Updated 9 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

526new WordPress flaws this week

391,181entries in the database

9,038 results · page 11 of 181

Oct 3, 2026SEOPress – AI SEO Plugin & On-site SEO: Stored Cross-Site ScriptingCVE-2026-101357 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The SEOPress – AI SEO Plugin & On-site SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'seopress_google_analytics_matomo_id' parameter in all versions up to, and including, 10.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires an administrator to have delegated the Analytics management capability to the Subscriber role via the plugin's Advanced > Security settings.
Product
SEOPress – AI SEO Plugin & On-site SEO
Affected
up to 10.2
What to do
Affects up to 10.2. Update SEOPress – AI SEO Plugin & On-site SEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 3, 2026WP Ultimate Review: Does not prevent unauthenticated users from storing crafted review content that makes the reviewed page fail with a fatal error on every subsequent visitCVE-2026-101161 · WordPress plugins & themes · reported by WPScanHigh 7.5
The WP Ultimate Review WordPress plugin before 2.4.4 does not prevent unauthenticated users from storing crafted review content that makes the reviewed page fail with a fatal error on every subsequent visit, resulting in a persistent denial of service when the WP Ultimate Review WordPress plugin before 2.4.4's review display settings have never been saved.
Product
WP Ultimate Review
Fixed in
2.4.4
What to do
Update WP Ultimate Review to 2.4.4 or newer.
Full record and what to do →NVD record wpscan.com
Oct 3, 2026WP Ultimate Review: Does not validate that a submitted review rating is numeric before storing it and later using it in numeric operationsCVE-2026-101160 · WordPress plugins & themes · reported by WPScanHigh 7.5
The WP Ultimate Review WordPress plugin before 2.4.4 does not validate that a submitted review rating is numeric before storing it and later using it in numeric operations when rendering reviews, allowing unauthenticated users to make the reviewed content fail with a fatal error for all visitors until the review is removed (a persistent denial of service), when user reviews are enabled.
Product
WP Ultimate Review
Fixed in
2.4.4
What to do
Update WP Ultimate Review to 2.4.4 or newer.
Full record and what to do →NVD record wpscan.com
Oct 3, 2026Rich Showcase for Google Reviews: Stored Cross-Site ScriptingCVE-2026-100148 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Rich Showcase for Google Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'reviews[].text' parameter in all versions up to, and including, 7.1.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload is delivered entirely through a Google review posted for the connected business and requires no WordPress account; the plugin's default daily cron auto-imports the malicious review text, and execution triggers for every visitor on DOMContentLoaded without any further user interaction.
Product
Rich Showcase for Google Reviews
Affected
up to 7.1.3
What to do
Affects up to 7.1.3. Update Rich Showcase for Google Reviews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 3, 2026Ultra Addons Lite for Elementor: Stored Cross-Site ScriptingCVE-2025-12828 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Ultra Addons Lite for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Type Out widget in all versions up to, and including, 1.3.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Ultra Addons Lite for Elementor
Affected
up to 1.3.2
What to do
Affects up to 1.3.2. Update Ultra Addons Lite for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 3, 2026Real Cookie Banner: GDPR & ePrivacy Cookie Consent: Stored Cross-Site ScriptingCVE-2026-92977 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Real Cookie Banner: GDPR & ePrivacy Cookie Consent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment in all versions up to, and including, 5.3.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Malicious script payloads placed in the title attribute of an anchor tag survive WordPress's comment kses filter at save time, as the payload is only promoted to executable HTML attributes when the plugin's page-wide regex strips the closing quote delimiter at render time; exploitability is therefore subject to the standard comment moderation workflow before the comment is publicly displayed.
Product
Real Cookie Banner: GDPR & ePrivacy Cookie Consent
Affected
up to 5.3.5
What to do
Affects up to 5.3.5. Update Real Cookie Banner: GDPR & ePrivacy Cookie Consent to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 3, 2026EmbedPress – PDF Embedder, 3D PDF FlipBook, Google Reviews, YouTube Videos, Upload & Embed PDF documents: Stored Cross-Site ScriptingCVE-2026-92727 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The EmbedPress – PDF Embedder, 3D PDF FlipBook, Google Reviews, YouTube Videos, Upload & Embed PDF documents plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'slidesShow' Block Attribute in all versions up to, and including, 4.6.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The slidesShow block attribute is interpolated into an unquoted data-carousel-options HTML attribute, allowing a payload containing spaces to break out of the attribute and inject additional DOM attributes such as onfocus event handlers onto the wrapper element.
