Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,687 results · page 1 of 34
Oct 29, 2026Food Store – Online Food Delivery & Pickup: Stored Cross-Site ScriptingCVE-2026-96669 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Food Store – Online Food Delivery & Pickup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'service_type' Cookie in all versions up to, and including, 1.5.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The attack is seeded unauthenticated by supplying a payload via the ?type= query parameter on the public checkout page, which the plugin writes directly into the browser's service_type cookie; this cookie value is later persisted to order meta and rendered unescaped in the admin panel.
- Product
- Food Store – Online Food Delivery & Pickup
- Affected
- up to 1.5.5
- What to do
- Affects up to 1.5.5. Update Food Store – Online Food Delivery & Pickup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 27, 2026Xerte Online Toolkits through 3.15.5 contains a remote code execution vulnerability that allows authenticated users with system permission to run PHP by importiCVE-2026-117607 · Other software · thexerteproject · reported by VulnCheckHigh 8.6
Xerte Online Toolkits through 3.15.5 contains a remote code execution vulnerability that allows authenticated users with system permission to run PHP by importing a crafted language pack. Attackers can upload a ZIP via import_language.php containing a .inc file, then request it through the language parameter to execute code on the server.
- Product
- xerteonlinetoolkits
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2026A vulnerability was detected in MD-MAFUJUL-HASAN Online-Payroll-Management-System up to a8902bf64575e325f6d6bf93a55f7bd273ec58cd.CVE-2026-116639 · Other software · MD-MAFUJUL-HASAN · reported by VulDBLow 2
A vulnerability was detected in MD-MAFUJUL-HASAN Online-Payroll-Management-System up to a8902bf64575e325f6d6bf93a55f7bd273ec58cd. Affected is an unknown function of the file chat.php. Performing a manipulation of the argument ID results in cross site scripting. It is possible to initiate the attack remotely. The exploit is now public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- Online-Payroll-Management-System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2026A vulnerability has been found in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578.CVE-2026-116482 · Other software · subhajitkhan · reported by VulDBLow 2
A vulnerability has been found in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. Affected is an unknown function of the file patientregistration.php. Such manipulation of the argument pat_name leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- online-clinic-management-system
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2026Online Payments with iK Pay Gateway: Does not properly verify the authenticity of its payment gateway callback on a default installationCVE-2026-103306 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Online Payments with iK Pay Gateway WordPress plugin before 3.0.4 does not properly verify the authenticity of its payment gateway callback on a default installation, allowing unauthenticated attackers to forge a successful payment notification and mark arbitrary orders as paid without any payment being made, and to mark arbitrary unprocessed orders as failed.
- Product
- Online Payments with iK Pay Gateway
- Fixed in
- 3.0.4
- What to do
- Update Online Payments with iK Pay Gateway to 3.0.4 or newer.
Oct 22, 2026Stack-based buffer overflow in Microsoft Exchange Online allows an authorized attacker to execute code over a network.CVE-2026-96185 · Email & office · Microsoft · reported by secure@microsoft.comHigh 7.5
Stack-based buffer overflow in Microsoft Exchange Online allows an authorized attacker to execute code over a network.
- Product
- Microsoft Exchange Online
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2026A flaw has been found in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578.CVE-2026-115249 · Other software · subhajitkhan · reported by VulDBLow 2
A flaw has been found in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. Impacted is an unknown function of the file patappointtime.php of the component Appointment Booking. This manipulation of the argument day/time/appdate causes improper input validation. The attack can be initiated remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- online-clinic-management-system
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2026A vulnerability was detected in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578.CVE-2026-115248 · Other software · subhajitkhan · reported by VulDBLow 2.1
A vulnerability was detected in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. This issue affects some unknown processing of the file patappointtime.php of the component Booking Handler. The manipulation results in enforcement of behavioral workflow. It is possible to launch the attack remotely. The exploit is now public and may be used. The patch is identified as e9ee77a8827a1446220fa07ee693dc4d9a29a578. It is advisable to implement a patch to correct this issue. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- online-clinic-management-system
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2026A security vulnerability has been detected in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578.CVE-2026-115247 · Other software · subhajitkhan · reported by VulDBLow 2.1
A security vulnerability has been detected in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. This vulnerability affects unknown code of the file patientregistration.php. The manipulation of the argument pat_pswd/doc_pswd leads to missing encryption of sensitive data. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- online-clinic-management-system
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2026A weakness has been identified in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578.CVE-2026-115246 · Other software · subhajitkhan · reported by VulDBLow 2
A weakness has been identified in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. This affects an unknown part of the file patdocmsg.php. Executing a manipulation of the argument Query can lead to cross site scripting. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- online-clinic-management-system
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2026Vulnerability in the Oracle Sales Online product of Oracle E-Business Suite (component: Internal Operations).CVE-2026-101643 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 7.1
Vulnerability in the Oracle Sales Online product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Sales Online. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Sales Online accessible data as well as unauthorized read access to a subset of Oracle Sales Online accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N).
