Updated 2 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

587new WordPress flaws this week

391,288entries in the database

9,081 results · page 14 of 182

Sep 30, 2026Contributor PHP Object Injection in 10Web Booster – Website speed optimization, Cache & Page Speed optimizer <= 2.33.6 versions.CVE-2026-94121 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Contributor PHP Object Injection in 10Web Booster – Website speed optimization, Cache & Page Speed optimizer <= 2.33.6 versions.
Affected
up to 2.33.6
What to do
Affects up to 2.33.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 30, 2026Contributor SQL Injection in Easy Pricing Tables <= 4.1.2 versions.CVE-2026-94115 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Contributor SQL Injection in Easy Pricing Tables <= 4.1.2 versions.
Affected
up to 4.1.2
What to do
Affects up to 4.1.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 30, 2026Contributor Cross Site Scripting (XSS) in Safe SVG <= 2.5.0 versions.CVE-2026-94077 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Cross Site Scripting (XSS) in Safe SVG <= 2.5.0 versions.
Affected
up to 2.5.0
What to do
Affects up to 2.5.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 30, 2026Contributor PHP Object Injection in SEO Plugin by Squirrly SEO <= 14.2.5 versions.CVE-2026-94076 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Contributor PHP Object Injection in SEO Plugin by Squirrly SEO <= 14.2.5 versions.
Affected
up to 14.2.5
What to do
Affects up to 14.2.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 30, 2026Administrator SQL Injection in WP Activity Log <= 5.6.6 versions.CVE-2026-62085 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Administrator SQL Injection in WP Activity Log <= 5.6.6 versions.
Affected
up to 5.6.6
What to do
Affects up to 5.6.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 30, 2026Subscriber Other Vulnerability Type in Creator LMS <= 1.2.19 versions.CVE-2026-62083 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Subscriber Other Vulnerability Type in Creator LMS <= 1.2.19 versions.
Affected
up to 1.2.19
What to do
Affects up to 1.2.19. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 30, 2026Contributor Insecure Direct Object References (IDOR) in Flexible PDF Coupons <= 1.14.11 versions.CVE-2026-62081 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Contributor Insecure Direct Object References (IDOR) in Flexible PDF Coupons <= 1.14.11 versions.
Affected
up to 1.14.11
What to do
Affects up to 1.14.11. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 30, 2026Contributor Cross Site Scripting (XSS) in Happy Addons for Elementor <= 3.23.1 versions.CVE-2026-62080 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Cross Site Scripting (XSS) in Happy Addons for Elementor <= 3.23.1 versions.
Affected
up to 3.23.1
What to do
Affects up to 3.23.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 30, 2026Contributor Cross Site Scripting (XSS) in Qi Addons For Elementor <= 1.11 versions.CVE-2026-62079 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Cross Site Scripting (XSS) in Qi Addons For Elementor <= 1.11 versions.
Affected
up to 1.11
What to do
Affects up to 1.11. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 30, 2026Contributor Cross Site Scripting (XSS) in Premium Addons for Elementor <= 4.11.105 versions.CVE-2026-62078 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Cross Site Scripting (XSS) in Premium Addons for Elementor <= 4.11.105 versions.
Affected
up to 4.11.105
What to do
Affects up to 4.11.105. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 30, 2026Contributor Cross Site Scripting (XSS) in CF7 Views – Complete Entry Management for Contact Form 7 <= 3.2.5 versions.CVE-2026-100513 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Cross Site Scripting (XSS) in CF7 Views – Complete Entry Management for Contact Form 7 <= 3.2.5 versions.
Affected
up to 3.2.5
What to do
Affects up to 3.2.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 30, 2026Unauthenticated Denial of Service Attack in Two Factor <= 0.16.0 versions.CVE-2026-100508 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Denial of Service Attack in Two Factor <= 0.16.0 versions.
Affected
up to 0.16.0
What to do
Affects up to 0.16.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 30, 2026Post Views Stats Counter: Stored Cross-Site ScriptingCVE-2026-97347 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Post Views Stats Counter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via User-Agent Header in all versions up to, and including, 1.1.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The plugin's only input filter is a substring blacklist for known bot signatures (e.g. 'bot', 'spider', 'crawler'), which can be trivially bypassed by crafting a User-Agent payload that omits those strings.
