Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
290 results · page 1 of 6
Oct 28, 2026Awesome Support – WordPress HelpDesk & Support: Stored Cross-Site ScriptingCVE-2026-103370 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Awesome Support – WordPress HelpDesk & Support Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpas_files' parameter in all versions up to, and including, 6.4.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with custom-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability is only exploitable when the "Enable drag-n-drop uploader for ticket form" setting is enabled, as it is disabled by default.
- Product
- Awesome Support – WordPress HelpDesk & Support
- Affected
- up to 6.4.1
- What to do
- Affects up to 6.4.1. Update Awesome Support – WordPress HelpDesk & Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 22, 2026Majestic Support: Missing AuthorizationCVE-2026-112218 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Ahmad Majestic Support majestic-support allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Majestic Support: from n/a through 1.2.1.
- Product
- Majestic Support
- Affected
- up to 1.2.1
- What to do
- Affects up to 1.2.1. Update Majestic Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 18, 2026Support Genix: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-110895 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in DevItems Support Genix support-genix-lite allows SQL Injection.This issue affects Support Genix: from n/a through 1.4.54.
- Product
- Support Genix
- Affected
- up to 1.4.54
- What to do
- Affects up to 1.4.54. Update Support Genix to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 17, 2026PeachPay — Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net, NMI): Does not perform any capability or ownership check before returning an order's secret key in response to an unCVE-2026-103376 · WordPress plugins & themes · reported by WPScanMedium 5.3
The PeachPay — Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net, NMI) WordPress plugin before 1.120.70 does not perform any capability or ownership check before returning an order's secret key in response to an unauthenticated request, allowing anyone to retrieve the key for any paid order and use it to view that order's customer name, email address, postal address and contents.
- Product
- PeachPay — Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net, NMI)
- Fixed in
- 1.120.70
- What to do
- Update PeachPay — Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net, NMI) to 1.120.70 or newer.
Oct 13, 2026Weaver Xtreme Theme Support: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-54870 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpweaver Weaver Xtreme Theme Support weaverx-theme-support allows Stored XSS.This issue affects Weaver Xtreme Theme Support: from n/a through 7.0.1.
- Product
- Weaver Xtreme Theme Support
- Affected
- up to 7.0.1
- What to do
- Affects up to 7.0.1. Update Weaver Xtreme Theme Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 3, 2026Helpdesk Support Ticket System for WooCommerce: Insecure Direct Object ReferenceCVE-2026-11399 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Helpdesk Support Ticket System for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.1.6 via the 'id' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary ticket responses belonging to other users by supplying any stsw_responses row ID to the deletion handler after obtaining the nonce from the admin footer.
- Product
- Helpdesk Support Ticket System for WooCommerce
- Affected
- up to 2.1.6
- What to do
- Affects up to 2.1.6. Update Helpdesk Support Ticket System for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Oct 2, 2026SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent: Time-based SQL InjectionCVE-2026-94539 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent plugin for WordPress is vulnerable to time-based SQL Injection via the 'sort_by' parameter in all versions up to, and including, 3.5.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with custom-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Exploitation requires the authenticated attacker to hold both a Subscriber-level (or higher) WordPress role and a SupportCandy Agent account with the 'Assign Agents' permission configured.
- Product
- SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent
- Affected
- up to 3.5.3
- What to do
- Affects up to 3.5.3. Update SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.svn.wordpress.orgplugins.trac.wordpress.org
Oct 2, 2026SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent: Stored Cross-Site ScriptingCVE-2026-94378 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name' parameter in all versions up to, and including, 3.5.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This exploit chain requires the 'Register user if not exists' setting to be disabled, which is its default configuration.
- Product
- SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent
- Affected
- up to 3.5.3
- What to do
- Affects up to 3.5.3. Update SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.svn.wordpress.orgplugins.trac.wordpress.org
Oct 1, 2026Majestic Support: Authorization Bypass Through User-Controlled KeyCVE-2026-102382 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Authorization Bypass Through User-Controlled Key vulnerability in Ahmad Majestic Support majestic-support allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Majestic Support: from n/a through 1.2.0.
