Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
14,848 results · page 16 of 297
Oct 6, 2026Unauthenticated Cross Site Scripting (XSS) in StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart <= 2.0.6 CVE-2026-39750 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart <= 2.0.6 versions.
- Affected
- up to 2.0.6
- What to do
- Affects up to 2.0.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2026Booknetic: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-39746 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Booknetic Booknetic booknetic allows Blind SQL Injection.This issue affects Booknetic: from n/a before 5.10.3.
- Product
- Booknetic
- Fixed in
- 5.10.3
- What to do
- Update Booknetic to 5.10.3 or newer.
Oct 6, 2026Unauthenticated Server Side Request Forgery (SSRF) in PDF Smart Viewer for Elementor <= 1.0.4 versions.CVE-2026-39719 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Unauthenticated Server Side Request Forgery (SSRF) in PDF Smart Viewer for Elementor <= 1.0.4 versions.
- Affected
- up to 1.0.4
- What to do
- Affects up to 1.0.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2026Unauthenticated Arbitrary File Upload in Kognetiks Chatbot for WordPress <= 2.4.9 versions.CVE-2026-32579 · WordPress plugins & themes · reported by PatchstackCritical 10
Unauthenticated Arbitrary File Upload in Kognetiks Chatbot for WordPress <= 2.4.9 versions.
- Affected
- up to 2.4.9
- What to do
- Affects up to 2.4.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2026Unauthenticated Cross Site Scripting (XSS) in Frontend File Manager <= 23.6 versions.CVE-2026-32577 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Frontend File Manager <= 23.6 versions.
- Affected
- up to 23.6
- What to do
- Affects up to 23.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2026WooCommerce Appointments: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-32557 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in BookingWP WooCommerce Appointments woocommerce-appointments allows Blind SQL Injection.This issue affects WooCommerce Appointments: from n/a through 5.3.2.
- Product
- WooCommerce Appointments
- Affected
- up to 5.3.2
- What to do
- Affects up to 5.3.2. Update WooCommerce Appointments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2026Subscriber SQL Injection in WP2LEADS <= 3.5.7 versions.CVE-2026-25434 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Subscriber SQL Injection in WP2LEADS <= 3.5.7 versions.
- Affected
- up to 3.5.7
- What to do
- Affects up to 3.5.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2026Subscriber Broken Access Control in WP2LEADS <= 3.5.7 versions.CVE-2026-25433 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Subscriber Broken Access Control in WP2LEADS <= 3.5.7 versions.
- Affected
- up to 3.5.7
- What to do
- Affects up to 3.5.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2026JetElements For Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-105879 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetElements For Elementor jet-elements allows Stored XSS.This issue affects JetElements For Elementor: from n/a through 2.9.2.2.
- Product
- JetElements For Elementor
- Affected
- up to 2.9.2.2
- What to do
- Affects up to 2.9.2.2. Update JetElements For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2026Unauthenticated Privilege Escalation in Salon booking system <= 10.31.7 versions.CVE-2026-105070 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Unauthenticated Privilege Escalation in Salon booking system <= 10.31.7 versions.
- Affected
- up to 10.31.7
- What to do
- Affects up to 10.31.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2026Delete All Comments of: Missing AuthorizationCVE-2026-105059 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in royalnavneet Delete All Comments of wordpress delete-all-comments-of-website allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Delete All Comments of wordpress: from n/a through 7.1.
- Product
- Delete All Comments of
- Affected
- up to 7.1
- What to do
- Affects up to 7.1. Update Delete All Comments of to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2026Subscriber Privilege Escalation in WP User Profiles <= 2.7.3 versions.CVE-2026-105058 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Subscriber Privilege Escalation in WP User Profiles <= 2.7.3 versions.
- Affected
- up to 2.7.3
- What to do
- Affects up to 2.7.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2026Editor Privilege Escalation in Import and export users and customers <= 2.5.5 versions.CVE-2026-104757 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Editor Privilege Escalation in Import and export users and customers <= 2.5.5 versions.
- Affected
- up to 2.5.5
- What to do
- Affects up to 2.5.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2026Unauthenticated Cross Site Scripting (XSS) in LearnPress <= 4.4.9 versions.CVE-2026-104670 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in LearnPress <= 4.4.9 versions.
- Affected
- up to 4.4.9
- What to do
- Affects up to 4.4.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2026Unauthenticated Privilege Escalation in GiveWP <= 4.17.0 versions.CVE-2026-104405 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Privilege Escalation in GiveWP <= 4.17.0 versions.
