Updated 5 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

344new WordPress flaws this week

390,080entries in the database

459 results · page 1 of 10

Oct 29, 2026Sequential Order Numbers for WooCommerce: Stored Cross-Site ScriptingCVE-2026-104727 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Sequential Order Numbers for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'condition' Post Meta Array Keys in all versions up to, and including, 3.6.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Sequential Order Numbers for WooCommerce
Affected
up to 3.6.5
What to do
Affects up to 3.6.5. Update Sequential Order Numbers for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 28, 2026BitPay Gateway for WooCommerce: Does not bind the payment provider's transaction confirmation to the order it completesCVE-2026-103313 · WordPress plugins & themes · reported by WPScanMedium 5.3
The BitPay Gateway for WooCommerce WordPress plugin through 4.1.3 does not bind the payment provider's transaction confirmation to the order it completes, nor verify the confirmed amount, allowing an unauthenticated attacker who holds a single genuine low-value transaction to mark arbitrary higher-value orders as paid.
Product
BitPay Gateway for WooCommerce
Affected
up to 4.1.3
What to do
Affects up to 4.1.3. Update BitPay Gateway for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Oct 28, 2026PayPlug for WooCommerce (Official): Does not perform any capability or ownership check on a set of unauthenticated AJAX actions that operate on a caller-supplied order identifierCVE-2026-113813 · WordPress plugins & themes · reported by WPScanMedium 6.5
The PayPlug for WooCommerce (Official) WordPress plugin before 3.1.1 does not perform any capability or ownership check on a set of unauthenticated AJAX actions that operate on a caller-supplied order identifier, allowing unauthenticated attackers to modify, read the contents of, and permanently delete arbitrary WooCommerce orders.
Product
PayPlug for WooCommerce (Official)
Fixed in
3.1.1
What to do
Update PayPlug for WooCommerce (Official) to 3.1.1 or newer.
Full record and what to do →NVD record wpscan.com
Oct 28, 2026PayPlug for WooCommerce (Official): Does not verify that the requester owns the WooCommerce order named in a payment requestCVE-2026-110292 · WordPress plugins & themes · reported by WPScanMedium 6.5
The PayPlug for WooCommerce (Official) WordPress plugin before 3.1.1 does not verify that the requester owns the WooCommerce order named in a payment request, allowing unauthenticated users to disclose another customer's order key and cancel their unpaid guest order.
Product
PayPlug for WooCommerce (Official)
Fixed in
3.1.1
What to do
Update PayPlug for WooCommerce (Official) to 3.1.1 or newer.
Full record and what to do →NVD record wpscan.com
Oct 28, 2026Payconiq: Does not check that a visitor is allowed to see an order before returning its confirmation linkCVE-2026-103372 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Payconiq WordPress plugin through 1.0.4 does not check that a visitor is allowed to see an order before returning its confirmation link, allowing unauthenticated users to obtain any paid order's key and, for recent guest orders, view the customer's personal details.
Product
Payconiq
Affected
up to 1.0.4
What to do
Affects up to 1.0.4. Update Payconiq to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Oct 25, 2026Chikkili- Google Pay India for Woocommerce: Does not verify that a payment notification actually originated from the payment provider before marking the associated orderCVE-2026-94295 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Chikkili- Google Pay India for Woocommerce WordPress plugin through 1.0.6 does not verify that a payment notification actually originated from the payment provider before marking the associated order as paid, allowing unauthenticated attackers to mark arbitrary orders as paid without any payment being made.
Product
Chikkili- Google Pay India for Woocommerce
Affected
up to 1.0.6
What to do
Affects up to 1.0.6. Update Chikkili- Google Pay India for Woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Oct 22, 2026Restaurant Menu – Food Ordering System – Table Reservation: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-114700 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Gloriafood Restaurant Menu – Food Ordering System – Table Reservation menu-ordering-reservations allows Stored XSS.This issue affects Restaurant Menu – Food Ordering System – Table Reservation: from n/a through 2.4.4.