Product
Post Views Stats Counter
Affected
up to 1.1.7
What to do
Affects up to 1.1.7. Update Post Views Stats Counter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 30, 2026Real Estate Manager – Property Listing and Agent Management: Stored Cross-Site ScriptingCVE-2026-93908 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Real Estate Manager – Property Listing and Agent Management plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'before_price_text' parameter in all versions up to, and including, 7.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerability is further enabled by the absence of any capability, nonce, or ownership check on the wp_ajax_rem_create_pro_ajax handler, and because the value is persisted via update_post_meta rather than post_content, the wp_kses filtering tied to the unfiltered_html capability does not apply.
Product
Real Estate Manager – Property Listing and Agent Management
Affected
up to 7.3
What to do
Affects up to 7.3. Update Real Estate Manager – Property Listing and Agent Management to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Sep 30, 2026ReactPress – Create React App for: Stored Cross-Site ScriptingCVE-2026-92712 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The ReactPress – Create React App for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'permalink' parameter in all versions up to, and including, 3.4.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is possible because the permalink parameter is only passed through sanitize_url(), which does not prevent fetching attacker-controlled remote URLs whose response body — including script tags and event-handler attributes — is written verbatim to disk via file_put_contents().
Product
ReactPress – Create React App for
Affected
up to 3.4.0
What to do
Affects up to 3.4.0. Update ReactPress – Create React App for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 30, 2026Product Designer App: Directory TraversalCVE-2026-75098 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Product Designer App plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.1.3 via the 'svg' parameter parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. The endpoint's only authentication gate relies on a nonce and token that are both publicly emitted as JavaScript globals on any page rendering the [pdapp-studio-page] shortcode, making them freely obtainable by anonymous visitors.
Product
Product Designer App
Affected
up to 1.1.3
What to do
Affects up to 1.1.3. Update Product Designer App to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 30, 2026Viable URL Media Uploader: Stored Cross-Site ScriptingCVE-2025-14564 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Viable URL Media Uploader plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
Product
Viable URL Media Uploader
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Viable URL Media Uploader to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 30, 2026Bold Page Builder: Stored Cross-Site ScriptingCVE-2026-88037 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `title` attribute of the `bt_bb_service` shortcode in all versions up to, and including, 5.7.2. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Bold Page Builder
Affected
up to 5.7.2
What to do
Affects up to 5.7.2. Update Bold Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 30, 2026Motors – Car Dealership & Classified Listings: Time-based blind SQL InjectionCVE-2026-6806 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'stm_lat/stm_lng' parameter in all versions up to, and including, 1.4.109 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Motors – Car Dealership & Classified Listings
Affected
up to 1.4.109
What to do
Affects up to 1.4.109. Update Motors – Car Dealership & Classified Listings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 30, 2026Bold Page Builder: Stored Cross-Site ScriptingCVE-2026-6173 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'background_image' parameter of the plugin's bt_bb_section shortcode in all versions up to, and including, 5.7.2 due to insufficient input sanitization and output escaping on user-supplied attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Bold Page Builder
Affected
up to 5.7.2
What to do
Affects up to 5.7.2. Update Bold Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 30, 2026Bold Page Builder: Stored Cross-Site ScriptingCVE-2026-6172 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'caption' parameter of the plugin's bt_bb_image shortcode in all versions up to, and including, 5.7.2 due to insufficient input sanitization and output escaping on user-supplied attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Bold Page Builder
Affected
up to 5.7.2
What to do
Affects up to 5.7.2. Update Bold Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 30, 2026Bold Page Builder: Stored Cross-Site ScriptingCVE-2026-6171 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'target' parameter of the plugin's bt_bb_icon shortcode in all versions up to, and including, 5.7.2 due to insufficient input sanitization and output escaping on user-supplied attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Bold Page Builder
