Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
7,439 results · page 14 of 149
Sep 17, 2026vm2 before 3.11.8 contains an incomplete fix for Error.cause sanitization that allows sandbox escape when revisited host-wrapped AggregateError objects are caugCVE-2026-92934 · Other software · patriksimek · reported by VulnCheckCritical 9.5
vm2 before 3.11.8 contains an incomplete fix for Error.cause sanitization that allows sandbox escape when revisited host-wrapped AggregateError objects are caught within a single exception handler traversal. Attackers can exploit cycle detection bypass in handleException to access unsanitized host proxies embedded in the errors array, enabling full remote code execution and process information disclosure from the sandbox.
- Product
- vm2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Sep 17, 2026Realtyna Organic IDX plugin + WPL Real Estate: Does not sanitise and escape some of its parameters before reflecting them back in the pageCVE-2026-91014 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Realtyna Organic IDX plugin + WPL Real Estate WordPress plugin before 5.4.2 does not sanitise and escape some of its parameters before reflecting them back in the page, allowing unauthenticated attackers to run arbitrary web scripts in a visitor's browser if they can trick the visitor into following a crafted link (reflected XSS).
- Product
- Realtyna Organic IDX plugin + WPL Real Estate
- Fixed in
- 5.4.2
- What to do
- Update Realtyna Organic IDX plugin + WPL Real Estate to 5.4.2 or newer.
Sep 17, 2026EWWW Image Optimizer: Does not properly escape image attribute valuesCVE-2026-91011 · WordPress plugins & themes · reported by WPScanMedium 6.8
The EWWW Image Optimizer WordPress plugin before 8.7.7 does not properly escape image attribute values when it rewrites page output, allowing authenticated users with author-level access and above to inject arbitrary JavaScript that is stored in published content and executes in the browser of any user who later views the affected page.
- Product
- EWWW Image Optimizer
- Fixed in
- 8.7.7
- What to do
- Update EWWW Image Optimizer to 8.7.7 or newer.
Sep 17, 2026Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms: Does not check the user's capabilities in its message deletion AJAX actionCVE-2026-91010 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms WordPress plugin before 5.1.1 does not check the user's capabilities in its message deletion AJAX action, and only tests that a nonce parameter is present rather than validating it, allowing any authenticated user, such as a subscriber, to permanently delete every form submission the Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms WordPress plugin before 5.1.1 has stored.
- Product
- Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms
- Fixed in
- 5.1.1
- What to do
- Update Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms to 5.1.1 or newer.
Sep 17, 2026Dewa Kirim: Does not escape delivery coordinates submitted at checkout before outputting them inside an inline scriptCVE-2026-87786 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Dewa Kirim WordPress plugin through 1.0.0 does not escape delivery coordinates submitted at checkout before outputting them inside an inline script, allowing unauthenticated users to store JavaScript that runs in the session of an administrator who later opens the order.
- Product
- Dewa Kirim
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Dewa Kirim to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 17, 2026WPLP Cookie Consent: Does not escape a value submitted through a public endpoint for the JavaScript context it is later output in on an administrative screenCVE-2026-85130 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WPLP Cookie Consent WordPress plugin before 4.4.4 does not escape a value submitted through a public endpoint for the JavaScript context it is later output in on an administrative screen, allowing unauthenticated users to run arbitrary JavaScript in the session of an administrator who interacts with the logged entry. Only multisite installations are affected.
- Product
- WPLP Cookie Consent
- Fixed in
- 4.4.4
- What to do
- Update WPLP Cookie Consent to 4.4.4 or newer.
Sep 17, 2026Dictionary: Does not escape user input before reflecting it back in the responses of several directly accessible scriptsCVE-2025-15697 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Dictionary WordPress plugin through 1.0 does not escape user input before reflecting it back in the responses of several directly accessible scripts, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting attacks against anyone they can induce to submit a crafted request.