Product
Restaurant Menu – Food Ordering System – Table Reservation
Affected
up to 2.4.4
What to do
Affects up to 2.4.4. Update Restaurant Menu – Food Ordering System – Table Reservation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 21, 2026Click n Chat (Chat Widget Integration): Does not sanitise sort parameters before using them in a SQL ORDER BY clauseCVE-2026-92998 · WordPress plugins & themes · reported by WPScanHigh 8.6
The Click n Chat (Chat Widget Integration) WordPress plugin before 1.1.3 does not sanitise sort parameters before using them in a SQL ORDER BY clause, allowing unauthenticated attackers to perform SQL injection attacks.
Product
Click n Chat (Chat Widget Integration)
Fixed in
1.1.3
What to do
Update Click n Chat (Chat Widget Integration) to 1.1.3 or newer.
Full record and what to do →NVD record wpscan.com
Oct 21, 2026SUMIT Payment Gateway for WooCommerce: Does not bind the payment it confirms with the provider to the order being completedCVE-2026-111957 · WordPress plugins & themes · reported by WPScanMedium 5.3
The SUMIT Payment Gateway for WooCommerce WordPress plugin before 4.0.0 does not bind the payment it confirms with the provider to the order being completed, nor check the payment amount against the order total, allowing unauthenticated users to mark a pending order as paid by replaying a payment identifier obtained from any single genuine payment.
Product
SUMIT Payment Gateway for WooCommerce
Fixed in
4.0.0
What to do
Update SUMIT Payment Gateway for WooCommerce to 4.0.0 or newer.
Full record and what to do →NVD record wpscan.com
Oct 21, 2026Kliken: Ads + Pixel for Meta: Does not verify that a visitor holds an order's key before outputting that order's details on the order confirmation pageCVE-2026-111596 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Kliken: Ads + Pixel for Meta WordPress plugin before 1.2.3 does not verify that a visitor holds an order's key before outputting that order's details on the order confirmation page, allowing unauthenticated users to retrieve the billing location, purchased products and totals of other customers' orders by enumerating order IDs.
Product
Kliken: Ads + Pixel for Meta
Fixed in
1.2.3
What to do
Update Kliken: Ads + Pixel for Meta to 1.2.3 or newer.
Full record and what to do →NVD record wpscan.com
Oct 21, 2026WPZOOM Portfolio Lite: Does not check that a user is allowed to edit a post before changing its type and orderCVE-2026-110514 · WordPress plugins & themes · reported by WPScanMedium 4.9
The WPZOOM Portfolio Lite WordPress plugin before 1.4.34 does not check that a user is allowed to edit a post before changing its type and order, which could allow users with the contributor role and above to convert any other user's posts and pages into portfolio items, removing them from their original listings and URLs.
Product
WPZOOM Portfolio Lite
Fixed in
1.4.34
What to do
Update WPZOOM Portfolio Lite to 1.4.34 or newer.
Full record and what to do →NVD record wpscan.com
Oct 21, 2026Synchrony Financing: Does not properly authorise requests to one of its REST routes that modifies WooCommerce ordersCVE-2026-100145 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Synchrony Financing WordPress plugin before 1.1.2 does not properly authorise requests to one of its REST routes that modifies WooCommerce orders, allowing unauthenticated attackers to reassign any order to an account they control, tamper with its details, and read the associated customer's personal data.
Product
Synchrony Financing
Fixed in
1.1.2
What to do
Update Synchrony Financing to 1.1.2 or newer.
Full record and what to do →NVD record wpscan.com
Oct 19, 2026Snap Finance: Does not verify that a request to change a WooCommerce order's status comes from an authorised sourceCVE-2026-94272 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Snap Finance WordPress plugin before 3.12.0 does not verify that a request to change a WooCommerce order's status comes from an authorised source, allowing unauthenticated attackers to move any order into a paid state or force it to fail.
Product
Snap Finance
Fixed in
3.12.0
What to do
Update Snap Finance to 3.12.0 or newer.
