Updated 2 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,769exploited flaws on CISA’s list

30added in the last 30 days

495new WordPress flaws this week

394,829entries in the database

24,770 results · page 11 of 496

Oct 29, 2026Subscriber Insecure Direct Object References (IDOR) in Hotel Booking <= 3.8 versions.CVE-2026-118084 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Subscriber Insecure Direct Object References (IDOR) in Hotel Booking <= 3.8 versions.
Affected
up to 3.8
What to do
Affects up to 3.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 29, 2026Unauthenticated Sensitive Data Exposure in WP Crowdfunding <= 2.2.2 versions.CVE-2026-118083 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Sensitive Data Exposure in WP Crowdfunding <= 2.2.2 versions.
Affected
up to 2.2.2
What to do
Affects up to 2.2.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 29, 2026Contributor PHP Object Injection in 10Web Social Photo Feed <= 1.5.6 versions.CVE-2026-118081 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Contributor PHP Object Injection in 10Web Social Photo Feed <= 1.5.6 versions.
Affected
up to 1.5.6
What to do
Affects up to 1.5.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 29, 2026Contributor PHP Object Injection in Social Snap <= 1.5.4 versions.CVE-2026-118080 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Contributor PHP Object Injection in Social Snap <= 1.5.4 versions.
Affected
up to 1.5.4
What to do
Affects up to 1.5.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 29, 2026Shop manager PHP Object Injection in Product Catalog Feed by PixelYourSite <= 3.1.4 versions.CVE-2026-118078 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Shop manager PHP Object Injection in Product Catalog Feed by PixelYourSite <= 3.1.4 versions.
Affected
up to 3.1.4
What to do
Affects up to 3.1.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 29, 2026Author PHP Object Injection in Sastra Essential Addons for Elementor <= 1.2.3 versions.CVE-2026-118077 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Author PHP Object Injection in Sastra Essential Addons for Elementor <= 1.2.3 versions.
Affected
up to 1.2.3
What to do
Affects up to 1.2.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 29, 2026Contributor PHP Object Injection in Frisbii Pay <= 1.8.19 versions.CVE-2026-118076 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Contributor PHP Object Injection in Frisbii Pay <= 1.8.19 versions.
Affected
up to 1.8.19
What to do
Affects up to 1.8.19. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 29, 2026Contributor PHP Object Injection in WP Media folders <= 1.1.10 versions.CVE-2026-118075 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Contributor PHP Object Injection in WP Media folders <= 1.1.10 versions.
Affected
up to 1.1.10
What to do
Affects up to 1.1.10. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 29, 2026Shop manager PHP Object Injection in Finale Lite <= 2.21.0 versions.CVE-2026-118074 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Shop manager PHP Object Injection in Finale Lite <= 2.21.0 versions.
Affected
up to 2.21.0
What to do
Affects up to 2.21.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 29, 2026Subscriber PHP Object Injection in News Kit Elementor Addons <= 1.5.0 versions.CVE-2026-118073 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Subscriber PHP Object Injection in News Kit Elementor Addons <= 1.5.0 versions.
Affected
up to 1.5.0
What to do
Affects up to 1.5.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 29, 2026Shop manager PHP Object Injection in myPOS Checkout <= 1.4.5 versions.CVE-2026-116869 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Shop manager PHP Object Injection in myPOS Checkout <= 1.4.5 versions.
Affected
up to 1.4.5
What to do
Affects up to 1.4.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 29, 2026Subscriber PHP Object Injection in BuddyPress Xprofile Custom Field Types <= 1.3.1 versions.CVE-2026-116868 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Subscriber PHP Object Injection in BuddyPress Xprofile Custom Field Types <= 1.3.1 versions.
Affected
up to 1.3.1
What to do
Affects up to 1.3.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 29, 2026Contributor PHP Object Injection in Dynamic QR Code – generator <= 1.0.1 versions.CVE-2026-116867 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Contributor PHP Object Injection in Dynamic QR Code – generator <= 1.0.1 versions.
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 29, 2026Contributor PHP Object Injection in Extra Fees Plugin for WooCommerce <= 4.4.0 versions.CVE-2026-116866 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Contributor PHP Object Injection in Extra Fees Plugin for WooCommerce <= 4.4.0 versions.
Affected
up to 4.4.0
What to do
Affects up to 4.4.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 29, 2026Editor PHP Object Injection in Zippy <= 1.7.0 versions.CVE-2026-116865 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Editor PHP Object Injection in Zippy <= 1.7.0 versions.
