Updated 1 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,769exploited flaws on CISA’s list

30added in the last 30 days

495new WordPress flaws this week

394,829entries in the database

331,420 results · page 11 of 6629

Nov 7, 2026Superb Addons: Blocks, Patterns & Theme Designer: Cross-Site Request Forgery (CSRF)CVE-2026-66669 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Cross-Site Request Forgery (CSRF) vulnerability in Suplugins Superb Addons: Blocks, Patterns & Theme Designer superb-blocks allows Cross Site Request Forgery.This issue affects Superb Addons: Blocks, Patterns & Theme Designer: from n/a through 4.2.4.
Product
Superb Addons: Blocks, Patterns & Theme Designer
Affected
up to 4.2.4
What to do
Affects up to 4.2.4. Update Superb Addons: Blocks, Patterns & Theme Designer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 7, 2026LearnPress: Missing AuthorizationCVE-2026-52713 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LearnPress: from n/a through 4.4.12.
Product
LearnPress
Affected
up to 4.4.12
What to do
Affects up to 4.4.12. Update LearnPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 7, 2026ProfilePress: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)CVE-2026-39733 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in properfraction ProfilePress wp-user-avatar allows Code Injection.This issue affects ProfilePress: from n/a through 4.17.7.
Product
ProfilePress
Affected
up to 4.17.7
What to do
Affects up to 4.17.7. Update ProfilePress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 7, 2026myCred: Missing AuthorizationCVE-2026-124274 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in myCred myCred mycred allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects myCred: from n/a through 4.0.2.
Product
myCred
Affected
up to 4.0.2
What to do
Affects up to 4.0.2. Update myCred to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 7, 2026Fluent Booking: Missing AuthorizationCVE-2026-121781 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WP ManageNinja LLC Fluent Booking fluent-booking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Fluent Booking: from n/a through 2.5.0.
Product
Fluent Booking
Affected
up to 2.5.0
What to do
Affects up to 2.5.0. Update Fluent Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 7, 2026YITH WooCommerce Subscription: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2026-121779 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in YITH YITH WooCommerce Subscription yith-woocommerce-subscription allows Retrieve Embedded Sensitive Data.This issue affects YITH WooCommerce Subscription: from n/a through 4.22.0.
Product
YITH WooCommerce Subscription
Affected
up to 4.22.0
What to do
Affects up to 4.22.0. Update YITH WooCommerce Subscription to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 7, 2026WP-Lister Lite for Amazon: Missing AuthorizationCVE-2026-121778 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WP Lab WP-Lister Lite for Amazon wp-lister-for-amazon allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP-Lister Lite for Amazon: from n/a through 2.9.2.
Product
WP-Lister Lite for Amazon
Affected
up to 2.9.2
What to do
Affects up to 2.9.2. Update WP-Lister Lite for Amazon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 7, 2026weDocs: Missing AuthorizationCVE-2026-121767 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in weDevs weDocs wedocs allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects weDocs: from n/a through 2.6.1.
Product
weDocs
Affected
up to 2.6.1
What to do
Affects up to 2.6.1. Update weDocs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 7, 2026VOD Infomaniak: Missing AuthorizationCVE-2026-121761 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Infomaniak Network VOD Infomaniak vod-infomaniak allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VOD Infomaniak: from n/a through 1.5.15.
Product
VOD Infomaniak
Affected
up to 1.5.15
What to do
Affects up to 1.5.15. Update VOD Infomaniak to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 7, 2026WCFM Marketplace: Missing AuthorizationCVE-2026-120849 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WC Lovers WCFM Marketplace wc-multivendor-marketplace allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WCFM Marketplace: from n/a through 3.8.3.
Product
WCFM Marketplace
Affected
up to 3.8.3
What to do
Affects up to 3.8.3. Update WCFM Marketplace to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 7, 2026MC Woocommerce Wishlist: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-119510 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Saeed MC Woocommerce Wishlist smart-wishlist-for-more-convert allows Stored XSS.This issue affects MC Woocommerce Wishlist: from n/a through 2.0.3.
