Updated 29 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,769exploited flaws on CISA’s list

30added in the last 30 days

496new WordPress flaws this week

394,829entries in the database

331,420 results · page 10 of 6629

Nov 7, 2026Appointment Booking Plugin – LatePoint | Calendar & Scheduling for: Authentication BypassCVE-2026-118066 · WordPress plugins & themes · reported by WordfenceCritical 9.1
The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Authentication Bypass via Account Takeover in all versions up to, and including, 5.7.6. This is due to the `OsModel::build_conditions_query()` function in `lib/models/model.php` comparing WHERE-clause values against the literal strings `'IS NULL'` and `'IS NOT NULL'` and concatenating a match directly into SQL without binding it as a parameter, a flaw that neither `sanitize_text_field()` nor the 5.7.5 `is_scalar()` hardening guard closes, since both pass the scalar sentinel through unchanged. This makes it possible for unauthenticated attackers to send `params[password_reset_token]=IS NOT NULL` to the public `customer_cabinet__change_password` AJAX route to match every non-null `account_nonse` value, resolving to the lowest-id customer and overwriting that customer's password to an attacker-chosen value — granting full access to their bookings, orders, and PII, and, when the `wp_users_as_customers` option is enabled, takeover of the linked WordPress subscriber or customer-role account. The attacker can first identify the target customer's email by sending `params[o
Product
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for
Affected
up to 5.7.6
What to do
Affects up to 5.7.6. Update Appointment Booking Plugin – LatePoint | Calendar & Scheduling for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 7, 2026Image Hover Effects Ultimate ( Image Gallery, Effects, Lightbox, Comparison & Magnifier ): Stored Cross-Site ScriptingCVE-2026-118056 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The Image Hover Effects Ultimate ( Image Gallery, Effects, Lightbox, Comparison & Magnifier ) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'rawdata.oxi_image_comparison_before_text' parameter in all versions up to, and including, 9.12.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is only exploitable when an administrator has configured the plugin's "Who can edit" setting to Subscriber, which allows any authenticated user to overwrite existing styles — including those created by administrators — via a missing ownership check on the target style ID.
Product
Image Hover Effects Ultimate ( Image Gallery, Effects, Lightbox, Comparison & Magnifier )
Affected
up to 9.12.2
What to do
Affects up to 9.12.2. Update Image Hover Effects Ultimate ( Image Gallery, Effects, Lightbox, Comparison & Magnifier ) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 7, 2026Quttera ThreatSign – Web Malware Scanner for: Stored Cross-Site ScriptingCVE-2026-115548 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Quttera ThreatSign – Web Malware Scanner for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'HTTP_USER_AGENT' parameter in all versions up to, and including, 4.1.0.48 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever an administrator accesses an injected page.
Product
Quttera ThreatSign – Web Malware Scanner for
Affected
up to 4.1.0.48
What to do
Affects up to 4.1.0.48. Update Quttera ThreatSign – Web Malware Scanner for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 7, 2026The User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission plugin for WordPress is vulnCVE-2026-109214 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '<taxonomy_field_name> (default: 'category')' parameter in all versions up to, and including, 4.3.13 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the target installation to have configured a Taxonomy field in text-input mode with guest post submission enabled on at least one frontend form.