- Product
- Dictionary
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Dictionary to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 17, 2026Memory corruption when processing escape handling flow with insufficient user buffer sizes.CVE-2026-25280 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7.8
Memory corruption when processing escape handling flow with insufficient user buffer sizes.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 16, 2026Craft CMS versions from 5.7.0 before 5.10.13 contain a stored cross-site scripting vulnerability in the Generated Fields feature that disables Twig autoescapingCVE-2026-92590 · Other software · craftcms · reported by VulnCheckMedium 5.1
Craft CMS versions from 5.7.0 before 5.10.13 contain a stored cross-site scripting vulnerability in the Generated Fields feature that disables Twig autoescaping and fails to encode cached values. Content editors can inject malicious JavaScript through editable fields that executes in authenticated Control Panel sessions of higher-privileged users viewing element indexes.
- Product
- cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Sep 16, 2026changedetection.io through 0.60.6 fails to escape the scraped page title in HTML notifications, allowing arbitrary markup injection.CVE-2026-92814 · Other software · dgtlmoon · reported by VulnCheckLow 2.3
changedetection.io through 0.60.6 fails to escape the scraped page title in HTML notifications, allowing arbitrary markup injection. Attackers can place malicious markup in monitored page titles that reaches notification channels like email and Telegram as live content when the watch_title token is used in templates.
- Product
- changedetection.io
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 16, 2026Decap CMS before 3.11.0 contains a path traversal vulnerability in the local proxy containment guard that uses plain string prefix comparison without path separCVE-2026-92812 · Other software · decaporg · reported by VulnCheckCritical 9.3
Decap CMS before 3.11.0 contains a path traversal vulnerability in the local proxy containment guard that uses plain string prefix comparison without path separator validation. Attackers can access sibling directories whose names begin with the repository directory name to read, write, or delete files outside the intended repository root.
- Product
- decap-cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 16, 2026@refinedev/inferencer through 7.0.0 fails to escape API field names when interpolating them into generated JSX source code.CVE-2026-92784 · Other software · refinedev · reported by VulnCheckHigh 7.7
@refinedev/inferencer through 7.0.0 fails to escape API field names when interpolating them into generated JSX source code. Attackers controlling the data provider can inject malicious JavaScript through crafted JSON property names that execute in the developer's browser when the Inferencer page renders.
- Product
- @refinedev/inferencer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 16, 2026Scirius through 3.8.0 contains an arbitrary file write vulnerability in the PCAP filestore upload endpoint that allows default User role users to write attackerCVE-2026-92604 · Other software · StamusNetworks · reported by VulnCheckHigh 7.2
Scirius through 3.8.0 contains an arbitrary file write vulnerability in the PCAP filestore upload endpoint that allows default User role users to write attacker-controlled JSON content to filesystem paths. Attackers can supply path traversal sequences in the uploaded document's _id field to escape the intended directory and write files with .json extension to arbitrary locations as root.
- Product
- scirius
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 16, 2026Jenkins Gitee Plugin 1301.v8957053c7902 and earlier does not escape the sender name from Gitee push webhook payloads in build causes, resulting in a stored crosCVE-2026-92140 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comMedium 6.8
Jenkins Gitee Plugin 1301.v8957053c7902 and earlier does not escape the sender name from Gitee push webhook payloads in build causes, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to trigger builds via the Jenkins Gitee Plugin webhook endpoint.