Product
MC Woocommerce Wishlist
Affected
up to 2.0.3
What to do
Affects up to 2.0.3. Update MC Woocommerce Wishlist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 7, 2026AnyWhere Elementor: Missing AuthorizationCVE-2026-119467 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in WPVibes AnyWhere Elementor anywhere-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AnyWhere Elementor: from n/a through 1.3.0.
Product
AnyWhere Elementor
Affected
up to 1.3.0
What to do
Affects up to 1.3.0. Update AnyWhere Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 7, 2026Advanced Form Integration — Connect Forms to 300+ Apps: PHP Object InjectionCVE-2026-104738 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Advanced Form Integration — Connect Forms to 300+ Apps plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.10.2 via deserialization of untrusted input . This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present. Exploitation requires that an administrator has previously configured at least one active NexForms integration (status=1) in the plugin's database table; in the free tier, only POST parameter keys containing the substrings 'name', 'email', 'first', or 'last' are routed to the vulnerable normalizer.
Product
Advanced Form Integration — Connect Forms to 300+ Apps
Affected
up to 2.10.2
What to do
Affects up to 2.10.2. Update Advanced Form Integration — Connect Forms to 300+ Apps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 7, 2026QA Assistants – Driven by data: PHP Object InjectionCVE-2026-87112 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The QA Assistants – Driven by data plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 5.3.0 via the 'dlevent_ver' parameter. This is due to unrestricted PHP deserialization via wrap_unserialize_static() calling unserialize() without an allowed_classes restriction, combined with serialize_escape() failing to sanitize path traversal sequences in the raw_name parameter. This makes it possible for unauthenticated attackers to inject a PHP Object. The Guzzle FileCookieJar gadget present in the plugin's bundled Composer dependencies can be leveraged to perform an Arbitrary File Write, writing attacker-controlled content to an attacker-chosen filename, which can result in Remote Code Execution. Exploitation requires triggering the qahm_cron_data_manage scheduled event via wp-cron.php to invoke the deserialization sink against a planted queue file, but this endpoint requires no authentication and fires automatically on a two-minute schedule.
Product
QA Assistants – Driven by data
Affected
up to 5.3.0
What to do
Affects up to 5.3.0. Update QA Assistants – Driven by data to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 7, 2026A flaw was found in the Trainer v2 TrainJob API.CVE-2026-83495 · Other software · Red Hat · reported by Red Hat
A flaw was found in the Trainer v2 TrainJob API. A user with permissions to create TrainJobs can exploit this by injecting `valueFrom.secretKeyRef` into environment variable definitions. This allows them to read and exfiltrate sensitive information (secrets) from the namespace, leading to a privilege escalation. This occurs when the TrainJob Role-Based Access Control (RBAC) is broader than the Secret read RBAC.
Product
Red Hat OpenShift AI (RHOAI)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record access.redhat.com bugzilla.redhat.com
Nov 7, 2026Vanquish Upload Files for WooCommerce: Directory TraversalCVE-2026-122265 · WordPress plugins & themes · reported by WordfenceMedium 5.9
The Vanquish Upload Files for WooCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.7.13 via the 'vanupfi_file_name' parameter parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. The authorization bypass is achieved by supplying a non-existent order ID (e.g., '.pdf'), which causes wc_get_order() to return false and short-circuits the vanupfi_user_can_access_order_files() check, while the is_pdf() branch selector's loose strpos() substring match allows a traversal payload such as '../.pdf/../../../../wp-config.php' to satisfy the PDF branch and be streamed verbatim via readfile().