- Product
- Majestic Support
- Affected
- up to 1.2.0
- What to do
- Affects up to 1.2.0. Update Majestic Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 1, 2026Majestic Support: Missing AuthorizationCVE-2026-102381 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Ahmad Majestic Support majestic-support allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Majestic Support: from n/a through 1.2.0.
- Product
- Majestic Support
- Affected
- up to 1.2.0
- What to do
- Affects up to 1.2.0. Update Majestic Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 1, 2026Awesome Support – WordPress HelpDesk & Support: Stored Cross-Site ScriptingCVE-2026-96268 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Awesome Support – WordPress HelpDesk & Support Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'gdpr-data' parameter in all versions up to, and including, 6.4.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable by Subscriber-level users against other accounts because the AJAX handlers accept an arbitrary gdpr-user ID without verifying it belongs to the requester, and the required wpas-gdpr-nonce is emitted via wp_localize_script to every logged-in user on frontend plugin pages and on /wp-admin/profile.php.
- Product
- Awesome Support – WordPress HelpDesk & Support
- Affected
- up to 6.4.0
- What to do
- Affects up to 6.4.0. Update Awesome Support – WordPress HelpDesk & Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 30, 2026Subscriber Cross Site Scripting (XSS) in Awesome Support <= 6.3.9 versions.CVE-2026-96820 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Subscriber Cross Site Scripting (XSS) in Awesome Support <= 6.3.9 versions.
- Affected
- up to 6.3.9
- What to do
- Affects up to 6.3.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 23, 2026Subscriber Broken Access Control in Fluent Support <= 2.3.2 versions.CVE-2026-94679 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Subscriber Broken Access Control in Fluent Support <= 2.3.2 versions.
- Affected
- up to 2.3.2
- What to do
- Affects up to 2.3.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2026Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping & Social Channels: Directory TraversalCVE-2026-15095 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping & Social Channels plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.6.43 via the 'provider' parameter. This makes it possible for authenticated attackers, with shop manager-level access and above, to delete arbitrary files on the server, which can lead to remote code execution when critical files are deleted. Exploitation requires two sequential REST API calls: first to /wp-json/ctxfeed/v1/make_feed/save_feed_config to persist the traversal payload in wp_options, then to /wp-json/ctxfeed/v1/manage_feeds/delete_feed to trigger the unlink(); deletion is further constrained to files whose extensions match the plugin's validated whitelist (csv, xml, tsv, xls, xlsx, json, txt).
- Product
- Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping & Social Channels
- Affected
- up to 6.6.43
- What to do
- Affects up to 6.6.43. Update Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping & Social Channels to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 9, 2026Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More: Does not validate a user-supplied HTML tag name in one of its Beaver Builder widgets before echoing it into the rendered markupCVE-2026-85418 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More WordPress plugin before 3.0.9 does not validate a user-supplied HTML tag name in one of its Beaver Builder widgets before echoing it into the rendered markup, allowing users with contributor-level access and above to inject arbitrary web scripts that execute when any visitor views the affected page.
- Product
- Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More
- Fixed in
- 3.0.9
- What to do
- Update Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More to 3.0.9 or newer.
Sep 9, 2026WPBot – AI ChatBot for Live Support, Lead Generation, AI Services: Stored Cross-Site ScriptingCVE-2026-83593 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The WPBot – AI ChatBot for Live Support, Lead Generation, AI Services plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'conversation' parameter in all versions up to, and including, 8.7.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The action is gated only by a nonce that is localized into every public-facing page via wp_localize_script, rendering the nonce check ineffective as an access control barrier for unauthenticated users.