Affected
up to 5.7.2
What to do
Affects up to 5.7.2. Update Bold Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 30, 2026Bold Page Builder: Stored Cross-Site ScriptingCVE-2026-6170 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'images' parameter of the plugin's bt_bb_css_image_grid shortcode in all versions up to, and including, 5.7.2 due to insufficient input sanitization and output escaping on user-supplied attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Bold Page Builder
Affected
up to 5.7.2
What to do
Affects up to 5.7.2. Update Bold Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 30, 2026WP Directory Kit: Generic SQL InjectionCVE-2026-16596 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The WP Directory Kit plugin for WordPress is vulnerable to generic SQL Injection via the 'data_fields_list' parameter in all versions up to, and including, 1.5.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with custom-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
WP Directory Kit
Affected
up to 1.5.4
What to do
Affects up to 1.5.4. Update WP Directory Kit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 30, 2026Smart Slider 3: Stored Cross-Site ScriptingCVE-2026-14876 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Smart Slider 3 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data-href' parameter in all versions up to, and including, 3.5.1.38 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Smart Slider 3
Affected
up to 3.5.1.38
What to do
Affects up to 3.5.1.38. Update Smart Slider 3 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 30, 2026HT Mega Addons for Elementor – Elementor Widgets & Template Builder: Stored Cross-Site ScriptingCVE-2026-11895 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The HT Mega Addons for Elementor – Elementor Widgets & Template Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Data Table 'display_options' Setting in all versions up to, and including, 3.1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
HT Mega Addons for Elementor – Elementor Widgets & Template Builder
Affected
up to 3.1.1
What to do
Affects up to 3.1.1. Update HT Mega Addons for Elementor – Elementor Widgets & Template Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 30, 2026Verge3D Publishing and E-Commerce: Does not validate the contents of files uploaded through its file storage feature and serves them back with an attacker-controlled content typeCVE-2026-92994 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Verge3D Publishing and E-Commerce WordPress plugin before 4.13.1 does not validate the contents of files uploaded through its file storage feature and serves them back with an attacker-controlled content type, allowing unauthenticated attackers to store a file containing malicious JavaScript that executes in the browser of any user who opens it.
Product
Verge3D Publishing and E-Commerce
Fixed in
4.13.1
What to do
Update Verge3D Publishing and E-Commerce to 4.13.1 or newer.
Full record and what to do →NVD record wpscan.com
Sep 30, 2026EWWW Image Optimizer: Does not confine a WebP-derivative file migration routine to the current site's own uploads directoryCVE-2026-91072 · WordPress plugins & themes · reported by WPScanMedium 4.4
The EWWW Image Optimizer WordPress plugin before 8.8.0 does not confine a WebP-derivative file migration routine to the current site's own uploads directory, letting an attacker with Administrator-level access rename or delete existing WebP-derivative image files outside that scope, including, on a multisite network, files belonging to a different site they have no access to.
Product
EWWW Image Optimizer
Fixed in
8.8.0
What to do
Update EWWW Image Optimizer to 8.8.0 or newer.
Full record and what to do →NVD record wpscan.com
Sep 30, 2026EWWW Image Optimizer: Does not prevent authenticated users with author-level permissions from storing a serialized value in a post meta field that is deserializedCVE-2026-91051 · WordPress plugins & themes · reported by WPScanMedium 6.6
The EWWW Image Optimizer WordPress plugin before 8.8.0 does not prevent authenticated users with author-level permissions from storing a serialized value in a post meta field that is deserialized when the post is rendered, allowing them to perform PHP Object Injection, which can lead to remote code execution when a suitable gadget chain is present via another installed EWWW Image Optimizer WordPress plugin before 8.8.0 or .
Product
EWWW Image Optimizer
Fixed in
8.8.0
What to do
Update EWWW Image Optimizer to 8.8.0 or newer.
Full record and what to do →NVD record wpscan.com
Sep 30, 2026Hostinger Reach: Does not sanitize and escape a widget setting before outputting it in the editor previewCVE-2026-87777 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Hostinger Reach WordPress plugin before 1.8.3 does not sanitize and escape a widget setting before outputting it in the editor preview, allowing users with contributor-level access and above to inject arbitrary web scripts that will execute in the session of a higher-privileged user who opens the affected content in the editor.
