Updated 8 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

343new WordPress flaws this week

390,080entries in the database

577 results · page 1 of 12

Oct 29, 2026Wallet System for WooCommerce: Does not restrict its KYC document submission handler to the current user's own accountCVE-2026-108763 · WordPress plugins & themes · reported by WPScan
The Wallet System for WooCommerce WordPress plugin before 2.8.2 does not restrict its KYC document submission handler to the current user's own account, taking the target user ID from a client-supplied request field with no ownership or capability check, allowing authenticated users with minimal privileges such as Subscriber or Customer to overwrite the KYC documents and verification status of any other user, including an administrator.
Product
Wallet System for WooCommerce
Fixed in
2.8.2
What to do
Update Wallet System for WooCommerce to 2.8.2 or newer.
Full record and what to do →NVD record wpscan.com
Oct 28, 2026VikRentCar Car Rental Management System: Blind SQL InjectionCVE-2026-116750 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to blind SQL Injection via the 'catid' parameter in all versions up to, and including, 1.4.10 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. A Contributor-level user can store a malicious block via the REST API in a pending post and trigger server-side rendering by previewing that post, bypassing wp_magic_quotes since the attribute is sourced from post_content via parse_blocks rather than a superglobal.
Product
VikRentCar Car Rental Management System
Affected
up to 1.4.10
What to do
Affects up to 1.4.10. Update VikRentCar Car Rental Management System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 28, 2026VikRentCar Car Rental Management System: Stored Cross-Site ScriptingCVE-2026-116749 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'className' parameter in all versions up to, and including, 1.4.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. wp_kses_post() applied at save time does not neutralize the payload because the injection lands in an HTML-attribute context where only a raw double-quote is needed to break out, and block-comment JSON encoding of that quote is decoded back to a literal character by do_blocks() at render time.
Product
VikRentCar Car Rental Management System
Affected
up to 1.4.10
What to do
Affects up to 1.4.10. Update VikRentCar Car Rental Management System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 28, 2026VikRentCar Car Rental Management System: Cross-Site Request ForgeryCVE-2026-111120 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.8. This is due to missing or incorrect nonce validation on the condtext_update_tmpl function. This makes it possible for unauthenticated attackers to write arbitrary PHP code to the plugin's executable template files such as site/helpers/email_tmpl.php, which are later include()d by loadEmailTemplate() and loadPdfTemplate(), achieving remote code execution on the server via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. The injected PHP payload bypasses sanitization because the plugin's own __PHP_OPEN__/__PHP_CLOSE__ placeholder expansion and cleanPHPSourceCode() logic explicitly reverse both sanitize_text_field filtering and saveHTML() HTML-encoding, restoring a literal <?php...?> payload to live PHP before it is written to disk. Successful exploitation additionally requires an action by an administrator — the attacker cannot trigger the vulnerability on their own.
Product
VikRentCar Car Rental Management System
Affected
up to 1.4.8
What to do
Affects up to 1.4.8. Update VikRentCar Car Rental Management System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 28, 2026Customer Engagement System: Does not restrict access to its MailChimp interest-group lookup or validate the API key supplied to itCVE-2026-115225 · WordPress plugins & themes · reported by WPScanMedium 5.8
The Customer Engagement System WordPress plugin before 2.0.2 does not restrict access to its MailChimp interest-group lookup or validate the API key supplied to it, allowing unauthenticated users to make the server open connections to arbitrary internal hosts and ports and infer from response timing which ones are reachable.
Product
Customer Engagement System
Fixed in
2.0.2
What to do
Update Customer Engagement System to 2.0.2 or newer.
Full record and what to do →NVD record wpscan.com
Oct 28, 2026Customer Engagement System: Does not safely build the SQL statements that store a popup's page and category visibility rulesCVE-2026-115224 · WordPress plugins & themes · reported by WPScanMedium 4.1
The Customer Engagement System WordPress plugin before 2.0.2 does not safely build the SQL statements that store a popup's page and category visibility rules, concatenating request-supplied ID values directly into an INSERT statement with no parameter binding or integer cast, allowing an authenticated administrator to inject arbitrary SQL and read the contents of the WordPress database.
