Updated 44 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

35added in the last 30 days

575new WordPress flaws this week

391,358entries in the database

5,932 results · page 13 of 119

Sep 2, 2026Easy Waveform Player: Stored Cross-Site ScriptingCVE-2025-7963 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Easy Waveform Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the shortcode_easywaveformplayer() function in all versions up to, and including, 1.2.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Easy Waveform Player
Affected
up to 1.2.2
What to do
Affects up to 1.2.2. Update Easy Waveform Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 2, 2026OAuth Single Sign On: Does not verify the identity assertion returned by its Steam single sign-on flowCVE-2026-82183 · WordPress plugins & themes · reported by WPScanHigh 8.1
The OAuth Single Sign On WordPress plugin before 7.0.1 does not verify the identity assertion returned by its Steam single sign-on flow, allowing unauthenticated attackers to log in as an arbitrary non-administrator user, and to create new accounts.
Product
OAuth Single Sign On
Fixed in
7.0.1
What to do
Update OAuth Single Sign On to 7.0.1 or newer.
Full record and what to do →NVD record wpscan.com
Sep 2, 2026MasterStudy LMS: Does not perform an authorization check before returning a student's learning statisticsCVE-2026-81199 · WordPress plugins & themes · reported by WPScanMedium 5.3
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not perform an authorization check before returning a student's learning statistics, allowing unauthenticated attackers to disclose the course counts, points, certificates, quiz and assignment totals of any registered user.
Product
MasterStudy LMS
Fixed in
3.7.46
What to do
Update MasterStudy LMS to 3.7.46 or newer.
Full record and what to do →NVD record wpscan.com
Sep 2, 2026MasterStudy LMS: Does not properly verify ownership of a curriculum object before acting on itCVE-2026-81198 · WordPress plugins & themes · reported by WPScanLow 3.8
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not properly verify ownership of a curriculum object before acting on it, allowing authenticated users with the instructor role to delete or modify curriculum sections and materials belonging to courses owned by other instructors.
Product
MasterStudy LMS
Fixed in
3.7.46
What to do
Update MasterStudy LMS to 3.7.46 or newer.
Full record and what to do →NVD record wpscan.com
Sep 2, 2026MasterStudy LMS: Does not restrict access to a REST route that lists an author's coursesCVE-2026-81197 · WordPress plugins & themes · reported by WPScanMedium 5.3
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not restrict access to a REST route that lists an author's courses, nor does it filter that listing by publication status, allowing unauthenticated users to read the titles and IDs of unpublished (draft, pending and private) courses.
Product
MasterStudy LMS
Fixed in
3.7.46
What to do
Update MasterStudy LMS to 3.7.46 or newer.
Full record and what to do →NVD record wpscan.com
Sep 2, 2026MasterStudy LMS: Does not properly verify ownership of quiz question identifiersCVE-2026-81196 · WordPress plugins & themes · reported by WPScanLow 2.7
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not properly verify ownership of quiz question identifiers, allowing users with instructor access to read other instructors' quiz questions, including the correct answers and explanations.
Product
MasterStudy LMS
Fixed in
3.7.46
What to do
Update MasterStudy LMS to 3.7.46 or newer.
Full record and what to do →NVD record wpscan.com
Sep 2, 2026MasterStudy LMS: Does not perform an authorization check before returning per-student course enrollment and progress dataCVE-2026-81195 · WordPress plugins & themes · reported by WPScanMedium 5.3
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not perform an authorization check before returning per-student course enrollment and progress data, allowing unauthenticated attackers to disclose the enrolled courses and learning progress of any registered user.
Product
MasterStudy LMS
Fixed in
3.7.46
What to do
Update MasterStudy LMS to 3.7.46 or newer.
Full record and what to do →NVD record wpscan.com
Sep 2, 2026MasterStudy LMS: Does not properly verify authorizationCVE-2026-81194 · WordPress plugins & themes · reported by WPScanMedium 4.3
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not properly verify authorization when retrieving order line-item data, allowing any authenticated user including Subscribers to read other instructors' course sales records by supplying another user's identifier.