- Product
- WPBot – AI ChatBot for Live Support, Lead Generation, AI Services
- Affected
- up to 8.7.3
- What to do
- Affects up to 8.7.3. Update WPBot – AI ChatBot for Live Support, Lead Generation, AI Services to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 9, 2026SupportCandy: Does not validate a submitted per-ticket authorization code before disclosing the real code to the requesterCVE-2026-81022 · WordPress plugins & themes · reported by WPScanMedium 5.3
The SupportCandy WordPress plugin before 3.5.3 does not validate a submitted per-ticket authorization code before disclosing the real code to the requester, allowing unauthenticated users to read the contents of any support ticket.
- Product
- SupportCandy
- Fixed in
- 3.5.3
- What to do
- Update SupportCandy to 3.5.3 or newer.
Sep 9, 2026SupportCandy: Does not perform an authorization check on one of its support-ticket attachment download pathsCVE-2026-81021 · WordPress plugins & themes · reported by WPScanMedium 5.3
The SupportCandy WordPress plugin before 3.5.3 does not perform an authorization check on one of its support-ticket attachment download paths, allowing unauthenticated attackers to read protected customer-uploaded attachments by enumerating sequential attachment identifiers.
- Product
- SupportCandy
- Fixed in
- 3.5.3
- What to do
- Update SupportCandy to 3.5.3 or newer.
Sep 9, 2026Awesome Support: Missing AuthorizationCVE-2026-19946 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Awesome Support plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 6.3.9. This is due to a missing capability check on the wpas_do_mr_deny_user() function, which unlike its counterpart wpas_do_mr_activate_user() does not enforce current_user_can('edit_users') or current_user_can('edit_user', $user_id), relying solely on a nonce that is not scoped to the target user. This makes it possible for authenticated attackers, with subscriber-level access and above, to set the mr_user_denied flag on any user account — including administrators — permanently blocking their moderated activation and dispatching a denial notification email to the victim.
- Product
- Awesome Support
- Affected
- up to 6.3.9
- What to do
- Affects up to 6.3.9. Update Awesome Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 1, 2026Support Genix – Helpdesk, AI Chatbot, Knowledge Base & Customer Support Ticketing System: Authentication Bypass leading to Administrator Account TakeoverCVE-2026-19806 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Support Genix – Helpdesk, AI Chatbot, Knowledge Base & Customer Support Ticketing System plugin for WordPress is vulnerable to Authentication Bypass leading to Administrator Account Takeover in all versions up to, and including, 1.4.52 via the `guest_ticket_login()` function and its `p` parameter. This is due to the site-wide AES-256-CBC encryption key being derived from only three two-digit `wp_rand(10, 99)` values and a Unix timestamp via `md5()` — yielding approximately 19.5 bits of entropy — combined with a deterministic IV derived from the password, no authentication tag on the ciphertext, and no capability check, nonce, or session validation on the publicly reachable `/sgnix/?p=<token>` endpoint. This makes it possible for authenticated attackers, with subscriber-level access and above, who can obtain a single legitimate guest ticket token as a known-plaintext oracle and bound the plugin activation timestamp, to exhaust the ~729,000-candidate keyspace entirely offline, recover the site-wide encryption key, and forge a self-consistent `{ticket_id, ticket_user}` token targeting any administrator-owned ticket. Submitting the forged token to the unprotected endpoint causes `w
- Product
- Support Genix – Helpdesk, AI Chatbot, Knowledge Base & Customer Support Ticketing System
- Affected
- up to 1.4.52
- What to do
- Affects up to 1.4.52. Update Support Genix – Helpdesk, AI Chatbot, Knowledge Base & Customer Support Ticketing System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 24, 2026Unauthenticated Cross Site Request Forgery (CSRF) in Fluent Support Pro <= 2.3.1 versions.CVE-2026-78279 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Unauthenticated Cross Site Request Forgery (CSRF) in Fluent Support Pro <= 2.3.1 versions.
- Affected
- up to 2.3.1
- What to do
- Affects up to 2.3.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 24, 2026Subscriber Broken Access Control in Fluent Support Pro <= 2.3.1 versions.CVE-2026-78272 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Subscriber Broken Access Control in Fluent Support Pro <= 2.3.1 versions.