Product
Customer Engagement System
Fixed in
2.0.2
What to do
Update Customer Engagement System to 2.0.2 or newer.
Full record and what to do →NVD record wpscan.com
Oct 23, 2026Download Monitor: Does not correctly restrict management of the list of filesystem locations it may serve files from to network administrators on multisiteCVE-2026-112219 · WordPress plugins & themes · reported by WPScanMedium 4.9
The Download Monitor WordPress plugin before 5.3.5 does not correctly restrict management of the list of filesystem locations it may serve files from to network administrators on multisite, allowing a subsite administrator who is not trusted at the network level to approve arbitrary locations and have the Download Monitor WordPress plugin before 5.3.5 serve readable files from outside the uploads directory, including files belonging to other subsites, to unauthenticated visitors; single-site installations are unaffected.
Product
Download Monitor
Fixed in
5.3.5
What to do
Update Download Monitor to 5.3.5 or newer.
Full record and what to do →NVD record wpscan.com
Oct 22, 2026Restaurant Menu – Food Ordering System – Table Reservation: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-114700 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Gloriafood Restaurant Menu – Food Ordering System – Table Reservation menu-ordering-reservations allows Stored XSS.This issue affects Restaurant Menu – Food Ordering System – Table Reservation: from n/a through 2.4.4.
Product
Restaurant Menu – Food Ordering System – Table Reservation
Affected
up to 2.4.4
What to do
Affects up to 2.4.4. Update Restaurant Menu – Food Ordering System – Table Reservation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 21, 2026WP Booking System: Does not validate and escape one of its parameters before reflecting it back in an admin pageCVE-2026-109147 · WordPress plugins & themes · reported by WPScanHigh 7.1
The WP Booking System WordPress plugin before 2.1.0.3 does not validate and escape one of its parameters before reflecting it back in an admin page, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as administrators.
Product
WP Booking System
Fixed in
2.1.0.3
What to do
Update WP Booking System to 2.1.0.3 or newer.
Full record and what to do →NVD record wpscan.com
Oct 19, 2026Salon Booking System: Does not enforce a minimum of zeroCVE-2026-110034 · WordPress plugins & themes · reported by WPScanLow 3.7
The Salon Booking System WordPress plugin before 10.31.11 does not enforce a minimum of zero when subtracting a fixed-amount discount from a booking's total, allowing an unauthenticated visitor who knows a valid discount code to create a confirmed booking stored with a negative total.
Product
Salon Booking System
Fixed in
10.31.11
What to do
Update Salon Booking System to 10.31.11 or newer.
Full record and what to do →NVD record wpscan.com
Oct 18, 2026Salon Booking System: Does not restrict one of its REST API endpoints to salon staffCVE-2026-110035 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Salon Booking System WordPress plugin before 10.31.11 does not restrict one of its REST API endpoints to salon staff, allowing any authenticated user, such as a subscriber, to retrieve every discount coupon configured on the site, including coupons the administrator has chosen to hide from customers, together with their amounts, validity dates and usage limits.
Product
Salon Booking System
Fixed in
10.31.11
What to do
Update Salon Booking System to 10.31.11 or newer.
Full record and what to do →NVD record wpscan.com
Oct 18, 2026Salon Booking System: Does not validate a user-supplied image URL before fetching it server-side and writing the response to a publicly accessible location under an attacker-chosen filenameCVE-2026-110033 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Salon Booking System WordPress plugin before 10.31.11 does not validate a user-supplied image URL before fetching it server-side and writing the response to a publicly accessible location under an attacker-chosen filename, allowing users with the Salon Staff role or higher to force the server to read internal-only resources and disclose them, and to store a malicious SVG that runs arbitrary scripts in the site's origin for anyone who opens it.
Product
Salon Booking System
Fixed in
10.31.11
What to do
Update Salon Booking System to 10.31.11 or newer.
Full record and what to do →NVD record wpscan.com
Oct 18, 2026Salon Booking System: Does not restrictCVE-2026-110032 · WordPress plugins & themes · reported by WPScanMedium 5.5
The Salon Booking System WordPress plugin before 10.31.11 does not restrict which user account its salon staff roles may edit through the customers management screen, allowing users with the Salon Staff or Salon Worker role to reset any other user's role, including administrators, to a customer and to overwrite arbitrary profile fields on any account, leading to loss of administrative access and potential site lockout.