Product
MasterStudy LMS
Fixed in
3.7.46
What to do
Update MasterStudy LMS to 3.7.46 or newer.
Full record and what to do →NVD record wpscan.com
Sep 2, 2026Rank Math SEO: Does not verify that the metadata row being updated belongs to the object the user was authorised againstCVE-2026-77788 · WordPress plugins & themes · reported by WPScanMedium 4.9
The Rank Math SEO WordPress plugin before 1.0.277 does not verify that the metadata row being updated belongs to the object the user was authorised against, allowing users with the Author role and above to overwrite arbitrary post and user metadata, including that belonging to higher-privileged users.
Product
Rank Math SEO
Fixed in
1.0.277
What to do
Update Rank Math SEO to 1.0.277 or newer.
Full record and what to do →NVD record wpscan.com
Sep 2, 2026Rank Math SEO: Does not check whether a post is password protected before using its content to build publicly generated SEO metadataCVE-2026-77782 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Rank Math SEO WordPress plugin before 1.0.277.1 does not check whether a post is password protected before using its content to build publicly generated SEO metadata, allowing unauthenticated users to read the content of password-protected posts.
Product
Rank Math SEO
Fixed in
1.0.277.1
What to do
Update Rank Math SEO to 1.0.277.1 or newer.
Full record and what to do →NVD record wpscan.com
Sep 2, 2026Social Media Share Buttons & Social Sharing Icons: Does not properly escape a value taken from the incoming request before outputting it in an inline JavaScript event handlerCVE-2026-19723 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Social Media Share Buttons & Social Sharing Icons WordPress plugin before 3.0.1 does not properly escape a value taken from the incoming request before outputting it in an inline JavaScript event handler, leading to Reflected Cross-Site Scripting which is triggered when a user interacts with the affected button. Exploitation requires the Social Media Share Buttons & Social Sharing Icons WordPress plugin before 3.0.1 to be running a non-default icon display configuration.
Product
Social Media Share Buttons & Social Sharing Icons
Fixed in
3.0.1
What to do
Update Social Media Share Buttons & Social Sharing Icons to 3.0.1 or newer.
Full record and what to do →NVD record wpscan.com
Sep 2, 2026Social Media Share Buttons & Social Sharing Icons: Does not escape the post title before outputting it in an inline JavaScript event handlerCVE-2026-19719 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Social Media Share Buttons & Social Sharing Icons WordPress plugin before 3.0.1 does not escape the post title before outputting it in an inline JavaScript event handler, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks which are triggered when a visitor interacts with the affected button. Exploitation requires the Social Media Share Buttons & Social Sharing Icons WordPress plugin before 3.0.1 to be running a non-default icon display configuration.
Product
Social Media Share Buttons & Social Sharing Icons
Fixed in
3.0.1
What to do
Update Social Media Share Buttons & Social Sharing Icons to 3.0.1 or newer.
Full record and what to do →NVD record wpscan.com
Sep 2, 2026Comments: Does not validate a value used to build a database queryCVE-2026-19704 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Comments WordPress plugin before 7.6.66 does not validate a value used to build a database query, allowing unauthenticated users to inject SQL and read comments they are not entitled to see, including comments awaiting moderation, comments marked as spam or trashed, and comments on private and draft posts. The injected text reaches the query as grammar rather than as data and does not yield extraction of arbitrary data, so the confidentiality impact is the disclosed comment content rather than the database at large.
Product
Comments
Fixed in
7.6.66
What to do
Update Comments to 7.6.66 or newer.
Full record and what to do →NVD record wpscan.com
Sep 2, 2026Ultimate Member: Does not check whether a comment has been approvedCVE-2026-19251 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Ultimate Member WordPress plugin before 2.13.0 does not check whether a comment has been approved, or whether the profile it belongs to is private, before returning profile activity to unauthenticated visitors, allowing them to read the content of comments still awaiting moderation.
Product
Ultimate Member
Fixed in
2.13.0
What to do
Update Ultimate Member to 2.13.0 or newer.