Full record and what to do →NVD record wpscan.com
Oct 19, 2026iPOSpays Payment Gateway for WooCommerce: Does not verify that a payment was actually completed before recording an orderCVE-2026-86791 · WordPress plugins & themes · reported by WPScanMedium 5.3
The iPOSpays Payment Gateway for WooCommerce WordPress plugin before 1.4.7 does not verify that a payment was actually completed before recording an order as paid, allowing unauthenticated users to mark any unpaid order as paid and to rewrite its total.
Product
iPOSpays Payment Gateway for WooCommerce
Fixed in
1.4.7
What to do
Update iPOSpays Payment Gateway for WooCommerce to 1.4.7 or newer.
Full record and what to do →NVD record wpscan.com
Oct 17, 2026SMS Alert Order Notifications: Missing AuthorizationCVE-2026-110882 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Cozy Vision Technologies Pvt. Ltd. SMS Alert Order Notifications sms-alert allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SMS Alert Order Notifications: from n/a through 4.0.1.
Product
SMS Alert Order Notifications
Affected
up to 4.0.1
What to do
Affects up to 4.0.1. Update SMS Alert Order Notifications to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 17, 2026PeachPay — Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net, NMI): Does not perform any capability or ownership check before returning an order's secret key in response to an unCVE-2026-103376 · WordPress plugins & themes · reported by WPScanMedium 5.3
The PeachPay — Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net, NMI) WordPress plugin before 1.120.70 does not perform any capability or ownership check before returning an order's secret key in response to an unauthenticated request, allowing anyone to retrieve the key for any paid order and use it to view that order's customer name, email address, postal address and contents.
Product
PeachPay — Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net, NMI)
Fixed in
1.120.70
What to do
Update PeachPay — Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net, NMI) to 1.120.70 or newer.
Full record and what to do →NVD record wpscan.com
Oct 16, 2026Product Delivery Date for WooCommerce: Does not perform a capability check before disclosing order details through its calendar view AJAX actionsCVE-2026-110191 · WordPress plugins & themes · reported by WPScanLow 2.7
The Product Delivery Date for WooCommerce WordPress plugin before 3.3.2 does not perform a capability check before disclosing order details through its calendar view AJAX actions, allowing users with a role as low as Contributor to view other customers' order information.
Product
Product Delivery Date for WooCommerce
Fixed in
3.3.2
What to do
Update Product Delivery Date for WooCommerce to 3.3.2 or newer.
Full record and what to do →NVD record wpscan.com
Oct 15, 2026Rede Itaú for WooCommerce: Does not verify the authenticity of a payment gateway webhook before updating an order's statusCVE-2026-92429 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Rede Itaú for WooCommerce WordPress plugin before 5.5.3 does not verify the authenticity of a payment gateway webhook before updating an order's status, allowing unauthenticated attackers to change the status of arbitrary WooCommerce orders, including marking unpaid orders as paid and cancelling completed orders.
Product
Rede Itaú for WooCommerce
Fixed in
5.5.3
What to do
Update Rede Itaú for WooCommerce to 5.5.3 or newer.
Full record and what to do →NVD record wpscan.com
Oct 15, 2026Rede Itaú for WooCommerce: Does not verify the authenticity of a payment gateway webhook before updating an order's statusCVE-2026-92428 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Rede Itaú for WooCommerce WordPress plugin before 5.5.3 does not verify the authenticity of a payment gateway webhook before updating an order's status, allowing unauthenticated attackers to change the status of arbitrary WooCommerce orders, including orders that were already paid or completed.
Product
Rede Itaú for WooCommerce
Fixed in
5.5.3
What to do
Update Rede Itaú for WooCommerce to 5.5.3 or newer.
Full record and what to do →NVD record wpscan.com
Oct 14, 2026Paymentfor Gateway for WooCommerce: Does not verify the authenticity of an inbound payment notification before marking an orderCVE-2026-94360 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Paymentfor Gateway for WooCommerce WordPress plugin before 1.0.6 does not verify the authenticity of an inbound payment notification before marking an order as paid, allowing unauthenticated attackers to mark orders as paid without any payment being completed.
Product
Paymentfor Gateway for WooCommerce
Fixed in
1.0.6
What to do
Update Paymentfor Gateway for WooCommerce to 1.0.6 or newer.