- Affected
- up to 4.17.0
- What to do
- Affects up to 4.17.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2026Unauthenticated Cross Site Scripting (XSS) in Charitable <= 1.8.12.3 versions.CVE-2026-104394 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Charitable <= 1.8.12.3 versions.
- Affected
- up to 1.8.12.3
- What to do
- Affects up to 1.8.12.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2026Payflex Payment Gateway: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-103346 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tomlister Payflex Payment Gateway payflex-payment-gateway allows Reflected XSS.This issue affects Payflex Payment Gateway: from n/a through 2.7.1.
- Product
- Payflex Payment Gateway
- Affected
- up to 2.7.1
- What to do
- Affects up to 2.7.1. Update Payflex Payment Gateway to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2026Unauthenticated Broken Authentication in Advanced Google reCAPTCHA <= 5.40 versions.CVE-2026-100518 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Broken Authentication in Advanced Google reCAPTCHA <= 5.40 versions.
- Affected
- up to 5.40
- What to do
- Affects up to 5.40. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2026elegro Crypto Payment: Does not require a shared secret to be configured before trusting incoming payment notification requestsCVE-2026-94299 · WordPress plugins & themes · reported by WPScanMedium 6.5
The elegro Crypto Payment WordPress plugin through 1.0.1 does not require a shared secret to be configured before trusting incoming payment notification requests, allowing unauthenticated attackers to forge payment confirmations and change the status of arbitrary orders on any installation where that secret has been left at its default empty value.
- Product
- elegro Crypto Payment
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update elegro Crypto Payment to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2026File Media Renamer: Does not verify that the requesting user is authorised to modify a given media attachmentCVE-2026-94278 · WordPress plugins & themes · reported by WPScanMedium 5.5
The File Media Renamer WordPress plugin through 1.3 does not verify that the requesting user is authorised to modify a given media attachment, allowing any user with file-upload privileges to rename attachments belonging to other users, including administrators, and to corrupt unrelated stored site data that referenced the old file path.
- Product
- File Media Renamer
- Affected
- up to 1.3
- What to do
- Affects up to 1.3. Update File Media Renamer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2026Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App: Stored Cross-Site ScriptingCVE-2026-75962 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'user_email' parameter in all versions up to, and including, 4.0.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable without authentication on WordPress Multisite installations with public registration enabled, as WordPress accepts email addresses containing numeric HTML character references that Post SMTP's stricter validator rejects, persisting the attacker-controlled address verbatim to the email log via the failed-send exception message.
- Product
- Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App
- Affected
- up to 4.0.1
- What to do
- Affects up to 4.0.1. Update Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 6, 2026Subscriber Bypass Vulnerability in WP Migration Plugin DB & Files – WP Synchro <= 1.16.1 versions.CVE-2026-41558 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Subscriber Bypass Vulnerability in WP Migration Plugin DB & Files – WP Synchro <= 1.16.1 versions.
- Affected
- up to 1.16.1
- What to do
- Affects up to 1.16.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2026Faktur Pro for WooCommerce: Authorization Bypass Through User-Controlled KeyCVE-2026-32576 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Authorization Bypass Through User-Controlled Key vulnerability in ZWEISCHNEIDER Faktur Pro for WooCommerce woorechnung allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Faktur Pro for WooCommerce: from n/a through 3.2.2.
- Product
- Faktur Pro for WooCommerce
- Affected
- up to 3.2.2
- What to do
- Affects up to 3.2.2. Update Faktur Pro for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026Simple Event Planner: Deserialization of Untrusted DataCVE-2026-97257 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in PressTigers Simple Event Planner simple-event-planner allows Object Injection.This issue affects Simple Event Planner: from n/a through 1.5.7.
- Product
- Simple Event Planner
- Affected
- up to 1.5.7
- What to do
- Affects up to 1.5.7. Update Simple Event Planner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026WP BASE Booking: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-103066 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP BASE WP BASE Booking wp-base-booking-of-appointments-services-and-events allows Blind SQL Injection.This issue affects WP BASE Booking: from n/a through 6.4.0.
- Product
- WP BASE Booking
- Affected
- up to 6.4.0
- What to do
- Affects up to 6.4.0. Update WP BASE Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026VK Google Job Posting Manager: Deserialization of Untrusted DataCVE-2026-100511 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in Vektor Inc. VK Google Job Posting Manager vk-google-job-posting-manager allows Object Injection.This issue affects VK Google Job Posting Manager: from n/a through 1.3.1.