- Affected
- up to 2.3.1
- What to do
- Affects up to 2.3.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 18, 2026Unauthenticated Broken Authentication in SupportCandy <= 3.5.1 versions.CVE-2026-73350 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Unauthenticated Broken Authentication in SupportCandy <= 3.5.1 versions.
- Affected
- up to 3.5.1
- What to do
- Affects up to 3.5.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 5, 2026Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More: Does not sanitize uploaded SVG filesCVE-2026-16583 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More WordPress plugin before 3.0.8 does not sanitize uploaded SVG files when its SVG upload feature is enabled, allowing authenticated users with the upload capability (Author and above by default, without the unfiltered_html capability) to upload SVG files containing JavaScript that executes in the site context when the file is viewed, leading to Stored Cross-Site Scripting.
- Product
- Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More
- Fixed in
- 3.0.8
- What to do
- Update Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More to 3.0.8 or newer.
Aug 5, 2026ERP: Complete HR, Accounting & CRM Suite with WooCommerce CRM Support: SQL InjectionCVE-2026-11421 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The ERP: Complete HR, Accounting & CRM Suite with WooCommerce CRM Support plugin for WordPress is vulnerable to SQL Injection via the 'erpadvancefilter' parameter in all versions up to, and including, 1.17.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. The handler runs the value through sanitize_text_field, which preserves single quotes, and the downstream erp_crm_contact_advance_filter() function interpolates it directly into a single-quoted SQL WHERE clause before execution via $wpdb->get_results(). This makes it possible for authenticated attackers, with the plugin-supplied CRM Agent role (or higher CRM Manager / WordPress admin) and the erp_crm_list_contact capability, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- ERP: Complete HR, Accounting & CRM Suite with WooCommerce CRM Support
- Affected
- up to 1.17.4
- What to do
- Affects up to 1.17.4. Update ERP: Complete HR, Accounting & CRM Suite with WooCommerce CRM Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 4, 2026Chat Widget: Floating Customer Support Button for 30+ Channels, Supporting SMS, Calls, and Chat: Does not validate the typeCVE-2026-16548 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Chat Widget: Floating Customer Support Button for 30+ Channels, Supporting SMS, Calls, and Chat WordPress plugin before 1.8.2 does not validate the type, extension, content, or size of files submitted to its public response endpoint and stores them under the uploads directory, so an unauthenticated user can upload arbitrary files. The original extension is discarded (files are stored under a bare UUID), so this does not yield code execution or stored XSS; impact is bounded to disk consumption and content hosting. The storing path requires the channel's response storage or mail-forwarding to be configured.
- Product
- Chat Widget: Floating Customer Support Button for 30+ Channels, Supporting SMS, Calls, and Chat
- Fixed in
- 1.8.2
- What to do
- Update Chat Widget: Floating Customer Support Button for 30+ Channels, Supporting SMS, Calls, and Chat to 1.8.2 or newer.
Aug 3, 2026SVG Support: Does not apply its SVG sanitisation to uploaded files using theCVE-2026-13340 · WordPress plugins & themes · reported by WPScanMedium 6.1
The SVG Support WordPress plugin before 2.5.17 does not apply its SVG sanitisation to uploaded files using the .svgz extension, even though it registers and serves them as SVG, allowing a user permitted to upload SVGs (such as an Author once granted upload access) to store a script-bearing file that executes in the browser of anyone who later views it, including an administrator.
- Product
- SVG Support
- Fixed in
- 2.5.17
- What to do
- Update SVG Support to 2.5.17 or newer.
Aug 1, 2026Support Genix: Does not prevent directory traversal in its ticket-attachment download routeCVE-2026-15932 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Support Genix WordPress plugin before 1.4.48 does not prevent directory traversal in its ticket-attachment download route, allowing unauthenticated attackers to read arbitrary files with an allowlisted extension — including other users' private ticket attachments — from the server.
- Product
- Support Genix
- Fixed in
- 1.4.48
- What to do
- Update Support Genix to 1.4.48 or newer.