Product
Salon Booking System
Fixed in
10.31.11
What to do
Update Salon Booking System to 10.31.11 or newer.
Full record and what to do →NVD record wpscan.com
Oct 18, 2026Salon Booking System: Does not prevent users holding its custom salon staff role from assigning arbitrary capabilities to other accountsCVE-2026-110031 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Salon Booking System WordPress plugin before 10.31.11 does not prevent users holding its custom salon staff role from assigning arbitrary capabilities to other accounts when editing a customer, allowing them to escalate any account to administrator and take over the site.
Product
Salon Booking System
Fixed in
10.31.11
What to do
Update Salon Booking System to 10.31.11 or newer.
Full record and what to do →NVD record wpscan.com
Oct 17, 2026Payment forms, Buy now buttons, and Invoicing System | GetPaid: Stored Cross-Site ScriptingCVE-2026-111110 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Payment forms, Buy now buttons, and Invoicing System | GetPaid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mmdwqzpoxadd' parameter in all versions up to, and including, 2.8.61 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The required nonce (getpaid_form_nonce) is publicly emitted to all visitors via wp_localize_script as WPInv.formNonce, meaning no authentication or prior nonce leak is needed; the stored payload fires when an administrator views the affected invoice's Payment Form Details metabox.
Product
Payment forms, Buy now buttons, and Invoicing System | GetPaid
Affected
up to 2.8.61
What to do
Affects up to 2.8.61. Update Payment forms, Buy now buttons, and Invoicing System | GetPaid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Oct 17, 2026WP Booking System – Booking Calendar: Authorization bypassCVE-2026-109369 · WordPress plugins & themes · reported by WordfenceMedium 6.8
The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.1.0.3 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to grant themselves and arbitrary other users edit access to every booking form on the site by overwriting the user_permission meta that governs the plugin's own access-control list. Exploitation requires the attacker to have already been delegated edit rights on at least one booking form, as this delegation both downgrades the submenu capability to 'read' (making the edit page accessible) and allows them to harvest a valid wpbs_edit_form nonce that will pass validation against any other form_id.
Product
WP Booking System – Booking Calendar
Affected
up to 2.1.0.3
What to do
Affects up to 2.1.0.3. Update WP Booking System – Booking Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 17, 2026WP Booking System – Booking Calendar: Sensitive Information ExposureCVE-2026-109368 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.1.0.3 via the 'id' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract private per-event booking descriptions and booking IDs from any calendar managed by the site.
Product
WP Booking System – Booking Calendar
Affected
up to 2.1.0.3
What to do
Affects up to 2.1.0.3. Update WP Booking System – Booking Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 17, 2026WP Booking System – Booking Calendar: Authorization bypassCVE-2026-108123 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.1.0.3 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to read the stored notification email body of any booking by iterating booking_id and email_log_id, exposing customer PII including names, email addresses, phone numbers, messages, and booking dates intended to be visible only to administrators. This is exploitable by any Subscriber-level user because admin_init fires on profile.php, a wp-admin page accessible to all authenticated users.
Product
WP Booking System – Booking Calendar
Affected
up to 2.1.0.3
What to do
Affects up to 2.1.0.3. Update WP Booking System – Booking Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 16, 2026WP Booking System – Booking Calendar: Generic SQL InjectionCVE-2026-111178 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to generic SQL Injection via the 'data[orderby]' parameter in all versions up to, and including, 2.1.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Exploitation requires the targeted calendar to have more than 200 bookings, as the orderby value is only forwarded to the database layer when the AJAX handler takes the use_ajax branch; an Administrator can satisfy this condition by creating bookings directly.