Affected
up to 4.3.13
What to do
Affects up to 4.3.13. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 7, 2026AutomatorWP – No-Code Workflow Automation, Integration & Webhooks Plugin, now with AI: Privilege EscalationCVE-2026-104768 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The AutomatorWP – No-Code Workflow Automation, Integration & Webhooks Plugin, now with AI plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.0.4. This is due to missing privilege-ceiling validation in the `create_user()` function within the anonymous-user action (and equally in the Create User and Add/Change Role WordPress-integration actions), which verify only that the submitted role exists via `automatorwp_get_editable_roles()` without confirming the role falls at or below the acting context's privilege level — allowing attacker-controlled trigger tag data (e.g., a `{comment_author}` tag bound to the Role option) to supply any role, including `administrator`, unchallenged. This makes it possible for unauthenticated attackers to create a new administrator-role account tied to an attacker-controlled email address, receiving the generated password via WordPress's new-user notification email and thereby gaining full administrative access to the site. Exploitation requires the site to have an anonymous automation configured with the Role option bound to a dynamic trigger tag such as `{comment_author}`, and is triggered when a site admin
Product
AutomatorWP – No-Code Workflow Automation, Integration & Webhooks Plugin, now with AI
Affected
up to 6.0.4
What to do
Affects up to 6.0.4. Update AutomatorWP – No-Code Workflow Automation, Integration & Webhooks Plugin, now with AI to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 7, 2026weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot: Stored Cross-Site ScriptingCVE-2026-104760 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'modalPlaceholder' Block Attribute in all versions up to, and including, 2.6.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Because Contributors can save posts in pending status, a malicious payload in the modalPlaceholder block attribute will execute in the browser of any admin or editor who previews or views the pending post.
Product
weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot
Affected
up to 2.6.1
What to do
Affects up to 2.6.1. Update weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 7, 2026Motors – Car Dealership & Classified Listings: Arbitrary file deletionCVE-2026-104746 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the stm_listings_ajax_save_user_data function in all versions up to, and including, 1.4.125 This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). Although deletion is bounded to wp-content/uploads (preventing removal of wp-config.php), any authenticated Subscriber can trivially exploit this because the required AJAX nonce is printed on every front-end page and the handler's stm_user_avatar_path meta is writable by any logged-in user against their own account.
Product
Motors – Car Dealership & Classified Listings
Affected
up to 1.4.125
What to do
Affects up to 1.4.125. Update Motors – Car Dealership & Classified Listings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.svn.wordpress.org plugins.trac.wordpress.org
Nov 7, 2026Naimur Email OTP Verification for WooCommerce: Authentication bypassCVE-2026-104014 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Naimur Email OTP Verification for WooCommerce plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.1.0. This is due to the plugin's password-reset finalization endpoint (the wp_ajax_nopriv_ceovw_update_new_password action handled by CEOVW_AJAX::update_new_password()) authorizing the reset solely by the presence of a database row marking an email as 'VERIFIED', with no timestamp check, no session binding, and no per-reset token — combined with mark_otp_as_verified_for_reset() leaving the row in that state after a user enters their code (abandoning the flow leaves the row behind), and a scheduled 'ceovw_cleanup_expired_otps_event' cron that has no add_action() handler anywhere in the plugin so cleanup never runs. This makes it possible for unauthenticated attackers to take over any account whose owner previously requested and verified a password-reset code and did not immediately finish choosing a new password — the attacker needs only the victim's email address and a nonce that the plugin itself localizes publicly into the CEOVW_APP global on the WooCommerce account page for logged-out visitors, after which they call the endpoint, overw
Product
Naimur Email OTP Verification for WooCommerce
Affected
up to 2.1.0
What to do
Affects up to 2.1.0. Update Naimur Email OTP Verification for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 7, 2026The Dynific Addons for Elementor (formerly Anywhere Elementor): Arbitrary shortcode executionCVE-2026-102564 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The The Dynific Addons for Elementor (formerly Anywhere Elementor) plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.3.0 This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. Exploitation requires the target site to have a public post rendered through an AE template that includes the AE Post Comments widget, and for the attacker's comment to be visible on that page — a barrier removed once the attacker has a previously approved comment or when comment moderation is relaxed.
Product
The Dynific Addons for Elementor (formerly Anywhere Elementor)
Affected
up to 1.3.0
What to do
Affects up to 1.3.0. Update The Dynific Addons for Elementor (formerly Anywhere Elementor) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 7, 2026A security vulnerability has been detected in TOTOLINK CA300-PoE 6.2c.884.CVE-2026-123961 · Other software · TOTOLINK · reported by VulDBHigh 8.6
A security vulnerability has been detected in TOTOLINK CA300-PoE 6.2c.884. This impacts the function setWiFiBasicConfig of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument KeyStr leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used.
