Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
13,868 results · page 1 of 278
Oct 22, 2026JetBackup: Symlink-based arbitrary file writeCVE-2026-104068 · WordPress plugins & themes · reported by VulnCheckHigh 8.6
JetBackup plugin for WordPress before 3.1.24.10 contains a symlink-based arbitrary file write vulnerability that allows an authenticated WordPress administrator to write attacker-controlled file contents outside the intended restore destination during backup import and restore. Attackers can craft a backup archive containing a symbolic link that archive extraction follows without validating targets or enforcing destination containment, potentially leading to server-side code execution depending on the writable destination and server configuration.
- Product
- JetBackup
- Fixed in
- 3.1.24.10
- What to do
- Update JetBackup to 3.1.24.10 or newer.
Oct 22, 2026Joomla Extension - yootheme.com - Unauthenticated remote code execution in YOOtheme Pro 5.0.0-5.0.52 - YOOtheme Pro’s publicly accessible image transformation hCVE-2026-102785 · Websites & servers · reported by security@joomla.orgCritical 10
Joomla Extension - yootheme.com - Unauthenticated remote code execution in YOOtheme Pro 5.0.0-5.0.52 - YOOtheme Pro’s publicly accessible image transformation handler incompletely binds normalized image operations and the output destination to its request signature. An unauthenticated remote attacker can reuse a signature disclosed in a legitimate public image URL, inject additional image operations, traverse out of the intended cache directory, and write an attacker-controlled PNG/PHP polyglot to an executable public media directory.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2026Cozmoslabs Paid Member Subscriptions paid-member-subscriptions: Missing AuthorizationCVE-2026-112842 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Cozmoslabs Paid Member Subscriptions paid-member-subscriptions allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Paid Member Subscriptions: from n/a through 3.1.2.
- Product
- Cozmoslabs Paid Member Subscriptions paid-member-subscriptions
- Affected
- up to 3.1.2
- What to do
- Affects up to 3.1.2. Update Cozmoslabs Paid Member Subscriptions paid-member-subscriptions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2026CozyThemes Rootblox rootblox: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-112832 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in CozyThemes Rootblox rootblox allows PHP Local File Inclusion.This issue affects Rootblox: from n/a through 1.0.6.
- Product
- CozyThemes Rootblox rootblox
- Affected
- up to 1.0.6
- What to do
- Affects up to 1.0.6. Update CozyThemes Rootblox rootblox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2026AmentoTech Workreap Core workreap_core: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-112822 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AmentoTech Workreap Core workreap_core allows Blind SQL Injection.This issue affects Workreap Core: from n/a before 3.4.4.
- Product
- AmentoTech Workreap Core workreap_core
- Fixed in
- 3.4.4
- What to do
- Update AmentoTech Workreap Core workreap_core to 3.4.4 or newer.
Oct 22, 2026Elated-Themes Academist Core academist-core: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-112820 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Elated-Themes Academist Core academist-core allows PHP Local File Inclusion.This issue affects Academist Core: from n/a through 1.4.1.
- Product
- Elated-Themes Academist Core academist-core
- Affected
- up to 1.4.1
- What to do
- Affects up to 1.4.1. Update Elated-Themes Academist Core academist-core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2026ACF Extended ACF Extended acf-extended: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-112313 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ACF Extended ACF Extended acf-extended allows Stored XSS.This issue affects ACF Extended: from n/a through 0.9.2.7.
- Product
- ACF Extended ACF Extended acf-extended
- Affected
- up to 0.9.2.7
- What to do
- Affects up to 0.9.2.7. Update ACF Extended ACF Extended acf-extended to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2026WPML Multilingual CMS: Reflected cross-site scriptingCVE-2023-54413 · WordPress plugins & themes · reported by VulnCheckMedium 5.1
WPML Multilingual CMS plugin for WordPress before 4.6.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script by supplying crafted input in the wp_lang parameter. Attackers can lure users to /wp-login.php with a wp_lang value injecting an image input with an obfuscated onfocus handler to execute JavaScript in the victim's browser. Exploitation evidence was first observed by the Shadowserver Foundation on 2025-11-12.
- Product
- WPML Multilingual CMS
- Fixed in
- 4.6.1
- What to do
- Update WPML Multilingual CMS to 4.6.1 or newer.