Product
WP Booking System – Booking Calendar
Affected
up to 2.1.0.1
What to do
Affects up to 2.1.0.1. Update WP Booking System – Booking Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 16, 2026Salon Booking System: Does not correctly verify the authenticity of REST API requests and discards WordPress core's nonce check for cookie-authenticated sessions across the whole REST APICVE-2026-110015 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Salon Booking System WordPress plugin before 10.31.9 does not correctly verify the authenticity of REST API requests and discards WordPress core's nonce check for cookie-authenticated sessions across the whole REST API, allowing unauthenticated attackers who trick a logged-in administrator into clicking a crafted link to forge requests in that administrator's browser, up to creating a new administrator account.
Product
Salon Booking System
Fixed in
10.31.9
What to do
Update Salon Booking System to 10.31.9 or newer.
Full record and what to do →NVD record wpscan.com
Oct 16, 2026Salon Booking System: Does not properly check authorization before creating a booking and trusts a caller-supplied user identifier and booking statusCVE-2026-110014 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Salon Booking System WordPress plugin before 10.31.9 does not properly check authorization before creating a booking and trusts a caller-supplied user identifier and booking status, allowing unauthenticated attackers to create bookings attributed to arbitrary users, overwrite those users' stored contact details, and mark bookings as paid or confirmed without any payment.
Product
Salon Booking System
Fixed in
10.31.9
What to do
Update Salon Booking System to 10.31.9 or newer.
Full record and what to do →NVD record wpscan.com
Oct 16, 2026Salon Booking System: Does not generate its booking-API access tokens from a secure random sourceCVE-2026-110013 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Salon Booking System WordPress plugin before 10.31.9 does not generate its booking-API access tokens from a secure random source, instead deriving them from a value hardcoded in the Salon Booking System WordPress plugin before 10.31.9 and the second at which a token was issued. An attacker able to constrain when a staff or administrator token was issued can compute a valid token and access the booking API as that user, including an administrator.
Product
Salon Booking System
Fixed in
10.31.9
What to do
Update Salon Booking System to 10.31.9 or newer.
Full record and what to do →NVD record wpscan.com
Oct 16, 2026Salon Booking System: Does not restrict several of its booking REST API routes to users with the appropriate capabilityCVE-2026-110012 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Salon Booking System WordPress plugin before 10.31.3 does not restrict several of its booking REST API routes to users with the appropriate capability, allowing any authenticated user such as a subscriber to read every customer's booking records, including their personal data.
Product
Salon Booking System
Fixed in
10.31.3
What to do
Update Salon Booking System to 10.31.3 or newer.
Full record and what to do →NVD record wpscan.com
Oct 16, 2026Salon Booking System – Appointment Booking for Salons, Barbershops & Spas: Stored Cross-Site ScriptingCVE-2026-109232 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Salon Booking System – Appointment Booking for Salons, Barbershops & Spas plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'sln[<checkout-field-key>]' parameter in all versions up to, and including, 10.31.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that the site administrator has configured at least one custom checkout field of type Html or File, which is a standard documented plugin feature.
Product
Salon Booking System – Appointment Booking for Salons, Barbershops & Spas
Affected
up to 10.31.9
What to do
Affects up to 10.31.9. Update Salon Booking System – Appointment Booking for Salons, Barbershops & Spas to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 16, 2026ELEX WordPress HelpDesk & Customer Ticketing System: Arbitrary File UploadCVE-2026-103768 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.3.7 via the initMailPart function. This is due to insufficient file type validation when saving IMAP email attachments. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible.
Product
ELEX WordPress HelpDesk & Customer Ticketing System
Affected
up to 3.3.7
What to do
Affects up to 3.3.7. Update ELEX WordPress HelpDesk & Customer Ticketing System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 14, 2026WP Booking System: Does not sanitise and escape a client-controllable request value before storing it and later outputting it in an administration screenCVE-2026-107126 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WP Booking System WordPress plugin before 2.1.0.1 does not sanitise and escape a client-controllable request value before storing it and later outputting it in an administration screen, allowing unauthenticated attackers to perform Stored Cross-Site Scripting attacks that execute in the session of an administrator who views the stored data.
Product
WP Booking System
Fixed in
2.1.0.1
What to do
Update WP Booking System to 2.1.0.1 or newer.
