Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
7,719 results · page 14 of 155
Sep 12, 2026WP Highlight Box: Does not escape some shortcode attributes before outputting them in a page where the shortcode is embeddedCVE-2026-86790 · WordPress plugins & themes · reported by WPScanMedium 6.8
The WP Highlight Box WordPress plugin through 1.0 does not escape some shortcode attributes before outputting them in a page where the shortcode is embedded, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- WP Highlight Box
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update WP Highlight Box to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 12, 2026BEAR: Does not verify a CSRF nonce or check user capabilities before updating taxonomy termsCVE-2026-84023 · WordPress plugins & themes · reported by WPScanMedium 6.5
The BEAR WordPress plugin before 1.2.2 does not verify a CSRF nonce or check user capabilities before updating taxonomy terms, allowing an attacker to modify arbitrary terms by tricking a logged-in privileged user into visiting a crafted page.
- Product
- BEAR
- Fixed in
- 1.2.2
- What to do
- Update BEAR to 1.2.2 or newer.
Sep 12, 2026Export & Import WPBakery Page Builder: Does not perform any CSRF check on its template-import feature and does not sanitise the imported data before storing it and echoing it backCVE-2026-81429 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Export & Import WPBakery Page Builder WordPress plugin through 1.0.2 does not perform any CSRF check on its template-import feature and does not sanitise the imported data before storing it and echoing it back, allowing attackers to make a logged-in administrator import a crafted template via a forged request that results in Stored Cross-Site Scripting executed in the administrator's session.
- Product
- Export & Import WPBakery Page Builder
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update Export & Import WPBakery Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 12, 2026Gpx2Graphics: Does not perform a CSRF checkCVE-2026-81090 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Gpx2Graphics WordPress plugin through 0.3 does not perform a CSRF check when handling file uploads, nor validate the type of the uploaded file, allowing attackers to make a logged-in administrator upload arbitrary files such as PHP via a CSRF attack, leading to Remote Code Execution.
- Product
- Gpx2Graphics
- Affected
- up to 0.3
- What to do
- Affects up to 0.3. Update Gpx2Graphics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 12, 2026SureRank SEO: Does not exclude users' registered account email addresses from the structured data it outputs on public pages by defaultCVE-2026-78152 · WordPress plugins & themes · reported by WPScanMedium 5.3
The SureRank SEO WordPress plugin before 1.10.1 does not exclude users' registered account email addresses from the structured data it outputs on public pages by default, allowing unauthenticated visitors to obtain the email address of any user who has published content.
- Product
- SureRank SEO
- Fixed in
- 1.10.1
- What to do
- Update SureRank SEO to 1.10.1 or newer.
Sep 11, 2026Contributor Cross Site Scripting (XSS) in Visual Composer Website Builder <= 45.16.1 versions.CVE-2026-62138 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Cross Site Scripting (XSS) in Visual Composer Website Builder <= 45.16.1 versions.
- Affected
- up to 45.16.1
- What to do
- Affects up to 45.16.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 11, 2026Unauthenticated Sensitive Data Exposure in bbPress <= 2.6.14 versions.CVE-2026-62137 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Sensitive Data Exposure in bbPress <= 2.6.14 versions.
- Affected
- up to 2.6.14
- What to do
- Affects up to 2.6.14. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 11, 2026Unauthenticated Broken Access Control in Flexible Quantity – Measurement Price Calculator for WooCommerce <= 2.3.21 versions.CVE-2026-62136 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Broken Access Control in Flexible Quantity – Measurement Price Calculator for WooCommerce <= 2.3.21 versions.
- Affected
- up to 2.3.21
- What to do
- Affects up to 2.3.21. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 11, 2026Contributor Cross Site Scripting (XSS) in Simple Payment <= 2.5.4 versions.CVE-2026-62111 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Cross Site Scripting (XSS) in Simple Payment <= 2.5.4 versions.
- Affected
- up to 2.5.4
- What to do
- Affects up to 2.5.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 11, 2026Contributor Cross Site Scripting (XSS) in Bold Page Builder <= 5.9.9 versions.CVE-2026-62110 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Cross Site Scripting (XSS) in Bold Page Builder <= 5.9.9 versions.