Product
CA300-PoE
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lavender-bicycle-a5a.notion.site vuldb.com
Nov 7, 2026HivePress: Missing AuthorizationCVE-2026-123470 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in HivePress HivePress hivepress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HivePress: from n/a through 1.8.1.
Product
HivePress
Affected
up to 1.8.1
What to do
Affects up to 1.8.1. Update HivePress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 7, 2026Motors: Missing AuthorizationCVE-2026-123468 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in StylemixThemes Motors motors-car-dealership-classified-listings allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Motors: from n/a through 1.4.128.
Product
Motors
Affected
up to 1.4.128
What to do
Affects up to 1.4.128. Update Motors to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 7, 2026IvyForms: Missing AuthorizationCVE-2026-123148 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in TMS IvyForms ivyforms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects IvyForms: from n/a through 1.5.1.
Product
IvyForms
Affected
up to 1.5.1
What to do
Affects up to 1.5.1. Update IvyForms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 7, 2026Contextual Related Posts: Missing AuthorizationCVE-2026-121724 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WebberZone Contextual Related Posts contextual-related-posts allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Contextual Related Posts: from n/a through 4.5.3.
Product
Contextual Related Posts
Affected
up to 4.5.3
What to do
Affects up to 4.5.3. Update Contextual Related Posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 7, 2026Autopay dla WooCommerce: Missing AuthorizationCVE-2026-121571 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WP Desk Autopay dla WooCommerce pay-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Autopay dla WooCommerce: from n/a through 2.3.0.
Product
Autopay dla WooCommerce
Affected
up to 2.3.0
What to do
Affects up to 2.3.0. Update Autopay dla WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 7, 20262Way VideoCalls and Random Chat: Missing AuthorizationCVE-2026-120857 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in VideoWhisper.com 2Way VideoCalls and Random Chat webcam-2way-videochat allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects 2Way VideoCalls and Random Chat: from n/a through 6.1.9.
Product
2Way VideoCalls and Random Chat
Affected
up to 6.1.9
What to do
Affects up to 6.1.9. Update 2Way VideoCalls and Random Chat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 7, 2026Everest Forms: Missing AuthorizationCVE-2026-120837 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Everest Forms Everest Forms everest-forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Everest Forms: from n/a through 3.6.3.
Product
Everest Forms
Affected
up to 3.6.3
What to do
Affects up to 3.6.3. Update Everest Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 7, 2026Dropshipping XML for WooCommerce: Missing AuthorizationCVE-2026-119525 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WP Desk Dropshipping XML for WooCommerce dropshipping-xml-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Dropshipping XML for WooCommerce: from n/a through 1.7.4.
Product
Dropshipping XML for WooCommerce
Affected
up to 1.7.4
What to do
Affects up to 1.7.4. Update Dropshipping XML for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 7, 2026Paid Member Subscriptions: Missing AuthorizationCVE-2026-119523 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Cozmoslabs Paid Member Subscriptions paid-member-subscriptions allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Paid Member Subscriptions: from n/a through 3.1.3.
Product
Paid Member Subscriptions
Affected
up to 3.1.3
What to do
Affects up to 3.1.3. Update Paid Member Subscriptions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 7, 2026JS Help Desk: Missing AuthorizationCVE-2026-119513 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Ahmad JS Help Desk js-support-ticket allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JS Help Desk: from n/a through 5.0.3.
Product
JS Help Desk
Affected
up to 5.0.3
What to do
Affects up to 5.0.3. Update JS Help Desk to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 7, 2026Radius Booking — Booking Calendar for Appointments & Services: Missing AuthorizationCVE-2026-119508 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Mamunur Rashid Radius Booking — Booking Calendar for Appointments & Services radius-booking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Radius Booking — Booking Calendar for Appointments & Services: from n/a through 1.0.20.