Affected
up to 1.7.0
What to do
Affects up to 1.7.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 29, 2026Author PHP Object Injection in WPCargo Track & Trace <= 8.0.5 versions.CVE-2026-116864 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Author PHP Object Injection in WPCargo Track & Trace <= 8.0.5 versions.
Affected
up to 8.0.5
What to do
Affects up to 8.0.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 29, 2026The Plus Addons for Elementor Page Builder Lite: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-116848 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in POSIMYTH Innovations The Plus Addons for Elementor Page Builder Lite the-plus-addons-for-elementor-page-builder allows Stored XSS.This issue affects The Plus Addons for Elementor Page Builder Lite: from n/a through 6.5.3.
Product
The Plus Addons for Elementor Page Builder Lite
Affected
up to 6.5.3
What to do
Affects up to 6.5.3. Update The Plus Addons for Elementor Page Builder Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 29, 2026Happy Addons for Elementor: Missing AuthorizationCVE-2026-109891 · WordPress plugins & themes · reported by PatchstackMedium 6.4
Missing Authorization vulnerability in weDevs Happy Addons for Elementor happy-elementor-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Happy Addons for Elementor: from n/a through 3.50.1.
Product
Happy Addons for Elementor
Affected
up to 3.50.1
What to do
Affects up to 3.50.1. Update Happy Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 29, 2026Unauthenticated Cross Site Scripting (XSS) in Chained Quiz <= 1.4.1 versions.CVE-2026-108494 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Chained Quiz <= 1.4.1 versions.
Affected
up to 1.4.1
What to do
Affects up to 1.4.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 29, 2026myCred: Missing AuthorizationCVE-2026-97073 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in myCred myCred mycred allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects myCred: from n/a through 4.0.2.
Product
myCred
Affected
up to 4.0.2
What to do
Affects up to 4.0.2. Update myCred to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 29, 2026MasterStudy LMS: Missing authorizationCVE-2026-80069 · WordPress plugins & themes · reported by VulnCheckMedium 5.3
MasterStudy LMS plugin for WordPress before 3.7.50 contains a missing authorization vulnerability that allows any authenticated user, including Subscribers, to trigger the stm_lms_send_test_email_ajax AJAX action without capability or nonce validation. Attackers can invoke this handler directly or via cross-site request forgery to cause an uncaught PHP fatal error that, when display_errors is enabled, discloses the absolute filesystem path of the plugin.
Product
MasterStudy LMS
Fixed in
3.7.50
What to do
Update MasterStudy LMS to 3.7.50 or newer.
Full record and what to do →NVD record docs.stylemixthemes.com wordpress.org
Oct 29, 2026MasterStudy LMS: Path traversalCVE-2026-80067 · WordPress plugins & themes · reported by VulnCheckMedium 5.3
MasterStudy LMS plugin for WordPress before 3.7.50 contains a path traversal vulnerability that allows authenticated Subscriber-level users to import arbitrary WXR XML files by supplying directory traversal sequences in the stm_lms_step parameter passed to the stm_lms_import_sample_data AJAX action, which lacks capability checks and nonce verification. Attackers can traverse the file system to reference a reachable WXR file and have the handler publish its contained posts under their identity, enabling publication of attacker-chosen post type, title, content, and metadata.
Product
MasterStudy LMS
Fixed in
3.7.50
What to do
Update MasterStudy LMS to 3.7.50 or newer.
Full record and what to do →NVD record docs.stylemixthemes.com wordpress.org
Oct 29, 2026ShopBuilder – Elementor WooCommerce Builder Addons: Missing AuthorizationCVE-2026-54871 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Mamunur Rashid ShopBuilder – Elementor WooCommerce Builder Addons shopbuilder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ShopBuilder – Elementor WooCommerce Builder Addons: from n/a through 3.4.2.
Product
ShopBuilder – Elementor WooCommerce Builder Addons
Affected
up to 3.4.2
What to do
Affects up to 3.4.2. Update ShopBuilder – Elementor WooCommerce Builder Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 29, 2026Profile Builder: Missing AuthorizationCVE-2026-54853 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Cozmoslabs Profile Builder profile-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Profile Builder: from n/a through 4.0.5.
Product
Profile Builder
Affected
up to 4.0.5
What to do
Affects up to 4.0.5. Update Profile Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 29, 2026Page Restriction WordPress (WP): Missing AuthorizationCVE-2026-54852 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in miniOrange Page Restriction WordPress (WP) page-and-post-restriction allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Page Restriction WordPress (WP): from n/a through 1.6.1.