Oct 22, 2026NotificationX: Unauthenticated SQL injectionCVE-2022-51021 · WordPress plugins & themes · reported by VulnCheckHigh 8.8
NotificationX plugin for WordPress 2.0.0 before 2.3.12 contains an unauthenticated SQL injection vulnerability that allows remote attackers to manipulate database queries by supplying an array-form 'id' parameter to /wp-json/notificationx/v1/notification/{id}. Attackers can pass id[1] with crafted SQL, such as time-based SLEEP payloads, along with an api_key derived from md5(home_url()), which flows unsanitized into Database::get_where_query to extract database contents. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-18.
- Product
- NotificationX
- Fixed in
- 2.3.12
- What to do
- Update NotificationX to 2.3.12 or newer.
Oct 22, 2026Broadstreet Ad Widget: Local file inclusionCVE-2017-20289 · WordPress plugins & themes · reported by VulnCheckHigh 7.7
Broadstreet Ad Widget plugin for WordPress 2.2.0 before 2.12.0 contains a local file inclusion vulnerability that allows authenticated users to execute attacker-chosen PHP files by passing unsanitized input to require in views/modal/index.php. Attackers can supply directory traversal sequences in the 'step' parameter, optionally with a null byte, to include local files and execute PHP code. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.
- Product
- Broadstreet Ad Widget
- Fixed in
- 2.12.0
- What to do
- Update Broadstreet Ad Widget to 2.12.0 or newer.
Oct 22, 2026Javo Spot: Path traversalCVE-2017-20287 · WordPress plugins & themes · reported by VulnCheckHigh 8.7
Javo Spot theme for WordPress before 3.0.0 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files via the fn parameter of the jvfrm_spot_get_json AJAX action. Attackers can send GET requests to /wp-admin/admin-ajax.php with fn set to ../../wp-config.php to retrieve database credentials and secret keys. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.
- Product
- Javo Spot
- Fixed in
- 3.0.0
- What to do
- Update Javo Spot to 3.0.0 or newer.
Oct 22, 2026hupe13 Extensions for Leaflet Map extensions-leaflet-map: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-114703 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hupe13 Extensions for Leaflet Map extensions-leaflet-map allows Stored XSS.This issue affects Extensions for Leaflet Map: from n/a through 6.0.
- Product
- hupe13 Extensions for Leaflet Map extensions-leaflet-map
- Affected
- up to 6.0
- What to do
- Affects up to 6.0. Update hupe13 Extensions for Leaflet Map extensions-leaflet-map to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2026nicdark ND Shortcodes For Visual Composer nd-shortcodes: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-114702 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in nicdark ND Shortcodes For Visual Composer nd-shortcodes allows Stored XSS.This issue affects ND Shortcodes For Visual Composer: from n/a through 7.8.
- Product
- nicdark ND Shortcodes For Visual Composer nd-shortcodes
- Affected
- up to 7.8
- What to do
- Affects up to 7.8. Update nicdark ND Shortcodes For Visual Composer nd-shortcodes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2026xootix Waitlist Woocommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-114701 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in xootix Waitlist Woocommerce ( Back in stock notifier ) waitlist-woocommerce allows Stored XSS.This issue affects Waitlist Woocommerce ( Back in stock notifier ): from n/a through 2.9.1.
- Product
- xootix Waitlist Woocommerce
- Affected
- up to 2.9.1
- What to do
- Affects up to 2.9.1. Update xootix Waitlist Woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2026Gloriafood Restaurant Menu – Food Ordering System – Table Reservation menu-ordering-reservations: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-114700 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Gloriafood Restaurant Menu – Food Ordering System – Table Reservation menu-ordering-reservations allows Stored XSS.This issue affects Restaurant Menu – Food Ordering System – Table Reservation: from n/a through 2.4.4.
- Product
- Gloriafood Restaurant Menu – Food Ordering System – Table Reservation menu-ordering-reservations
- Affected
- up to 2.4.4
- What to do
- Affects up to 2.4.4. Update Gloriafood Restaurant Menu – Food Ordering System – Table Reservation menu-ordering-reservations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2026yoomoney ЮKassa для WooCommerce yookassa: Missing AuthorizationCVE-2026-114699 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in yoomoney ЮKassa для WooCommerce yookassa allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ЮKassa для WooCommerce: from n/a through 2.17.3.