Aug 1, 2026Fluent Support: Does not perform a per-ticket access check before reassigning a ticket's customerCVE-2026-14197 · WordPress plugins & themes · reported by WPScanLow 3.8
The Fluent Support WordPress plugin before 2.3.1 does not perform a per-ticket access check before reassigning a ticket's customer, allowing a restricted support agent to change the assigned customer of any ticket in the system, including tickets outside their granted scope.
- Product
- Fluent Support
- Fixed in
- 2.3.1
- What to do
- Update Fluent Support to 2.3.1 or newer.
Jul 31, 2026JS Help Desk: Grants a support-agent capability to the Contributor role on activation and does not perform a capability check on a user-listing handlerCVE-2026-14931 · WordPress plugins & themes · reported by WPScanMedium 6.5
The JS Help Desk WordPress plugin before 3.1.4 grants a support-agent capability to the Contributor role on activation and does not perform a capability check on a user-listing handler, allowing Contributor-level users to enumerate the email addresses of all registered WordPress users.
- Product
- JS Help Desk
- Fixed in
- 3.1.4
- What to do
- Update JS Help Desk to 3.1.4 or newer.
Jul 31, 2026JS Help Desk: Does not perform authorization or ownership checks before returning support-ticket content in a nonce-gated search handlerCVE-2026-14928 · WordPress plugins & themes · reported by WPScanMedium 6.5
The JS Help Desk WordPress plugin before 3.1.4 does not perform authorization or ownership checks before returning support-ticket content in a nonce-gated search handler, allowing any authenticated user (Subscriber and above) to read the subject and full message body of every other user's support tickets.
- Product
- JS Help Desk
- Fixed in
- 3.1.4
- What to do
- Update JS Help Desk to 3.1.4 or newer.
Jul 31, 2026Support Genix: Does not properly authorize access to support-ticket attachment downloadsCVE-2026-14862 · WordPress plugins & themes · reported by WPScanLow 3.7
The Support Genix WordPress plugin before 1.4.48 does not properly authorize access to support-ticket attachment downloads, allowing unauthenticated users who obtain the stored attachment file name to download other users' private ticket attachments.
- Product
- Support Genix
- Fixed in
- 1.4.48
- What to do
- Update Support Genix to 1.4.48 or newer.
Jul 28, 2026WPBot – AI ChatBot for Live Support, Lead Generation, AI Services: Sensitive Information ExposureCVE-2026-16773 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WPBot – AI ChatBot for Live Support, Lead Generation, AI Services plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 8.5.9 via the wpbot_send_email_transcript_free. This makes it possible for unauthenticated attackers to exfiltrate full chat transcripts and associated user PII — including names, email addresses, and phone numbers — stored in the wpbot_user and wpbot_conversation tables to an attacker-controlled email address.
- Product
- WPBot – AI ChatBot for Live Support, Lead Generation, AI Services
- Affected
- up to 8.5.9
- What to do
- Affects up to 8.5.9. Update WPBot – AI ChatBot for Live Support, Lead Generation, AI Services to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 24, 2026Fluent Support – Helpdesk & Customer Support Ticket System: Stored Cross-Site ScriptingCVE-2026-15665 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Fluent Support – Helpdesk & Customer Support Ticket System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'redirect-to' Shortcode Attribute in all versions up to, and including, 2.3.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The XSS payload is in a hidden attribute so it only fires in specific browsers when specific access keys are used making exploitation unlikely.
- Product
- Fluent Support – Helpdesk & Customer Support Ticket System
- Affected
- up to 2.3.0
- What to do
- Affects up to 2.3.0. Update Fluent Support – Helpdesk & Customer Support Ticket System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 23, 2026Contributor Cross Site Scripting (XSS) in Fluent Support <= 2.3.0 versions.CVE-2026-65470 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Cross Site Scripting (XSS) in Fluent Support <= 2.3.0 versions.