Full record and what to do →NVD record wpscan.com
Oct 14, 2026Sifalo Pay: Does not verify that a payment transaction identifier belongs to the order it is confirmingCVE-2026-94261 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Sifalo Pay WordPress plugin before 2.5.3 does not verify that a payment transaction identifier belongs to the order it is confirming, nor that the requester owns that order, allowing unauthenticated attackers holding one valid transaction identifier from a payment of their own to mark arbitrary pending orders as paid.
Product
Sifalo Pay
Fixed in
2.5.3
What to do
Update Sifalo Pay to 2.5.3 or newer.
Full record and what to do →NVD record wpscan.com
Oct 14, 2026Robokassa payment gateway for Woocommerce: Does not verify the authenticity of an incoming payment-notification request before acting on the order named in itCVE-2026-91076 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Robokassa payment gateway for Woocommerce WordPress plugin before 1.9.0 does not verify the authenticity of an incoming payment-notification request before acting on the order named in it, allowing unauthenticated attackers to force any WooCommerce order into a failed state. Order identifiers are sequential, so every order in the shop can be taken out of the fulfilment queue one request at a time.
Product
Robokassa payment gateway for Woocommerce
Fixed in
1.9.0
What to do
Update Robokassa payment gateway for Woocommerce to 1.9.0 or newer.
Full record and what to do →NVD record wpscan.com
Oct 14, 2026File Upload to Order: Does not validate or confine a file path taken from attacker-controlled session data before deleting the fileCVE-2026-107594 · WordPress plugins & themes · reported by WPScanCritical 10
The File Upload to Order WordPress plugin before 1.1.4 does not validate or confine a file path taken from attacker-controlled session data before deleting the file, and the action that performs the deletion is reachable by unauthenticated users, allowing them to delete arbitrary files on the server, including files whose removal leads to full site compromise.
Product
File Upload to Order
Fixed in
1.1.4
What to do
Update File Upload to Order to 1.1.4 or newer.
Full record and what to do →NVD record wpscan.com
Oct 12, 2026Hotel Booking: Does not implement CSRF protection on its administrative booking order managementCVE-2026-84166 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Hotel Booking WordPress plugin through 3.8 does not implement CSRF protection on its administrative booking order management, allowing attackers to trick a logged-in administrator into creating, deleting, or modifying arbitrary booking order records via a forged request.
Product
Hotel Booking
Affected
up to 3.8
What to do
Affects up to 3.8. Update Hotel Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Oct 10, 2026Unauthenticated Broken Access Control in Barcode Scanner with Inventory & Order Manager <= 1.13.1 versions.CVE-2026-62118 · WordPress plugins & themes · reported by PatchstackHigh 7.3
Unauthenticated Broken Access Control in Barcode Scanner with Inventory & Order Manager <= 1.13.1 versions.
Affected
up to 1.13.1
What to do
Affects up to 1.13.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 10, 2026Subscriber SQL Injection in Barcode Scanner with Inventory & Order Manager <= 1.13.1 versions.CVE-2026-62117 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Subscriber SQL Injection in Barcode Scanner with Inventory & Order Manager <= 1.13.1 versions.
Affected
up to 1.13.1
What to do
Affects up to 1.13.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 10, 2026Unauthenticated Cross Site Scripting (XSS) in Barcode Scanner with Inventory & Order Manager <= 1.13.1 versions.CVE-2026-62116 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Barcode Scanner with Inventory & Order Manager <= 1.13.1 versions.
Affected
up to 1.13.1
What to do
Affects up to 1.13.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 10, 2026Unauthenticated Cross Site Scripting (XSS) in Food Menu – Restaurant Menu & Online Ordering for WooCommerce <= 6.0.5 versions.CVE-2026-42709 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Food Menu – Restaurant Menu & Online Ordering for WooCommerce <= 6.0.5 versions.
Affected
up to 6.0.5
What to do
Affects up to 6.0.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 10, 2026Unauthenticated Cross Site Scripting (XSS) in Additional Order Filters for WooCommerce <= 1.24 versions.CVE-2026-39800 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Additional Order Filters for WooCommerce <= 1.24 versions.