- Product
- yoomoney ЮKassa для WooCommerce yookassa
- Affected
- up to 2.17.3
- What to do
- Affects up to 2.17.3. Update yoomoney ЮKassa для WooCommerce yookassa to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2026myCred myCred mycred: Authorization Bypass Through User-Controlled KeyCVE-2026-114698 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Authorization Bypass Through User-Controlled Key vulnerability in myCred myCred mycred allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects myCred: from n/a through 4.0.0-beta.1.
- Product
- myCred myCred mycred
- Affected
- up to 4.0.0-beta.1
- What to do
- Affects up to 4.0.0-beta.1. Update myCred myCred mycred to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2026miniOrange Page Restriction WordPress: Missing AuthorizationCVE-2026-114696 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in miniOrange Page Restriction WordPress (WP) page-and-post-restriction allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Page Restriction WordPress (WP): from n/a through 1.6.0.
- Product
- miniOrange Page Restriction WordPress
- Affected
- up to 1.6.0
- What to do
- Affects up to 1.6.0. Update miniOrange Page Restriction WordPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2026WP Desk ShopMagic shopmagic-for-woocommerce: Insertion of Sensitive Information into Externally-Accessible File or DirectoryCVE-2026-114195 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Insertion of Sensitive Information into Externally-Accessible File or Directory vulnerability in WP Desk ShopMagic shopmagic-for-woocommerce allows Retrieve Embedded Sensitive Data.This issue affects ShopMagic: from n/a through 4.9.1.
- Product
- WP Desk ShopMagic shopmagic-for-woocommerce
- Affected
- up to 4.9.1
- What to do
- Affects up to 4.9.1. Update WP Desk ShopMagic shopmagic-for-woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2026Jory Hogeveen Off-Canvas Sidebars & Menus: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-112845 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jory Hogeveen Off-Canvas Sidebars & Menus (Slidebars) off-canvas-sidebars allows Stored XSS.This issue affects Off-Canvas Sidebars & Menus (Slidebars): from n/a through 0.5.9.
- Product
- Jory Hogeveen Off-Canvas Sidebars & Menus
- Affected
- up to 0.5.9
- What to do
- Affects up to 0.5.9. Update Jory Hogeveen Off-Canvas Sidebars & Menus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2026Codepeople Contact Form Email contact-form-to-email: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-112379 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Codepeople Contact Form Email contact-form-to-email allows Stored XSS.This issue affects Contact Form Email: from n/a through 1.3.68.
- Product
- Codepeople Contact Form Email contact-form-to-email
- Affected
- up to 1.3.68
- What to do
- Affects up to 1.3.68. Update Codepeople Contact Form Email contact-form-to-email to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2026TMS Amelia ameliabooking: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-112327 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TMS Amelia ameliabooking allows SQL Injection.This issue affects Amelia: from n/a through 2.4.11.
- Product
- TMS Amelia ameliabooking
- Affected
- up to 2.4.11
- What to do
- Affects up to 2.4.11. Update TMS Amelia ameliabooking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2026ACF Extended ACF Extended acf-extended: Missing AuthorizationCVE-2026-112312 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in ACF Extended ACF Extended acf-extended allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ACF Extended: from n/a through 0.9.2.7.
- Product
- ACF Extended ACF Extended acf-extended
- Affected
- up to 0.9.2.7
- What to do
- Affects up to 0.9.2.7. Update ACF Extended ACF Extended acf-extended to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2026ACF Extended ACF Extended acf-extended: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2026-112311 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ACF Extended ACF Extended acf-extended allows Path Traversal.This issue affects ACF Extended: from n/a through 0.9.2.7.
- Product
- ACF Extended ACF Extended acf-extended
- Affected
- up to 0.9.2.7
- What to do
- Affects up to 0.9.2.7. Update ACF Extended ACF Extended acf-extended to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2026Cozmoslabs Profile Builder profile-builder: Incorrect Privilege AssignmentCVE-2026-112242 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Incorrect Privilege Assignment vulnerability in Cozmoslabs Profile Builder profile-builder allows Privilege Escalation.This issue affects Profile Builder: from n/a through 4.0.4.