Full record and what to do →NVD record wpscan.com
Oct 11, 2026Post Voting System: Does not properly sanitize and escape a parameter before using it in a SQL queryCVE-2026-89302 · WordPress plugins & themes · reported by WPScanHigh 8.6
The Post Voting System WordPress plugin through 1.0 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks.
Product
Post Voting System
Affected
up to 1.0
What to do
Affects up to 1.0. Update Post Voting System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Oct 10, 2026YITH WooCommerce Product Add-Ons: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2026-66480 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in YITH YITH WooCommerce Product Add-Ons allows Retrieve Embedded Sensitive Data. This issue affects YITH WooCommerce Product Add-Ons: from n/a through 4.34.0.
Product
YITH WooCommerce Product Add-Ons
Affected
up to 4.34.0
What to do
Affects up to 4.34.0. Update YITH WooCommerce Product Add-Ons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 10, 2026Online Scheduling and Appointment Booking System – Bookly: PHP Object InjectionCVE-2026-12626 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 28.2 via deserialization of untrusted input via the ‘value’ parameter. This makes it possible for authenticated attackers, with custom-level access and above, to inject a PHP Object. No known gadget chain is available.
Product
Online Scheduling and Appointment Booking System – Bookly
Affected
up to 28.2
What to do
Affects up to 28.2. Update Online Scheduling and Appointment Booking System – Bookly to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 10, 2026WP Booking System – Booking Calendar: Time-based SQL InjectionCVE-2026-107712 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to time-based SQL Injection via the 'current_month' parameter in all versions up to, and including, 2.1.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This is a regression vulnerability — a capability check introduced in versions 2.0.19.11–2.0.19.14 to address CVE-2024-50425 was removed in version 2.1, meaning any authenticated subscriber-level account can reach the vulnerable handler with no nonce validation required.
Product
WP Booking System – Booking Calendar
Affected
up to 2.1.0.1
What to do
Affects up to 2.1.0.1. Update WP Booking System – Booking Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 10, 2026Online Scheduling and Appointment Booking System – Bookly: Insecure Direct Object ReferenceCVE-2026-104898 · WordPress plugins & themes · reported by WordfenceMedium 6.8
The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 28.4 via the 'id, wp_user_id' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with subscriber-level access and above, to overwrite the WordPress account binding of any Bookly staff record, including those owned by administrators, effectively hijacking a higher-privileged staff member's account association and escalating privileges. Exploitation requires the attacking user to be linked to at least one Bookly staff record, which occurs by default whenever an admin enables the bookly_gen_allow_staff_edit_profile option (active on fresh installs) and links a WordPress user to a staff entry.
Product
Online Scheduling and Appointment Booking System – Bookly
Affected
up to 28.4
What to do
Affects up to 28.4. Update Online Scheduling and Appointment Booking System – Bookly to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 10, 2026Bookly – Online Scheduling and Appointment Booking System: Sensitive Information ExposureCVE-2026-103365 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Bookly – Online Scheduling and Appointment Booking System plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 28.4 via the classic booking form's Details step. The endpoint bookly_render_details is registered for both wp_ajax and wp_ajax_nopriv, the module overrides csrfTokenValid() to always return true, and Bookly\Frontend\Components\Booking\InfoText::getCodes() calls UserBookingData::getCustomer() to load the persisted Customer entity keyed solely by the attacker-supplied phone (or email) with no invocation of the plugin's own customerIdentityConfirmed() predicate. When a site owner has placed the supported {client_name}, {client_email}, {client_phone}, or {client_note} placeholders into the Details step's Appearance information text, the matched customer's stored name, email, phone and internal notes are substituted into the returned HTML. This makes it possible for unauthenticated attackers who know only a registered customer's primary phone (or email) to read that customer's stored personal data.
Product
Bookly – Online Scheduling and Appointment Booking System
Affected
up to 28.4
What to do
Affects up to 28.4. Update Bookly – Online Scheduling and Appointment Booking System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 9, 2026All Bootstrap Blocks: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2026-62036 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in AREOI All Bootstrap Blocks all-bootstrap-blocks allows Retrieve Embedded Sensitive Data.This issue affects All Bootstrap Blocks: from n/a through 1.3.31.