- Product
- Oracle Sales Online
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2026A vulnerability has been found in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578.CVE-2026-112139 · Other software · subhajitkhan · reported by VulDBMedium 5.5
A vulnerability has been found in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. This affects an unknown function of the file admindocview.php of the component Administrative Mutation Handler. The manipulation of the argument docid leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- online-clinic-management-system
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2026A vulnerability has been found in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578.CVE-2026-112093 · Other software · subhajitkhan · reported by VulDBLow 2.1
A vulnerability has been found in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. The impacted element is an unknown function of the file feedback.php. The manipulation of the argument msg leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- online-clinic-management-system
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2026A flaw has been found in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578.CVE-2026-112092 · Other software · subhajitkhan · reported by VulDBLow 2.1
A flaw has been found in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. The affected element is the function echo of the file doctorregistration.php of the component Doctor Registration. Executing a manipulation of the argument doc_name can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has been published and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- online-clinic-management-system
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 18, 2026A vulnerability was detected in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449.CVE-2026-111992 · Other software · itsmeravitejak · reported by VulDBLow 2.1
A vulnerability was detected in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. This issue affects the function Exam::startExam of the file exam.php of the component Exam Module. The manipulation of the argument topicid results in sql injection. The attack can be executed remotely. The exploit is now public and may be used. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- Online-Examination-System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 18, 2026A vulnerability was detected in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449.CVE-2026-111873 · Other software · itsmeravitejak · reported by VulDBMedium 5.5
A vulnerability was detected in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. This impacts the function MySQLDB::topicslist of the file exammanger.php of the component AJAX Endpoint. The manipulation of the argument subject results in sql injection. The attack may be launched remotely. The exploit is now public and may be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- Online-Examination-System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 18, 2026A security vulnerability has been detected in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449.CVE-2026-111872 · Other software · itsmeravitejak · reported by VulDBMedium 5.5
A security vulnerability has been detected in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. This affects the function MySQLDB::valid/MySQLDB::getresults/MySQLDB::noresults/MySQLDB::getExams/MySQLDB::latestExamID/MySQLDB::getreport of the file results.php/include/database.php. The manipulation of the argument id/user/topic leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- Online-Examination-System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 18, 2026A weakness has been identified in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449.CVE-2026-111871 · Other software · itsmeravitejak · reported by VulDBMedium 5.5
A weakness has been identified in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. The impacted element is an unknown function of the file qsdb/usersdb/brandb/topicsdb/subjectsdb.php. Executing a manipulation of the argument query/qtype/sortname/sortorder can lead to sql injection. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- Online-Examination-System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 18, 2026A security flaw has been discovered in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449.CVE-2026-111870 · Other software · itsmeravitejak · reported by VulDBMedium 5.5
A security flaw has been discovered in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. The affected element is the function isAdmin of the file admin/admin.php. Performing a manipulation results in missing authentication. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- Online-Examination-System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 17, 2026Tutor LMS – eLearning and online course solution: Insecure Direct Object ReferenceCVE-2026-92715 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.1.0 via the 'ID' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with author-level access and above, to modify arbitrary courses created by other instructors — overwriting their title, content, and status — and reassign ownership of those courses to themselves. This is possible because Input::sanitize_array() preserves attacker-supplied POST keys (including 'ID') without stripping them, and WordPress interprets a non-empty ID in the wp_insert_post() argument array as an update to the existing post rather than a new insert.