- Product
- Jenkins Gitee Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 16, 2026Jenkins OWASP Dependency-Check Plugin 5.6.4 and earlier does not escape CWE values from Dependency-Check reports on the Jenkins UI, resulting in a stored cross-CVE-2026-92136 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comHigh 8
Jenkins OWASP Dependency-Check Plugin 5.6.4 and earlier does not escape CWE values from Dependency-Check reports on the Jenkins UI, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
- Product
- Jenkins OWASP Dependency-Check Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 16, 2026In the Linux kernel, the following vulnerability has been resolved: scsi: bsg: Cap io_uring sense copy to max_response_len Completion copied scmd->sense_len tCVE-2026-90010 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 7.8
In the Linux kernel, the following vulnerability has been resolved: scsi: bsg: Cap io_uring sense copy to max_response_len Completion copied scmd->sense_len to the user response buffer without honoring max_response_len. After a valid sense, the midlayer sets sense_len to the real length (up to SCSI_SENSE_BUFFERSIZE), so a smaller user buffer was overrun.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Sep 16, 2026In the Linux kernel, the following vulnerability has been resolved: ceph: lock mutex in ceph_mds_check_access() MDS session OPEN handling replaces mdsc->s_capCVE-2026-89990 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Critical 9.8
In the Linux kernel, the following vulnerability has been resolved: ceph: lock mutex in ceph_mds_check_access() MDS session OPEN handling replaces mdsc->s_cap_auths under mdsc->mutex, freeing the previous array and its strings. ceph_mds_check_access() traverses this array without holding the mutex. A concurrent session reopen can therefore free the array while it is being inspected, resulting in a use-after-free like this: Unable to handle kernel paging request at virtual address 003aaad64b2c8bb9 [...] Internal error: Oops: 0000000096000004 [#1] SMP Modules linked in: CPU: 56 UID: 2953037534 PID: 1253231 Comm: php-cgi8.4 Not tainted 6.18.45-i2-ampere #1146 NONE [..] pc : ceph_mds_check_access+0xd4/0x550 lr : ceph_mds_check_access+0xc8/0x550 [...] Call trace: ceph_mds_check_access+0xd4/0x550 (P) ceph_atomic_open+0x138/0xbe8 path_openat+0xa24/0xfa8 do_filp_open+0x94/0x158 do_sys_openat2+0x88/0xf8
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Sep 16, 2026In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Correctly cap TLBI Range to the architural limit TLB Invalidation by Range hasCVE-2026-89911 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 7.9
In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Correctly cap TLBI Range to the architural limit TLB Invalidation by Range has a fairly powerful way of encoding pretty large ranges in a small number of bits. This range can be based on an arbitrary VA, which means it is pretty easy for a guest to generate an overflow should the hypervisor be naive enough to add the range to the base... Make sure the range is capped to the limit dictated by the address bit that determines the VA range. For an IPA invalidation, this is further corrected down the line to ignore the upper range.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Sep 16, 2026In the Linux kernel, the following vulnerability has been resolved: media: cx231xx: reject geometry changes while the VBI queue is busy vidioc_s_fmt_vid_cap()CVE-2026-89894 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 7.8
In the Linux kernel, the following vulnerability has been resolved: media: cx231xx: reject geometry changes while the VBI queue is busy vidioc_s_fmt_vid_cap() and vidioc_s_std() change the device-wide dev->width / dev->norm but only refuse the change when the *video* queue (dev->vidq) is busy. The VBI queue (dev->vbiq) shares that same geometry: cx231xx_init_vbi_isoc() latches dma_q->lines_per_field from dev->norm, the VBI videobuf2 plane is sized from dev->width / dev->norm in vbi_queue_setup() and vbi_buf_prepare(), and cx231xx_do_vbi_copy() then recomputes the destination offset from the *live* dev->width and the latched lines_per_field on every URB completion: offset = lines_completed * (dev->width << 1) + ...; if (dma_q->current_field == 2) offset += dev->width * 2 * dma_q->lines_per_field; memcpy(plane + offset, p_buffer, lencopy); Because the VBI node shares video_ioctl_ops with the video node, an application can size a small VBI plane (REQBUFS/QBUF with a small width, or with the NTSC standard), then enlarge dev->width (or switch dev->norm to PAL) through the video node while the VBI stream is running -- the change is allowed because only dev->vidq is checked -- an