Product
Radius Booking — Booking Calendar for Appointments & Services
Affected
up to 1.0.20
What to do
Affects up to 1.0.20. Update Radius Booking — Booking Calendar for Appointments & Services to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 7, 2026Media LIbrary Assistant: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)CVE-2026-119496 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in David Lingren Media LIbrary Assistant media-library-assistant allows Code Injection.This issue affects Media LIbrary Assistant: from n/a through 3.43.
Product
Media LIbrary Assistant
Affected
up to 3.43
What to do
Affects up to 3.43. Update Media LIbrary Assistant to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 7, 2026Ditty: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)CVE-2026-119492 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Metaphor Creations, LLC Ditty ditty-news-ticker allows Code Injection.This issue affects Ditty: from n/a through 3.1.71.
Product
Ditty
Affected
up to 3.1.71
What to do
Affects up to 3.1.71. Update Ditty to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 7, 2026Better Notifications for WP: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)CVE-2026-119490 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Made with Fuel Ltd. Better Notifications for WP bnfw allows Code Injection.This issue affects Better Notifications for WP: from n/a through 1.10.1.
Product
Better Notifications for WP
Affected
up to 1.10.1
What to do
Affects up to 1.10.1. Update Better Notifications for WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 7, 2026MasterStudy LMS: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)CVE-2026-119478 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in StylemixThemes MasterStudy LMS masterstudy-lms-learning-management-system allows Code Injection.This issue affects MasterStudy LMS: from n/a through 3.7.56.
Product
MasterStudy LMS
Affected
up to 3.7.56
What to do
Affects up to 3.7.56. Update MasterStudy LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 7, 2026WCFM Membership: Missing AuthorizationCVE-2026-61990 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WC Lovers WCFM Membership wc-multivendor-membership allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WCFM Membership: from n/a through 2.12.0.
Product
WCFM Membership
Affected
up to 2.12.0
What to do
Affects up to 2.12.0. Update WCFM Membership to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 7, 2026A weakness has been identified in TOTOLINK CA300-PoE 6.2c.884.CVE-2026-123960 · Other software · TOTOLINK · reported by VulDBHigh 8.6
A weakness has been identified in TOTOLINK CA300-PoE 6.2c.884. This affects the function setWanConfig of the file /cgi-bin/cstecgi.cgi. Executing a manipulation of the argument pppoeUser/priDns/secDns can lead to buffer overflow. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks.
Product
CA300-PoE
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lavender-bicycle-a5a.notion.site vuldb.com
Nov 7, 2026A security flaw has been discovered in TOTOLINK CA300-PoE 6.2c.884.CVE-2026-123959 · Other software · TOTOLINK · reported by VulDBHigh 8.5
A security flaw has been discovered in TOTOLINK CA300-PoE 6.2c.884. The impacted element is the function setLanguageCfg of the file /cgi-bin/cstecgi.cgi. Performing a manipulation of the argument langType results in buffer overflow. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks.
Product
CA300-PoE
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lavender-bicycle-a5a.notion.site vuldb.com
Nov 7, 2026The Events Calendar: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)CVE-2026-123469 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Liquid Web / StellarWP The Events Calendar the-events-calendar allows Code Injection.This issue affects The Events Calendar: from n/a through 6.18.3.
Product
The Events Calendar
Affected
up to 6.18.3
What to do
Affects up to 6.18.3. Update The Events Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 7, 2026Premium Blocks – Gutenberg Blocks for: Missing AuthorizationCVE-2026-123466 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in LeapWorx Premium Blocks – Gutenberg Blocks for WordPress premium-blocks-for-gutenberg allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Premium Blocks – Gutenberg Blocks for WordPress: from n/a through 2.3.18.
Product
Premium Blocks – Gutenberg Blocks for
Affected
up to 2.3.18
What to do
Affects up to 2.3.18. Update Premium Blocks – Gutenberg Blocks for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 7, 2026The Events Calendar: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-123464 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / StellarWP The Events Calendar the-events-calendar allows Stored XSS.This issue affects The Events Calendar: from n/a through 6.18.3.