Product
Vanquish Upload Files for WooCommerce
Affected
up to 2.7.13
What to do
Affects up to 2.7.13. Update Vanquish Upload Files for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 7, 2026AgenWebsite Shipping – Plugin Ongkos Kirim & Generate Resi Otomatis Semua Kurir Indonesia: Stored Cross-Site ScriptingCVE-2026-122037 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The AgenWebsite Shipping – Plugin Ongkos Kirim & Generate Resi Otomatis Semua Kurir Indonesia plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'zipcode' parameter in all versions up to, and including, 9.2.41 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
AgenWebsite Shipping – Plugin Ongkos Kirim & Generate Resi Otomatis Semua Kurir Indonesia
Affected
up to 9.2.41
What to do
Affects up to 9.2.41. Update AgenWebsite Shipping – Plugin Ongkos Kirim & Generate Resi Otomatis Semua Kurir Indonesia to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record downloads.wordpress.org plugins.trac.wordpress.org
Nov 7, 2026GamiPress – Gamification plugin to reward points, badges & ranks in WordPress, now with AI: Generic SQL InjectionCVE-2026-121792 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The GamiPress – Gamification plugin to reward points, badges & ranks in WordPress, now with AI plugin for WordPress is vulnerable to generic SQL Injection via the 'input_<field_id>.<part> (Gravity Forms name-field part, or list-field row)' parameter in all versions up to, and including, 8.1.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Exploitation requires a GamiPress achievement already configured against a Gravity Forms 'field value submission' event with the corresponding form published — a standard setup for sites using the integration.
Product
GamiPress – Gamification plugin to reward points, badges & ranks in WordPress, now with AI
Affected
up to 8.1.1
What to do
Affects up to 8.1.1. Update GamiPress – Gamification plugin to reward points, badges & ranks in WordPress, now with AI to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 7, 2026WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps: Generic SQL InjectionCVE-2026-121536 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps plugin for WordPress is vulnerable to generic SQL Injection via the 'engine' parameter in all versions up to, and including, 5.5.90 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This is only exploitable when an administrator has configured a Data Project page to admit a lower-privileged role, which is the plugin's documented mechanism for sharing projects with subscribers and other users.
Product
WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps
Affected
up to 5.5.90
What to do
Affects up to 5.5.90. Update WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 7, 2026TranslatePress – Translate Multilingual sites with AI Translation: Stored Cross-Site ScriptingCVE-2026-120537 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment (storage); originals / language / original_language (exfiltration from endpoint)' parameter in all versions up to, and including, 3.3.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
TranslatePress – Translate Multilingual sites with AI Translation
Affected
up to 3.3.8
What to do
Affects up to 3.3.8. Update TranslatePress – Translate Multilingual sites with AI Translation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 7, 2026WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps: Stored Cross-Site ScriptingCVE-2026-120479 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Data Projects front-end simple form in versions up to, and including, 5.5.90 This is due to insufficient input sanitization and output escaping on the value of TEXT/TINYTEXT/MEDIUMTEXT/LONGTEXT columns rendered by the WPDA_Simple_Form_Item_Textarea::show_item() method, which emits the stored column value directly inside a <textarea> element after only replacing '&' with '&'. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps
Affected
up to 5.5.90
What to do
Affects up to 5.5.90. Update WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 7, 2026aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder: Sensitive Information ExposureCVE-2026-118801 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.18.0 via the 'id' parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to extract the full rendered body content of any password-protected post of any post type by embedding the shortcode with the target post's ID. Author-level attackers and above can additionally publish a post embedding the shortcode, exposing the password-protected content to unauthenticated visitors.
Product
aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder
Affected
up to 2.18.0
What to do
Affects up to 2.18.0. Update aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 7, 2026aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder: Stored Cross-Site ScriptingCVE-2026-118800 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'headingTag' parameter in all versions up to, and including, 2.18.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder
Affected
up to 2.18.0
What to do
Affects up to 2.18.0. Update aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 7, 2026WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps: Stored Cross-Site ScriptingCVE-2026-118204 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ImageURL column value (populated from wp_usermeta.description in the demonstrated path)' parameter in all versions up to, and including, 5.5.89 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires an administrator to have published a DataTables shortcode over a database column the attacker controls (e.g., wp_usermeta.description) with the Image URL media type assigned to that column — both are supported plugin features but are not enabled by default.