- Affected
- up to 5.9.9
- What to do
- Affects up to 5.9.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 11, 2026Unauthenticated PHP Object Injection in ThemeREX Addons < 2.45.0 versions.CVE-2026-62105 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in ThemeREX Addons < 2.45.0 versions.
- What to do
- Update the plugin to the newest version.
Sep 11, 2026The Nexi XPay Build WordPress plugin from 7.6.1 to 7.6.2 does not verify that the saved payment token being requested belongs to the current user, allowing unauCVE-2026-82213 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Nexi XPay Build WordPress plugin from 7.6.1 to 7.6.2 does not verify that the saved payment token being requested belongs to the current user, allowing unauthenticated attackers to retrieve other customers' stored card token references together with a valid authorisation signature.
- What to do
- Update the plugin to the newest version.
Sep 11, 2026Gutenverse News: Does not restrict the extra HTML it adds to WordPress's allowed elements to the context it is meant forCVE-2026-85677 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Gutenverse News WordPress plugin before 3.3.3 does not restrict the extra HTML it adds to WordPress's allowed elements to the context it is meant for, applying the same relaxed list to every sanitisation context including untrusted comments, allowing unauthenticated users to store JavaScript that will execute in the browser of any administrator who reviews the comment queue, and of any visitor to the post once the comment is approved.
- Product
- Gutenverse News
- Fixed in
- 3.3.3
- What to do
- Update Gutenverse News to 3.3.3 or newer.
Sep 11, 2026MultiVendorX: Does not restrict who can update its role and capability settingsCVE-2026-74925 · WordPress plugins & themes · reported by WPScanHigh 7.2
The MultiVendorX WordPress plugin before 5.0.16 does not restrict who can update its role and capability settings, allowing users holding its vendor role to grant that role administrator-level capabilities and take over the site.
- Product
- MultiVendorX
- Fixed in
- 5.0.16
- What to do
- Update MultiVendorX to 5.0.16 or newer.
Sep 11, 2026Simple Ajax Chat – Add a Fast, Secure Chat Box: Stored Cross-Site ScriptingCVE-2026-81825 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Simple Ajax Chat – Add a Fast, Secure Chat Box plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Chat Message in all versions up to, and including, <= 20260811 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The nonce protecting chat message submission is publicly visible on the chat page, rendering it ineffective as an authentication barrier and allowing fully unauthenticated attackers to submit malicious messages that are stored persistently and rendered to all visitors on every page load.
- Product
- Simple Ajax Chat – Add a Fast, Secure Chat Box
- Affected
- up to 20260811
- What to do
- Affects up to 20260811. Update Simple Ajax Chat – Add a Fast, Secure Chat Box to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 10, 2026Unauthenticated Cross Site Scripting (XSS) in WPAdverts <= 2.3.3 versions.CVE-2026-84819 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in WPAdverts <= 2.3.3 versions.
- Affected
- up to 2.3.3
- What to do
- Affects up to 2.3.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 10, 2026Unauthenticated Cross Site Scripting (XSS) in WPCS <= 1.3.2 versions.CVE-2026-84816 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in WPCS <= 1.3.2 versions.
- Affected
- up to 1.3.2
- What to do
- Affects up to 1.3.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 10, 2026Unauthenticated Sensitive Data Exposure in ZHBackup – Backup, Restore & Migration <= 2.4.2 versions.CVE-2026-81804 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Sensitive Data Exposure in ZHBackup – Backup, Restore & Migration <= 2.4.2 versions.
- Affected
- up to 2.4.2
- What to do
- Affects up to 2.4.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 10, 2026Subscriber Remote Code Execution (RCE) in RepairBuddy <= 4.1224 versions.CVE-2026-81803 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Subscriber Remote Code Execution (RCE) in RepairBuddy <= 4.1224 versions.
- Affected
- up to 4.1224
- What to do
- Affects up to 4.1224. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 10, 2026Unauthenticated Broken Access Control in Return Refund and Exchange For WooCommerce <= 4.6.4 versions.CVE-2026-81799 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in Return Refund and Exchange For WooCommerce <= 4.6.4 versions.
