter also lacked a `..` path-traversal guard: `CLuaHandler::executeLuaScript` in `main/LuaHandler.cpp` constructed the filename from the parser directory and the supplied script name before passing it to `luaL_loadfile`. Execution is limited to already-installed valid Lua files; this is not arbitrary code execution, and the advisory states that file-write and upload paths require administrator privileges. This issue is addressed in version 2026.3.
Product
domoticz
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Oct 28, 2026InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments.CVE-2026-55561 · Other software · InvoicePlane · reported by GitHubMedium 5.3
InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2-beta-1, guest users can approve or reject quotes belonging to any client, not just their assigned clients. The `approve()` and `reject()` methods in the Guest Quotes controller, `application/modules/guest/controllers/Quotes.php`, call `approve_quote_by_id($quote_id)` and `reject_quote_by_id($quote_id)` directly without the `where_in('ip_quotes.client_id', $this->user_clients)` scoping that sibling methods use. A guest user assigned to one client can change another client's quote status by supplying sequential integer `quote_id` values, and `email_quote_status()` also sends notification emails. Additionally, `generate_pdf()` calls `mark_viewed($quote_id)` before checking the client scope, allowing a guest user to mark another client's quote as viewed. These issues are fixed in version 1.7.2-beta-1 and the subsequent stable version 1.7.2.
Product
InvoicePlane
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.