Product
Hostinger Reach
Fixed in
1.8.3
What to do
Update Hostinger Reach to 1.8.3 or newer.
Full record and what to do →NVD record wpscan.com
Sep 30, 2026Connections Business Directory: Does not apply its visibility and moderation-status restrictions on certain REST API read endpointsCVE-2026-86789 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Connections Business Directory WordPress plugin through 10.4.67 does not apply its visibility and moderation-status restrictions on certain REST API read endpoints, allowing unauthenticated attackers to retrieve directory entries that are marked private or unlisted, or that are still pending moderation, including entry names, organizations, biographies, internal notes and street addresses. The Connections Business Directory WordPress plugin through 10.4.67 has been closed on WordPress.org and no fixed version is available, so site owners should remove it or restrict unauthenticated access to its REST API routes.
Product
Connections Business Directory
Affected
up to 10.4.67
What to do
Affects up to 10.4.67. Update Connections Business Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Sep 30, 2026EmbedPress: Does not sanitise and escape one of its Elementor widget settings before outputting it into an HTML attributeCVE-2026-85001 · WordPress plugins & themes · reported by WPScanMedium 6.8
The EmbedPress WordPress plugin before 4.6.7 does not sanitise and escape one of its Elementor widget settings before outputting it into an HTML attribute, which could allow users with the Contributor role or above to inject arbitrary web scripts that execute when the affected content is viewed.
Product
EmbedPress
Fixed in
4.6.7
What to do
Update EmbedPress to 4.6.7 or newer.
Full record and what to do →NVD record wpscan.com
Sep 29, 2026Frontend Post Submission Manager Lite – Frontend Posting: Stored DOM-Based Cross-Site ScriptingCVE-2026-96649 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Frontend Post Submission Manager Lite – Frontend Posting WordPress Plugin plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via post_content Parameter (data-label DOM Sink) in all versions up to, and including, 1.3.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the site operator to have enabled guest post submission via the [fpsm] shortcode, which registers a publicly accessible AJAX handler gated only by a nonce emitted on every page containing the shortcode.
Product
Frontend Post Submission Manager Lite – Frontend Posting
Affected
up to 1.3.4
What to do
Affects up to 1.3.4. Update Frontend Post Submission Manager Lite – Frontend Posting to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 28, 2026HT Contact Form – Drag & Drop Form Builder for: Stored Cross-Site ScriptingCVE-2026-96326 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The HT Contact Form – Drag & Drop Form Builder for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Rich Text Editor Field in all versions up to, and including, 2.10.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
HT Contact Form – Drag & Drop Form Builder for
Affected
up to 2.10.2
What to do
Affects up to 2.10.2. Update HT Contact Form – Drag & Drop Form Builder for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 27, 2026Optima Express IDX: Does not properly neutralise a script value submitted through one of its REST endpoints before storing it and echoing it into the document headCVE-2026-96899 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Optima Express IDX WordPress plugin before 8.7.6 does not properly neutralise a script value submitted through one of its REST endpoints before storing it and echoing it into the document head when the post is rendered, allowing users with a role as low as author to perform Stored Cross-Site Scripting attacks.
Product
Optima Express IDX
Fixed in
8.7.6
What to do
Update Optima Express IDX to 8.7.6 or newer.
Full record and what to do →NVD record wpscan.com
Sep 27, 2026Malcure Malware Shield — Removal, Repair, Monitor: Does not perform an authorisation check on one of its AJAX actionsCVE-2026-96896 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Malcure Malware Shield — Removal, Repair, Monitor WordPress plugin before 19.9.7 does not perform an authorisation check on one of its AJAX actions, allowing users with a subsite administrator role on a multisite network to write and delete arbitrary files in the network's shared filesystem, which can lead to remote code execution.
Product
Malcure Malware Shield — Removal, Repair, Monitor
Fixed in
19.9.7
What to do
Update Malcure Malware Shield — Removal, Repair, Monitor to 19.9.7 or newer.