Affected
up to 1.24
What to do
Affects up to 1.24. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 10, 2026Order Export & Order Import for WooCommerce: Sensitive Information ExposureCVE-2026-94375 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Order Export & Order Import for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.7.8 via the get_file_path. This makes it possible for unauthenticated attackers to extract download exported order CSV files containing customer PII — including names, billing and shipping addresses, email addresses, phone numbers, and order contents — directly over HTTP with no authentication. This is exploitable whenever the .htaccess and index.php guard files are absent from wp-content/webtoffee_export/, which can occur after any uninstall/reinstall cycle, migration, backup restore, or staging sync, since the export directory persists but its guard files do not; export filenames follow a fully deterministic second-precision timestamp pattern, making them brute-forceable across any suspected export window.
Product
Order Export & Order Import for WooCommerce
Affected
up to 2.7.8
What to do
Affects up to 2.7.8. Update Order Export & Order Import for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 10, 2026Tutor LMS: Does not verify that the posts named in its course content ordering requests belong to a course the requester managesCVE-2026-85571 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Tutor LMS WordPress plugin before 4.1.1 does not verify that the posts named in its course content ordering requests belong to a course the requester manages, allowing users with instructor level access to reassign the parent of any post on the site, taking other instructors' course content into their own courses and making arbitrary published content unreachable.
Product
Tutor LMS
Fixed in
4.1.1
What to do
Update Tutor LMS to 4.1.1 or newer.
Full record and what to do →NVD record wpscan.com
Oct 8, 2026Track Orders for WooCommerce: Does not verify ownership of an order before returning its billing detailsCVE-2026-94275 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Track Orders for WooCommerce WordPress plugin before 1.2.7 does not verify ownership of an order before returning its billing details, allowing unauthenticated attackers to obtain a customer's name, email address, phone number, postal address and order history by supplying that customer's email address.
Product
Track Orders for WooCommerce
Fixed in
1.2.7
What to do
Update Track Orders for WooCommerce to 1.2.7 or newer.
Full record and what to do →NVD record wpscan.com
Oct 8, 2026Appointment Booking: Does not verify that the caller owns the order referenced by an order-item identifier before rendering that order's confirmation summaryCVE-2026-105198 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Appointment Booking Plugin WordPress plugin before 5.7.3 does not verify that the caller owns the order referenced by an order-item identifier before rendering that order's confirmation summary, letting an unauthenticated visitor retrieve any customer's name, contact details and order confirmation code by supplying a sequential order-item id.
Product
Appointment Booking
Fixed in
5.7.3
What to do
Update Appointment Booking to 5.7.3 or newer.
Full record and what to do →NVD record wpscan.com
Oct 8, 2026Easy Digital Downloads: Does not restrict a block's order data to the current userCVE-2026-105194 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Easy Digital Downloads WordPress plugin before 3.7.1 does not restrict a block's order data to the current user, allowing users with subscriber-level access to view other customers' recent order products and obtain signed download links that grant access to paid digital files without purchase.
Product
Easy Digital Downloads
Fixed in
3.7.1
What to do
Update Easy Digital Downloads to 3.7.1 or newer.
Full record and what to do →NVD record wpscan.com
Oct 7, 2026Yaad Sarig Payment Gateway For WC: Does not verify authorization or that the requesting user owns the target order in several of its order payment-processing actionsCVE-2026-104651 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Yaad Sarig Payment Gateway For WC WordPress plugin before 2.2.13 does not verify authorization or that the requesting user owns the target order in several of its order payment-processing actions, allowing any authenticated user, including subscribers, to act on and alter orders belonging to other customers.
Product
Yaad Sarig Payment Gateway For WC
Fixed in
2.2.13
What to do
Update Yaad Sarig Payment Gateway For WC to 2.2.13 or newer.
Full record and what to do →NVD record wpscan.com
Oct 6, 2026SMS Alert Order Notifications: Incorrect Privilege AssignmentCVE-2026-95594 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Incorrect Privilege Assignment vulnerability in Cozy Vision Technologies Pvt. Ltd. SMS Alert Order Notifications sms-alert allows Privilege Escalation.This issue affects SMS Alert Order Notifications: from n/a through 4.0.0.