Product
EmbedPress – PDF Embedder, 3D PDF FlipBook, Google Reviews, YouTube Videos, Upload & Embed PDF documents
Affected
up to 4.6.6
What to do
Affects up to 4.6.6. Update EmbedPress – PDF Embedder, 3D PDF FlipBook, Google Reviews, YouTube Videos, Upload & Embed PDF documents to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 2, 2026Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership: Stored Cross-Site ScriptingCVE-2026-96270 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'form_id' parameter in all versions up to, and including, 2.13.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload is stored in the registering user's 'submitted' usermeta via update_user_meta() and is only triggered when an administrator opens the affected user record in the wp-admin Users modal, which inserts the unescaped output via jQuery .html().
Product
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership
Affected
up to 2.13.1
What to do
Affects up to 2.13.1. Update Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Oct 2, 2026SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent: Stored Cross-Site ScriptingCVE-2026-94378 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name' parameter in all versions up to, and including, 3.5.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This exploit chain requires the 'Register user if not exists' setting to be disabled, which is its default configuration.
Product
SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent
Affected
up to 3.5.3
What to do
Affects up to 3.5.3. Update SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.svn.wordpress.org plugins.trac.wordpress.org
Oct 2, 2026Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership: Authorization bypassCVE-2026-93428 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.13.1 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to view privacy-restricted member profile field values — including fields explicitly configured as owner-only, members-only, or role-restricted — by querying the publicly accessible wp_ajax_nopriv_um_get_members endpoint. The nonce required by the endpoint ('um-frontend-nonce') is emitted to all unauthenticated visitors via wp_localize_script, meaning it provides no meaningful access control and any anonymous visitor can satisfy the endpoint's authentication requirements.
Product
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership
Affected
up to 2.13.1
What to do
Affects up to 2.13.1. Update Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Oct 2, 2026Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for: Stored Cross-Site ScriptingCVE-2026-100180 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment in all versions up to, and including, 3.2.19 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Immediate persistence without moderator approval is possible when the attacker submits from an email address with at least one previously approved comment, though the widened allowlist bypasses sanitization regardless of approval status.
Product
Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for
Affected
up to 3.2.19
What to do
Affects up to 3.2.19. Update Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 2, 2026JetAppointment: Stored Cross-Site ScriptingCVE-2026-93875 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The JetAppointment plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'friendlyTime' parameter in all versions up to, and including, 2.5.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload is stored in the wp_jet_appointments_meta table via the unauthenticated jet_engine_form_booking_submit endpoint and executes in the administrator's browser when the appointment details popup is opened in the WordPress admin panel.
Product
JetAppointment
Affected
up to 2.5.2.1
What to do
Affects up to 2.5.2.1. Update JetAppointment to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record crocoblock.com wordfence.com
Oct 2, 2026W3 Total Cache: Stored Cross-Site ScriptingCVE-2026-87920 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Output-Buffer Regex Rewrite in all versions up to, and including, 2.10.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability is only exploitable when the 'Remove query strings from static resources' option is enabled in W3 Total Cache, as mutate_url() must strip the '?' delimiter and everything following it — including the closing quote of the outer attribute — to break the attribute boundary.
Product
W3 Total Cache
Affected
up to 2.10.6
What to do
Affects up to 2.10.6. Update W3 Total Cache to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 2, 2026Customer Reviews for WooCommerce: Stored Cross-Site ScriptingCVE-2026-97663 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Author Name in all versions up to, and including, 5.122.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the image attachment feature (ivole_attach_image) to be enabled, which allows unauthenticated attackers to both submit a review with an entity-encoded malicious author name and upload an attached image via the publicly accessible wp_ajax_nopriv_cr_upload_local_images_frontend endpoint.