- Product
- Tutor LMS – eLearning and online course solution
- Affected
- up to 4.1.0
- What to do
- Affects up to 4.1.0. Update Tutor LMS – eLearning and online course solution to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 17, 2026LearnPress – WordPress LMS Plugin for Create and Sell Online Courses: Authorization bypassCVE-2026-107744 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.4.10 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to enumerate the complete site user roster and extract the full email address of any WordPress account, including administrator accounts, character-by-character by using the search response as an oracle against both user_login and user_email columns.
- Product
- LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
- Affected
- up to 4.4.10
- What to do
- Affects up to 4.4.10. Update LearnPress – WordPress LMS Plugin for Create and Sell Online Courses to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 16, 2026LearnPress – WordPress LMS Plugin for Create and Sell Online Courses: Stored Cross-Site ScriptingCVE-2026-109208 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'quantity (REST) / order_comments (checkout)' parameter in all versions up to, and including, 4.4.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. With guest checkout enabled the attack is fully unauthenticated; with guest checkout disabled, any Subscriber-level user can exploit both vectors through their own checkout.
- Product
- LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
- Affected
- up to 4.4.10
- What to do
- Affects up to 4.4.10. Update LearnPress – WordPress LMS Plugin for Create and Sell Online Courses to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 16, 2026Tutor LMS – eLearning and online course solution: Stored Cross-Site ScriptingCVE-2026-93681 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via display_name Parameter in all versions up to, and including, 4.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that a Legal Consent record exists for the attacker's user account, causing the View Logs button to appear in the wp-admin/users.php Consent Logs column.
- Product
- Tutor LMS – eLearning and online course solution
- Affected
- up to 4.1.0
- What to do
- Affects up to 4.1.0. Update Tutor LMS – eLearning and online course solution to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 16, 2026Tutor LMS – eLearning and online course solution: DOM-Based Cross-Site ScriptingCVE-2026-88963 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to DOM-Based Cross-Site Scripting via the 'redirect_url' parameter in versions up to, and including, 4.0.8 This is due to insufficient input validation in the Topbar component's back button handler. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute in the victim's browser whenever the victim accesses a page that includes the malicious payload.
- Product
- Tutor LMS – eLearning and online course solution
- Affected
- up to 4.0.8
- What to do
- Affects up to 4.0.8. Update Tutor LMS – eLearning and online course solution to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 15, 2026Helium is a free online student planner for classes, homework, grades, and notes.CVE-2026-55876 · Other software · HeliumEdu · reported by GitHubLow 3.5
Helium is a free online student planner for classes, homework, grades, and notes. Prior to 2.2.60, the POST /planner/attachments/ endpoint allows authenticated users to upload SVG and HTML attachments because conf/configs/common.py omits those formats from BLOCKED_ATTACHMENT_EXTENSIONS and BLOCKED_ATTACHMENT_MIME_TYPES, and helium/planner/serializers/attachmentserializer.py relies on those blocklists. An uploaded SVG served as image/svg+xml can execute embedded script when a visitor opens its public attachment URL, allowing persistent attacker-controlled active content and phishing under an application-managed storage URL. The attachment storage uses a separate origin from the application, so same-origin policy prevents the script from reading application cookies or storage, and application-session compromise is not supported by the maintained deployment configuration. This issue is fixed in version 2.2.60.
- Product
- platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026Helium is a free online student planner for classes, homework, grades, and notes.CVE-2026-55875 · Other software · HeliumEdu · reported by GitHubMedium 4.3
Helium is a free online student planner for classes, homework, grades, and notes. Prior to 2.2.60, any authenticated user can submit an arbitrary URL to POST /feed/externalcalendars/, where helium/feed/services/icalexternalcalendarservice.py uses validate_url to check only URL syntax before passing the value to urllib.request.urlopen, and fetch_ical_conditional periodically refetches the stored URL. The server can therefore issue requests to attacker-selected external or internal hosts, while distinct responses, including an uncaught http.client.RemoteDisconnected condition for non-HTTP services, reveal internal host and port reachability. The supported impact is forced outbound requests and internal service reconnaissance; the advisory does not demonstrate secret retrieval because the relevant ECS credentials path is task-specific and unpredictable. This issue is fixed in version 2.2.60.