Product
SMS Alert Order Notifications
Affected
up to 4.0.0
What to do
Affects up to 4.0.0. Update SMS Alert Order Notifications to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 6, 2026Fast Courier: Does not restrict an unauthenticated REST route that writes order fulfillment dataCVE-2026-89289 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Fast Courier WordPress plugin through 5.2.3 does not restrict an unauthenticated REST route that writes order fulfillment data, allowing unauthenticated attackers to overwrite the courier status and customer-facing tracking details of any WooCommerce order by supplying its id.
Product
Fast Courier
Affected
up to 5.2.3
What to do
Affects up to 5.2.3. Update Fast Courier to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Oct 5, 2026UPI QR Code Payment Gateway: Does not verify that a payment-confirmation request actually belongs to the order and customer it claims to confirmCVE-2026-84169 · WordPress plugins & themes · reported by WPScanMedium 5.3
The UPI QR Code Payment Gateway WordPress plugin through 1.4.3 does not verify that a payment-confirmation request actually belongs to the order and customer it claims to confirm, allowing unauthenticated attackers to mark an arbitrary order as paid without making any payment.
Product
UPI QR Code Payment Gateway
Affected
up to 1.4.3
What to do
Affects up to 1.4.3. Update UPI QR Code Payment Gateway to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Oct 3, 2026WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System: Local File InclusionCVE-2026-75028 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.0.18 via the (template scope) function. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.
Product
WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System
Affected
up to 3.0.18
What to do
Affects up to 3.0.18. Update WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 3, 2026WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System: Authorization bypassCVE-2026-11601 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.0.19. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to read, create, update, clone, and delete email notification flows, including overwriting the default reservation confirmation, cancellation, and admin alert emails with attacker-controlled content sent from the site's legitimate address, or destroying reservation notification flows entirely. The vulnerable endpoints are active by default on every WPCafe installation without any configuration requirement, as the Email_Automation_Service_Provider::is_enable() method unconditionally returns true and the plugin ships with five pre-configured default email flows upon activation.
Product
WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System
Affected
up to 3.0.19
What to do
Affects up to 3.0.19. Update WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 3, 2026SaveTo Wishlist Lite: Does not sanitise and escape parameters before using them in the ORDER BY clause of a SQL queryCVE-2026-89236 · WordPress plugins & themes · reported by WPScanHigh 8.6
The SaveTo Wishlist Lite WordPress plugin before 1.1.5 does not sanitise and escape parameters before using them in the ORDER BY clause of a SQL query, allowing unauthenticated attackers to append additional SQL queries and extract sensitive information from the database.
Product
SaveTo Wishlist Lite
Fixed in
1.1.5
What to do
Update SaveTo Wishlist Lite to 1.1.5 or newer.
Full record and what to do →NVD record wpscan.com
Oct 1, 2026FluentForm: Incorrect Behavior OrderCVE-2026-103353 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Incorrect Behavior Order vulnerability in WP ManageNinja LLC FluentForm fluentform allows Removing Important Client Functionality.This issue affects FluentForm: from n/a through 6.2.14.
Product
FluentForm
Affected
up to 6.2.14
What to do
Affects up to 6.2.14. Update FluentForm to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 1, 2026Payments for Hubtel: Does not verify that the requester is authorized to view an order before redirecting a public payment-callback requestCVE-2026-96173 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Payments for Hubtel WordPress plugin before 1.0.2 does not verify that the requester is authorized to view an order before redirecting a public payment-callback request, allowing unauthenticated attackers to obtain the order key of an arbitrary order and view its contents.
Product
Payments for Hubtel
Fixed in
1.0.2
What to do
Update Payments for Hubtel to 1.0.2 or newer.