- Product
- VK Google Job Posting Manager
- Affected
- up to 1.3.1
- What to do
- Affects up to 1.3.1. Update VK Google Job Posting Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026AI Chatbot for WordPress – Hyve Lite: Authorization Bypass Through User-Controlled KeyCVE-2026-97305 · WordPress plugins & themes · reported by PatchstackMedium 6.9
Authorization Bypass Through User-Controlled Key vulnerability in Themeisle AI Chatbot for WordPress – Hyve Lite hyve-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AI Chatbot for WordPress – Hyve Lite: from n/a through 2.0.2.
- Product
- AI Chatbot for WordPress – Hyve Lite
- Affected
- up to 2.0.2
- What to do
- Affects up to 2.0.2. Update AI Chatbot for WordPress – Hyve Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026Cozy Blocks: Authorization Bypass Through User-Controlled KeyCVE-2026-97070 · WordPress plugins & themes · reported by PatchstackMedium 6.9
Authorization Bypass Through User-Controlled Key vulnerability in CozyThemes Cozy Blocks cozy-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cozy Blocks: from n/a through 2.2.23.
- Product
- Cozy Blocks
- Affected
- up to 2.2.23
- What to do
- Affects up to 2.2.23. Update Cozy Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026WP BASE Booking: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-103352 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP BASE WP BASE Booking wp-base-booking-of-appointments-services-and-events allows Blind SQL Injection.This issue affects WP BASE Booking: from n/a through 6.4.0.
- Product
- WP BASE Booking
- Affected
- up to 6.4.0
- What to do
- Affects up to 6.4.0. Update WP BASE Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026LearnPress: Stored cross-site scriptingCVE-2026-105397 · WordPress plugins & themes · reported by VulnCheckMedium 5.1
LearnPress plugin for WordPress through 4.4.9.1 contains a stored cross-site scripting vulnerability that allows authenticated instructors to inject scripts via quiz question hint and explanation fields. Attackers with the Instructor role can submit unsanitized payloads through the update_question AJAX handler that execute in the session of every student taking the quiz.
- Product
- LearnPress
- Affected
- up to 4.4.9.1
- What to do
- Affects up to 4.4.9.1. Update LearnPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.complugins.svn.wordpress.org
Oct 5, 2026Unlimited Elements For Elementor (Free Widgets, Addons, Templates): Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')CVE-2026-105064 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor allows Parameter Injection.This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 2.0.22.
- Product
- Unlimited Elements For Elementor (Free Widgets, Addons, Templates)
- Affected
- up to 2.0.22
- What to do
- Affects up to 2.0.22. Update Unlimited Elements For Elementor (Free Widgets, Addons, Templates) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026Image Photo Gallery Final Tiles Grid: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-104409 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Image Photo Gallery Final Tiles Grid final-tiles-grid-gallery-lite allows Stored XSS.This issue affects Image Photo Gallery Final Tiles Grid: from n/a through 3.6.13.
- Product
- Image Photo Gallery Final Tiles Grid
- Affected
- up to 3.6.13
- What to do
- Affects up to 3.6.13. Update Image Photo Gallery Final Tiles Grid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026Groundhogg: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-104408 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Groundhogg Groundhogg groundhogg allows Blind SQL Injection.This issue affects Groundhogg: from n/a through 4.8.3.
- Product
- Groundhogg
- Affected
- up to 4.8.3
- What to do
- Affects up to 4.8.3. Update Groundhogg to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026Sirv: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-104389 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Sirv Sirv sirv allows Blind SQL Injection.This issue affects Sirv: from n/a through 8.2.5.
- Product
- Sirv
- Affected
- up to 8.2.5
- What to do
- Affects up to 8.2.5. Update Sirv to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026Premium Addons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-103084 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LeapWorx Premium Addons for Elementor premium-addons-for-elementor allows Stored XSS.This issue affects Premium Addons for Elementor: from n/a through 4.11.109.
- Product
- Premium Addons for Elementor
- Affected
- up to 4.11.109
- What to do
- Affects up to 4.11.109. Update Premium Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026JS Help Desk: Authorization Bypass Through User-Controlled KeyCVE-2026-103079 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Authorization Bypass Through User-Controlled Key vulnerability in Ahmad JS Help Desk js-support-ticket allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JS Help Desk: from n/a through 4.0.0.