- Affected
- up to 4.6.4
- What to do
- Affects up to 4.6.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 10, 2026Unauthenticated Cross Site Scripting (XSS) in Page Visits Counter – Lite <= 1.2.3 versions.CVE-2026-81795 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Page Visits Counter – Lite <= 1.2.3 versions.
- Affected
- up to 1.2.3
- What to do
- Affects up to 1.2.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 10, 2026Subscriber Cross Site Scripting (XSS) in EventON <= 2.5.7 versions.CVE-2026-81791 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Subscriber Cross Site Scripting (XSS) in EventON <= 2.5.7 versions.
- Affected
- up to 2.5.7
- What to do
- Affects up to 2.5.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 10, 2026Advanced Product Fields Extended for WooCommerce: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2026-81789 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Studio Wombat Advanced Product Fields Extended for WooCommerce allows Path Traversal. This issue affects Advanced Product Fields Extended for WooCommerce: from n/a through 3.1.6.
- Product
- Advanced Product Fields Extended for WooCommerce
- Affected
- up to 3.1.6
- What to do
- Affects up to 3.1.6. Update Advanced Product Fields Extended for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 10, 2026Subscriber Broken Access Control in IMPress for IDX Broker <= 3.3.0 versions.CVE-2026-81788 · WordPress plugins & themes · reported by PatchstackMedium 6.3
Subscriber Broken Access Control in IMPress for IDX Broker <= 3.3.0 versions.
- Affected
- up to 3.3.0
- What to do
- Affects up to 3.3.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 10, 2026Unauthenticated Broken Authentication in IMPress for IDX Broker <= 3.3.0 versions.CVE-2026-81787 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Broken Authentication in IMPress for IDX Broker <= 3.3.0 versions.
- Affected
- up to 3.3.0
- What to do
- Affects up to 3.3.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 10, 2026Subscriber Cross Site Scripting (XSS) in WP Docs <= 2.3.1 versions.CVE-2026-81782 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Subscriber Cross Site Scripting (XSS) in WP Docs <= 2.3.1 versions.
- Affected
- up to 2.3.1
- What to do
- Affects up to 2.3.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 10, 2026Redux Framework: Stored Cross-Site ScriptingCVE-2026-5399 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Slider field in User Profile settings in versions up to and including 4.5.13.1. This is due to insufficient input sanitization in the user_meta_save() function (which only sanitizes array values, not scalar values) and improper output escaping in the Redux_Slider::render() method, which outputs slider values into unquoted HTML attributes. The vulnerability also exploits the fact that the clean_default() method only casts values to numeric types when they are empty or out of bounds, allowing malicious strings like '1 tabindex=0 autofocus onfocus=alert(1) x=' to pass validation through PHP's loose type comparison. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts into their user profile that will execute whenever an Administrator navigates to view the attacker's profile page.
- Product
- Redux Framework
- Affected
- up to 4.5.13.1
- What to do
- Affects up to 4.5.13.1. Update Redux Framework to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.complugins.trac.wordpress.org
Sep 10, 2026Notiqoo: Does not have capability checks on several of its AJAX actions and builds the name of the option to write from user inputCVE-2026-19840 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Notiqoo WordPress plugin before 1.4.14 does not have capability checks on several of its AJAX actions and builds the name of the option to write from user input, allowing users with a role as low as contributor to modify arbitrary WordPress options, which can be used to deactivate Notiqoo WordPress plugin before 1.4.14 and to lock every administrator out of the site.
- Product
- Notiqoo
- Fixed in
- 1.4.14
- What to do
- Update Notiqoo to 1.4.14 or newer.
Sep 9, 2026Ninja Forms - Scheduled Exports: Stored Cross-Site ScriptingCVE-2026-87870 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Ninja Forms - Scheduled Exports plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REST API Parameters (interval, format, emailTo) in all versions up to, and including, 3.0.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level privileges and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The REST endpoint is registered without a permission_callback and only validates a nonce without checking user capabilities.