Product
All Bootstrap Blocks
Affected
up to 1.3.31
What to do
Affects up to 1.3.31. Update All Bootstrap Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 9, 2026Salon booking system: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-94668 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dimitri Grassi Salon booking system salon-booking-system allows Reflected XSS.This issue affects Salon booking system: from n/a through 10.31.5.
Product
Salon booking system
Affected
up to 10.31.5
What to do
Affects up to 10.31.5. Update Salon booking system to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 8, 2026Wallet System for WooCommerce: Does not validate that a wallet transfer amount is positiveCVE-2026-93509 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not validate that a wallet transfer amount is positive, and computes the sender's new balance from a stale snapshot taken before crediting the recipient, allowing an authenticated attacker with Subscriber-level access to mint wallet funds for themselves or drain a specific victim's balance into their own account.
Product
Wallet System for WooCommerce
Fixed in
2.8.0
What to do
Update Wallet System for WooCommerce to 2.8.0 or newer.
Full record and what to do →NVD record wpscan.com
Oct 8, 2026Wallet System for WooCommerce: Does not verify that the wallet account named in a withdrawal submission belongs to the user making itCVE-2026-94246 · WordPress plugins & themes · reported by WPScanMedium 6.3
The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not verify that the wallet account named in a withdrawal submission belongs to the user making it, allowing any authenticated user, such as a subscriber, to file a withdrawal request against another user's wallet for an amount and a payout destination of their choosing, and to indefinitely prevent that user from submitting withdrawals of their own.
Product
Wallet System for WooCommerce
Fixed in
2.8.0
What to do
Update Wallet System for WooCommerce to 2.8.0 or newer.
Full record and what to do →NVD record wpscan.com
Oct 8, 2026Wallet System for WooCommerce: Does not verify that the user submitting a wallet transfer owns the wallet being debitedCVE-2026-94245 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not verify that the user submitting a wallet transfer owns the wallet being debited, allowing any authenticated user, including one with only the Subscriber role, to move an arbitrary user's wallet balance, including an administrator's, into an account they control.
Product
Wallet System for WooCommerce
Fixed in
2.8.0
What to do
Update Wallet System for WooCommerce to 2.8.0 or newer.
Full record and what to do →NVD record wpscan.com
Oct 8, 2026Wallet System for WooCommerce: Does not perform any capability checkCVE-2026-94244 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not perform any capability check, and relies on a token any authenticated user can obtain from a front-end page, before generating a report containing every customer's wallet transaction history, allowing any authenticated user, such as a subscriber, to disclose all users' names, email addresses, roles, transaction amounts, payment methods and dates.
Product
Wallet System for WooCommerce
Fixed in
2.8.0
What to do
Update Wallet System for WooCommerce to 2.8.0 or newer.
Full record and what to do →NVD record wpscan.com
Oct 6, 2026Unauthenticated Privilege Escalation in Salon booking system <= 10.31.7 versions.CVE-2026-105070 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Unauthenticated Privilege Escalation in Salon booking system <= 10.31.7 versions.
Affected
up to 10.31.7
What to do
Affects up to 10.31.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 5, 2026WP Event Solution: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2026-105073 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Arraytics WP Event Solution wp-event-solution allows Retrieve Embedded Sensitive Data.This issue affects WP Event Solution: from n/a through 4.1.25.
Product
WP Event Solution
Affected
up to 4.1.25
What to do
Affects up to 4.1.25. Update WP Event Solution to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 5, 2026Memberful - Membership: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2026-104401 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Memberful Memberful - Membership Plugin memberful-wp allows Retrieve Embedded Sensitive Data.This issue affects Memberful - Membership Plugin: from n/a through 1.81.2.
Product
Memberful - Membership
Affected
up to 1.81.2
What to do
Affects up to 1.81.2. Update Memberful - Membership to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 3, 2026WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System: Local File InclusionCVE-2026-75028 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.0.18 via the (template scope) function. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.