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Sep 16, 2026In the Linux kernel, the following vulnerability has been resolved: media: video-i2c: fix kthread error pointer left in kthread_vid_cap on failure kthread_runCVE-2026-89871 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
In the Linux kernel, the following vulnerability has been resolved: media: video-i2c: fix kthread error pointer left in kthread_vid_cap on failure kthread_run() returns an ERR_PTR on failure, not NULL. When start_streaming() fails, data->kthread_vid_cap is left holding this error pointer instead of being cleared. This causes two subsequent bugs: 1. A future call to start_streaming() sees a non-NULL kthread_vid_cap and returns 0 (success) immediately, without actually starting the capture thread. 2. A call to stop_streaming() checks 'kthread_vid_cap == NULL' which is false for an error pointer, and proceeds to call kthread_stop() on the error pointer, leading to a kernel crash. Fix this by resetting kthread_vid_cap to NULL on failure before jumping to the error path.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Sep 16, 2026In the Linux kernel, the following vulnerability has been resolved: vfio/pci: clear vdev->msi_perm after freeing it on init failure vfio_msi_cap_len() lazily CVE-2026-89777 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 8.8
In the Linux kernel, the following vulnerability has been resolved: vfio/pci: clear vdev->msi_perm after freeing it on init failure vfio_msi_cap_len() lazily allocates the per-device MSI permission table: vdev->msi_perm = kmalloc_obj(struct perm_bits, GFP_KERNEL_ACCOUNT); if (!vdev->msi_perm) return -ENOMEM; ret = init_pci_cap_msi_perm(vdev->msi_perm, len, flags); if (ret) { kfree(vdev->msi_perm); return ret; /* vdev->msi_perm left dangling */ } When init_pci_cap_msi_perm() -> alloc_perm_bits() fails with -ENOMEM, the error path frees vdev->msi_perm but leaves the freed pointer stored in it. vdev->msi_perm is not re-zeroed later because struct vfio_pci_core_device is per-device and persists across open/close cycles, and the vfio_config_init() error path returns without calling vfio_config_free(). So the dangling pointer outlives the failed open. That leads to two use-after-frees on the same device: 1. Reuse. The next vfio_config_init() sees the stale pointer at "if (vdev->msi_perm) return len;" and reuses the freed object. MSI config accesses in vfio_pci_config_rw_single() then dereference and call the freed perm->readfn / perm->writefn function pointers
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Sep 16, 2026Appointment Hour Booking: Does not check every appointment in a booking submission against the capacity configured for its own slotCVE-2026-86475 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Appointment Hour Booking WordPress plugin before 1.5.95 does not check every appointment in a booking submission against the capacity configured for its own slot, allowing unauthenticated visitors to take slots that are already fully booked.
- Product
- Appointment Hour Booking
- Fixed in
- 1.5.95
- What to do
- Update Appointment Hour Booking to 1.5.95 or newer.
Sep 16, 2026Royal Elementor Addons: Does not properly sanitize and escape values submitted through its form widget before including them in the body of administrator notification emailsCVE-2026-13407 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Royal Elementor Addons WordPress plugin before 1.7.1067 does not properly sanitize and escape values submitted through its form widget before including them in the body of administrator notification emails, allowing unauthenticated attackers to inject arbitrary HTML into emails sent to the site administrator on form submission.
- Product
- Royal Elementor Addons
- Fixed in
- 1.7.1067
- What to do
- Update Royal Elementor Addons to 1.7.1067 or newer.
Sep 16, 2026WPBot: Does not perform a capability check on the AJAX action that saves its Claude AI provider settingsCVE-2026-87959 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WPBot WordPress plugin before 8.7.6 does not perform a capability check on the AJAX action that saves its Claude AI provider settings, allowing users with subscriber-level access to overwrite those settings, including the API key used for the WPBot WordPress plugin before 8.7.6's outgoing AI requests.
- Product
- WPBot
- Fixed in
- 8.7.6
- What to do
- Update WPBot to 8.7.6 or newer.
Sep 16, 2026Seraphinite Accelerator: Does not perform a capability check on one of its state-update AJAX actionsCVE-2026-87828 · WordPress plugins & themes · reported by WPScanMedium 5.7
The Seraphinite Accelerator WordPress plugin before 2.29.24 does not perform a capability check on one of its state-update AJAX actions, allowing authenticated users such as subscribers to write a malformed value that causes an uncaught error on every subsequent admin page load, making the entire admin area inaccessible to all administrators (denial of service).
