Updated 57 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

344new WordPress flaws this week

390,080entries in the database

672 results · page 1 of 14

Oct 28, 2026Filter Everything — WordPress & WooCommerce Filters: Deserialization of Untrusted DataCVE-2026-116390 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Deserialization of Untrusted Data vulnerability in stepasyuk Filter Everything — WordPress & WooCommerce Filters filter-everything allows Object Injection.This issue affects Filter Everything — WordPress & WooCommerce Filters: from n/a through 1.9.7.
Product
Filter Everything — WordPress & WooCommerce Filters
Affected
up to 1.9.7
What to do
Affects up to 1.9.7. Update Filter Everything — WordPress & WooCommerce Filters to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 28, 2026Phoenix Media Rename: Deserialization of Untrusted DataCVE-2026-116389 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in crossi72 Phoenix Media Rename phoenix-media-rename allows Object Injection.This issue affects Phoenix Media Rename: from n/a through 3.13.5.
Product
Phoenix Media Rename
Affected
up to 3.13.5
What to do
Affects up to 3.13.5. Update Phoenix Media Rename to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 28, 2026Ultimate Member: Deserialization of Untrusted DataCVE-2026-115968 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in Ultimate Member Ultimate Member ultimate-member allows Object Injection.This issue affects Ultimate Member: from n/a through 2.13.1.
Product
Ultimate Member
Affected
up to 2.13.1
What to do
Affects up to 2.13.1. Update Ultimate Member to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 28, 2026Dokan: Deserialization of Untrusted DataCVE-2026-115590 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Deserialization of Untrusted Data vulnerability in weDevs Dokan dokan-lite allows Object Injection.This issue affects Dokan: from n/a through 5.3.1.
Product
Dokan
Affected
up to 5.3.1
What to do
Affects up to 5.3.1. Update Dokan to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 28, 2026Accordion: Deserialization of Untrusted DataCVE-2026-116392 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Deserialization of Untrusted Data vulnerability in PickPlugins Accordion accordions allows Object Injection.This issue affects Accordion: from n/a through 2.3.25.
Product
Accordion
Affected
up to 2.3.25
What to do
Affects up to 2.3.25. Update Accordion to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 28, 2026GS Logo Slider: Deserialization of Untrusted DataCVE-2026-116391 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in GS Plugins GS Logo Slider gs-logo-slider allows Object Injection.This issue affects GS Logo Slider: from n/a through 3.8.9.
Product
GS Logo Slider
Affected
up to 3.8.9
What to do
Affects up to 3.8.9. Update GS Logo Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 25, 2026Datawiza Proxy Auth: Does not verify that the user-identity and role HTTP request headers it trusts originate from a trusted reverse proxyCVE-2026-115214 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Datawiza Proxy Auth Plugin WordPress plugin before 1.1.1 does not verify that the user-identity and role HTTP request headers it trusts originate from a trusted reverse proxy, allowing unauthenticated attackers to create and authenticate as a WordPress administrator.
Product
Datawiza Proxy Auth
Fixed in
1.1.1
What to do
Update Datawiza Proxy Auth to 1.1.1 or newer.
Full record and what to do →NVD record wpscan.com
Oct 24, 2026Relevanssi: Deserialization of Untrusted DataCVE-2026-114704 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Deserialization of Untrusted Data vulnerability in Christoph Vielgrader Relevanssi relevanssi allows Object Injection.This issue affects Relevanssi : from n/a through 4.28.4.
Product
Relevanssi
Affected
up to 4.28.4
What to do
Affects up to 4.28.4. Update Relevanssi to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 24, 2026Newsletters: Deserialization of Untrusted DataCVE-2026-94075 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in Tribulant Software Newsletters newsletters-lite allows Object Injection.This issue affects Newsletters: from n/a through 4.18.1.
Product
Newsletters
Affected
up to 4.18.1
What to do
Affects up to 4.18.1. Update Newsletters to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 24, 2026Paytium: Deserialization of Untrusted DataCVE-2026-114196 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in paytiumsupport Paytium paytium allows Object Injection.This issue affects Paytium: from n/a through 5.0.5.
Product
Paytium
Affected
up to 5.0.5
What to do
Affects up to 5.0.5. Update Paytium to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 23, 2026Little Birdies: Deserialization of Untrusted DataCVE-2026-112859 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeREX Group Little Birdies little-birdies allows Object Injection.This issue affects Little Birdies: from n/a through 1.3.16.
Product
Little Birdies
Affected
up to 1.3.16
What to do
Affects up to 1.3.16. Update Little Birdies to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 23, 2026Rhodos: Deserialization of Untrusted DataCVE-2026-112858 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in axiomthemes Rhodos rhodos allows Object Injection.This issue affects Rhodos: from n/a through 1.3.3.
