Vulnerability database

10,137 results · page 17 of 203

• Sep 30, 2026Unauthenticated Broken Access Control in WP Express Checkout (Accept PayPal Payments) <= 2.4.9 versions.CVE-2026-96818 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Unauthenticated Broken Access Control in WP Express Checkout (Accept PayPal Payments) <= 2.4.9 versions.

  Affected

  up to 2.4.9

  What to do

  Affects up to 2.4.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 30, 2026Unauthenticated Cross Site Scripting (XSS) in Trusted Shops Easy Integration for WooCommerce <= 2.0.6 versions.CVE-2026-96816 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in Trusted Shops Easy Integration for WooCommerce <= 2.0.6 versions.

  Affected

  up to 2.0.6

  What to do

  Affects up to 2.0.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 30, 2026Unauthenticated Cross Site Scripting (XSS) in WooCommerce Product Table Lite <= 5.6.7 versions.CVE-2026-96814 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in WooCommerce Product Table Lite <= 5.6.7 versions.

  Affected

  up to 5.6.7

  What to do

  Affects up to 5.6.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 30, 2026Unauthenticated Cross Site Scripting (XSS) in YITH WooCommerce Ajax Search <= 2.28.0 versions.CVE-2026-96352 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in YITH WooCommerce Ajax Search <= 2.28.0 versions.

  Affected

  up to 2.28.0

  What to do

  Affects up to 2.28.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 30, 2026Unauthenticated Cross Site Scripting (XSS) in Classified Listing <= 6.1.3 versions.CVE-2026-96351 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in Classified Listing <= 6.1.3 versions.

  Affected

  up to 6.1.3

  What to do

  Affects up to 6.1.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 30, 2026Unauthenticated Remote Code Execution (RCE) in SiteSkite <= 2.1.8 versions.CVE-2026-96349 · WordPress plugins & themes · reported by PatchstackCritical 10

  Unauthenticated Remote Code Execution (RCE) in SiteSkite <= 2.1.8 versions.

  Affected

  up to 2.1.8

  What to do

  Affects up to 2.1.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 30, 2026Unauthenticated Broken Access Control in Bookly <= 28.2 versions.CVE-2026-96348 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Unauthenticated Broken Access Control in Bookly <= 28.2 versions.

  Affected

  up to 28.2

  What to do

  Affects up to 28.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 30, 2026Author SQL Injection in WP ERP <= 1.17.9 versions.CVE-2026-96346 · WordPress plugins & themes · reported by PatchstackHigh 7.6

  Author SQL Injection in WP ERP <= 1.17.9 versions.

  Affected

  up to 1.17.9

  What to do

  Affects up to 1.17.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 30, 2026Unauthenticated Broken Access Control in Hostinger Migrator <= 1.0 versions.CVE-2026-95587 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Unauthenticated Broken Access Control in Hostinger Migrator <= 1.0 versions.

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 30, 2026Unauthenticated Denial of Service Attack in WP Store Locator < 3.0.0 versions.CVE-2026-94681 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Unauthenticated Denial of Service Attack in WP Store Locator < 3.0.0 versions.

  What to do

  Update the plugin to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Sep 30, 2026Unauthenticated Insecure Direct Object References (IDOR) in Simply Schedule Appointments <= 1.6.12.31 versions.CVE-2026-94673 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Unauthenticated Insecure Direct Object References (IDOR) in Simply Schedule Appointments <= 1.6.12.31 versions.

  Affected

  up to 1.6.12.31

  What to do

  Affects up to 1.6.12.31. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 30, 2026Unauthenticated Remote Code Execution (RCE) in AcyMailing SMTP Newsletter <= 11.0.5 versions.CVE-2026-94389 · WordPress plugins & themes · reported by PatchstackCritical 9

  Unauthenticated Remote Code Execution (RCE) in AcyMailing SMTP Newsletter <= 11.0.5 versions.

  Affected

  up to 11.0.5

  What to do

  Affects up to 11.0.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 30, 2026Unauthenticated Arbitrary File Download in NextGEN Gallery <= 4.5.0 versions.CVE-2026-94123 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Unauthenticated Arbitrary File Download in NextGEN Gallery <= 4.5.0 versions.