- Product
- Seraphinite Accelerator
- Fixed in
- 2.29.24
- What to do
- Update Seraphinite Accelerator to 2.29.24 or newer.
Sep 16, 2026Visualizer: Does not sanitise and escape a chart's JSON data source configuration before outputting it back in the chart editorCVE-2026-86784 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Visualizer WordPress plugin before 4.0.8 does not sanitise and escape a chart's JSON data source configuration before outputting it back in the chart editor, allowing users with the Contributor role and above to store JavaScript that executes in the browser of any higher-privileged user, such as an administrator, who reviews the affected chart.
- Product
- Visualizer
- Fixed in
- 4.0.8
- What to do
- Update Visualizer to 4.0.8 or newer.
Sep 16, 2026LearnPress: Does not check the user's capabilities before applying a user supplied post status filter in one of its REST routesCVE-2026-86449 · WordPress plugins & themes · reported by WPScanMedium 5.3
The LearnPress WordPress plugin before 4.4.7 does not check the user's capabilities before applying a user supplied post status filter in one of its REST routes, allowing unauthenticated attackers to list courses that are not published, including draft, pending, private, scheduled and trashed ones.
- Product
- LearnPress
- Fixed in
- 4.4.7
- What to do
- Update LearnPress to 4.4.7 or newer.
Sep 16, 2026LearnPress: Does not check the user's capabilities in one of its administrative course toolsCVE-2026-86447 · WordPress plugins & themes · reported by WPScanMedium 5.3
The LearnPress WordPress plugin before 4.4.7 does not check the user's capabilities in one of its administrative course tools, allowing unauthenticated attackers to list every enrolled student's display name and user identifier against the course they are enrolled on, and to recover their email addresses through the same handler's search filter.
- Product
- LearnPress
- Fixed in
- 4.4.7
- What to do
- Update LearnPress to 4.4.7 or newer.
Sep 16, 2026LearnPress: Does not check the user's capabilities in one of its administrative template handlersCVE-2026-86445 · WordPress plugins & themes · reported by WPScanMedium 5.3
The LearnPress WordPress plugin before 4.4.7 does not check the user's capabilities in one of its administrative template handlers, allowing unauthenticated attackers to retrieve the text, identifier and type of every published quiz question on the site, along with a keyword search over them, which is content the LearnPress WordPress plugin before 4.4.7 otherwise keeps non-public.
- Product
- LearnPress
- Fixed in
- 4.4.7
- What to do
- Update LearnPress to 4.4.7 or newer.
Sep 16, 2026LearnPress: Does not escape a user supplied value before using it in an HTML attribute on a public pageCVE-2026-86444 · WordPress plugins & themes · reported by WPScanHigh 7.1
The LearnPress WordPress plugin before 4.4.7 does not escape a user supplied value before using it in an HTML attribute on a public page, allowing unauthenticated attackers to execute arbitrary JavaScript in the browser of anyone who opens a crafted link, including a logged in administrator. Only sites running a classic, non-block are affected.
- Product
- LearnPress
- Fixed in
- 4.4.7
- What to do
- Update LearnPress to 4.4.7 or newer.
Sep 16, 2026WPLP Cookie Consent: Does not perform CSRF or capability checksCVE-2026-85131 · WordPress plugins & themes · reported by WPScanMedium 6.5
The WPLP Cookie Consent WordPress plugin before 4.4.4 does not perform CSRF or capability checks when processing bulk actions on its administration screens, and does not restrict the targeted items to its own records, allowing attackers to make a logged in admin permanently delete arbitrary posts and pages via a crafted request.
- Product
- WPLP Cookie Consent
- Fixed in
- 4.4.4
- What to do
- Update WPLP Cookie Consent to 4.4.4 or newer.
Sep 16, 2026Eventin: Does not verify a user's capability to create accountsCVE-2026-84905 · WordPress plugins & themes · reported by WPScanLow 2.7
The Eventin WordPress plugin before 4.1.24 does not verify a user's capability to create accounts when adding a speaker, allowing users with contributor-level access and above to create new WordPress user accounts that carry capabilities beyond their own, including publishing content and uploading files, and, by supplying an email address they control, to obtain a working login to the created account.