Product
Rhodos
Affected
up to 1.3.3
What to do
Affects up to 1.3.3. Update Rhodos to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 23, 2026Reprizo: Deserialization of Untrusted DataCVE-2026-112857 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in axiomthemes Reprizo reprizo allows Object Injection.This issue affects Reprizo: from n/a through 1.0.8.
Product
Reprizo
Affected
up to 1.0.8
What to do
Affects up to 1.0.8. Update Reprizo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 23, 2026Vagabonds: Deserialization of Untrusted DataCVE-2026-112856 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeREX Group Vagabonds vagabonds allows Object Injection.This issue affects Vagabonds: from n/a through 1.3.10.
Product
Vagabonds
Affected
up to 1.3.10
What to do
Affects up to 1.3.10. Update Vagabonds to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 23, 2026Redy: Deserialization of Untrusted DataCVE-2026-112855 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in axiomthemes Redy redy allows Object Injection.This issue affects Redy: from n/a through 1.3.5.
Product
Redy
Affected
up to 1.3.5
What to do
Affects up to 1.3.5. Update Redy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 23, 2026Holistic Center: Deserialization of Untrusted DataCVE-2026-112854 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in axiomthemes Holistic Center holistic-center allows Object Injection.This issue affects Holistic Center: from n/a through 1.2.6.
Product
Holistic Center
Affected
up to 1.2.6
What to do
Affects up to 1.2.6. Update Holistic Center to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 23, 2026Hallelujah: Deserialization of Untrusted DataCVE-2026-112853 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in axiomthemes Hallelujah hallelujah allows Object Injection.This issue affects Hallelujah: from n/a through 1.1.1.
Product
Hallelujah
Affected
up to 1.1.1
What to do
Affects up to 1.1.1. Update Hallelujah to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 23, 2026Helion: Deserialization of Untrusted DataCVE-2026-112852 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Deserialization of Untrusted Data vulnerability in ThemeREX Group Helion helion allows Object Injection.This issue affects Helion: from n/a through 1.1.12.
Product
Helion
Affected
up to 1.1.12
What to do
Affects up to 1.1.12. Update Helion to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 23, 2026HotLock: Deserialization of Untrusted DataCVE-2026-112851 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeREX Group HotLock hotlock allows Object Injection.This issue affects HotLock: from n/a through 1.3.9.
Product
HotLock
Affected
up to 1.3.9
What to do
Affects up to 1.3.9. Update HotLock to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 23, 2026Hostme v2: Deserialization of Untrusted DataCVE-2026-112848 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in AivahThemes Hostme v2 hostmev2 allows Object Injection.This issue affects Hostme v2: from n/a through 7.0.
Product
Hostme v2
Affected
up to 7.0
What to do
Affects up to 7.0. Update Hostme v2 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 23, 2026ZenSoul: Deserialization of Untrusted DataCVE-2026-112847 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeREX ZenSoul zensoul allows Object Injection.This issue affects ZenSoul: from n/a through 1.13.
Product
ZenSoul
Affected
up to 1.13
What to do
Affects up to 1.13. Update ZenSoul to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 23, 2026Save Life: Deserialization of Untrusted DataCVE-2026-112846 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeREX Group Save Life save-life allows Object Injection.This issue affects Save Life: from n/a through 1.2.14.
Product
Save Life
Affected
up to 1.2.14
What to do
Affects up to 1.2.14. Update Save Life to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 23, 2026Participants Database: Deserialization of Untrusted DataCVE-2026-112862 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in xnau webdesign Participants Database participants-database allows Object Injection.This issue affects Participants Database: from n/a through 2.7.8.5.
Product
Participants Database
Affected
up to 2.7.8.5
What to do
Affects up to 2.7.8.5. Update Participants Database to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 21, 2026GS Pins for Pinterest: Deserialization of Untrusted DataCVE-2026-110370 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in GS Plugins GS Pins for Pinterest gs-pinterest-portfolio allows Object Injection.This issue affects GS Pins for Pinterest: from n/a through 1.9.2.
Product
GS Pins for Pinterest
Affected
up to 1.9.2
What to do
Affects up to 1.9.2. Update GS Pins for Pinterest to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 21, 2026WordPress Team Members – GS: Deserialization of Untrusted DataCVE-2026-110369 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in GS Plugins WordPress Team Members – GS Plugins gs-team-members allows Object Injection.This issue affects WordPress Team Members – GS Plugins: from n/a through 2.8.2.
Product
WordPress Team Members – GS
Affected
up to 2.8.2
What to do
Affects up to 2.8.2. Update WordPress Team Members – GS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 19, 2026Quiz And Survey Master: Deserialization of Untrusted DataCVE-2026-111408 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows Object Injection.This issue affects Quiz And Survey Master: from n/a through 11.2.7.