- Product
- platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026A weakness has been identified in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449.CVE-2026-110696 · Other software · itsmeravitejak · reported by VulDBMedium 5.5
A weakness has been identified in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. The affected element is an unknown function of the file dbtables.sql. Executing a manipulation can lead to information disclosure. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- Online-Examination-System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026A vulnerability relating to the exposure of confidential information in the customer invoicing web application, which exposes personally identifiable informatioCVE-2026-14851 · Other software · Copart · reported by cve-coordination@incibe.esCritical 9.2
A vulnerability relating to the exposure of confidential information in the customer invoicing web application, which exposes personally identifiable information (PII) and financial data – including customer names, addresses, invoice numbers, payment details and tax information – to unauthorised individuals. The issue is caused by a lack of authorisation checks at the endpoint responsible for serving PDF invoice files. Furthermore, some URLs for invoicing documents appear to be publicly accessible via search engines, exposing paths to confidential files. Successful exploitation of this vulnerability could allow an attacker to access data to which they should not have access, as well as to predict identifiers in order to access even more confidential information.
- Product
- Copart’s online billing service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes: Local File InclusionCVE-2026-110284 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 10.3.1 via attacker-controlled attributes of the [lifterlms_checkout] shortcode. This is due to the llms_get_template() helper performing extract() on the shortcode attribute array before resolving the template path, which allows the attacker-supplied 'template_name' and 'default_path' shortcode attributes to overwrite the function's local parameters and ultimately control the path passed to a PHP include. This makes it possible for authenticated attackers, with Instructor-level access and above, to include and execute arbitrary files on the server, that can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where files with safe extensions containing attacker-controlled content can be uploaded and included.
- Product
- LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes
- Affected
- up to 10.3.1
- What to do
- Affects up to 10.3.1. Update LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 14, 2026Tutor LMS – eLearning and online course solution: Reflected Cross-Site ScriptingCVE-2026-100193 · WordPress plugins & themes · reported by WordfenceMedium 4.7
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab' parameter in all versions up to, and including, 4.1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Exploitation requires the targeted lesson page to have an empty nav-items array — a condition that occurs naturally when a lesson has no post content, no attachments, and comments are disabled or the viewer is not logged in — which bypasses the in_array() tab validation and allows the raw attacker-controlled value to reach the sink.
- Product
- Tutor LMS – eLearning and online course solution
- Affected
- up to 4.1.0
- What to do
- Affects up to 4.1.0. Update Tutor LMS – eLearning and online course solution to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 13, 2026Collabora Online – Built-in CODE Server OS Command Injection VulnerabilityCVE-2026-110447 · Other software · Collabora · reported by MITREExploitedCritical 9.2
Collabora Collabora Online – Built-in CODE Server when used within the NextCloud platform contains an OS command injection vulnerability that allows for remote code execution when the CODE server isn't running.