Full record and what to do →NVD record wpscan.com
Sep 1, 2026Simple Membership: Authentication Bypass leading to Administrator Account TakeoverCVE-2026-77194 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Simple Membership plugin for WordPress is vulnerable to Authentication Bypass leading to Administrator Account Takeover in versions up to, and including, 4.8.0. This is due to improper identity verification during the public registration flow in WordPress Multisite environments, where the plugin binds new Simple Membership records to existing global WordPress users based solely on matching username and email, without requiring password verification or ownership proof, and fails to properly detect Administrator roles on child sites. This makes it possible for unauthenticated attackers to take over Administrator accounts on child sites in a Multisite network by registering a Simple Membership account with a victim's credentials on a site where public registration is enabled, then updating the victim's global WordPress password through the profile edit functionality. The vulnerability was partially patched in version 4.8.1.
Product
Simple Membership
Affected
up to 4.8.0
What to do
Affects up to 4.8.0. Update Simple Membership to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 1, 2026WP Fastest Cache: Does not include a set of tracking-related query parameters in its page-cache key while still caching pages requested with themCVE-2026-74916 · WordPress plugins & themes · reported by WPScanMedium 6.5
The WP Fastest Cache WordPress plugin before 1.5.1 does not include a set of tracking-related query parameters in its page-cache key while still caching pages requested with them, allowing unauthenticated attackers to have a page rendered under their own request context stored under, and served from, the clean URL's cache entry to every subsequent visitor.
Product
WP Fastest Cache
Fixed in
1.5.1
What to do
Update WP Fastest Cache to 1.5.1 or newer.
Full record and what to do →NVD record wpscan.com
Sep 1, 2026BetterDocs – AI Documentation, Knowledge Base, Docs, Wikis, FAQ with Chatbot: Stored Cross-Site ScriptingCVE-2026-75980 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The BetterDocs – AI Documentation, Knowledge Base, Docs, Wikis, FAQ with Chatbot plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Heading 'id' Attribute in Post Content in all versions up to, and including, 4.8.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit survives wp_kses_post because entity-encoded quotes in a heading id attribute are treated as a single legitimate attribute value at save time; the dangerous payload only materialises after process_content_for_toc() calls html_entity_decode() on the stored content and the broken id is extracted by a lazy regex before being echoed unescaped into the Table of Contents output.
Product
BetterDocs – AI Documentation, Knowledge Base, Docs, Wikis, FAQ with Chatbot
Affected
up to 4.8.1
What to do
Affects up to 4.8.1. Update BetterDocs – AI Documentation, Knowledge Base, Docs, Wikis, FAQ with Chatbot to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 1, 2026The Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits plugin for WordPress is vulnerableCVE-2026-75921 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.1.9 via the upload_template_kit function. This is due to incorrect authorization on the upload_template_kit() AJAX handler, which requires only upload_files capability instead of the manage_options required by all sibling handlers, combined with missing per-entry file type filtering after ZIP extraction. This makes it possible for authenticated attackers, with editor-level access and above, to upload files that may be executable, which makes remote code execution possible. Editors can satisfy the nonce requirement because the required nonces are localized on the standard Pages list screen, which is accessible to any user with the edit_pages capability.
Affected
up to 3.1.9
What to do
Affects up to 3.1.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 1, 2026Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 700+ Patterns, 58 Blocks & Templates: Authorization bypassCVE-2026-19948 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 700+ Patterns, 58 Blocks & Templates plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.2.17. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to retrieve the name, price, short description, image URL, permalink, stock status, and product type of draft, pending, private, and catalog-hidden WooCommerce products not intended to be publicly visible. The sidebarNonce value is emitted unconditionally into public page HTML by multiple block renderers with no login gate, allowing unauthenticated visitors to harvest a valid nonce and pass the only authentication check in the handler.