Product
WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps
Affected
up to 5.5.89
What to do
Affects up to 5.5.89. Update WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 7, 2026Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership: Stored Cross-Site ScriptingCVE-2026-116621 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'pm_note (any custom Textarea metakey with html disabled)' parameter in all versions up to, and including, 2.14.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires a privileged victim to click the attacker-rendered anchor on the target profile page, which triggers the DOM gadget that concatenates the unescaped data-src value into an HTML string passed to jQuery.
Product
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership
Affected
up to 2.14.1
What to do
Affects up to 2.14.1. Update Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Nov 7, 2026The Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker: Arbitrary shortcode executionCVE-2026-103917 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The The Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 11.2.7. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. The submission nonce is dispensed to any unauthenticated caller by the public wp_ajax_nopriv_qsm_create_quiz_nonce endpoint, meaning it functions as a CSRF token rather than an authorization barrier and imposes no meaningful obstacle to exploitation.
Product
The Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker
Affected
up to 11.2.7
What to do
Affects up to 11.2.7. Update The Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 7, 2026Advanced Custom Fields (ACF®): Does not verify that a user is allowed to edit the target object before writing to it during bidirectional relationship synchronizationCVE-2026-97190 · WordPress plugins & themes · reported by WPScanLow 2.7
The Advanced Custom Fields (ACF®) WordPress plugin before 6.8.11 does not verify that a user is allowed to edit the target object before writing to it during bidirectional relationship synchronization, allowing users with contributor-level access and above to add or remove a reference to their own object on arbitrary posts, users, or terms they cannot otherwise edit.
Product
Advanced Custom Fields (ACF®)
Fixed in
6.8.11
What to do
Update Advanced Custom Fields (ACF®) to 6.8.11 or newer.
Full record and what to do →NVD record wpscan.com
Nov 7, 2026Advanced Custom Fields (ACF®): Does not perform a read-permission checkCVE-2026-97189 · WordPress plugins & themes · reported by WPScanLow 2.7
The Advanced Custom Fields (ACF®) WordPress plugin before 6.8.11 does not perform a read-permission check when it renders and formats the values of its relational fields, allowing users with post-editing access (Contributor and above) to disclose the titles and non-public statuses of other users' unpublished posts.
Product
Advanced Custom Fields (ACF®)
Fixed in
6.8.11
What to do
Update Advanced Custom Fields (ACF®) to 6.8.11 or newer.
Full record and what to do →NVD record wpscan.com
Nov 7, 2026Komfortkasse for WooCommerce: Does not properly validate the authenticity of REST API requestsCVE-2026-122001 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Komfortkasse for WooCommerce WordPress plugin before 1.4.9 does not properly validate the authenticity of REST API requests, overriding WordPress's own nonce verification so that a request forged in a logged-in administrator's browser is accepted, which can be used to create a new administrator account and fully take over the site.
Product
Komfortkasse for WooCommerce
Fixed in
1.4.9
What to do
Update Komfortkasse for WooCommerce to 1.4.9 or newer.
Full record and what to do →NVD record wpscan.com
Nov 7, 2026iLeads SMS Gateway by Exsile: Does not check capabilities or nonces in several AJAX actions that update a site option chosen by the requestCVE-2026-121866 · WordPress plugins & themes · reported by WPScanHigh 8.8
The iLeads SMS Gateway by Exsile WordPress plugin before 2.0.0 does not check capabilities or nonces in several AJAX actions that update a site option chosen by the request, allowing any authenticated user, such as a subscriber, to change arbitrary WordPress options and escalate to administrator, for example by enabling registration with administrator as the default role.
Product
iLeads SMS Gateway by Exsile
Fixed in
2.0.0
What to do
Update iLeads SMS Gateway by Exsile to 2.0.0 or newer.