- Product
- Eventin
- Fixed in
- 4.1.24
- What to do
- Update Eventin to 4.1.24 or newer.
Sep 16, 2026Optimole: Does not properly escape a user supplied value before using it to build an image tag attributeCVE-2026-84829 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Optimole WordPress plugin before 4.2.12 does not properly escape a user supplied value before using it to build an image tag attribute, allowing unauthenticated users to inject arbitrary attributes into pages served to every visitor, which leads to Stored Cross-Site Scripting.
- Product
- Optimole
- Fixed in
- 4.2.12
- What to do
- Update Optimole to 4.2.12 or newer.
Sep 16, 2026Ni WooCommerce Sales Report: Does not sanitise and escape a parameter before using it in a SQL statementCVE-2026-78472 · WordPress plugins & themes · reported by WPScanHigh 8.6
The Ni WooCommerce Sales Report WordPress plugin before 4.2.0 does not sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks.
- Product
- Ni WooCommerce Sales Report
- Fixed in
- 4.2.0
- What to do
- Update Ni WooCommerce Sales Report to 4.2.0 or newer.
Sep 16, 2026WP Import Export Lite: Does not escape custom field names retrieved from the database before inserting them into the DOM of one of its administration screensCVE-2026-76558 · WordPress plugins & themes · reported by WPScanMedium 6.8
The WP Import Export Lite WordPress plugin before 3.9.33 does not escape custom field names retrieved from the database before inserting them into the DOM of one of its administration screens, allowing users with a role as low as contributor to perform Stored XSS attacks which will trigger in the browser of a high privileged user, such as an administrator, viewing that screen.
- Product
- WP Import Export Lite
- Fixed in
- 3.9.33
- What to do
- Update WP Import Export Lite to 3.9.33 or newer.
Sep 16, 2026WP Import Export Lite: Does not properly sanitise and escape some import configuration values before using them in SQL statementsCVE-2026-76557 · WordPress plugins & themes · reported by WPScanMedium 6.8
The WP Import Export Lite WordPress plugin before 3.9.33 does not properly sanitise and escape some import configuration values before using them in SQL statements, allowing users whose role an administrator has granted the WP Import Export Lite WordPress plugin before 3.9.33's import permission to perform SQL injection attacks.
- Product
- WP Import Export Lite
- Fixed in
- 3.9.33
- What to do
- Update WP Import Export Lite to 3.9.33 or newer.
Sep 16, 2026WP Import Export Lite: Does not properly sanitise and escape some export filter values before using them in SQL statementsCVE-2026-76556 · WordPress plugins & themes · reported by WPScanMedium 6.8
The WP Import Export Lite WordPress plugin before 3.9.33 does not properly sanitise and escape some export filter values before using them in SQL statements, allowing users holding its export permission, which administrators have by default and may also grant to lower roles, to perform SQL injection attacks.
- Product
- WP Import Export Lite
- Fixed in
- 3.9.33
- What to do
- Update WP Import Export Lite to 3.9.33 or newer.
Sep 15, 2026EspoCRM through 10.0.8 uses PHP's rand() function to generate tokens for lead-capture opt-in, event invitation, and campaign URLs instead of a cryptographicallyCVE-2026-92298 · Other software · EspoCRM · reported by VulnCheckMedium 6.3
EspoCRM through 10.0.8 uses PHP's rand() function to generate tokens for lead-capture opt-in, event invitation, and campaign URLs instead of a cryptographically secure generator. Remote unauthenticated attackers can guess these roughly 31-bit tokens to confirm opt-ins, accept or decline event invitations on behalf of other contacts, and access event details.
- Product
- EspoCRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Sep 15, 2026Netcore NR255-V version 1.5.130703 contains a sensitive information disclosure vulnerability in l7_web_auth_user_show.cgi related to captive-portal credential hCVE-2026-76854 · Other software · Netcore · reported by VulnCheckHigh 7.1
Netcore NR255-V version 1.5.130703 contains a sensitive information disclosure vulnerability in l7_web_auth_user_show.cgi related to captive-portal credential handling. Attackers can query this component to obtain captive-portal user credentials, compromising confidentiality of authenticated network access.