- Product
- Ninja Forms - Scheduled Exports
- Affected
- up to 3.0.3
- What to do
- Affects up to 3.0.3. Update Ninja Forms - Scheduled Exports to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordninjaforms.comwordfence.com
Sep 9, 2026WP Express Checkout: Does not verify server-side that a payment was actually completed before marking an orderCVE-2026-83537 · WordPress plugins & themes · reported by WPScanMedium 5.3
The WP Express Checkout WordPress plugin before 2.5.0 does not verify server-side that a payment was actually completed before marking an order as paid, allowing unauthenticated users to forge a completed order without paying.
- Product
- WP Express Checkout
- Fixed in
- 2.5.0
- What to do
- Update WP Express Checkout to 2.5.0 or newer.
Sep 9, 2026Hustle: Does not prevent shortcodes in submitted form values from being executedCVE-2026-80440 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Hustle WordPress plugin before 7.8.14.2 does not prevent shortcodes in submitted form values from being executed when it substitutes those values into the message it returns after submission, because the guard it applies can be defeated by nesting, allowing unauthenticated users to run any shortcode registered on the site.
- Product
- Hustle
- Fixed in
- 7.8.14.2
- What to do
- Update Hustle to 7.8.14.2 or newer.
Sep 9, 2026Reviso Exporter for WooCommerce: Unauthorized modification of dataCVE-2026-8615 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Reviso Exporter for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check and missing nonce verification on the disconnect_callback() function in versions up to, and including, 1.2.3. The function is registered to the 'wp_ajax_wcefr-disconnect' AJAX action and unconditionally calls delete_option('wcefr-agt'), which removes the Reviso Agreement Grant Token used to authenticate API calls. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete the plugin's stored Agreement Grant Token, breaking the connection between WooCommerce and the Reviso service.
- Product
- Reviso Exporter for WooCommerce
- Affected
- up to 1.2.3
- What to do
- Affects up to 1.2.3. Update Reviso Exporter for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.complugins.trac.wordpress.org
Sep 9, 2026Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More: Does not validate a user-supplied HTML tag name in one of its Beaver Builder widgets before echoing it into the rendered markupCVE-2026-85418 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More WordPress plugin before 3.0.9 does not validate a user-supplied HTML tag name in one of its Beaver Builder widgets before echoing it into the rendered markup, allowing users with contributor-level access and above to inject arbitrary web scripts that execute when any visitor views the affected page.
- Product
- Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More
- Fixed in
- 3.0.9
- What to do
- Update Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More to 3.0.9 or newer.
Sep 9, 2026WPLP Cookie Consent: Does not perform nonce or capability checks on several of its settings AJAX actionsCVE-2026-85133 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WPLP Cookie Consent WordPress plugin before 4.4.2 does not perform nonce or capability checks on several of its settings AJAX actions, allowing any authenticated user, such as a subscriber, to read and destroy scan data belonging to the administrator and to overwrite the WPLP Cookie Consent WordPress plugin before 4.4.2's stored configuration.
- Product
- WPLP Cookie Consent
- Fixed in
- 4.4.2
- What to do
- Update WPLP Cookie Consent to 4.4.2 or newer.
Sep 9, 2026WPLP Cookie Consent: Does not perform nonce or capability checks on one of its cookie scanner AJAX actionsCVE-2026-85132 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WPLP Cookie Consent WordPress plugin before 4.4.2 does not perform nonce or capability checks on one of its cookie scanner AJAX actions, allowing any authenticated user, such as a subscriber, to read back the automated scan schedule the administrator configured.
- Product
- WPLP Cookie Consent
- Fixed in
- 4.4.2
- What to do
- Update WPLP Cookie Consent to 4.4.2 or newer.
Sep 9, 2026Sina Extension for Elementor: Does not properly escape a Table widget setting before outputting it within an HTML attributeCVE-2026-83541 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Sina Extension for Elementor WordPress plugin before 3.10.4 does not properly escape a Table widget setting before outputting it within an HTML attribute, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Sina Extension for Elementor
- Fixed in
- 3.10.4
- What to do
- Update Sina Extension for Elementor to 3.10.4 or newer.