Full record and what to do →NVD record wpscan.com
Nov 7, 2026Event Tickets with Ticket Scanner: Does not properly escape a search value before using it in SQL queries in several of its admin listingsCVE-2026-121858 · WordPress plugins & themes · reported by WPScanMedium 6.3
The Event Tickets with Ticket Scanner WordPress plugin before 3.2.9 does not properly escape a search value before using it in SQL queries in several of its admin listings, allowing users with access to its admin area (administrators by default, or any role granted access in its settings) to perform SQL injection attacks.
Product
Event Tickets with Ticket Scanner
Fixed in
3.2.9
What to do
Update Event Tickets with Ticket Scanner to 3.2.9 or newer.
Full record and what to do →NVD record wpscan.com
Nov 7, 2026Event Tickets with Ticket Scanner: Does not check that a user may manage WooCommerce orders before returning or removing ticket data for any orderCVE-2026-121857 · WordPress plugins & themes · reported by WPScanMedium 4.2
The Event Tickets with Ticket Scanner WordPress plugin before 3.1.14 does not check that a user may manage WooCommerce orders before returning or removing ticket data for any order, allowing any role an administrator has granted access to the Event Tickets with Ticket Scanner WordPress plugin before 3.1.14's admin area (down to Subscriber) to view other customers' ticket codes and names and to remove tickets from their orders.
Product
Event Tickets with Ticket Scanner
Fixed in
3.1.14
What to do
Update Event Tickets with Ticket Scanner to 3.1.14 or newer.
Full record and what to do →NVD record wpscan.com
Nov 7, 2026Magic Link: Does not check that the user requesting a login link is authorised to generate one for the chosen accountCVE-2026-121848 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Magic Link WordPress plugin before 2.2.6 does not check that the user requesting a login link is authorised to generate one for the chosen account, allowing any authenticated user, such as a subscriber, to generate a working login link for an administrator and log in as them.
Product
Magic Link
Fixed in
2.2.6
What to do
Update Magic Link to 2.2.6 or newer.
Full record and what to do →NVD record wpscan.com
Nov 7, 2026Add From Server Lite: Does not restrict SVG uploads to users allowed to post unfiltered HTMLCVE-2026-121796 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Add From Server Lite WordPress plugin before 6.0.0 does not restrict SVG uploads to users allowed to post unfiltered HTML, allowing users with the Author role and above to upload SVG files containing JavaScript and perform Stored XSS attacks.
Product
Add From Server Lite
Fixed in
6.0.0
What to do
Update Add From Server Lite to 6.0.0 or newer.
Full record and what to do →NVD record wpscan.com
Nov 7, 2026Fiber Admin: Does not have authorisation checks in some of its AJAX actionsCVE-2026-121492 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Fiber Admin WordPress plugin before 4.0.1 does not have authorisation checks in some of its AJAX actions, allowing unauthenticated users to change the order of arbitrary posts, including drafts, private posts and navigation menu items, as well as the order of taxonomy terms when term ordering is enabled.
Product
Fiber Admin
Fixed in
4.0.1
What to do
Update Fiber Admin to 4.0.1 or newer.
Full record and what to do →NVD record wpscan.com
Nov 7, 2026Fiber Admin: Does not validate or escape a request header before writing it into a PHP file it regenerates on an unprotected admin hookCVE-2026-121491 · WordPress plugins & themes · reported by WPScanCritical 9
The Fiber Admin WordPress plugin before 4.0.1 does not validate or escape a request header before writing it into a PHP file it regenerates on an unprotected admin hook, allowing unauthenticated attackers to execute arbitrary code when its custom database error page is enabled and they win a race against an administrator saving its settings.
Product
Fiber Admin
Fixed in
4.0.1
What to do
Update Fiber Admin to 4.0.1 or newer.