Full record and what to do →NVD record wpscan.com
Sep 27, 2026WPeMatico RSS Feed Fetcher: Does not sanitize imported feed content before storing itCVE-2026-89006 · WordPress plugins & themes · reported by WPScanMedium 6.8
The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27 does not sanitize imported feed content before storing it as post content, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
WPeMatico RSS Feed Fetcher
Fixed in
2.8.27
What to do
Update WPeMatico RSS Feed Fetcher to 2.8.27 or newer.
Full record and what to do →NVD record wpscan.com
Sep 27, 2026Online Scheduling and Appointment Booking System: Does not prevent deserialization of untrusted input and does not correctly restrict a privileged maintenance feature to administratorsCVE-2026-86841 · WordPress plugins & themes · reported by WPScanMedium 4.7
The Online Scheduling and Appointment Booking System WordPress plugin before 28.3 does not prevent deserialization of untrusted input and does not correctly restrict a privileged maintenance feature to administrators, allowing users granted a custom booking-management capability, which an administrator must explicitly assign, to inject arbitrary PHP objects, overwrite privileged site options, and read stored integration secrets.
Product
Online Scheduling and Appointment Booking System
Fixed in
28.3
What to do
Update Online Scheduling and Appointment Booking System to 28.3 or newer.
Full record and what to do →NVD record wpscan.com
Sep 27, 2026UpdraftPlus: WP Backup & Migration Plugin WordPress plugin before 1.26.8, UpdraftPlus: WP Backup & Migration: Does not have any capability check in a routine that outputs its stored remote storage settings into admin pagCVE-2026-82841 · WordPress plugins & themes · reported by WPScanMedium 5.3
The UpdraftPlus: WP Backup & Migration Plugin WordPress plugin before 1.26.8, UpdraftPlus: WP Backup & Migration Plugin WordPress plugin before 2.26.8.26 does not have any capability check in a routine that outputs its stored remote storage settings into admin pages when the site is left in a particular post-migration state, allowing any authenticated user, such as a subscriber, to retrieve the credentials of the configured backup destinations, such as passwords and secret keys.
Product
UpdraftPlus: WP Backup & Migration Plugin WordPress plugin before 1.26.8, UpdraftPlus: WP Backup & Migration
Fixed in
1.26.8
What to do
Update UpdraftPlus: WP Backup & Migration Plugin WordPress plugin before 1.26.8, UpdraftPlus: WP Backup & Migration to 1.26.8 or newer.
Full record and what to do →NVD record wpscan.com
Sep 26, 2026Testimonials Widget: Does not validate a user-supplied URL before fetching it server-side and storing the responseCVE-2026-96533 · WordPress plugins & themes · reported by WPScanMedium 5.8
The Testimonials Widget WordPress plugin through 4.0.4 does not validate a user-supplied URL before fetching it server-side and storing the response as a public file, allowing unauthenticated users to make the server issue requests to internal services and read the responses.
Product
Testimonials Widget
Affected
up to 4.0.4
What to do
Affects up to 4.0.4. Update Testimonials Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Sep 26, 2026wp-review-slider-pro: Does not sanitize a value stored through one of its AJAX handlersCVE-2026-84097 · WordPress plugins & themes · reported by WPScanMedium 6.5
The wp-review-slider-pro WordPress plugin before 12.7.12 does not sanitize a value stored through one of its AJAX handlers, which lacks a capability check, before using it in a SQL statement, allowing any authenticated user, such as a subscriber, to perform SQL injection attacks whose results are then returned to unauthenticated visitors.
Product
wp-review-slider-pro
Fixed in
12.7.12
What to do
Update wp-review-slider-pro to 12.7.12 or newer.
Full record and what to do →NVD record wpscan.com
Sep 26, 2026WP Directory Kit: Does not sanitize and escape some of its category and location fields before outputting them in page attributesCVE-2026-16591 · WordPress plugins & themes · reported by WPScanHigh 7.2
The WP Directory Kit WordPress plugin before 1.5.8 does not sanitize and escape some of its category and location fields before outputting them in page attributes, allowing users with a WP Directory Kit WordPress plugin before 1.5.8-specific listing-management role (and without the unfiltered_html capability) to perform Stored Cross-Site Scripting attacks that execute for any visitor of the affected page.
Product
WP Directory Kit
Fixed in
1.5.8
What to do
Update WP Directory Kit to 1.5.8 or newer.