Product
Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 700+ Patterns, 58 Blocks & Templates
Affected
up to 2.2.17
What to do
Affects up to 2.2.17. Update Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 700+ Patterns, 58 Blocks & Templates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 1, 2026Support Genix – Helpdesk, AI Chatbot, Knowledge Base & Customer Support Ticketing System: Authentication Bypass leading to Administrator Account TakeoverCVE-2026-19806 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Support Genix – Helpdesk, AI Chatbot, Knowledge Base & Customer Support Ticketing System plugin for WordPress is vulnerable to Authentication Bypass leading to Administrator Account Takeover in all versions up to, and including, 1.4.52 via the `guest_ticket_login()` function and its `p` parameter. This is due to the site-wide AES-256-CBC encryption key being derived from only three two-digit `wp_rand(10, 99)` values and a Unix timestamp via `md5()` — yielding approximately 19.5 bits of entropy — combined with a deterministic IV derived from the password, no authentication tag on the ciphertext, and no capability check, nonce, or session validation on the publicly reachable `/sgnix/?p=<token>` endpoint. This makes it possible for authenticated attackers, with subscriber-level access and above, who can obtain a single legitimate guest ticket token as a known-plaintext oracle and bound the plugin activation timestamp, to exhaust the ~729,000-candidate keyspace entirely offline, recover the site-wide encryption key, and forge a self-consistent `{ticket_id, ticket_user}` token targeting any administrator-owned ticket. Submitting the forged token to the unprotected endpoint causes `w
Product
Support Genix – Helpdesk, AI Chatbot, Knowledge Base & Customer Support Ticketing System
Affected
up to 1.4.52
What to do
Affects up to 1.4.52. Update Support Genix – Helpdesk, AI Chatbot, Knowledge Base & Customer Support Ticketing System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 1, 2026Listdom: AI-powered Business Directory with Classifieds Ads Listings: Stored Cross-Site ScriptingCVE-2026-19796 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Listdom: AI-powered Business Directory with Classifieds Ads Listings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'lsd[displ][style]' Parameter in all versions up to, and including, 5.8.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the Listdom Pro add-on to be active and the 'Display Options Per Listing' displ setting to be enabled, both of which are non-default configurations.
Product
Listdom: AI-powered Business Directory with Classifieds Ads Listings
Affected
up to 5.8.1
What to do
Affects up to 5.8.1. Update Listdom: AI-powered Business Directory with Classifieds Ads Listings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 1, 2026Affiliate Super Assistent: Stored Cross-Site ScriptingCVE-2026-19573 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Affiliate Super Assistent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘doCommentShortcode’ function in all versions up to, and including, 1.10.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Affiliate Super Assistent
Affected
up to 1.10.2
What to do
Affects up to 1.10.2. Update Affiliate Super Assistent to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 31, 2026Unauthenticated Bypass Vulnerability in SiteGround Security <= 1.6.6 versions.CVE-2026-82228 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Bypass Vulnerability in SiteGround Security <= 1.6.6 versions.
Affected
up to 1.6.6
What to do
Affects up to 1.6.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 31, 2026Unauthenticated Arbitrary File Upload in Hash Form <= 1.4.2 versions.CVE-2026-81780 · WordPress plugins & themes · reported by PatchstackCritical 10
Unauthenticated Arbitrary File Upload in Hash Form <= 1.4.2 versions.
Affected
up to 1.4.2
What to do
Affects up to 1.4.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 30, 2026A vulnerability was found in Cozmoslabs Profile Builder Plugin up to 3.16.1 on WordPress.CVE-2026-82607 · WordPress plugins & themes · reported by VulDBMedium 5.5
A vulnerability was found in Cozmoslabs Profile Builder Plugin up to 3.16.1 on WordPress. The impacted element is the function wppb_ajax_simple_avatar of the file /wp-admin/admin-ajax.php of the component Avatar Simple Upload AJAX Handler. Performing a manipulation results in unrestricted upload. The attack is possible to be carried out remotely. The exploit has been made public and could be used. Upgrading to version 3.16.2 is sufficient to resolve this issue. It is suggested to upgrade the affected component.