Product
Quiz And Survey Master
Affected
up to 11.2.7
What to do
Affects up to 11.2.7. Update Quiz And Survey Master to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 18, 2026Conversational Forms for ChatBot: Deserialization of Untrusted DataCVE-2026-110886 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in QuantumCloud Conversational Forms for ChatBot conversational-forms allows Object Injection.This issue affects Conversational Forms for ChatBot: from n/a through 1.5.1.
Product
Conversational Forms for ChatBot
Affected
up to 1.5.1
What to do
Affects up to 1.5.1. Update Conversational Forms for ChatBot to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 18, 2026Strong Testimonials: Deserialization of Untrusted DataCVE-2026-107436 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in WP Chill Strong Testimonials strong-testimonials allows Object Injection.This issue affects Strong Testimonials: from n/a through 3.3.12.
Product
Strong Testimonials
Affected
up to 3.3.12
What to do
Affects up to 3.3.12. Update Strong Testimonials to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 16, 2026Gravity Forms: Deserialization of Untrusted DataCVE-2026-97296 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Deserialization of Untrusted Data vulnerability in Rocketgenius, Inc Gravity Forms gravityforms allows Object Injection.This issue affects Gravity Forms: from n/a before 3.1.1.
Product
Gravity Forms
Fixed in
3.1.1
What to do
Update Gravity Forms to 3.1.1 or newer.
Full record and what to do →NVD record patchstack.com
Oct 16, 2026Subscribe to Comments: Does not sign or validate a cookie it trusts to identify a commenterCVE-2026-91830 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Subscribe to Comments WordPress plugin before 2.3.3 does not sign or validate a cookie it trusts to identify a commenter, allowing unauthenticated attackers to disclose a subscriber's management key and silently alter that subscriber's subscriptions.
Product
Subscribe to Comments
Fixed in
2.3.3
What to do
Update Subscribe to Comments to 2.3.3 or newer.
Full record and what to do →NVD record wpscan.com
Oct 16, 2026Salon Booking System: Does not properly check authorization before creating a booking and trusts a caller-supplied user identifier and booking statusCVE-2026-110014 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Salon Booking System WordPress plugin before 10.31.9 does not properly check authorization before creating a booking and trusts a caller-supplied user identifier and booking status, allowing unauthenticated attackers to create bookings attributed to arbitrary users, overwrite those users' stored contact details, and mark bookings as paid or confirmed without any payment.
Product
Salon Booking System
Fixed in
10.31.9
What to do
Update Salon Booking System to 10.31.9 or newer.
Full record and what to do →NVD record wpscan.com
Oct 15, 2026Link Whisper Free: Deserialization of Untrusted DataCVE-2026-109686 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in Link Whisper INC Link Whisper Free link-whisper allows Object Injection.This issue affects Link Whisper Free: from n/a through 0.9.7.
Product
Link Whisper Free
Affected
up to 0.9.7
What to do
Affects up to 0.9.7. Update Link Whisper Free to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 14, 2026Polylang: Deserialization of Untrusted DataCVE-2026-97278 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Deserialization of Untrusted Data vulnerability in WP SYNTEX Polylang polylang allows Object Injection.This issue affects Polylang: from n/a through 3.8.9.
Product
Polylang
Affected
up to 3.8.9
What to do
Affects up to 3.8.9. Update Polylang to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 14, 2026Affiliates: Deserialization of Untrusted DataCVE-2026-108291 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in itthinx Affiliates affiliates allows Object Injection.This issue affects Affiliates: from n/a through 7.0.1.
Product
Affiliates
Affected
up to 7.0.1
What to do
Affects up to 7.0.1. Update Affiliates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 14, 2026SureCart: Deserialization of Untrusted DataCVE-2026-106599 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in Brainstorm Force SureCart surecart allows Object Injection.This issue affects SureCart: from n/a through 4.9.3.
Product
SureCart
Affected
up to 4.9.3
What to do
Affects up to 4.9.3. Update SureCart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 14, 2026Trust Payments Gateway for WooCommerce: Does not verify the authenticity of the payment provider's responseCVE-2026-87843 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Trust Payments Gateway for WooCommerce WordPress plugin before 3.1.0 does not verify the authenticity of the payment provider's response when a customer returns from the hosted payment page, nor bind that response to the targeted order or check the amount, allowing unauthenticated attackers to mark arbitrary orders as paid without any payment being made, and to retrieve order and customer details.
Product
Trust Payments Gateway for WooCommerce
Fixed in
3.1.0
What to do
Update Trust Payments Gateway for WooCommerce to 3.1.0 or newer.