- Product
- JS Help Desk
- Affected
- up to 4.0.0
- What to do
- Affects up to 4.0.0. Update JS Help Desk to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026JS Help Desk: Authorization Bypass Through User-Controlled KeyCVE-2026-103078 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Authorization Bypass Through User-Controlled Key vulnerability in Ahmad JS Help Desk js-support-ticket allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JS Help Desk: from n/a through 4.0.0.
- Product
- JS Help Desk
- Affected
- up to 4.0.0
- What to do
- Affects up to 4.0.0. Update JS Help Desk to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026File Uploads Addon for WooCommerce: Does not verify that the person requesting a customer-uploaded file is the customer who uploaded itCVE-2026-78371 · WordPress plugins & themes · reported by WPScanMedium 5.9
The File Uploads Addon for WooCommerce WordPress plugin before 1.7.6 does not verify that the person requesting a customer-uploaded file is the customer who uploaded it, allowing unauthenticated attackers who know or guess a file's name to download other customers' uploaded files.
- Product
- File Uploads Addon for WooCommerce
- Fixed in
- 1.7.6
- What to do
- Update File Uploads Addon for WooCommerce to 1.7.6 or newer.
Oct 5, 2026File Uploads Addon for WooCommerce: Stores customer-uploaded files in a publicly web-accessible uploads directory and the access restriction it generates is ineffectiveCVE-2026-13607 · WordPress plugins & themes · reported by WPScanMedium 5.9
The File Uploads Addon for WooCommerce WordPress plugin through 1.7.6 stores customer-uploaded files in a publicly web-accessible uploads directory and the access restriction it generates is ineffective, so an unauthenticated attacker who knows or guesses a file's name can retrieve customer-uploaded files directly, bypassing the File Uploads Addon for WooCommerce WordPress plugin through 1.7.6's authenticated download mechanism.
- Product
- File Uploads Addon for WooCommerce
- Affected
- up to 1.7.6
- What to do
- Affects up to 1.7.6. Update File Uploads Addon for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 4, 2026Unlimited Elements For Elementor (Free Widgets, Addons, Templates): Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-103355 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor allows Blind SQL Injection.This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 2.0.20.
- Product
- Unlimited Elements For Elementor (Free Widgets, Addons, Templates)
- Affected
- up to 2.0.20
- What to do
- Affects up to 2.0.20. Update Unlimited Elements For Elementor (Free Widgets, Addons, Templates) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 4, 2026Unlimited Elements For Elementor (Free Widgets, Addons, Templates): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-103344 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor allows Reflected XSS.This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 2.0.20.
- Product
- Unlimited Elements For Elementor (Free Widgets, Addons, Templates)
- Affected
- up to 2.0.20
- What to do
- Affects up to 2.0.20. Update Unlimited Elements For Elementor (Free Widgets, Addons, Templates) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 4, 2026User Private Files: Does not properly protect its stored private files on multisite installationsCVE-2026-97332 · WordPress plugins & themes · reported by WPScanMedium 5.3
The User Private Files WordPress plugin before 2.2.0 does not properly protect its stored private files on multisite installations, where the rewrite rule it relies on to route file requests through its access check is never reached, allowing unauthenticated users to retrieve other users' private files directly.
- Product
- User Private Files
- Fixed in
- 2.2.0
- What to do
- Update User Private Files to 2.2.0 or newer.
Oct 4, 2026Five Star Business Profile and Schema: Does not properly restrict the callbacks used to resolve schema field default valuesCVE-2026-86817 · WordPress plugins & themes · reported by WPScanMedium 4.9
The Five Star Business Profile and Schema WordPress plugin before 2.4.0 does not properly restrict the callbacks used to resolve schema field default values, allowing authenticated users with Author-level access and above to store input that discloses sensitive data, including other users' password hashes and arbitrary site option values, in public output readable by unauthenticated visitors.
- Product
- Five Star Business Profile and Schema
- Fixed in
- 2.4.0
- What to do
- Update Five Star Business Profile and Schema to 2.4.0 or newer.
Oct 4, 2026Simple Shopping Cart: Does not escape some of its settings field values before outputting them on an admin settings pageCVE-2026-104119 · WordPress plugins & themes · reported by WPScanLow 3.5
The Simple Shopping Cart WordPress plugin before 5.2.6 does not escape some of its settings field values before outputting them on an admin settings page, allowing high-privilege users such as administrators to perform Stored Cross-Site Scripting attacks, which is notably impactful on multisite installations where administrators do not have the unfiltered_html capability.