Product
Customer Reviews for WooCommerce
Affected
up to 5.122.0
What to do
Affects up to 5.122.0. Update Customer Reviews for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 2, 2026Relevanssi – A Better Search: Stored Cross-Site ScriptingCVE-2026-97641 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Relevanssi – A Better Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to, and including, 4.28.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is only exploitable when the administrator has configured a non-empty value for the "Allowable tags in excerpts" setting, such as the default example value of <p><a><strong>, as the prefix-matching regex must have an allowable tag whose name is a prefix of the injected tag name.
Product
Relevanssi – A Better Search
Affected
up to 4.28.3
What to do
Affects up to 4.28.3. Update Relevanssi – A Better Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Oct 2, 2026JetFormBuilder — Dynamic Blocks Form Builder: Stored Cross-Site ScriptingCVE-2026-97342 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'choice' Post Meta via Insert/Update Post Action in all versions up to, and including, 3.6.5.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload is submitted via the unauthenticated wp_ajax_nopriv_jet_form_builder_submit endpoint, stored verbatim into post meta through the Insert/Update Post action, and later rendered unescaped by the Select Field block template when the get_from_db option generator copies raw meta values into option value attributes and label content.
Product
JetFormBuilder — Dynamic Blocks Form Builder
Affected
up to 3.6.5.4
What to do
Affects up to 3.6.5.4. Update JetFormBuilder — Dynamic Blocks Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Oct 2, 2026Download Manager: Stored Cross-Site ScriptingCVE-2026-97338 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Display Name in all versions up to, and including, 3.3.70 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the [wpdm_edit_profile] shortcode to be present on a front-end page accessible to Subscriber-level users, who can then submit a multiply entity-encoded payload via the display name field to bypass sanitization.
Product
Download Manager
Affected
up to 3.3.70
What to do
Affects up to 3.3.70. Update Download Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 2, 2026CMB2: Stored Cross-Site ScriptingCVE-2026-97336 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The CMB2 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'file_list' Field Type in all versions up to, and including, 2.13.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is only exploitable when an integrating plugin or theme registers a file_list field on a publicly accessible front-end form or a user meta box, as CMB2 is a developer library and does not expose these fields by default.
Product
CMB2
Affected
up to 2.13.0
What to do
Affects up to 2.13.0. Update CMB2 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 2, 2026Mang Board: Stored Cross-Site ScriptingCVE-2026-96871 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Mang Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data_type' parameter in all versions up to, and including, 2.4.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable on any board configured with the default write_level=0 (guest posting) and editor_type=N settings, which are the out-of-the-box defaults for newly created boards.
Product
Mang Board
Affected
up to 2.4.2
What to do
Affects up to 2.4.2. Update Mang Board to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 2, 2026Listdom: AI-powered Business Directory with Classifieds Ads Listings: Stored Cross-Site ScriptingCVE-2026-96647 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Listdom: AI-powered Business Directory with Classifieds Ads Listings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'lsd[remark]' Parameter in all versions up to, and including, 6.1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable by Subscriber-level users because the listing-creation branch of the AJAX handler omits a capability check, and the required nonce is publicly emitted on any page containing the [listdom-dashboard] shortcode.
Product
Listdom: AI-powered Business Directory with Classifieds Ads Listings
Affected
up to 6.1.1
What to do
Affects up to 6.1.1. Update Listdom: AI-powered Business Directory with Classifieds Ads Listings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 2, 2026GSpeech TTS – WordPress Text To Speech: Stored Cross-Site ScriptingCVE-2026-96578 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The GSpeech TTS – WordPress Text To Speech Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to, and including, 3.22.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This mXSS-style transform bypasses WordPress comment kses sanitization because the payload is stored using only kses-allowed tags and attributes; the malicious event handlers and style fragments become active only when the plugin's output-buffer callback rewrites the rendered HTML at request time.
Product
GSpeech TTS – WordPress Text To Speech
Affected
up to 3.22.0
What to do
Affects up to 3.22.0. Update GSpeech TTS – WordPress Text To Speech to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 2, 2026MW WP Form: Stored Cross-Site ScriptingCVE-2026-96567 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The MW WP Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post_id' parameter in all versions up to, and including, 5.1.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The CSRF gate protecting form submission (MW_WP_Form_Csrf) is bypassable by any unauthenticated visitor who first loads the public form page to obtain a valid double-submit cookie, leaving no effective barrier to storing malicious payloads.