- Product
- Collabora Online – Built-in CODE Server
- On CISA’s list since
- Oct 23, 2026 (federal fix deadline Oct 26, 2026)
- What to do
- Attackers are using this now. Install Collabora’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA cataloggithub.comhelp.nextcloud.com
Oct 13, 2026A vulnerability was identified in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5.CVE-2026-109525 · Other software · girishsaraf · reported by VulDBMedium 5.5
A vulnerability was identified in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. This affects an unknown part of the file changebookingstatus.php of the component submit2 Handler. Such manipulation of the argument username[]/timestamp[]/status[] leads to missing authorization. The attack may be performed from remote. The exploit is publicly available and might be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- Online-Appointment-Booking-System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026A vulnerability was determined in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5.CVE-2026-109524 · Other software · girishsaraf · reported by VulDBMedium 5.5
A vulnerability was determined in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. Affected by this issue is some unknown functionality of the file Admin/showdoctor.php of the component Admin Display Pages. This manipulation causes missing authorization. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- Online-Appointment-Booking-System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026A vulnerability was found in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5.CVE-2026-109523 · Other software · girishsaraf · reported by VulDBMedium 5.5
A vulnerability was found in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. Affected by this vulnerability is an unknown functionality of the file Admin/getclinic.php of the component AJAX Endpoint. The manipulation of the argument city/cid results in sql injection. The attack can be executed remotely. The exploit has been made public and could be used. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- Online-Appointment-Booking-System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026A vulnerability has been found in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5.CVE-2026-109522 · Other software · girishsaraf · reported by VulDBMedium 5.5
A vulnerability has been found in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. Affected is an unknown function of the file Admin/deleteclinic.php of the component Admin CRUD Endpoint. The manipulation of the argument cid/did leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- Online-Appointment-Booking-System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026A vulnerability was detected in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5.CVE-2026-109521 · Other software · girishsaraf · reported by VulDBMedium 5.5
A vulnerability was detected in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. This affects an unknown function of the file changebookingstatus.php. Performing a manipulation of the argument dateselected results in sql injection. The attack may be initiated remotely. The exploit is now public and may be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- Online-Appointment-Booking-System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026A vulnerability was detected in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449.CVE-2026-108970 · Other software · itsmeravitejak · reported by VulDBMedium 5.5
A vulnerability was detected in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. This affects the function MySQLDB::addNewUser of the file include/database.php of the component Registration Form. Performing a manipulation of the argument branch results in sql injection. The attack is possible to be carried out remotely. The exploit is now public and may be used. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- Online-Examination-System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026A security vulnerability has been detected in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449.CVE-2026-108969 · Other software · itsmeravitejak · reported by VulDBMedium 5.5
A security vulnerability has been detected in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. The impacted element is the function Session::checkLogin of the file include/session.php of the component Session Handler. Such manipulation of the argument cookname/cookid leads to incorrect comparison. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- Online-Examination-System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026Qexo is an open source online editor for static blogs.CVE-2026-44828 · Other software · Qexo · reported by GitHubCritical 9.3
Qexo is an open source online editor for static blogs. From 4.0.0 until 4.2.0, Qexo exposes /api/init_step/ through init_step_api without authentication, authorization, or a setup-completion guard. An unauthenticated requester with a valid CSRF token obtained from a public page can submit the first initialization step and reset the INIT setting, causing the instance to re-enter the setup flow. The setup response and /init/ page can expose stored PROVIDER configuration, including service credentials, in frontend content. This issue is fixed in version 4.2.0.
- Product
- Qexo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2026Unauthenticated Cross Site Scripting (XSS) in Food Menu – Restaurant Menu & Online Ordering for WooCommerce <= 6.0.5 versions.CVE-2026-42709 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Food Menu – Restaurant Menu & Online Ordering for WooCommerce <= 6.0.5 versions.
- Affected
- up to 6.0.5
- What to do
- Affects up to 6.0.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026Online Scheduling and Appointment Booking System – Bookly: PHP Object InjectionCVE-2026-12626 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 28.2 via deserialization of untrusted input via the ‘value’ parameter. This makes it possible for authenticated attackers, with custom-level access and above, to inject a PHP Object. No known gadget chain is available.
- Product
- Online Scheduling and Appointment Booking System – Bookly
- Affected
- up to 28.2
- What to do
- Affects up to 28.2. Update Online Scheduling and Appointment Booking System – Bookly to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Oct 10, 2026LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes: PHP Object InjectionCVE-2026-104723 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 10.2.1 via deserialization of untrusted input . This makes it possible for authenticated attackers, with custom-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present. This vulnerability is only exploitable during lesson creation when a temporary lesson ID triggers the custom metadata path, and requires the attacker to hold a role with the edit_course capability, such as Instructor, Instructor's Assistant, LMS Manager, or Administrator.