Product
The Events Calendar
Affected
up to 6.18.3
What to do
Affects up to 6.18.3. Update The Events Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 7, 2026myCred: Missing AuthorizationCVE-2026-122668 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in myCred myCred mycred allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects myCred: from n/a through 4.0.2.
Product
myCred
Affected
up to 4.0.2
What to do
Affects up to 4.0.2. Update myCred to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 7, 2026PowerPress Podcasting: Missing AuthorizationCVE-2026-121766 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Blubrry Podcasting PowerPress Podcasting powerpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PowerPress Podcasting: from n/a through 11.18.0.
Product
PowerPress Podcasting
Affected
up to 11.18.0
What to do
Affects up to 11.18.0. Update PowerPress Podcasting to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 7, 2026CartFlows: Missing AuthorizationCVE-2026-120853 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Brainstorm Force CartFlows cartflows allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CartFlows: from n/a through 3.3.0.
Product
CartFlows
Affected
up to 3.3.0
What to do
Affects up to 3.3.0. Update CartFlows to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 7, 2026CartFlows: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)CVE-2026-120852 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Brainstorm Force CartFlows cartflows allows Code Injection.This issue affects CartFlows: from n/a through 3.3.0.
Product
CartFlows
Affected
up to 3.3.0
What to do
Affects up to 3.3.0. Update CartFlows to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 7, 2026Metform: Missing AuthorizationCVE-2026-120847 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Wpmet Metform metform allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Metform: from n/a through 4.3.3.
Product
Metform
Affected
up to 4.3.3
What to do
Affects up to 4.3.3. Update Metform to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 7, 2026SureForms: Missing AuthorizationCVE-2026-120842 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Brainstorm Force SureForms sureforms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SureForms: from n/a through 2.13.0.
Product
SureForms
Affected
up to 2.13.0
What to do
Affects up to 2.13.0. Update SureForms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 7, 2026User Registration: Missing AuthorizationCVE-2026-120840 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in ThemeGrill User Registration user-registration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Registration: from n/a through 5.3.0.
Product
User Registration
Affected
up to 5.3.0
What to do
Affects up to 5.3.0. Update User Registration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 7, 2026Zephyr Project Manager: Stored Cross-Site ScriptingCVE-2026-120514 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Zephyr Project Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'zpm_profile_picture' parameter in all versions up to, and including, 3.3.209 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload is stored in the subscriber's own Zephyr profile and fires in any Administrator's browser session the first time the autocomplete mention lookup renders the avatar field, requiring no additional configuration beyond the plugin's default access_roles setting. Successful exploitation additionally requires an action by an administrator — the attacker cannot trigger the vulnerability on their own.
Product
Zephyr Project Manager
Affected
up to 3.3.209
What to do
Affects up to 3.3.209. Update Zephyr Project Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 7, 2026MC Woocommerce Wishlist: Missing AuthorizationCVE-2026-119511 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Saeed MC Woocommerce Wishlist smart-wishlist-for-more-convert allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MC Woocommerce Wishlist: from n/a through 2.0.3.
Product
MC Woocommerce Wishlist
Affected
up to 2.0.3
What to do
Affects up to 2.0.3. Update MC Woocommerce Wishlist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 7, 2026NotificationX: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)CVE-2026-119507 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in WPDeveloper NotificationX notificationx allows Code Injection.This issue affects NotificationX: from n/a through 3.3.6.
Product
NotificationX
Affected
up to 3.3.6
What to do
Affects up to 3.3.6. Update NotificationX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 7, 2026Ultimate Store Kit Elementor Addons: Missing AuthorizationCVE-2026-119502 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in BdThemes Ultimate Store Kit Elementor Addons ultimate-store-kit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ultimate Store Kit Elementor Addons: from n/a through 4.0.1.