- Product
- Cozmoslabs Profile Builder profile-builder
- Affected
- up to 4.0.4
- What to do
- Affects up to 4.0.4. Update Cozmoslabs Profile Builder profile-builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2026Brainstorm Force SureCart surecart: Authentication Bypass by SpoofingCVE-2026-112241 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Authentication Bypass by Spoofing vulnerability in Brainstorm Force SureCart surecart allows Authentication Abuse.This issue affects SureCart: from n/a through 4.9.5.
- Product
- Brainstorm Force SureCart surecart
- Affected
- up to 4.9.5
- What to do
- Affects up to 4.9.5. Update Brainstorm Force SureCart surecart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2026Ahmad Majestic Support majestic-support: Missing AuthorizationCVE-2026-112218 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Ahmad Majestic Support majestic-support allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Majestic Support: from n/a through 1.2.1.
- Product
- Ahmad Majestic Support majestic-support
- Affected
- up to 1.2.1
- What to do
- Affects up to 1.2.1. Update Ahmad Majestic Support majestic-support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2026WProyal Royal Elementor Addons royal-elementor-addons: Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')CVE-2026-111851 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in WProyal Royal Elementor Addons royal-elementor-addons allows Code Injection.This issue affects Royal Elementor Addons: from n/a through 1.7.1068.
- Product
- WProyal Royal Elementor Addons royal-elementor-addons
- Affected
- up to 1.7.1068
- What to do
- Affects up to 1.7.1068. Update WProyal Royal Elementor Addons royal-elementor-addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2026WP Sunshine Sunshine Photo Cart sunshine-photo-cart: Missing AuthorizationCVE-2026-111842 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WP Sunshine Sunshine Photo Cart sunshine-photo-cart allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sunshine Photo Cart: from n/a through 3.7.5.
- Product
- WP Sunshine Sunshine Photo Cart sunshine-photo-cart
- Affected
- up to 3.7.5
- What to do
- Affects up to 3.7.5. Update WP Sunshine Sunshine Photo Cart sunshine-photo-cart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2026WP Mailster WP Mailster wp-mailster: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-111830 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Mailster WP Mailster wp-mailster allows Stored XSS.This issue affects WP Mailster: from n/a through 1.9.1.0.
- Product
- WP Mailster WP Mailster wp-mailster
- Affected
- up to 1.9.1.0
- What to do
- Affects up to 1.9.1.0. Update WP Mailster WP Mailster wp-mailster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2026Brainstorm Force SureDash suredash: Missing AuthorizationCVE-2026-110894 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Brainstorm Force SureDash suredash allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SureDash: from n/a through 1.12.2.
- Product
- Brainstorm Force SureDash suredash
- Affected
- up to 1.12.2
- What to do
- Affects up to 1.12.2. Update Brainstorm Force SureDash suredash to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2026Brainstorm Force SureDash suredash: Missing AuthorizationCVE-2026-110893 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Brainstorm Force SureDash suredash allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SureDash: from n/a through 1.12.2.
- Product
- Brainstorm Force SureDash suredash
- Affected
- up to 1.12.2
- What to do
- Affects up to 1.12.2. Update Brainstorm Force SureDash suredash to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2026WPVibes Elementor Addon Elements addon-elements-for-elementor-page-builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-114184 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPVibes Elementor Addon Elements addon-elements-for-elementor-page-builder allows Stored XSS.This issue affects Elementor Addon Elements: from n/a through 1.14.4.
- Product
- WPVibes Elementor Addon Elements addon-elements-for-elementor-page-builder
- Affected
- up to 1.14.4
- What to do
- Affects up to 1.14.4. Update WPVibes Elementor Addon Elements addon-elements-for-elementor-page-builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2026IdeaBox Creations PowerPack Addons for Elementor powerpack-lite-for-elementor: Missing AuthorizationCVE-2026-114182 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in IdeaBox Creations PowerPack Addons for Elementor powerpack-lite-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PowerPack Addons for Elementor: from n/a through 3.1.0.
- Product
- IdeaBox Creations PowerPack Addons for Elementor powerpack-lite-for-elementor
- Affected
- up to 3.1.0
- What to do
- Affects up to 3.1.0. Update IdeaBox Creations PowerPack Addons for Elementor powerpack-lite-for-elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2026Wpmet Metform metform: Missing AuthorizationCVE-2026-114180 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Wpmet Metform metform allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Metform: from n/a through 4.3.2.