- Product
- NR255-V
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Sep 15, 2026QloApps through 1.7.0 reflects unescaped child feature names into back-office validation error messages in the Hotel Reservation System feature management page.CVE-2026-92234 · Other software · Webkul · reported by VulnCheckMedium 5.1
QloApps through 1.7.0 reflects unescaped child feature names into back-office validation error messages in the Hotel Reservation System feature management page. Authenticated back-office users who follow a crafted link can execute injected JavaScript in their administrative session via the child_features parameter.
- Product
- QloApps
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2026Concrete CMS 9.4.0 through 9.5.2 did not escape colliding page paths before rendering them in the location panel's duplicate-path confirmation dialog.CVE-2026-81926 · Other software · Concrete CMS · reported by ff5b8ace-8b95-4078-9743-eac1ca5451deLow 2
Concrete CMS 9.4.0 through 9.5.2 did not escape colliding page paths before rendering them in the location panel's duplicate-path confirmation dialog. The panel's check endpoint returned the submitted path unmodified in its JSON response, and client-side JavaScript inserted each value into the dialog as raw HTML, so a crafted page path executed script in the editor's authenticated browser session. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 2.0 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N. Thanks Yonatan Drori from Tenzai for reporting.
- Product
- Concrete CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.concretecms.org
Sep 15, 2026Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle).CVE-2026-83339 · Other software · Oracle Corporation · reported by secalert_us@oracle.comCritical 9.8
Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Enterprise Capture. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Enterprise Capture. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
- Product
- Oracle WebCenter Enterprise Capture
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2026Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle).CVE-2026-83022 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 7.9
Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the Oracle WebCenter Enterprise Capture executes to compromise Oracle WebCenter Enterprise Capture. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle WebCenter Enterprise Capture, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Enterprise Capture. CVSS 3.1 Base Score 7.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H).
- Product
- Oracle WebCenter Enterprise Capture
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2026Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle).CVE-2026-83013 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 8.8
Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Enterprise Capture. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Enterprise Capture. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
- Product
- Oracle WebCenter Enterprise Capture
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2026Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle).CVE-2026-83012 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 7.7
Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Enterprise Capture. While the vulnerability is in Oracle WebCenter Enterprise Capture, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebCenter Enterprise Capture accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).
- Product
- Oracle WebCenter Enterprise Capture
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2026Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle).CVE-2026-83010 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 8.1
Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle WebCenter Enterprise Capture. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle WebCenter Enterprise Capture, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle WebCenter Enterprise Capture accessible data as well as unauthorized access to critical data or complete access to all Oracle WebCenter Enterprise Capture accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N).
- Product
- Oracle WebCenter Enterprise Capture
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2026Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle).CVE-2026-83009 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 8.8
Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Enterprise Capture. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Enterprise Capture. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
- Product
- Oracle WebCenter Enterprise Capture
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2026Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle).CVE-2026-83008 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 8.8
Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via T3, IIOP to compromise Oracle WebCenter Enterprise Capture. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Enterprise Capture. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
- Product
- Oracle WebCenter Enterprise Capture
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2026Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle).CVE-2026-83007 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 8.5
Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Enterprise Capture. While the vulnerability is in Oracle WebCenter Enterprise Capture, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebCenter Enterprise Capture accessible data as well as unauthorized update, insert or delete access to some of Oracle WebCenter Enterprise Capture accessible data. CVSS 3.1 Base Score 8.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N).
- Product
- Oracle WebCenter Enterprise Capture
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2026Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle).CVE-2026-83006 · Other software · Oracle Corporation · reported by secalert_us@oracle.comCritical 9.1
Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle WebCenter Enterprise Capture. While the vulnerability is in Oracle WebCenter Enterprise Capture, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Enterprise Capture. CVSS 3.1 Base Score 9.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).
- Product
- Oracle WebCenter Enterprise Capture
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.