Sep 9, 2026Next-Cart Store to WooCommerce Migration: Authentication BypassCVE-2026-76009 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Next-Cart Store to WooCommerce Migration plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 3.9.8 via the `NCWM_Kitconnect::run()` function. This is due to the plugin registering the `/wp-json/next_cart/v1/migration` REST route with `permission_callback` set to `__return_true` and relying on a hardcoded fallback value of `__token__` in `get_option('nextcart_token', '__token__')` when the `nextcart_token` option has not yet been written to the database. This makes it possible for unauthenticated attackers to bypass authentication to the migration endpoint by supplying the literal string `__token__` as the token, gaining access to privileged handlers that pass attacker-controlled SQL directly to `$wpdb->query()` and `$wpdb->get_results()` — enabling arbitrary SQL execution including administrator account creation — and pass an attacker-controlled path to `unlink()`, enabling arbitrary file deletion and full site takeover. The hardcoded fallback is reachable whenever the `nextcart_token` option has not yet been populated, which occurs after WP-CLI, network, or programmatic plugin activation without a subsequent authenticated `wp-admin
- Product
- Next-Cart Store to WooCommerce Migration
- Affected
- up to 3.9.8
- What to do
- Affects up to 3.9.8. Update Next-Cart Store to WooCommerce Migration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 9, 2026ELEX WooCommerce Request a Quote: Does not properly sanitise and escape a parameter before using it in a SQL queryCVE-2026-14962 · WordPress plugins & themes · reported by WPScanHigh 8.6
The ELEX WooCommerce Request a Quote WordPress plugin before 2.4.1 does not properly sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks and extract arbitrary data from the database.
- Product
- ELEX WooCommerce Request a Quote
- Fixed in
- 2.4.1
- What to do
- Update ELEX WooCommerce Request a Quote to 2.4.1 or newer.
Sep 8, 2026FireBox – WooCommerce Popup Builder, Exit Intent Popup, Email Optin & Cart Abandonment: Remote Code ExecutionCVE-2026-76801 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The FireBox – WooCommerce Popup Builder, Exit Intent Popup, Email Optin & Cart Abandonment plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 3.1.10 via the value function. This is due to a trivially bypassable regex blacklist in Executer::allowedToRun() that fails to block WordPress core functions such as wp_insert_user, update_option, and file_put_contents, combined with no sanitization of PHP condition rule values stored via the firebox_meta REST endpoint. This makes it possible for authenticated attackers, with author-level access and above, to execute code on the server. On sites upgraded from a version prior to 3.1.10, the Migrator::preserveCampaignRoleAccess() function automatically grants the edit_fireboxes and publish_fireboxes capabilities to the Author role, lowering the effective entry point to Author-level access.
- Product
- FireBox – WooCommerce Popup Builder, Exit Intent Popup, Email Optin & Cart Abandonment
- Affected
- up to 3.1.10
- What to do
- Affects up to 3.1.10. Update FireBox – WooCommerce Popup Builder, Exit Intent Popup, Email Optin & Cart Abandonment to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 8, 2026The Beaver Builder Page Builder – Drag and Drop Website Builder: Arbitrary shortcode executionCVE-2026-18021 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The The Beaver Builder Page Builder – Drag and Drop Website Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.10.3.1. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
- Product
- The Beaver Builder Page Builder – Drag and Drop Website Builder
- Affected
- up to 2.10.3.1
- What to do
- Affects up to 2.10.3.1. Update The Beaver Builder Page Builder – Drag and Drop Website Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 8, 2026EDD Product Catalog Feed by PixelYourSite: Unauthorized modification of data that can lead to a denial of serviceCVE-2026-9331 · WordPress plugins & themes · reported by WordfenceHigh 7.1
The EDD Product Catalog Feed by PixelYourSite plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capability check on the wpeddpcf_delete_feed function in all versions up to, and including, 1.0.2. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary option values on the WordPress site. This can be leveraged to delete an option that would create an error on the site and deny service to legitimate users.