- Product
- Wpmet Metform metform
- Affected
- up to 4.3.2
- What to do
- Affects up to 4.3.2. Update Wpmet Metform metform to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2026Xpro Xpro Elementor Addons xpro-elementor-addons: Cross-Site Request Forgery (CSRF)CVE-2026-114177 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Cross-Site Request Forgery (CSRF) vulnerability in Xpro Xpro Elementor Addons xpro-elementor-addons allows Cross Site Request Forgery.This issue affects Xpro Elementor Addons: from n/a through 1.7.10.
- Product
- Xpro Xpro Elementor Addons xpro-elementor-addons
- Affected
- up to 1.7.10
- What to do
- Affects up to 1.7.10. Update Xpro Xpro Elementor Addons xpro-elementor-addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2026DigitalME eRoom eroom-zoom-meetings-webinar: Missing AuthorizationCVE-2026-114175 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in DigitalME eRoom eroom-zoom-meetings-webinar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects eRoom: from n/a through 1.7.1.
- Product
- DigitalME eRoom eroom-zoom-meetings-webinar
- Affected
- up to 1.7.1
- What to do
- Affects up to 1.7.1. Update DigitalME eRoom eroom-zoom-meetings-webinar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2026H5P H5P h5p: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-112867 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in H5P H5P h5p allows Stored XSS.This issue affects H5P: from n/a through 1.17.9.
- Product
- H5P H5P h5p
- Affected
- up to 1.17.9
- What to do
- Affects up to 1.17.9. Update H5P H5P h5p to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2026WP Chill Strong Testimonials strong-testimonials: Missing AuthorizationCVE-2026-112843 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WP Chill Strong Testimonials strong-testimonials allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Strong Testimonials: from n/a through 3.3.14.
- Product
- WP Chill Strong Testimonials strong-testimonials
- Affected
- up to 3.3.14
- What to do
- Affects up to 3.3.14. Update WP Chill Strong Testimonials strong-testimonials to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2026eLightUp Falcon – WordPress Optimizations & Tweaks falcon: Missing AuthorizationCVE-2026-112826 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in eLightUp Falcon – WordPress Optimizations & Tweaks falcon allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Falcon – WordPress Optimizations & Tweaks: from n/a through 2.12.0.
- Product
- eLightUp Falcon – WordPress Optimizations & Tweaks falcon
- Affected
- up to 2.12.0
- What to do
- Affects up to 2.12.0. Update eLightUp Falcon – WordPress Optimizations & Tweaks falcon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2026Kings Plugins MarketKing marketking-multivendor-marketplace-for-woocommerce: Missing AuthorizationCVE-2026-111847 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Kings Plugins MarketKing marketking-multivendor-marketplace-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MarketKing: from n/a through 2.1.72.
- Product
- Kings Plugins MarketKing marketking-multivendor-marketplace-for-woocommerce
- Affected
- up to 2.1.72
- What to do
- Affects up to 2.1.72. Update Kings Plugins MarketKing marketking-multivendor-marketplace-for-woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2026WebP Express: Does not escape values that its bundled HTML parser re-emits into element attributesCVE-2026-97328 · WordPress plugins & themes · reported by WPScanHigh 7.5
The WebP Express WordPress plugin before 0.25.16 does not escape values that its bundled HTML parser re-emits into element attributes when a non-default image delivery mode is enabled, allowing unauthenticated users to submit content that is stored and later executed as Cross-Site Scripting in the browser of any user viewing an affected page, including administrators.
- Product
- WebP Express
- Fixed in
- 0.25.16
- What to do
- Update WebP Express to 0.25.16 or newer.
Oct 22, 2026MasterStudy LMS: Does not verify that a user targeted through its student-enrolment feature has any relationship to the requesting instructorCVE-2026-88849 · WordPress plugins & themes · reported by WPScanLow 2.7
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.55 does not verify that a user targeted through its student-enrolment feature has any relationship to the requesting instructor, allowing users with the Instructor role to overwrite the first name, last name and public display name of any registered user on the site, including administrators, enabling impersonation and phishing.
- Product
- MasterStudy LMS
- Fixed in
- 3.7.55
- What to do
- Update MasterStudy LMS to 3.7.55 or newer.