- Product
- LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes
- Affected
- up to 10.2.1
- What to do
- Affects up to 10.2.1. Update LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 10, 2026Online Scheduling and Appointment Booking System – Bookly: Insecure Direct Object ReferenceCVE-2026-104898 · WordPress plugins & themes · reported by WordfenceMedium 6.8
The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 28.4 via the 'id, wp_user_id' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with subscriber-level access and above, to overwrite the WordPress account binding of any Bookly staff record, including those owned by administrators, effectively hijacking a higher-privileged staff member's account association and escalating privileges. Exploitation requires the attacking user to be linked to at least one Bookly staff record, which occurs by default whenever an admin enables the bookly_gen_allow_staff_edit_profile option (active on fresh installs) and links a WordPress user to a staff entry.
- Product
- Online Scheduling and Appointment Booking System – Bookly
- Affected
- up to 28.4
- What to do
- Affects up to 28.4. Update Online Scheduling and Appointment Booking System – Bookly to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 10, 2026Bookly – Online Scheduling and Appointment Booking System: Sensitive Information ExposureCVE-2026-103365 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Bookly – Online Scheduling and Appointment Booking System plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 28.4 via the classic booking form's Details step. The endpoint bookly_render_details is registered for both wp_ajax and wp_ajax_nopriv, the module overrides csrfTokenValid() to always return true, and Bookly\Frontend\Components\Booking\InfoText::getCodes() calls UserBookingData::getCustomer() to load the persisted Customer entity keyed solely by the attacker-supplied phone (or email) with no invocation of the plugin's own customerIdentityConfirmed() predicate. When a site owner has placed the supported {client_name}, {client_email}, {client_phone}, or {client_note} placeholders into the Details step's Appearance information text, the matched customer's stored name, email, phone and internal notes are substituted into the returned HTML. This makes it possible for unauthenticated attackers who know only a registered customer's primary phone (or email) to read that customer's stored personal data.
- Product
- Bookly – Online Scheduling and Appointment Booking System
- Affected
- up to 28.4
- What to do
- Affects up to 28.4. Update Bookly – Online Scheduling and Appointment Booking System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 8, 2026Airwallex Online Payments Gateway: Does not verify that an incoming payment notification genuinely comes from the payment providerCVE-2026-103517 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Airwallex Online Payments Gateway WordPress plugin before 1.36.0 does not verify that an incoming payment notification genuinely comes from the payment provider when no webhook secret has been configured, allowing unauthenticated attackers to forge one and mark orders as paid without paying.
- Product
- Airwallex Online Payments Gateway
- Fixed in
- 1.36.0
- What to do
- Update Airwallex Online Payments Gateway to 1.36.0 or newer.
Oct 5, 2026A weakness has been identified in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5.CVE-2026-105472 · Other software · girishsaraf · reported by VulDBLow 2.1
A weakness has been identified in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. The affected element is an unknown function of the file book.php of the component Booking Handler. This manipulation of the argument Doctor/appointment causes sql injection. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- Online-Appointment-Booking-System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2026A security flaw has been discovered in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5.CVE-2026-105471 · Other software · girishsaraf · reported by VulDBMedium 5.5
A security flaw has been discovered in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. Impacted is an unknown function of the file signup.php of the component Registration Handler. The manipulation of the argument fname results in sql injection. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- Online-Appointment-Booking-System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2026A vulnerability was identified in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5.CVE-2026-105470 · Other software · girishsaraf · reported by VulDBMedium 5.5
A vulnerability was identified in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. This issue affects the function mysqli_query of the file locateus.php of the component Doctor Search Endpoint. The manipulation of the argument doctorname leads to sql injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- Online-Appointment-Booking-System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2026A vulnerability was determined in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5.CVE-2026-105469 · Other software · girishsaraf · reported by VulDBMedium 5.5
A vulnerability was determined in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. This vulnerability affects unknown code of the file get_town.php of the component AJAX Endpoint. Executing a manipulation of the argument countryid/townid/cid/didval/cidval can lead to sql injection. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- Online-Appointment-Booking-System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2026A vulnerability was found in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5.CVE-2026-105468 · Other software · girishsaraf · reported by VulDBMedium 5.5
A vulnerability was found in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. This affects the function mysqli_query of the file Admin/mlogin.php of the component Login Handler. Performing a manipulation of the argument uname/pass results in sql injection. The attack may be initiated remotely. The exploit has been made public and could be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- Online-Appointment-Booking-System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.