Product
WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System
Affected
up to 3.0.18
What to do
Affects up to 3.0.18. Update WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 3, 2026WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System: Authorization bypassCVE-2026-11601 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.0.19. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to read, create, update, clone, and delete email notification flows, including overwriting the default reservation confirmation, cancellation, and admin alert emails with attacker-controlled content sent from the site's legitimate address, or destroying reservation notification flows entirely. The vulnerable endpoints are active by default on every WPCafe installation without any configuration requirement, as the Email_Automation_Service_Provider::is_enable() method unconditionally returns true and the plugin ships with five pre-configured default email flows upon activation.
Product
WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System
Affected
up to 3.0.19
What to do
Affects up to 3.0.19. Update WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 3, 2026GD Rating System: Stored Cross-Site ScriptingCVE-2026-93430 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The GD Rating System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'title' and 'url' Render Args in gdrts_live_handler AJAX in all versions up to, and including, 3.7.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Although the AJAX action requires a per-item nonce, that nonce is publicly emitted in the page's <script class="gdrts-rating-data"> JSON block on every page rendering the rating item, making it obtainable by any unauthenticated visitor and therefore not an authentication barrier.
Product
GD Rating System
Affected
up to 3.7.1
What to do
Affects up to 3.7.1. Update GD Rating System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 3, 2026Helpdesk Support Ticket System for WooCommerce: Insecure Direct Object ReferenceCVE-2026-11399 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Helpdesk Support Ticket System for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.1.6 via the 'id' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary ticket responses belonging to other users by supplying any stsw_responses row ID to the deletion handler after obtaining the nonce from the admin footer.
Product
Helpdesk Support Ticket System for WooCommerce
Affected
up to 2.1.6
What to do
Affects up to 2.1.6. Update Helpdesk Support Ticket System for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 2, 2026SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent: Time-based SQL InjectionCVE-2026-94539 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent plugin for WordPress is vulnerable to time-based SQL Injection via the 'sort_by' parameter in all versions up to, and including, 3.5.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with custom-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Exploitation requires the authenticated attacker to hold both a Subscriber-level (or higher) WordPress role and a SupportCandy Agent account with the 'Assign Agents' permission configured.
Product
SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent
Affected
up to 3.5.3
What to do
Affects up to 3.5.3. Update SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.svn.wordpress.org plugins.trac.wordpress.org
Oct 2, 2026SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent: Stored Cross-Site ScriptingCVE-2026-94378 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name' parameter in all versions up to, and including, 3.5.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This exploit chain requires the 'Register user if not exists' setting to be disabled, which is its default configuration.
Product
SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent
Affected
up to 3.5.3
What to do
Affects up to 3.5.3. Update SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.svn.wordpress.org plugins.trac.wordpress.org
Oct 1, 2026Cache Enabler: Does not validate a URL before using it to build a filesystem path in its cache purge routineCVE-2026-19253 · WordPress plugins & themes · reported by WPScanHigh 8.7
The Cache Enabler WordPress plugin before 1.8.17 does not validate a URL before using it to build a filesystem path in its cache purge routine, and does not confine the resulting deletion to the cache directory, allowing unauthenticated users to delete arbitrary files and directories on sites where another installed Cache Enabler WordPress plugin before 1.8.17 or passes a request-derived URL to its public cache-clearing hook.
Product
Cache Enabler
Fixed in
1.8.17
What to do
Update Cache Enabler to 1.8.17 or newer.
Full record and what to do →NVD record wpscan.com
Sep 30, 2026Course Booking System: Does not restrict access to its booking exportCVE-2026-96886 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Course Booking System WordPress plugin before 7.0.9 does not restrict access to its booking export, allowing unauthenticated users to download the name, email address and billing address of every customer who has booked a course.
Product
Course Booking System
Fixed in
7.0.9
What to do
Update Course Booking System to 7.0.9 or newer.
Full record and what to do →NVD record wpscan.com
Sep 28, 2026Post Voting System: Does not properly sanitize and escape a parameter before using it in a SQL queryCVE-2026-89303 · WordPress plugins & themes · reported by WPScanMedium 6.4
The Post Voting System WordPress plugin through 1.0 does not properly sanitize and escape a parameter before using it in a SQL query, allowing any authenticated user to perform SQL injection attacks.
Product
Post Voting System
Affected
up to 1.0
What to do
Affects up to 1.0. Update Post Voting System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.