Product
MW WP Form
Affected
up to 5.1.7
What to do
Affects up to 5.1.7. Update MW WP Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 2, 2026Newsletter – Send awesome emails from: Stored Cross-Site ScriptingCVE-2026-96566 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Newsletter – Send awesome emails from WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'np1' Custom Field Parameter in all versions up to, and including, 9.4.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The subscription endpoint (na=sa) requires no nonce, no capability check, and no CAPTCHA, and the payload can be smuggled past email-address validation by embedding the {profile_1} placeholder in the local part of the submitted address, since WordPress's is_email() permits curly braces there.
Product
Newsletter – Send awesome emails from
Affected
up to 9.4.0
What to do
Affects up to 9.4.0. Update Newsletter – Send awesome emails from to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 2, 2026DoFollow Case by Case: Stored Cross-Site ScriptingCVE-2026-95817 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The DoFollow Case by Case plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to, and including, 3.6.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Comment moderation delays but does not prevent exploitation — once an administrator approves the visually innocuous comment, the stored payload executes in the browser of every subsequent visitor to the affected post.
Product
DoFollow Case by Case
Affected
up to 3.6.0
What to do
Affects up to 3.6.0. Update DoFollow Case by Case to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 2, 2026No External Links: Stored Cross-Site ScriptingCVE-2026-95670 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The No External Links plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Log URL via /goto/{base64} Redirect in all versions up to, and including, 5.2.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is only exploitable when the administrator has enabled the 'Link Encoding: Base64' option in the plugin settings.
Product
No External Links
Affected
up to 5.2.0
What to do
Affects up to 5.2.0. Update No External Links to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 2, 2026Smash Balloon Social Post Feed – Simple Social Feeds for: Stored Cross-Site ScriptingCVE-2026-93756 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Smash Balloon Social Post Feed – Simple Social Feeds for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Facebook Comment Message via v-html in Admin Builder Preview in all versions up to, and including, 4.13.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that will execute whenever an administrator accesses the feed builder preview page. This attack requires only a Facebook account to post a comment on the connected Facebook Page, with no WordPress credentials needed; additionally, the use of v-show rather than v-if means injected HTML — including onerror handlers — is evaluated in the DOM even when the comment section is not visually displayed. When combined with the lack of URL validation in the cff_install_addon AJAX handler (admin/addon-functions.php), an injected script running in an administrator's session can trigger arbitrary plugin installation from an attacker-controlled URL, which may result in server-side code execution.
Product
Smash Balloon Social Post Feed – Simple Social Feeds for
Affected
up to 4.13.0
What to do
Affects up to 4.13.0. Update Smash Balloon Social Post Feed – Simple Social Feeds for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 2, 2026Relevanssi Premium: Stored Cross-Site ScriptingCVE-2026-103426 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Relevanssi Premium plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '_rt' parameter in all versions up to, and including, 2.31.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the click-tracking and logging feature to be activated in the plugin settings, and exploitation is trivially accessible to unauthenticated users because a valid _rt_nonce is publicly emitted on every search-results page.
Product
Relevanssi Premium
Affected
up to 2.31.4
What to do
Affects up to 2.31.4. Update Relevanssi Premium to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record relevanssi.com wordfence.com
Oct 2, 2026CMB2: Stored Cross-Site ScriptingCVE-2026-102772 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The CMB2 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '<textarea_code field id> (e.g. kl_code, kl_post_code)' parameter in all versions up to, and including, 2.13.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The front-end save path requires only a CMB2 box nonce, which is emitted to all visitors including unauthenticated guests via a simple GET request, making the attack trivially reachable without any credentials on sites that expose a public CMB2 form writing a textarea_code field.
Product
CMB2
Affected
up to 2.13.1
What to do
Affects up to 2.13.1. Update CMB2 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 2, 2026Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE: Sensitive Information ExposureCVE-2026-102002 · WordPress plugins & themes · reported by WordfenceLow 3.1
The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.2.6 via the 'otter_form_widget_filter' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract the email addresses of the five most recent form submitters, their submission dates, and the site's total form submission count. The widget is registered whenever the themeisle_blocks_form_emails option is non-empty — the normal state after any Form block has been saved — meaning the exposure is active on any standard site using the plugin's form feature.