Product
Cozmoslabs Profile Builder
Affected
up to 3.16.1
What to do
Affects up to 3.16.1. Update Cozmoslabs Profile Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record ciphersecuritylabs.com vuldb.com
Aug 30, 2026MW WP Form: Does not sanitise and escape some of its form settings before outputting them back in an admin dashboard pageCVE-2026-78364 · WordPress plugins & themes · reported by WPScanLow 3.5
The MW WP Form WordPress plugin before 5.1.6 does not sanitise and escape some of its form settings before outputting them back in an admin dashboard page, which could allow users with a role as low as Editor to perform Stored Cross-Site Scripting attacks against high privilege users such as admin.
Product
MW WP Form
Fixed in
5.1.6
What to do
Update MW WP Form to 5.1.6 or newer.
Full record and what to do →NVD record wpscan.com
Aug 30, 2026MyHome Core: Authentication BypassCVE-2026-15980 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The MyHome Core plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 4.4.5. This is due to missing authorization in the send_link() AJAX handler and improper token validation in the activate() function. This makes it possible for unauthenticated attackers to generate an activation token for an unconfirmed user account and obtain a valid authentication cookie for that account, including administrators. Successful exploitation requires the MyHome theme to be configured in legacy/WPBakery mode with frontend registration and confirmation email enabled, and the target account must not already have the myhome_agent_confirmed user meta set.
Product
MyHome Core
Affected
up to 4.4.5
What to do
Affects up to 4.4.5. Update MyHome Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Aug 29, 2026SAML Single Sign On – SSO Login: Authentication BypassCVE-2026-75807 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The SAML Single Sign On – SSO Login plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 5.4.6. This is due to the mo_saml_login_validate() ACS handler persisting the X.509 certificate extracted from an incoming SAMLResponse into the mo_saml_required_certificate option before the signature-validation verdict is enforced, because mo_saml_find_certificate() returns false on a fingerprint mismatch rather than halting execution. This makes it possible for unauthenticated attackers to overwrite the plugin's stored IdP signing certificate with an attacker-controlled value, and subsequently forge SAML assertions for any WordPress account — including administrators — to obtain a fully privileged session. Note: The exploit requires the administrator to perform a repair after receiving the test_config_error_wpsamlerr004 error message during the test configuration.
Product
SAML Single Sign On – SSO Login
Affected
up to 5.4.6
What to do
Affects up to 5.4.6. Update SAML Single Sign On – SSO Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 29, 2026MasterStudy LMS: Does not validate a redirect parameter supplied during user registration before using itCVE-2026-81342 · WordPress plugins & themes · reported by WPScanMedium 4.7
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.43 does not validate a redirect parameter supplied during user registration before using it, allowing unauthenticated attackers to redirect users to arbitrary external URLs.
Product
MasterStudy LMS
Fixed in
3.7.43
What to do
Update MasterStudy LMS to 3.7.43 or newer.
Full record and what to do →NVD record wpscan.com
Aug 29, 2026MasterStudy LMS: Does not correctly restrict access to order informationCVE-2026-81200 · WordPress plugins & themes · reported by WPScanLow 2.7
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.42 does not correctly restrict access to order information, allowing any user with the instructor role to read other users' order billing details, including name, email address, phone number and postal address, by enumerating order IDs.
Product
MasterStudy LMS
Fixed in
3.7.42
What to do
Update MasterStudy LMS to 3.7.42 or newer.
Full record and what to do →NVD record wpscan.com
Aug 29, 2026MasterStudy LMS: Does not verify the amountCVE-2026-81026 · WordPress plugins & themes · reported by WPScanMedium 4.8
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.40 does not verify the amount, receiver, currency or status of a payment notification before marking the corresponding order completed, allowing unauthenticated users to complete full-price orders and gain access to paid content by paying only a token amount.
Product
MasterStudy LMS
Fixed in
3.7.40
What to do
Update MasterStudy LMS to 3.7.40 or newer.