- Affected
- up to 2.3.0
- What to do
- Affects up to 2.3.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026Customer Support Ticket System & Helpdesk: Code InjectionCVE-2026-15011 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Customer Support Ticket System & Helpdesk plugin for WordPress is vulnerable to Code Injection via the 'path' parameter in all versions up to, and including, 6.0.5 due to the use of dynamic function invocation on an attacker-controlled value with insufficient validation. This makes it possible for unauthenticated attackers to invoke arbitrary parameterless PHP functions, which can be used to disrupt site functionality or expose sensitive information. The required nonce is publicly emitted via wp_localize_script whenever the plugin's [emd_form] shortcode is rendered on any public-facing page, making the endpoint reachable by unauthenticated visitors without any prior authentication or privilege.
- Product
- Customer Support Ticket System & Helpdesk
- Affected
- up to 6.0.5
- What to do
- Affects up to 6.0.5. Update Customer Support Ticket System & Helpdesk to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 16, 2026WPBot – AI ChatBot for Live Support, Lead Generation, AI Services: Authorization bypassCVE-2026-15610 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WPBot – AI ChatBot for Live Support, Lead Generation, AI Services plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 8.5.6. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to trigger arbitrary re-embedding of stored RAG documents, modifying the rag_documents table and consuming the site owner's paid third-party AI API credits (OpenAI, Gemini, OpenRouter, or xAI).
- Product
- WPBot – AI ChatBot for Live Support, Lead Generation, AI Services
- Affected
- up to 8.5.6
- What to do
- Affects up to 8.5.6. Update WPBot – AI ChatBot for Live Support, Lead Generation, AI Services to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 16, 2026WPBot – AI ChatBot for Live Support, Lead Generation, AI Services: Authorization bypassCVE-2026-15106 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WPBot – AI ChatBot for Live Support, Lead Generation, AI Services plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 8.5.6. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to delete arbitrary chat session records from the wpbot_user and wpbot_conversation tables, including chat history and conversation logs, by supplying a crafted userid value.
- Product
- WPBot – AI ChatBot for Live Support, Lead Generation, AI Services
- Affected
- up to 8.5.6
- What to do
- Affects up to 8.5.6. Update WPBot – AI ChatBot for Live Support, Lead Generation, AI Services to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 13, 2026SupportCandy: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-57711 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PSM Plugins SupportCandy supportcandy allows Stored XSS.This issue affects SupportCandy: from n/a through <= 3.4.8.
- Product
- SupportCandy
- Affected
- up to 3.4.8
- What to do
- Affects up to 3.4.8. Update SupportCandy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 11, 2026Majestic Support – The Leading-Edge Help Desk & Customer Support: Generic SQL InjectionCVE-2026-13262 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin plugin for WordPress is vulnerable to generic SQL Injection via the 'val' parameter in all versions up to, and including, 1.1.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Exploitation requires a valid 'get-smart-reply' nonce, which any Subscriber-level user can obtain by creating a ticket via the public frontend and visiting the resulting ticket detail page, making this effectively exploitable by any authenticated user.
- Product
- Majestic Support – The Leading-Edge Help Desk & Customer Support
- Affected
- up to 1.1.9
- What to do
- Affects up to 1.1.9. Update Majestic Support – The Leading-Edge Help Desk & Customer Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 9, 2026ERP: Complete HR, Accounting & CRM Suite with Recruitment and WooCommerce CRM Support: Generic SQL InjectionCVE-2026-13011 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The ERP: Complete HR, Accounting & CRM Suite with Recruitment and WooCommerce CRM Support plugin for WordPress is vulnerable to generic SQL Injection via the 'orderby' parameter in all versions up to, and including, 1.17.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with custom-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Exploitation requires the erp_list_employee capability, which is granted to HR Manager-level users and above within the WP ERP plugin.