Product
Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE
Affected
up to 3.2.6
What to do
Affects up to 3.2.6. Update Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 2, 2026Download Monitor: Stored Cross-Site ScriptingCVE-2026-100182 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Download Monitor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Cross-Origin postMessage to Admin Editor in all versions up to, and including, 5.2.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the attacker to trick an authenticated Administrator into visiting an attacker-controlled page that targets an open Download edit screen, after which the payload is persisted unfiltered via the Administrator's unfiltered_html capability and later emitted verbatim to the frontend by the [download_data] shortcode's unescaped post_content render path.
Product
Download Monitor
Affected
up to 5.2.10
What to do
Affects up to 5.2.10. Update Download Monitor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 2, 2026Kubio AI Page Builder: Stored Cross-Site ScriptingCVE-2026-100107 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Kubio AI Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 2.9.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Kubio AI Page Builder
Affected
up to 2.9.2
What to do
Affects up to 2.9.2. Update Kubio AI Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 2, 2026MStore API: Does not restrictCVE-2026-97219 · WordPress plugins & themes · reported by WPScanMedium 4.3
The MStore API WordPress plugin before 4.22.1 does not restrict which fields of an order a customer may update, allowing any authenticated user with a self-registerable account to change the status of their own unpaid order to a paid or fulfilled state and receive the goods without paying.
Product
MStore API
Fixed in
4.22.1
What to do
Update MStore API to 4.22.1 or newer.
Full record and what to do →NVD record wpscan.com
Oct 2, 2026Unlimited Elements for Elementor: Does not check that a request to render widget output comes from a user allowed to make itCVE-2026-92924 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not check that a request to render widget output comes from a user allowed to make it, allowing users with a role as low as subscriber to have arbitrary WordPress shortcodes executed on the site. Version 2.0.18 removed the subscriber-level access, so from 2.0.18 onward the issue requires a Contributor role or above.
Product
Unlimited Elements for Elementor
Fixed in
2.0.21
What to do
Update Unlimited Elements for Elementor to 2.0.21 or newer.
Full record and what to do →NVD record wpscan.com
Oct 2, 2026BA Book Everything: Stored Cross-Site ScriptingCVE-2026-102565 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The BA Book Everything plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'booking_service_qty' parameter in all versions up to, and including, 1.8.28 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires that an administrator or other privileged user opens the injected order record in the plugin's wp-admin order management area, which is the plugin's ordinary order-review workflow.
Product
BA Book Everything
Affected
up to 1.8.28
What to do
Affects up to 1.8.28. Update BA Book Everything to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 2, 2026Giveaways and Contests by RafflePress: Does not properly validate a giveaway's parent page URL before saving it and later redirecting visitors to itCVE-2026-97318 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Giveaways and Contests by RafflePress WordPress plugin before 1.12.27 does not properly validate a giveaway's parent page URL before saving it and later redirecting visitors to it, allowing unauthenticated attackers to make the site's own giveaway confirmation and referral links redirect visitors to an arbitrary external site.
Product
Giveaways and Contests by RafflePress
Fixed in
1.12.27
What to do
Update Giveaways and Contests by RafflePress to 1.12.27 or newer.
Full record and what to do →NVD record wpscan.com
Oct 2, 2026BuildKit: Does not properly sanitise and escape data submitted by contributor-level users before storing it and later using it in a SQL queryCVE-2026-94298 · WordPress plugins & themes · reported by WPScanMedium 6.2
The BuildKit WordPress plugin before 1.0.29 does not properly sanitise and escape data submitted by contributor-level users before storing it and later using it in a SQL query, allowing a Contributor to inject SQL that runs against the database once the resulting content is published and viewed by any unauthenticated visitor.
Product
BuildKit
Fixed in
1.0.29
What to do
Update BuildKit to 1.0.29 or newer.
Full record and what to do →NVD record wpscan.com
Oct 2, 2026Motors: Does not properly verify that a user is authorised to modify a listing before processing one of its listing management actionsCVE-2026-91023 · WordPress plugins & themes · reported by WPScanLow 3.1
The Motors WordPress plugin before 1.4.124 does not properly verify that a user is authorised to modify a listing before processing one of its listing management actions, allowing authenticated attackers with subscriber-level access and above to set metadata on posts they do not own, including overwriting product prices. Exploitation is possible only when WooCommerce is active and the Motors WordPress plugin before 1.4.124's paid featured-listing option is enabled, neither of which is a default configuration.