Full record and what to do →NVD record wpscan.com
Sep 28, 2026The Verge3D WordPress plugin from 4.1.0 through 4.13.0 does not verify with the payment provider that a payment was actually made, and does not check order owneCVE-2026-92996 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Verge3D WordPress plugin from 4.1.0 through 4.13.0 does not verify with the payment provider that a payment was actually made, and does not check order ownership, allowing unauthenticated users to mark any order as paid.
Affected
up to 4.13.0
What to do
Affects up to 4.13.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Sep 28, 2026The Paymattic WordPress plugin from 4.6.20 before 4.6.26 does not verify that a confirmed Stripe payment belongs to the order it is applied to, allowing unautheCVE-2026-89411 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Paymattic WordPress plugin from 4.6.20 before 4.6.26 does not verify that a confirmed Stripe payment belongs to the order it is applied to, allowing unauthenticated users to mark an arbitrary pending order as paid by confirming a smaller payment of their own against it.
Fixed in
4.6.26
What to do
Update the plugin to 4.6.26 or newer.
Full record and what to do →NVD record wpscan.com
Sep 25, 2026Restaurant Menu and Food Ordering: Stored Cross-Site ScriptingCVE-2026-96568 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Restaurant Menu and Food Ordering plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'phone_number' parameter in all versions up to, and including, 2.4.14 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Restaurant Menu and Food Ordering
Affected
up to 2.4.14
What to do
Affects up to 2.4.14. Update Restaurant Menu and Food Ordering to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 23, 2026SUMIT Payment Gateway for WooCommerce: Does not verify with the payment provider that a payment notification is genuine before marking the corresponding orderCVE-2026-84091 · WordPress plugins & themes · reported by WPScanMedium 5.3
The SUMIT Payment Gateway for WooCommerce WordPress plugin before 4.0.0 does not verify with the payment provider that a payment notification is genuine before marking the corresponding order as paid, allowing unauthenticated users to mark a pending order paid without completing payment.
Product
SUMIT Payment Gateway for WooCommerce
Fixed in
4.0.0
What to do
Update SUMIT Payment Gateway for WooCommerce to 4.0.0 or newer.
Full record and what to do →NVD record wpscan.com
Sep 23, 2026NP Quote Request for WooCommerce: Does not verify order ownership before rendering an order's detailsCVE-2026-93528 · WordPress plugins & themes · reported by WPScanLow 3.7
The NP Quote Request for WooCommerce WordPress plugin before 2.4.16 does not verify order ownership before rendering an order's details, allowing unauthenticated attackers to view another customer's order using the order's key.
Product
NP Quote Request for WooCommerce
Fixed in
2.4.16
What to do
Update NP Quote Request for WooCommerce to 2.4.16 or newer.
Full record and what to do →NVD record wpscan.com
Sep 23, 2026Payment Plugins for PayPal WooCommerce: Does not verify that a PayPal order supplied in a payment request belongs to the WooCommerce order being paid unless that PayPal order has already been completedCVE-2026-80342 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Payment Plugins for PayPal WooCommerce WordPress plugin before 2.0.27 does not verify that a PayPal order supplied in a payment request belongs to the WooCommerce order being paid unless that PayPal order has already been completed, allowing unauthenticated attackers to have another buyer's approved but uncaptured payment captured against an order of their own.
Product
Payment Plugins for PayPal WooCommerce
Fixed in
2.0.27
What to do
Update Payment Plugins for PayPal WooCommerce to 2.0.27 or newer.
Full record and what to do →NVD record wpscan.com
Sep 19, 2026Rede Itaú for WooCommerce — Payment PIX, Credit Card and Debit: Does not verify the authenticity of its PIX payment webhook before updating an order's statusCVE-2026-92430 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Rede Itaú for WooCommerce — Payment PIX, Credit Card and Debit WordPress plugin before 5.4.7 does not verify the authenticity of its PIX payment webhook before updating an order's status, allowing unauthenticated attackers to mark a pending order as paid without paying.
Product
Rede Itaú for WooCommerce — Payment PIX, Credit Card and Debit
Fixed in
5.4.7
What to do
Update Rede Itaú for WooCommerce — Payment PIX, Credit Card and Debit to 5.4.7 or newer.
Full record and what to do →NVD record wpscan.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.