Full record and what to do →NVD record wpscan.com
Nov 7, 2026Tournamatch: Does not restrict access to its team invitation listingCVE-2026-121380 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Tournamatch WordPress plugin before 4.7.1 does not restrict access to its team invitation listing, allowing unauthenticated users to retrieve the email addresses of people invited to join teams.
Product
Tournamatch
Fixed in
4.7.1
What to do
Update Tournamatch to 4.7.1 or newer.
Full record and what to do →NVD record wpscan.com
Nov 7, 2026Tournamatch: Does not validate or restrict the path of a previously stored profile or team image before deleting itCVE-2026-121379 · WordPress plugins & themes · reported by WPScanCritical 9.6
The Tournamatch WordPress plugin before 4.7.1 does not validate or restrict the path of a previously stored profile or team image before deleting it when a new image is uploaded, allowing users with a role as low as Subscriber to delete arbitrary files on the server, such as wp-config.php, which can lead to a full site takeover.
Product
Tournamatch
Fixed in
4.7.1
What to do
Update Tournamatch to 4.7.1 or newer.
Full record and what to do →NVD record wpscan.com
Nov 7, 2026Live Composer: Does not escape a pagination setting supplied through its post-listing module shortcodes before outputting it in an HTML attributeCVE-2026-119073 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Live Composer WordPress plugin before 2.1.23 does not escape a pagination setting supplied through its post-listing module shortcodes before outputting it in an HTML attribute, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
Live Composer
Fixed in
2.1.23
What to do
Update Live Composer to 2.1.23 or newer.
Full record and what to do →NVD record wpscan.com
Nov 7, 2026Directorist: AI-Powered Business Directory, Listings & Classified Ads: Does not verify that the order targeted by its checkout payment-retry REST action belongs to the requesting userCVE-2026-118534 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.11 does not verify that the order targeted by its checkout payment-retry REST action belongs to the requesting user, allowing any authenticated user, such as a subscriber, to create payment-attempt records against other users' orders.
Product
Directorist: AI-Powered Business Directory, Listings & Classified Ads
Fixed in
8.11
What to do
Update Directorist: AI-Powered Business Directory, Listings & Classified Ads to 8.11 or newer.
Full record and what to do →NVD record wpscan.com
Nov 7, 2026Directorist: AI-Powered Business Directory, Listings & Classified Ads: Does not verify that the user requesting an order's payment receipt owns that orderCVE-2026-118533 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.11 does not verify that the user requesting an order's payment receipt owns that order, allowing any authenticated user, such as a subscriber, to disclose other users' order and payment information, including amounts, payment method, payment status and transaction ID.
Product
Directorist: AI-Powered Business Directory, Listings & Classified Ads
Fixed in
8.11
What to do
Update Directorist: AI-Powered Business Directory, Listings & Classified Ads to 8.11 or newer.
Full record and what to do →NVD record wpscan.com
Nov 7, 2026Directorist: AI-Powered Business Directory, Listings & Classified Ads: Does not verify ownership of attachment IDs suppliedCVE-2026-118532 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.11 does not verify ownership of attachment IDs supplied when updating a listing's images, allowing authenticated users with Subscriber-level access and above to permanently delete arbitrary media library attachments, including those uploaded by administrators, along with their files.
Product
Directorist: AI-Powered Business Directory, Listings & Classified Ads
Fixed in
8.11
What to do
Update Directorist: AI-Powered Business Directory, Listings & Classified Ads to 8.11 or newer.
Full record and what to do →NVD record wpscan.com
Nov 7, 2026Directorist: AI-Powered Business Directory, Listings & Classified Ads: Does not check that the acting user may edit each targeted userCVE-2026-118530 · WordPress plugins & themes · reported by WPScanMedium 5
The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.11 does not check that the acting user may edit each targeted user when handling an email-verification bulk action on multisite, allowing an Administrator of one site on the network to lock out users of other sites, including the network Super Administrator, until they re-verify their email.
Product
Directorist: AI-Powered Business Directory, Listings & Classified Ads
Fixed in
8.11
What to do
Update Directorist: AI-Powered Business Directory, Listings & Classified Ads to 8.11 or newer.