Product
Motors
Fixed in
1.4.124
What to do
Update Motors to 1.4.124 or newer.
Full record and what to do →NVD record wpscan.com
Oct 2, 2026Motors: Does not sanitise and escape a listing badge setting before outputting it inside an HTML attributeCVE-2026-91022 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Motors WordPress plugin before 1.4.124 does not sanitise and escape a listing badge setting before outputting it inside an HTML attribute, allowing users with a custom, administrator-assigned listing-management role to inject arbitrary web scripts that execute when a listing is viewed by any visitor, including an administrator.
Product
Motors
Fixed in
1.4.124
What to do
Update Motors to 1.4.124 or newer.
Full record and what to do →NVD record wpscan.com
Oct 2, 2026Ninja Forms – The Contact Form Builder That Grows With You: Stored Cross-Site ScriptingCVE-2026-90438 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Paragraph Text (RTE) Field Submission in all versions up to, and including, 3.15.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is only exploitable when the targeted Paragraph Text field has the Rich Text Editor (RTE) option enabled.
Product
Ninja Forms – The Contact Form Builder That Grows With You
Affected
up to 3.15.4
What to do
Affects up to 3.15.4. Update Ninja Forms – The Contact Form Builder That Grows With You to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 2, 2026Unlimited Elements for Elementor: Does not escape an icon value before concatenating it into an HTML attribute in its shared widget-parameter processorCVE-2026-85016 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not escape an icon value before concatenating it into an HTML attribute in its shared widget-parameter processor, allowing users with Contributor access (who do not hold unfiltered_html) to store a payload that executes when the page is rendered.
Product
Unlimited Elements for Elementor
Fixed in
2.0.21
What to do
Update Unlimited Elements for Elementor to 2.0.21 or newer.
Full record and what to do →NVD record wpscan.com
Oct 2, 2026Autoptimize: Stored Cross-Site ScriptingCVE-2026-78471 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Autoptimize plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Author Name in all versions up to, and including, 3.1.15.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires an administrator to have enabled Autoptimize's 'Lazy-load images?' option, the w3-total-cache/w3-total-cache.php file to be present on disk with the plugin disabled, a class named Minify_HTML to be loaded into scope by another plugin, and the malicious comment to be approved by a moderator before the payload renders.
Product
Autoptimize
Affected
up to 3.1.15.1
What to do
Affects up to 3.1.15.1. Update Autoptimize to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 2, 2026Super Forms – Drag & Drop Form Builder: Directory TraversalCVE-2026-15896 · WordPress plugins & themes · reported by WordfenceCritical 9.1
The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.3.316 via the parse_request function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. The optional 'file_upload_auth' setting defaults to empty, meaning no authentication is required in the default configuration; enabling this setting mitigates unauthenticated exploitation but does not remediate the path traversal itself. Exploitation on Linux requires a real 13-digit timestamp directory to exist, whereas on Windows the traversal works with any hardcoded 13-digit prefix. However, the plugin's file upload response returns the name of the created directory, which means the vulnerability is exploitable as long as file upload is enabled on the form.
Product
Super Forms – Drag & Drop Form Builder
Affected
up to 6.3.316
What to do
Affects up to 6.3.316. Update Super Forms – Drag & Drop Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wordfence.com
Oct 2, 2026Tabs Responsive: Does not sanitize the content of WooCommerce product tabs before storing and rendering itCVE-2026-13718 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Tabs Responsive WordPress plugin through 2.5 does not sanitize the content of WooCommerce product tabs before storing and rendering it, allowing a shop manager to store JavaScript that executes when any user, including an administrator, views the product page.