- Product
- EDD Product Catalog Feed by PixelYourSite
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update EDD Product Catalog Feed by PixelYourSite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpixelyoursite.comwordfence.com
Sep 8, 2026Unauthenticated Cross Site Scripting (XSS) in Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 2.0.17 versions.CVE-2026-84820 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 2.0.17 versions.
- Affected
- up to 2.0.17
- What to do
- Affects up to 2.0.17. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 8, 2026Unauthenticated Cross Site Scripting (XSS) in Open User Map <= 1.4.50 versions.CVE-2026-84818 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Open User Map <= 1.4.50 versions.
- Affected
- up to 1.4.50
- What to do
- Affects up to 1.4.50. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 8, 2026Unauthenticated Cross Site Scripting (XSS) in JetFormBuilder <= 3.6.5.1 versions.CVE-2026-84817 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in JetFormBuilder <= 3.6.5.1 versions.
- Affected
- up to 3.6.5.1
- What to do
- Affects up to 3.6.5.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 8, 2026Product Catalog Enquiry for WooCommerce by MultiVendorX: Incorrect Privilege AssignmentCVE-2026-81792 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Incorrect Privilege Assignment vulnerability in MultiVendorX Product Catalog Enquiry for WooCommerce by MultiVendorX woocommerce-catalog-enquiry allows Privilege Escalation.This issue affects Product Catalog Enquiry for WooCommerce by MultiVendorX: from n/a through 6.1.5.
- Product
- Product Catalog Enquiry for WooCommerce by MultiVendorX
- Affected
- up to 6.1.5
- What to do
- Affects up to 6.1.5. Update Product Catalog Enquiry for WooCommerce by MultiVendorX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 7, 2026The Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for: Arbitrary shortcode executionCVE-2026-12757 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The The Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.9.27. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
- Product
- The Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for
- Affected
- up to 5.9.27
- What to do
- Affects up to 5.9.27. Update The Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 6, 2026The Redirection for Contact Form 7 WordPress plugin from 2.2.7 before 3.2.11 does not prevent shortcodes in submitted form values from being executed when it suCVE-2026-80439 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Redirection for Contact Form 7 WordPress plugin from 2.2.7 before 3.2.11 does not prevent shortcodes in submitted form values from being executed when it substitutes those values into an action's settings and then processes those settings for shortcodes, allowing unauthenticated users to run any shortcode registered on the site and read its output.
- Fixed in
- 3.2.11
- What to do
- Update the plugin to 3.2.11 or newer.
Sep 6, 2026The Ninja Forms WordPress plugin from 3.14.10 before 3.15.2 does not prevent shortcodes in request-derived values from being executed when it substitutes them iCVE-2026-80437 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Ninja Forms WordPress plugin from 3.14.10 before 3.15.2 does not prevent shortcodes in request-derived values from being executed when it substitutes them into content it later processes for shortcodes, allowing unauthenticated users to run any shortcode registered on the site.
- Fixed in
- 3.15.2
- What to do
- Update the plugin to 3.15.2 or newer.
Sep 6, 2026Real Estate Papi: Does not perform capability or CSRF checks on one of its AJAX actionsCVE-2026-13159 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Real Estate Papi WordPress theme through 1.0.5 does not perform capability or CSRF checks on one of its AJAX actions, allowing any authenticated user, such as a subscriber, to install a fixed set of companion from the WordPress.org repository. Where the request runs in the session of a user who can activate , those are activated as well.
- Product
- Real Estate Papi
- Affected
- up to 1.0.5
- What to do
- Affects up to 1.0.5. Update Real Estate Papi to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 5, 2026JCH Optimize: Does not perform a capability check on one of its authenticated AJAX actions and lets the request chooseCVE-2026-84934 · WordPress plugins & themes · reported by WPScanHigh 8
The JCH Optimize WordPress plugin before 6.0.1 does not perform a capability check on one of its authenticated AJAX actions and lets the request choose which internal action runs, allowing any authenticated users such as Subscribers to import arbitrary JCH Optimize WordPress plugin before 6.0.1 settings and store a script that executes in the browser of any visitor or administrator viewing the site.
- Product
- JCH Optimize
- Fixed in
- 6.0.1
- What to do
- Update JCH Optimize to 6.0.1 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.