Oct 22, 2026Link Library: Does not sanitise and escape a link field before outputting it inside an attribute of a link previewCVE-2026-78392 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Link Library WordPress plugin before 7.9.6 does not sanitise and escape a link field before outputting it inside an attribute of a link preview, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks. The preview is generated without authentication and without checking whether the link has been published, so an unapproved submission is enough to reach any visitor who opens it.
- Product
- Link Library
- Fixed in
- 7.9.6
- What to do
- Update Link Library to 7.9.6 or newer.
Oct 22, 2026WordPress Core is vulnerable to Stored Cross-Site Scripting via Quick Edit in all versions up to, and including, 7.0.2 due to insufficient escaping of user dispCVE-2026-114570 · WordPress plugins & themes · reported by WordfenceMedium 4.9
WordPress Core is vulnerable to Stored Cross-Site Scripting via Quick Edit in all versions up to, and including, 7.0.2 due to insufficient escaping of user display names. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a higher privileged user accesses the affected administrative screens. This issue only affects sites with a large number of users.
- Affected
- up to 7.0.2
- What to do
- Affects up to 7.0.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2026Photo Engine (Media Organizer & Lightroom): Does not verify that a user is authorised to act on the targeted media attachmentCVE-2026-111972 · WordPress plugins & themes · reported by WPScanMedium 4.9
The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.5.8 does not verify that a user is authorised to act on the targeted media attachment, allowing authenticated users with the author role and above to delete arbitrary media attachments, including those uploaded by other users and administrators.
- Product
- Photo Engine (Media Organizer & Lightroom)
- Fixed in
- 6.5.8
- What to do
- Update Photo Engine (Media Organizer & Lightroom) to 6.5.8 or newer.
Oct 22, 2026Photo Engine (Media Organizer & Lightroom): Does not sanitise and escape collection and gallery names before storing them and outputting them in an administrative dashboardCVE-2026-111971 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.5.8 does not sanitise and escape collection and gallery names before storing them and outputting them in an administrative dashboard, allowing authenticated users with the author role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Photo Engine (Media Organizer & Lightroom)
- Fixed in
- 6.5.8
- What to do
- Update Photo Engine (Media Organizer & Lightroom) to 6.5.8 or newer.
Oct 22, 2026Royal MCP: Does not limit a preview-link token to the single preview it was issued forCVE-2026-111958 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Royal MCP WordPress plugin before 1.5.7 does not limit a preview-link token to the single preview it was issued for, so any party that obtains a valid token is authenticated as the token's owning user, an administrator in the default configuration, across the entire REST API with no nonce, leading to full site takeover.
- Product
- Royal MCP
- Fixed in
- 1.5.7
- What to do
- Update Royal MCP to 1.5.7 or newer.
Oct 22, 2026MB Custom Post Types & Custom Taxonomies: Does not perform a capability check in its export featureCVE-2026-110011 · WordPress plugins & themes · reported by WPScanLow 2.7
The MB Custom Post Types & Custom Taxonomies WordPress plugin before 2.12.3 does not perform a capability check in its export feature, allowing users with a role as low as Contributor to read the configuration of admin-only custom post types and taxonomies, as well as the titles, dates, statuses and some stored content of other users' non-public posts and pages.
- Product
- MB Custom Post Types & Custom Taxonomies
- Fixed in
- 2.12.3
- What to do
- Update MB Custom Post Types & Custom Taxonomies to 2.12.3 or newer.
Oct 22, 2026MB Custom Post Types & Custom Taxonomies: Does not perform any capability or authentication check before allowing an unauthenticated request to re-run a legacy data migrationCVE-2026-110010 · WordPress plugins & themes · reported by WPScanMedium 4.8
The MB Custom Post Types & Custom Taxonomies WordPress plugin before 2.12.3 does not perform any capability or authentication check before allowing an unauthenticated request to re-run a legacy data migration, letting anyone revert a custom post type or taxonomy definition on sites upgraded from a pre-2.0 release back to its pre-upgrade state. This discards configuration changes an administrator made after upgrading and, where those changes had restricted a definition's visibility, silently re-exposes the definition and its content to anonymous visitors.
- Product
- MB Custom Post Types & Custom Taxonomies
- Fixed in
- 2.12.3
- What to do
- Update MB Custom Post Types & Custom Taxonomies to 2.12.3 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. The WordPress, CMS and hosting-panel entries come from the National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan and others); we show who. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories.
Tell us what you're building.
A website, a booking system, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.