Product
Ultimate Store Kit Elementor Addons
Affected
up to 4.0.1
What to do
Affects up to 4.0.1. Update Ultimate Store Kit Elementor Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 7, 2026Flash & HTML5 Video: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-119500 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Flash & HTML5 Video html5-video-player allows Stored XSS.This issue affects Flash & HTML5 Video: from n/a through 2.14.1.
Product
Flash & HTML5 Video
Affected
up to 2.14.1
What to do
Affects up to 2.14.1. Update Flash & HTML5 Video to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 7, 2026Site Reviews: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)CVE-2026-119494 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Gemini Labs Site Reviews site-reviews allows Code Injection.This issue affects Site Reviews: from n/a through 8.3.6.
Product
Site Reviews
Affected
up to 8.3.6
What to do
Affects up to 8.3.6. Update Site Reviews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 7, 2026Media LIbrary Assistant: Missing AuthorizationCVE-2026-119491 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in David Lingren Media LIbrary Assistant media-library-assistant allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Media LIbrary Assistant: from n/a through 3.43.
Product
Media LIbrary Assistant
Affected
up to 3.43
What to do
Affects up to 3.43. Update Media LIbrary Assistant to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 7, 2026FluentBoards: Missing AuthorizationCVE-2026-119486 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WP ManageNinja LLC FluentBoards fluent-boards allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FluentBoards: from n/a through 2.2.2.
Product
FluentBoards
Affected
up to 2.2.2
What to do
Affects up to 2.2.2. Update FluentBoards to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 7, 2026Photo Gallery by Supsystic: Cross-Site Request Forgery (CSRF)CVE-2026-119484 · WordPress plugins & themes · reported by PatchstackMedium 6.3
Cross-Site Request Forgery (CSRF) vulnerability in Supsystic Photo Gallery by Supsystic gallery-by-supsystic allows Cross Site Request Forgery.This issue affects Photo Gallery by Supsystic: from n/a through 1.21.6.
Product
Photo Gallery by Supsystic
Affected
up to 1.21.6
What to do
Affects up to 1.21.6. Update Photo Gallery by Supsystic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 7, 2026ProfilePress: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)CVE-2026-119473 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in properfraction ProfilePress wp-user-avatar allows Code Injection.This issue affects ProfilePress: from n/a through 4.17.7.
Product
ProfilePress
Affected
up to 4.17.7
What to do
Affects up to 4.17.7. Update ProfilePress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 7, 2026Amelia: Unauthorized access of attendee dataCVE-2026-107616 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Amelia plugin for WordPress is vulnerable to unauthorized access of attendee data due to a missing authorization check on the GetEventAttendeesCommandHandler::handle() function in versions up to, and including, 9.9.1. The handler only enforces the broad `amelia_read_events` capability — which the plugin's own `wpamelia-customer` role possesses — and does not verify that the authenticated user is an organizer/provider of the event referenced by the client-supplied `id` query parameter. This makes it possible for authenticated attackers, with wpamelia-customer-level access and above, to export the full CSV of attendee personally identifiable information (first/last name, email, phone, date of birth, gender, private notes, payment amounts/methods, WooCommerce order IDs, custom-field values, and uploaded-file URLs) for any Amelia event on the site by directly invoking the `/report/event/attendees` endpoint with an arbitrary event ID.
Product
Amelia
Affected
up to 9.9.1
What to do
Affects up to 9.9.1. Update Amelia to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 7, 2026Booking for Appointments and Events Calendar – Amelia: Authorization bypassCVE-2026-104992 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 9.9.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with custom-level access and above, to export a full CSV of booking records for any event on the site — including attendee names, email addresses, phone numbers, booking status, number of persons, price, payment status, payment amount, and coupon codes — regardless of whether they own or participate in those events.
Product
Booking for Appointments and Events Calendar – Amelia
Affected
up to 9.9.1
What to do
Affects up to 9.9.1. Update Booking for Appointments and Events Calendar – Amelia to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.