Product
Tabs Responsive
Affected
up to 2.5
What to do
Affects up to 2.5. Update Tabs Responsive to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Oct 2, 2026Visitors Traffic Real Time Statistics Pro: Unauthenticated stored Cross-Site ScriptingCVE-2026-93367 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Visitors Traffic Real Time Statistics Pro plugin for WordPress is vulnerable to unauthenticated stored Cross-Site Scripting in all versions up to, and including, 11.22 via the page_title parameter of the ahcpro_track_visitor AJAX action. The action is registered for logged-out callers (wp_ajax_nopriv_ahcpro_track_visitor) and stores $_POST['page_title'] with NO sanitization, keeping it raw in the ahc_title_traffic.til_page_title column. When an administrator opens the plugin's dashboard, the 'Traffic by Title' DataTable renders that stored value as innerHTML without output escaping, executing arbitrary JavaScript. This makes it possible for unauthenticated attackers to inject web scripts that run in an administrator's session.
Product
Visitors Traffic Real Time Statistics Pro
Affected
up to 11.22
What to do
Affects up to 11.22. Update Visitors Traffic Real Time Statistics Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordfence.com wp-buy.com
Oct 2, 2026DevKit Pro: Authentication Bypass Leading to Administrator Account TakeoverCVE-2026-14378 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The DevKit Pro plugin for WordPress is vulnerable to Authentication Bypass Leading to Administrator Account Takeover in all versions up to, and including, 2.3.0 This is due to the `revert_switch` handler trusting the attacker-controlled `original_user_id` cookie as the privileged identity: `verify_nonce_and_capability()` incorrectly checks the `manage_options` capability on the user identified by the cookie rather than on the actual requester via `current_user_can()`, while the switch-back form and a valid session-bound nonce are emitted publicly via `wp_footer` to any visitor — including unauthenticated users — whenever that cookie is present. This makes it possible for unauthenticated attackers to set the `original_user_id` cookie to any administrator's user ID, collect the rendered nonce, and POST it back to the `revert_switch` handler, causing `wp_set_auth_cookie()` to be called with the administrator's ID and granting the attacker a full administrator-level authenticated session and complete site takeover.
Product
DevKit Pro
Affected
up to 2.3.0
What to do
Affects up to 2.3.0. Update DevKit Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record docs.dplugins.com wordfence.com
Oct 1, 2026The Prime Mover: Stored cross-site scriptingCVE-2026-101890 · WordPress plugins & themes · reported by VulnCheckMedium 5.1
The Prime Mover plugin for WordPress before 2.2.1 contains a stored cross-site scripting vulnerability that allows attackers to execute arbitrary JavaScript by injecting an unescaped site_title value in a package's footprint.json file. Attackers can place a crafted package under the prime-mover-export-files directory so that the malicious value renders unescaped in the column_site_title() method of PrimeMoverBackupMenuListTable.php, triggering script execution in an administrator's browser when they view the Prime Mover Packages list table without needing to restore the package.
Product
The Prime Mover
Fixed in
2.2.1
What to do
Update The Prime Mover to 2.2.1 or newer.
Full record and what to do →NVD record wordpress.org vulncheck.com
Oct 1, 2026Contributor PHP Object Injection in Icegram <= 3.1.31 versions.CVE-2026-97284 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Contributor PHP Object Injection in Icegram <= 3.1.31 versions.
Affected
up to 3.1.31
What to do
Affects up to 3.1.31. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 1, 2026Editor PHP Object Injection in Hide Shipping Method For WooCommerce <= 1.5.4 versions.CVE-2026-94390 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Editor PHP Object Injection in Hide Shipping Method For WooCommerce <= 1.5.4 versions.
Affected
up to 1.5.4
What to do
Affects up to 1.5.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 1, 2026Subscriber Privilege Escalation in ByteCoreStack – MCP Connector for AI Tools <= 1.2.2 versions.CVE-2026-103068 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Subscriber Privilege Escalation in ByteCoreStack – MCP Connector for AI Tools <= 1.2.2 versions.
Affected
up to 1.2.2
What to do
Affects up to 1.2.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 1, 2026Unlimited Elements For Elementor (Free Widgets, Addons, Templates): Missing AuthorizationCVE-2026-103341 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 2.0.20.
Product
Unlimited Elements For Elementor (Free Widgets, Addons, Templates)
Affected
up to 2.0.20
What to do
Affects up to 2.0.20. Update Unlimited Elements For Elementor (Free Widgets, Addons, Templates) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.