Full record and what to do →NVD record wpscan.com
Sep 25, 2026Automatic.css: Stored Cross-Site ScriptingCVE-2026-15273 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Automatic.css plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REQUEST_URI in all version 4.0.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that will execute whenever an administrator accesses the Activity Log settings page.
Product
Automatic.css
What to do
Update Automatic.css to the newest version.
Full record and what to do →NVD record automaticcss.com plugins.trac.wordpress.org
Sep 25, 2026Bookly: Does not properly verify a customer's identity before updating their stored detailsCVE-2026-86837 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Bookly WordPress plugin before 28.3 does not properly verify a customer's identity before updating their stored details, allowing unauthenticated attackers who know a customer's primary identifier to overwrite that customer's stored personal information such as name, email and address.
Product
Bookly
Fixed in
28.3
What to do
Update Bookly to 28.3 or newer.
Full record and what to do →NVD record wpscan.com
Sep 25, 2026Zero Spam for: Stored Cross-Site ScriptingCVE-2026-96752 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Zero Spam for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Nested POST Array Keys via Contact Form 7 Integration in all versions up to, and including, 5.7.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload is delivered by submitting a Contact Form 7 request with a nested POST array key containing arbitrary HTML or JavaScript — PHP parses the field name into a nested array key, which is stored verbatim in the zerospam_log.submission_data column when Zero Spam flags the submission as spam due to the absence of the zerospam_david_walsh_key field.
Product
Zero Spam for
Affected
up to 5.7.10
What to do
Affects up to 5.7.10. Update Zero Spam for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 25, 2026Restaurant Menu and Food Ordering: Stored Cross-Site ScriptingCVE-2026-96568 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Restaurant Menu and Food Ordering plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'phone_number' parameter in all versions up to, and including, 2.4.14 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Restaurant Menu and Food Ordering
Affected
up to 2.4.14
What to do
Affects up to 2.4.14. Update Restaurant Menu and Food Ordering to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 25, 2026User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor: Stored Cross-Site ScriptingCVE-2026-95866 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Avatar Field in all versions up to, and including, 4.0.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The zero-length multipart file branch in wppb_save_avatar_value() writes the raw request value directly to user meta, bypassing the wppb_save_attachment_id()/wppb_verify_attachment_id() validation path; the stored payload is later adopted as a WordPress attachment URL and rendered unescaped by wppb_default_fields_make_upload_button() when an administrator views the affected account.
Product
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
Affected
up to 4.0.2
What to do
Affects up to 4.0.2. Update User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 25, 2026Themify Builder: Stored Cross-Site ScriptingCVE-2026-95864 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Themify Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'css[fonts]' Parameter in all versions up to, and including, 7.8.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The nonce required to reach the vulnerable endpoint is embedded in plain sight within the front-end page markup for all visitors, reducing the access control to a CSRF token rather than an authentication barrier and making the endpoint fully exploitable by unauthenticated attackers.
Product
Themify Builder
Affected
up to 7.8.1
What to do
Affects up to 7.8.1. Update Themify Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 25, 2026Repeater Fields for Elementor Forms: Stored Cross-Site ScriptingCVE-2026-94573 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Repeater Fields for Elementor Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Repeater Field Value in all versions up to, and including, 2.2.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Repeater Fields for Elementor Forms
Affected
up to 2.2.7
What to do
Affects up to 2.2.7. Update Repeater Fields for Elementor Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 25, 2026wpForo Forum: Stored Cross-Site ScriptingCVE-2026-93747 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The wpForo Forum plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'telegram' profile field in versions up to, and including, 3.1.6. This is due to insufficient input sanitization and output escaping in the profile_update action — the raw $_POST['data'] array is copied into a $custom_fields variable before validate() and sanitize() run, both of which operate only on a parallel $user reference, leaving $custom_fields unsanitized when it is persisted via update_custom_fields(); on render, wpforo_decode() reverses the entity encoding and the value is echoed without escaping in field_wrap_profile(). This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
wpForo Forum
Affected
up to 3.1.6
What to do
Affects up to 3.1.6. Update wpForo Forum to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.