Product
Page Restriction WordPress (WP)
Affected
up to 1.6.1
What to do
Affects up to 1.6.1. Update Page Restriction WordPress (WP) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 29, 2026WP User Frontend: Missing AuthorizationCVE-2026-52708 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in weDevs WP User Frontend wp-user-frontend allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP User Frontend: from n/a through 4.3.13.
Product
WP User Frontend
Affected
up to 4.3.13
What to do
Affects up to 4.3.13. Update WP User Frontend to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 29, 2026WP User Frontend: Missing AuthorizationCVE-2026-48884 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in weDevs WP User Frontend wp-user-frontend allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP User Frontend: from n/a through 4.3.13.
Product
WP User Frontend
Affected
up to 4.3.13
What to do
Affects up to 4.3.13. Update WP User Frontend to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 29, 2026EventPrime: Authorization Bypass Through User-Controlled KeyCVE-2026-42691 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Authorization Bypass Through User-Controlled Key vulnerability in EventPrime EventPrime eventprime-event-calendar-management allows Privilege Abuse.This issue affects EventPrime: from n/a through 4.3.6.0.
Product
EventPrime
Affected
up to 4.3.6.0
What to do
Affects up to 4.3.6.0. Update EventPrime to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 29, 2026Kit (formerly ConvertKit): Missing AuthorizationCVE-2026-27063 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Kit Kit (formerly ConvertKit) convertkit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kit (formerly ConvertKit): from n/a through 3.4.7.
Product
Kit (formerly ConvertKit)
Affected
up to 3.4.7
What to do
Affects up to 3.4.7. Update Kit (formerly ConvertKit) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 29, 2026User Registration: Missing AuthorizationCVE-2026-25450 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in ThemeGrill User Registration user-registration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Registration: from n/a through 5.3.0.
Product
User Registration
Affected
up to 5.3.0
What to do
Affects up to 5.3.0. Update User Registration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 29, 2026WP ERP: Missing AuthorizationCVE-2026-25448 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in weDevs WP ERP erp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP ERP: from n/a through 1.17.10.
Product
WP ERP
Affected
up to 1.17.10
What to do
Affects up to 1.17.10. Update WP ERP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 29, 2026Flash & HTML5 Video: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-118097 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Flash & HTML5 Video html5-video-player allows Stored XSS.This issue affects Flash & HTML5 Video: from n/a through 2.14.0.
Product
Flash & HTML5 Video
Affected
up to 2.14.0
What to do
Affects up to 2.14.0. Update Flash & HTML5 Video to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 29, 2026MasterStudy LMS: Missing AuthorizationCVE-2026-118092 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in StylemixThemes MasterStudy LMS masterstudy-lms-learning-management-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MasterStudy LMS: from n/a through 3.7.55.
Product
MasterStudy LMS
Affected
up to 3.7.55
What to do
Affects up to 3.7.55. Update MasterStudy LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 29, 2026WPFunnels: Missing AuthorizationCVE-2026-118091 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WPFunnels Team WPFunnels wpfunnels allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPFunnels: from n/a through 3.13.5.
Product
WPFunnels
Affected
up to 3.13.5
What to do
Affects up to 3.13.5. Update WPFunnels to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 29, 2026WPFunnels: Missing AuthorizationCVE-2026-118088 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WPFunnels Team WPFunnels wpfunnels allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPFunnels: from n/a through 3.13.5.
Product
WPFunnels
Affected
up to 3.13.5
What to do
Affects up to 3.13.5. Update WPFunnels to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 29, 2026Flexible Quantity – Measurement Price Calculator for WooCommerce: Missing AuthorizationCVE-2026-116856 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WP Desk Flexible Quantity – Measurement Price Calculator for WooCommerce flexible-quantity-measurement-price-calculator-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Flexible Quantity – Measurement Price Calculator for WooCommerce: from n/a through 2.3.24.
Product
Flexible Quantity – Measurement Price Calculator for WooCommerce
Affected
up to 2.3.24
What to do
Affects up to 2.3.24. Update Flexible Quantity – Measurement Price Calculator for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 29, 2026Happy Addons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-116850 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in weDevs Happy Addons for Elementor happy-elementor-addons allows Stored XSS.This issue affects Happy Addons for Elementor: from n/a through 3.50.1.
Product
Happy Addons for Elementor
Affected
up to 3.50.1
What to do
Affects up to 3.50.1. Update Happy Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 29, 2026WP User Manager: Missing AuthorizationCVE-2026-116846 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WP User Manager WP User Manager wp-user-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP User Manager: from n/a through 2.9.26.