- Product
- Simple Shopping Cart
- Fixed in
- 5.2.6
- What to do
- Update Simple Shopping Cart to 5.2.6 or newer.
Oct 3, 2026Ultimate Member: Authorization Bypass Through User-Controlled KeyCVE-2026-96451 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Authorization Bypass Through User-Controlled Key vulnerability in Ultimate Member Ultimate Member ultimate-member allows Privilege Escalation.This issue affects Ultimate Member: from n/a through 2.13.1.
- Product
- Ultimate Member
- Affected
- up to 2.13.1
- What to do
- Affects up to 2.13.1. Update Ultimate Member to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 3, 2026Unlimited Elements For Elementor (Free Widgets, Addons, Templates): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-103342 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor allows Reflected XSS.This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 2.0.20.
- Product
- Unlimited Elements For Elementor (Free Widgets, Addons, Templates)
- Affected
- up to 2.0.20
- What to do
- Affects up to 2.0.20. Update Unlimited Elements For Elementor (Free Widgets, Addons, Templates) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 3, 2026Burst Statistics – Simple WordPress Analytics (Google Analytics Alternative): Improper Authentication leading to Account PersistenceCVE-2026-97343 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Burst Statistics – Simple WordPress Analytics (Google Analytics Alternative) plugin for WordPress is vulnerable to Improper Authentication leading to Account Persistence in all versions up to, and including, 3.7.1. This is due to the `maybe_load_shared_dashboard()` handler issuing a genuine WordPress session cookie for the `burst_statistics_viewer` account to any visitor presenting a valid share token via `wp_set_auth_cookie()`, while the plugin only blocks Application Passwords for the resulting `burst_viewer` role and does not restrict the core `/wp-json/wp/v2/users/me` password update endpoint or filter the `edit_user` capability for that account — leaving WordPress core's built-in rule that any authenticated user may update their own account fully in effect. This makes it possible for unauthenticated attackers to set an attacker-chosen password on the `burst_statistics_viewer` WordPress account, constituting a permanent takeover of that limited-privilege (`view_burst_statistics`) account that persists through share-token revocation, share-token expiration, and execution of the plugin's daily `cleanup_viewer_sessions()` routine. Exploitation requires that the attacker have o
- Product
- Burst Statistics – Simple WordPress Analytics (Google Analytics Alternative)
- Affected
- up to 3.7.1
- What to do
- Affects up to 3.7.1. Update Burst Statistics – Simple WordPress Analytics (Google Analytics Alternative) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.complugins.trac.wordpress.org
Oct 3, 2026Nelio Content – Editorial Calendar & Social Media Auto-Posting: Authorization bypassCVE-2026-94505 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Nelio Content – Editorial Calendar & Social Media Auto-Posting plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5.0 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to permanently delete any reusable social message (nc_reusable_social post), including those authored by administrators or other privileged users.
- Product
- Nelio Content – Editorial Calendar & Social Media Auto-Posting
- Affected
- up to 4.5.0
- What to do
- Affects up to 4.5.0. Update Nelio Content – Editorial Calendar & Social Media Auto-Posting to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 3, 2026WPFront Notification Bar: Reflected Cross-Site ScriptingCVE-2026-93896 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WPFront Notification Bar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 3.5.1. This is due to the debug-log output path (write_debug_logs) reflecting the raw value of $_SERVER['REQUEST_URI'] through vprintf() directly inside a <script> block emitted on wp_footer, without any sanitization or escaping (see the 'Current URL is "%s"' log entry produced by the URL-text display filter in the filter() method). This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a specially crafted link.
- Product
- WPFront Notification Bar
- Affected
- up to 3.5.1
- What to do
- Affects up to 3.5.1. Update WPFront Notification Bar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 3, 2026Photo Gallery by 10Web – Mobile-Friendly Image Gallery: Reflected Cross-Site ScriptingCVE-2026-92974 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'thumb_url' parameter in all versions up to, and including, 1.8.46 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Exploitation requires that the authenticated victim holds the manage_options capability, as the editimage_bwg AJAX action performs a capability check but no nonce verification, meaning the payload can be delivered via a crafted GET request without a CSRF token.
- Product
- Photo Gallery by 10Web – Mobile-Friendly Image Gallery
- Affected
- up to 1.8.46
- What to do
- Affects up to 1.8.46. Update Photo Gallery by 10Web – Mobile-Friendly Image Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.