Full record and what to do →NVD record wpscan.com
Oct 10, 2026Super Video Player: Deserialization of Untrusted DataCVE-2026-62044 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Deserialization of Untrusted Data vulnerability in bPlugins Super Video Player super-video-player allows Object Injection.This issue affects Super Video Player: from n/a through 1.8.13.
Product
Super Video Player
Affected
up to 1.8.13
What to do
Affects up to 1.8.13. Update Super Video Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 10, 2026AFFI – Affiliate Marketing for WooCommerce: Deserialization of Untrusted DataCVE-2026-104398 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in VillaTheme AFFI – Affiliate Marketing for WooCommerce affi-affiliate-marketing-for-woo allows Object Injection.This issue affects AFFI – Affiliate Marketing for WooCommerce: from n/a through 1.0.10.
Product
AFFI – Affiliate Marketing for WooCommerce
Affected
up to 1.0.10
What to do
Affects up to 1.0.10. Update AFFI – Affiliate Marketing for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 10, 2026Tainacan: Deserialization of Untrusted DataCVE-2026-94676 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Deserialization of Untrusted Data vulnerability in Tainacan Community Tainacan tainacan allows Object Injection.This issue affects Tainacan: from n/a through 1.3.0.
Product
Tainacan
Affected
up to 1.3.0
What to do
Affects up to 1.3.0. Update Tainacan to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 10, 2026Slider by 10Web: Deserialization of Untrusted DataCVE-2026-105885 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in 10Web Slider by 10Web slider-wd allows Object Injection.This issue affects Slider by 10Web: from n/a through 1.2.62.
Product
Slider by 10Web
Affected
up to 1.2.62
What to do
Affects up to 1.2.62. Update Slider by 10Web to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 10, 2026Balance: Deserialization of Untrusted DataCVE-2026-93945 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in Axiomthemes Balance balance allows Object Injection.This issue affects Balance: from n/a through 1.12.0.
Product
Balance
Affected
up to 1.12.0
What to do
Affects up to 1.12.0. Update Balance to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 10, 2026Camelia: Deserialization of Untrusted DataCVE-2026-93944 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeREX Group Camelia camelia allows Object Injection.This issue affects Camelia: from n/a through 1.2.15.
Product
Camelia
Affected
up to 1.2.15
What to do
Affects up to 1.2.15. Update Camelia to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 10, 2026Convex: Deserialization of Untrusted DataCVE-2026-93943 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeREX Group Convex convex allows Object Injection.This issue affects Convex: from n/a through 1.16.0.
Product
Convex
Affected
up to 1.16.0
What to do
Affects up to 1.16.0. Update Convex to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 10, 2026Dwell: Deserialization of Untrusted DataCVE-2026-93942 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeREX Group Dwell dwell allows Object Injection.This issue affects Dwell: from n/a through 1.16.0.
Product
Dwell
Affected
up to 1.16.0
What to do
Affects up to 1.16.0. Update Dwell to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 10, 2026Edema: Deserialization of Untrusted DataCVE-2026-93941 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeREX Group Edema edema allows Object Injection.This issue affects Edema: from n/a through 1.2.2.2.
Product
Edema
Affected
up to 1.2.2.2
What to do
Affects up to 1.2.2.2. Update Edema to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 10, 2026Greeny: Deserialization of Untrusted DataCVE-2026-93940 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeREX Group Greeny greeny allows Object Injection.This issue affects Greeny: from n/a through 2.10.0.
Product
Greeny
Affected
up to 2.10.0
What to do
Affects up to 2.10.0. Update Greeny to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 10, 2026Hogwords: Deserialization of Untrusted DataCVE-2026-93938 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeREX Group Hogwords hogwords allows Object Injection.This issue affects Hogwords: from n/a through 1.2.7.
Product
Hogwords
Affected
up to 1.2.7
What to do
Affects up to 1.2.7. Update Hogwords to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 10, 2026Hygia: Deserialization of Untrusted DataCVE-2026-93937 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeREX Group Hygia hygia allows Object Injection.This issue affects Hygia: from n/a through 1.21.0.
Product
Hygia
Affected
up to 1.21.0
What to do
Affects up to 1.21.0. Update Hygia to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 10, 2026IPharm: Deserialization of Untrusted DataCVE-2026-93936 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeREX Group IPharm ipharm allows Object Injection.This issue affects IPharm: from n/a through 1.2.4.
Product
IPharm
Affected
up to 1.2.4
What to do
Affects up to 1.2.4. Update IPharm to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 10, 2026Let's Play: Deserialization of Untrusted DataCVE-2026-93935 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeREX Group Let's Play playhockey allows Object Injection.This issue affects Let's Play: from n/a through 1.1.15.
Product
Let's Play
Affected
up to 1.1.15
What to do
Affects up to 1.1.15. Update Let's Play to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.