Full record and what to do →NVD record wpscan.com
Aug 29, 2026HEL Online Classroom: AI-powered Online Classrooms: Does not perform authorisation checks on its REST API routes and does not consistently enforce the per-class access codeCVE-2026-77010 · WordPress plugins & themes · reported by WPScanMedium 6.5
The HEL Online Classroom: AI-powered Online Classrooms WordPress plugin through 1.0.3 does not perform authorisation checks on its REST API routes and does not consistently enforce the per-class access code, allowing unauthenticated users to obtain a signed meeting join link for any classroom, including one protected by an access code, and to join it with moderator privileges.
Product
HEL Online Classroom: AI-powered Online Classrooms
Affected
up to 1.0.3
What to do
Affects up to 1.0.3. Update HEL Online Classroom: AI-powered Online Classrooms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Aug 29, 2026HEL Online Classroom: AI-powered Online Classrooms: Does not have any authorisation or authentication checkCVE-2026-77008 · WordPress plugins & themes · reported by WPScanMedium 6.5
The HEL Online Classroom: AI-powered Online Classrooms WordPress plugin through 1.0.3 does not have any authorisation or authentication check when saving its settings, allowing unauthenticated users to overwrite them and repoint every online classroom, along with the shared secret those sessions are signed with, at infrastructure of their choosing.
Product
HEL Online Classroom: AI-powered Online Classrooms
Affected
up to 1.0.3
What to do
Affects up to 1.0.3. Update HEL Online Classroom: AI-powered Online Classrooms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Aug 29, 2026HEL Online Classroom: AI-powered Online Classrooms: Does not perform any authorisation check on one of its REST API routesCVE-2026-77007 · WordPress plugins & themes · reported by WPScanHigh 7.5
The HEL Online Classroom: AI-powered Online Classrooms WordPress plugin through 1.0.3 does not perform any authorisation check on one of its REST API routes, allowing unauthenticated users to retrieve its stored settings, including the shared secret used to sign API requests to the connected BigBlueButton server.
Product
HEL Online Classroom: AI-powered Online Classrooms
Affected
up to 1.0.3
What to do
Affects up to 1.0.3. Update HEL Online Classroom: AI-powered Online Classrooms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Aug 28, 2026WordPress plugin (Bit Assist) before 1.7.2 is affected by Stored Cross-Site Scripting in Call-To-Action feature.CVE-2026-39070 · WordPress plugins & themes · reported by MITREMedium 4.8
WordPress plugin (Bit Assist) before 1.7.2 is affected by Stored Cross-Site Scripting in Call-To-Action feature. An authenticated attacker with the privileged role (admin) can exploit this to redirect user to malicious site or control the account.
Fixed in
1.7.2
What to do
Update the plugin to 1.7.2 or newer.
Full record and what to do →NVD record github.com github.com
Aug 28, 2026Essential Addons for Elementor: Authentication Bypass by SpoofingCVE-2026-81777 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Authentication Bypass by Spoofing vulnerability in WPDeveloper Essential Addons for Elementor allows Identity Spoofing. This issue affects Essential Addons for Elementor: from n/a through 6.8.0.
Product
Essential Addons for Elementor
Affected
up to 6.8.0
What to do
Affects up to 6.8.0. Update Essential Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 28, 2026Quiz and Survey Master (QSM): Does not check authorisationCVE-2026-79615 · WordPress plugins & themes · reported by WPScanLow 2.7
The Quiz and Survey Master (QSM) WordPress plugin before 11.2.4 does not check authorisation when returning question bank entries through one of its REST API routes, allowing users with a role as low as Contributor to read the questions, hints and correct answer keys of quizzes belonging to other users.
Product
Quiz and Survey Master (QSM)
Fixed in
11.2.4
What to do
Update Quiz and Survey Master (QSM) to 11.2.4 or newer.
Full record and what to do →NVD record wpscan.com
Aug 28, 2026WPMU DEV Dashboard: Authentication BypassCVE-2026-76581 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The WPMU DEV Dashboard plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.0.1. This is due to inconsistent and ambiguous HMAC message construction between the unauthenticated `wdpsso_step1` and `wdpsso_step2` AJAX actions, where step 1 signs and discloses an unseparated concatenation of the token, state, redirect, and domain values, while step 2 verifies an unseparated concatenation that omits the domain field. This makes it possible for unauthenticated attackers, on sites connected to WPMU DEV with Hub SSO enabled and mapped to an administrator, to obtain a valid HMAC from step 1 and replay it to step 2 by moving the domain value into the redirect field, resulting in an authenticated administrator session.