- Product
- ERP: Complete HR, Accounting & CRM Suite with Recruitment and WooCommerce CRM Support
- Affected
- up to 1.17.5
- What to do
- Affects up to 1.17.5. Update ERP: Complete HR, Accounting & CRM Suite with Recruitment and WooCommerce CRM Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 9, 2026WP Support Plus Responsive Ticket System: Does not sign or verify its guest-session cookieCVE-2026-11875 · WordPress plugins & themes · reported by WPScanMedium 5.3
The WP Support Plus Responsive Ticket System WordPress plugin through 9.1.2 does not sign or verify its guest-session cookie, allowing unauthenticated attackers to forge it and impersonate any ticket owner (identified by email address) to read, reply to, and close that person's support tickets.
- Product
- WP Support Plus Responsive Ticket System
- Affected
- up to 9.1.2
- What to do
- Affects up to 9.1.2. Update WP Support Plus Responsive Ticket System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 1, 2026WPBot – AI ChatBot for Live Support, Lead Generation, AI Services: Stored Cross-Site ScriptingCVE-2026-13731 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The WPBot – AI ChatBot for Live Support, Lead Generation, AI Services plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'conversation' parameter in all versions up to, and including, 8.4.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The AJAX nonce required to authenticate the save request is publicly emitted on every frontend page via wp_localize_script, making it freely obtainable by any anonymous visitor and removing any practical barrier to exploitation.
- Product
- WPBot – AI ChatBot for Live Support, Lead Generation, AI Services
- Affected
- up to 8.4.9
- What to do
- Affects up to 8.4.9. Update WPBot – AI ChatBot for Live Support, Lead Generation, AI Services to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 30, 2026WP Support Plus Responsive Ticket System: Does not sanitize user-supplied array keys before using them in a SQL statementCVE-2026-11590 · WordPress plugins & themes · reported by WPScanHigh 8.6
The WP Support Plus Responsive Ticket System WordPress plugin through 9.1.2 does not sanitize user-supplied array keys before using them in a SQL statement, allowing unauthenticated users to perform SQL injection attacks.
- Product
- WP Support Plus Responsive Ticket System
- Affected
- up to 9.1.2
- What to do
- Affects up to 9.1.2. Update WP Support Plus Responsive Ticket System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 30, 2026WP Support Plus Responsive Ticket System: Does not properly validate uploaded filesCVE-2026-11589 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WP Support Plus Responsive Ticket System WordPress plugin through 9.1.2 does not properly validate uploaded files, allowing unauthenticated users to upload files containing malicious JavaScript (such as HTML or SVG) to a publicly accessible location, leading to Stored Cross-Site Scripting attacks against site users and administrators.
- Product
- WP Support Plus Responsive Ticket System
- Affected
- up to 9.1.2
- What to do
- Affects up to 9.1.2. Update WP Support Plus Responsive Ticket System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 29, 2026Team Members – Multi Language Supported Team: Stored Cross-Site ScriptingCVE-2026-12114 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Team Members – Multi Language Supported Team Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 8.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
- Product
- Team Members – Multi Language Supported Team
- Affected
- up to 8.7
- What to do
- Affects up to 8.7. Update Team Members – Multi Language Supported Team to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 26, 2026Subscriber Insecure Direct Object References (IDOR) in Majestic Support <= 1.1.7 versions.CVE-2026-57646 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Subscriber Insecure Direct Object References (IDOR) in Majestic Support <= 1.1.7 versions.
- What to do
- Update the plugin to the newest version.
Jun 26, 2026Subscriber Insecure Direct Object References (IDOR) in SupportCandy <= 3.4.6 versions.CVE-2026-54826 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Subscriber Insecure Direct Object References (IDOR) in SupportCandy <= 3.4.6 versions.
- What to do
- Update the plugin to the newest version.
Jun 18, 2026Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More: Stored Cross-Site ScriptingCVE-2026-11358 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.0.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
- Product
- Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More
- Affected
- up to 3.0.6
- What to do
- Affects up to 3.0.6. Update Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 17, 2026Unauthenticated Privilege Escalation in Support Board < 3.8.9 versions.CVE-2026-27395 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated Privilege Escalation in Support Board < 3.8.9 versions.
- What to do
- Update the plugin to the newest version.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.