Full record and what to do →NVD record wpscan.com
Nov 7, 2026Directorist: AI-Powered Business Directory, Listings & Classified Ads: Does not verify that a user owns a listing before processing a featured-listing checkout for itCVE-2026-118529 · WordPress plugins & themes · reported by WPScanLow 3.1
The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.11 does not verify that a user owns a listing before processing a featured-listing checkout for it, allowing any authenticated user, such as a subscriber, to publish and feature another user's pending listing when the featured listing fee is set to zero.
Product
Directorist: AI-Powered Business Directory, Listings & Classified Ads
Fixed in
8.11
What to do
Update Directorist: AI-Powered Business Directory, Listings & Classified Ads to 8.11 or newer.
Full record and what to do →NVD record wpscan.com
Nov 7, 2026Directorist: AI-Powered Business Directory, Listings & Classified Ads: Does not validate that the requesting user owns the referenced listing before returning its metadata via an AJAX actionCVE-2026-118528 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.11 does not validate that the requesting user owns the referenced listing before returning its metadata via an AJAX action, allowing authenticated attackers with Subscriber-level access and above to disclose another user's private and unpublished draft listing details, including contact information.
Product
Directorist: AI-Powered Business Directory, Listings & Classified Ads
Fixed in
8.11
What to do
Update Directorist: AI-Powered Business Directory, Listings & Classified Ads to 8.11 or newer.
Full record and what to do →NVD record wpscan.com
Nov 7, 2026FV Flowplayer Video Player: Does not escape shortcode attribute values embedded in comments before rendering them into the media player markupCVE-2026-117525 · WordPress plugins & themes · reported by WPScanHigh 7.5
The FV Flowplayer Video Player WordPress plugin before 7.5.57.7212 does not escape shortcode attribute values embedded in comments before rendering them into the media player markup, allowing an unauthenticated visitor to store a script payload in a comment that executes in the session of any visitor, including an administrator, who plays the commented video, when the non-default comment-shortcode-parsing setting is enabled.
Product
FV Flowplayer Video Player
Fixed in
7.5.57.7212
What to do
Update FV Flowplayer Video Player to 7.5.57.7212 or newer.
Full record and what to do →NVD record wpscan.com
Nov 7, 2026Live Composer: Does not sanitise and escape some of its custom post type slug settings before using them in front-end linksCVE-2025-15708 · WordPress plugins & themes · reported by WPScanLow 3.5
The Live Composer WordPress plugin before 2.1.23 does not sanitise and escape some of its custom post type slug settings before using them in front-end links, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in a multisite setup).
Product
Live Composer
Fixed in
2.1.23
What to do
Update Live Composer to 2.1.23 or newer.
Full record and what to do →NVD record wpscan.com
Nov 7, 2026IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to access internal network resources and obtain sensitive information due to server-sideCVE-2026-75590 · Other software · IBM · reported by psirt@us.ibm.comHigh 7.2
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to access internal network resources and obtain sensitive information due to server-side request forgery. A protection that blocks requests to internal addresses can be bypassed, so the server could be made to contact internal services and return part of their responses.
Product
API Connect
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record ibm.com
Nov 7, 2026IBM API Connect 12.1.0.0 through 12.1.1.2 could allow low-privileged users to query arbitrary indices and read sensitive data due to missing authorization.CVE-2026-19131 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.5
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow low-privileged users to query arbitrary indices and read sensitive data due to missing authorization.
Product
API Connect
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record ibm.com
Nov 7, 2026IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a network-positioned attacker to intercept backup data due to improper veriCVE-2026-19129 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.8
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a network-positioned attacker to intercept backup data due to improper verification of the backup server's identity. The identity of the backup server is not verified when the secure connection for analytics backups is established, which could allow backup data, and credentials if used, to be intercepted.
Product
API Connect
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record ibm.com ibm.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.