Product
WPMU DEV Dashboard
Affected
up to 5.0.1
What to do
Affects up to 5.0.1. Update WPMU DEV Dashboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpmudev.com wordfence.com
Aug 28, 2026Shared Files WordPress plugin before 1.7.67, shared-files-pro: Do not properly sanitize a file path taken from a frontend file submission and their single-pass traversal filter is bypassableCVE-2026-12513 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Shared Files WordPress plugin before 1.7.67, shared-files-pro WordPress plugin before 1.7.68 do not properly sanitize a file path taken from a frontend file submission and their single-pass traversal filter is bypassable, allowing unauthenticated users to store a path that points outside the uploads directory. When the corresponding file entry is later permanently deleted, an arbitrary file on the server (such as wp-config.php) is deleted, leading to denial of service and potential site takeover.
Product
Shared Files WordPress plugin before 1.7.67, shared-files-pro
Fixed in
1.7.67
What to do
Update Shared Files WordPress plugin before 1.7.67, shared-files-pro to 1.7.67 or newer.
Full record and what to do →NVD record wpscan.com
Aug 27, 2026Unauthenticated PHP Object Injection in Hash Form <= 1.4.1 versions.CVE-2026-78292 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in Hash Form <= 1.4.1 versions.
Affected
up to 1.4.1
What to do
Affects up to 1.4.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 26, 2026Classified Listing - Mobile Number Verification: Authentication BypassCVE-2026-15985 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Classified Listing - Mobile Number Verification plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.6.0. This is due to missing server-side Firebase OTP validation in the process_otp_login() function. This makes it possible for unauthenticated attackers to authenticate as any user with a phone number registered in the plugin's phone table by submitting an arbitrary OTP code and UID through the Firebase OTP login flow. Successful exploitation requires OTP login to be enabled with Firebase selected as the verification gateway, and requires the attacker to know or guess the target account's registered phone number. Administrator account takeover is possible if an administrator account has a phone number registered in the plugin.
Product
Classified Listing - Mobile Number Verification
Affected
up to 1.6.0
What to do
Affects up to 1.6.0. Update Classified Listing - Mobile Number Verification to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record radiustheme.com wordfence.com
Aug 26, 2026WooCommerce Lottery: Time-Based SQL InjectionCVE-2026-18884 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The WooCommerce Lottery plugin for WordPress is vulnerable to Time-Based SQL Injection via 'orderby' and 'order' GET Parameters in all versions up to, and including, 2.2.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
WooCommerce Lottery
Affected
up to 2.2.9
What to do
Affects up to 2.2.9. Update WooCommerce Lottery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codecanyon.net plugins.trac.wordpress.org
Aug 26, 2026Stripe Payment Forms by WP Full Pay: Does not properly verify that a customer portal session has completed its confirmation step before returning dataCVE-2026-77758 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.1 does not properly verify that a customer portal session has completed its confirmation step before returning data, allowing unauthenticated users to read another customer's subscription and billing information.
Product
Stripe Payment Forms by WP Full Pay
Fixed in
8.5.1
What to do
Update Stripe Payment Forms by WP Full Pay to 8.5.1 or newer.
Full record and what to do →NVD record wpscan.com
Aug 26, 2026Directorist: AI-Powered Business Directory, Listings & Classified Ads: Does not sanitize a user-supplied image reference before using itCVE-2026-77757 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.3 does not sanitize a user-supplied image reference before using it as the source of a file move, allowing users with a subscriber-level account to relocate arbitrary server-readable image files into a publicly accessible directory, and to delete them from their original location.
Product
Directorist: AI-Powered Business Directory, Listings & Classified Ads
Fixed in
8.9.3
What to do
Update Directorist: AI-Powered Business Directory, Listings & Classified Ads to 8.9.3 or newer.