Product
WP User Manager
Affected
up to 2.9.26
What to do
Affects up to 2.9.26. Update WP User Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 29, 2026Webba Booking: Missing AuthorizationCVE-2026-116406 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Webba Plugins Webba Booking webba-booking-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Webba Booking: from n/a through 6.5.4.
Product
Webba Booking
Affected
up to 6.5.4
What to do
Affects up to 6.5.4. Update Webba Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 29, 2026SureForms: Missing AuthorizationCVE-2026-116387 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Brainstorm Force SureForms sureforms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SureForms: from n/a through 2.12.9.
Product
SureForms
Affected
up to 2.12.9
What to do
Affects up to 2.12.9. Update SureForms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 29, 2026PublishPress Authors: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-115610 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PublishPress PublishPress Authors publishpress-authors allows Stored XSS.This issue affects PublishPress Authors: from n/a through 4.17.0.
Product
PublishPress Authors
Affected
up to 4.17.0
What to do
Affects up to 4.17.0. Update PublishPress Authors to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 29, 2026SureDash: Missing AuthorizationCVE-2026-115605 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Brainstorm Force SureDash suredash allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SureDash: from n/a through 1.12.3.
Product
SureDash
Affected
up to 1.12.3
What to do
Affects up to 1.12.3. Update SureDash to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 29, 2026Custom Price for WooCommerce: Missing AuthorizationCVE-2026-115601 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WP Desk Custom Price for WooCommerce custom-price-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Custom Price for WooCommerce: from n/a through 1.1.29.
Product
Custom Price for WooCommerce
Affected
up to 1.1.29
What to do
Affects up to 1.1.29. Update Custom Price for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 29, 2026Taxi Booking Manager for WooCommerce: Missing AuthorizationCVE-2026-114181 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Magepeople inc. Taxi Booking Manager for WooCommerce ecab-taxi-booking-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Taxi Booking Manager for WooCommerce: from n/a through 2.1.6.
Product
Taxi Booking Manager for WooCommerce
Affected
up to 2.1.6
What to do
Affects up to 2.1.6. Update Taxi Booking Manager for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 29, 2026SureDash: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-110881 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force SureDash suredash allows Stored XSS.This issue affects SureDash: from n/a through 1.12.3.
Product
SureDash
Affected
up to 1.12.3
What to do
Affects up to 1.12.3. Update SureDash to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 29, 2026Brave: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)CVE-2026-48202 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Brave Brave brave-popup-builder allows Code Injection.This issue affects Brave: from n/a through 0.8.8.
Product
Brave
Affected
up to 0.8.8
What to do
Affects up to 0.8.8. Update Brave to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 29, 2026HivePress Claim Listings: Missing AuthorizationCVE-2026-42707 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in HivePress HivePress Claim Listings hivepress-claim-listings allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HivePress Claim Listings: from n/a through 1.1.4.
Product
HivePress Claim Listings
Affected
up to 1.1.4
What to do
Affects up to 1.1.4. Update HivePress Claim Listings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 29, 2026Kali Forms: Missing AuthorizationCVE-2026-39782 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Kaliforms Kali Forms kali-forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kali Forms: from n/a through 2.4.27.
Product
Kali Forms
Affected
up to 2.4.27
What to do
Affects up to 2.4.27. Update Kali Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 29, 2026User Registration: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)CVE-2026-25467 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in ThemeGrill User Registration user-registration allows Code Injection.This issue affects User Registration: from n/a through 5.3.0.
Product
User Registration
Affected
up to 5.3.0
What to do
Affects up to 5.3.0. Update User Registration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 29, 2026Multiple Pages Generator by Themeisle before 4.2.5 contains a stored cross-site scripting vulnerability that allows Contributor-level users to inject script viaCVE-2026-119054 · WordPress plugins & themes · reported by VulnCheckMedium 5.1
Multiple Pages Generator by Themeisle before 4.2.5 contains a stored cross-site scripting vulnerability that allows Contributor-level users to inject script via the [mpg] and [mpg_match] shortcode base-url attribute. Attackers can store entity-encoded payloads that pass kses but are decoded by html_entity_decode() and rendered unescaped through {{mpg_url}}, executing script in administrators' browsers.
Fixed in
4.2.5
What to do
Update the plugin to 4.2.5 or newer.
Full record and what to do →NVD record plugins.svn.wordpress.org plugins.svn.wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.