Full record and what to do →NVD record wpscan.com
Aug 26, 2026WP Fastest Cache – WordPress Cache: Stored Cross-Site ScriptingCVE-2026-19760 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The WP Fastest Cache – WordPress Cache Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via HTTP Host Header in all versions up to, and including, 1.5.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the Polylang or Polylang Pro plugin to be active and the Combine JS option to be enabled, as these conditions trigger the vulnerable Host-header-to-URL code path that writes attacker-controlled script src values into the shared page-cache file served to all subsequent visitors.
Product
WP Fastest Cache – WordPress Cache
Affected
up to 1.5.0
What to do
Affects up to 1.5.0. Update WP Fastest Cache – WordPress Cache to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 26, 2026Tutor LMS: Does not validate values used to build a database queryCVE-2026-19094 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Tutor LMS WordPress plugin before 4.0.6 does not validate values used to build a database query, and does not restrict which template file a request may load, allowing unauthenticated users to inject SQL and to read question and answer content belonging to courses that are not publicly available. The injected text reaches the query as grammar rather than as data, and on the database engines tested it does not yield extraction of arbitrary data, so the confidentiality impact is the disclosed course content rather than the database at large.
Product
Tutor LMS
Fixed in
4.0.6
What to do
Update Tutor LMS to 4.0.6 or newer.
Full record and what to do →NVD record wpscan.com
Aug 25, 2026WP Fastest Cache: Does not validate the Host header before using it to build the URLs of the asset files it embeds in the pages it cachesCVE-2026-74932 · WordPress plugins & themes · reported by WPScanHigh 7.5
The WP Fastest Cache WordPress plugin before 1.5.1 does not validate the Host header before using it to build the URLs of the asset files it embeds in the pages it caches, and does not include that header in the cache key, allowing unauthenticated attackers to poison cached pages with references to a server they control and have arbitrary JavaScript run for every subsequent visitor.
Product
WP Fastest Cache
Fixed in
1.5.1
What to do
Update WP Fastest Cache to 1.5.1 or newer.
Full record and what to do →NVD record wpscan.com
Aug 25, 2026Newsletters: Authorization bypassCVE-2026-75908 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Newsletters plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.17. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with author-level access and above, to send arbitrary newsletter emails to users of any WordPress role, including administrators, by forging POST fields during a normal post submission. This allows an attacker-supplied role slug via the newsletters_mailinglistsroles POST field to be passed directly to get_users(), enabling unauthorized mass-mailing and potential phishing against privileged site users through the site's own outbound email channel.
Product
Newsletters
Affected
up to 4.17
What to do
Affects up to 4.17. Update Newsletters to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 25, 2026My Agile Privacy® – CMP, Cookie Consent & Privacy Tools: Authorization bypassCVE-2026-17587 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The My Agile Privacy® – CMP, Cookie Consent & Privacy Tools plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.3.6. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to modify plugin settings including missing_cookie_shield, cookie_shield_running, cmode_v2_js_on_error, cmode_v2_js_error_code, and cmode_v2_js_error_motivation stored in the plugin's settings key.
Product
My Agile Privacy® – CMP, Cookie Consent & Privacy Tools
Affected
up to 3.3.6
What to do
Affects up to 3.3.6. Update My Agile Privacy® – CMP, Cookie Consent & Privacy Tools to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 25, 2026Forminator Forms – Contact Form, Payment Form & Custom Form Builder: DOM-Based Reflected Cross-Site ScriptingCVE-2026-18328 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to DOM-Based Reflected Cross-Site Scripting via the 'error_description' parameter in all versions up to, and including, 1.57.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerability is only triggerable on pages hosting a Forminator form configured to use the Stripe Checkout Sessions payment API, which became the default in 1.56.0.
Product
Forminator Forms – Contact Form, Payment Form & Custom Form Builder
Affected
up to 1.57.0
What to do
Affects up to 1.57.0. Update Forminator Forms – Contact Form, Payment Form & Custom Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.