  Affected

  up to 4.5.0

  What to do

  Affects up to 4.5.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 30, 2026Unauthenticated Broken Access Control in GravityExport Lite for Gravity Forms <= 2.7.2 versions.CVE-2026-94120 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Unauthenticated Broken Access Control in GravityExport Lite for Gravity Forms <= 2.7.2 versions.

  Affected

  up to 2.7.2

  What to do

  Affects up to 2.7.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 30, 2026Author SQL Injection in Quiz Cat <= 3.1.1 versions.CVE-2026-94082 · WordPress plugins & themes · reported by PatchstackHigh 7.6

  Author SQL Injection in Quiz Cat <= 3.1.1 versions.

  Affected

  up to 3.1.1

  What to do

  Affects up to 3.1.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 30, 2026Unauthenticated Cross Site Scripting (XSS) in WordPress Persistent Login <= 3.1.3 versions.CVE-2026-94081 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in WordPress Persistent Login <= 3.1.3 versions.

  Affected

  up to 3.1.3

  What to do

  Affects up to 3.1.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 30, 2026Unauthenticated Cross Site Scripting (XSS) in Site Reviews <= 8.3.1 versions.CVE-2026-94078 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in Site Reviews <= 8.3.1 versions.

  Affected

  up to 8.3.1

  What to do

  Affects up to 8.3.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 30, 2026Unauthenticated Broken Access Control in Simply Schedule Appointments <= 1.6.12.29 versions.CVE-2026-94074 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Unauthenticated Broken Access Control in Simply Schedule Appointments <= 1.6.12.29 versions.

  Affected

  up to 1.6.12.29

  What to do

  Affects up to 1.6.12.29. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 30, 2026Unauthenticated Cross Site Scripting (XSS) in WP Statistics <= 14.16.13 versions.CVE-2026-93770 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in WP Statistics <= 14.16.13 versions.

  Affected

  up to 14.16.13

  What to do

  Affects up to 14.16.13. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 30, 2026Author PHP Object Injection in Minimum and Maximum Quantity for WooCommerce <= 2.1.2 versions.CVE-2026-93651 · WordPress plugins & themes · reported by PatchstackHigh 7.2

  Author PHP Object Injection in Minimum and Maximum Quantity for WooCommerce <= 2.1.2 versions.

  Affected

  up to 2.1.2

  What to do

  Affects up to 2.1.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 30, 2026Unauthenticated SQL Injection in WP Data Access <= 5.5.84 versions.CVE-2026-93621 · WordPress plugins & themes · reported by PatchstackHigh 8.2

  Unauthenticated SQL Injection in WP Data Access <= 5.5.84 versions.

  Affected

  up to 5.5.84

  What to do

  Affects up to 5.5.84. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 30, 2026Unauthenticated Cross Site Scripting (XSS) in Notification for Telegram <= 3.5.2 versions.CVE-2026-93514 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in Notification for Telegram <= 3.5.2 versions.

  Affected

  up to 3.5.2

  What to do

  Affects up to 3.5.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 30, 2026Unauthenticated Cross Site Scripting (XSS) in JW Player for WordPress <= 2.3.11 versions.CVE-2026-93512 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in JW Player for WordPress <= 2.3.11 versions.

  Affected

  up to 2.3.11

  What to do

  Affects up to 2.3.11. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 30, 2026Unauthenticated Cross Site Scripting (XSS) in WPFunnels <= 3.13.1 versions.CVE-2026-27371 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in WPFunnels <= 3.13.1 versions.

  Affected

  up to 3.13.1

  What to do

  Affects up to 3.13.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 30, 2026Unauthenticated Cross Site Request Forgery (CSRF) in Photo Gallery by Supsystic <= 1.21.0 versions.CVE-2026-102399 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Unauthenticated Cross Site Request Forgery (CSRF) in Photo Gallery by Supsystic <= 1.21.0 versions.

  Affected

  up to 1.21.0

  What to do

  Affects up to 1.21.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 30, 2026Unauthenticated Cross Site Scripting (XSS) in Popup by Supsystic <= 1.13.1 versions.CVE-2026-102398 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in Popup by Supsystic <= 1.13.1 versions.

  Affected

  up to 1.13.1

  What to do

  Affects up to 1.13.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 30, 2026Unauthenticated Cross Site Scripting (XSS) in Ultimate Maps by Supsystic <= 1.5.5 versions.CVE-2026-102396 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in Ultimate Maps by Supsystic <= 1.5.5 versions.

  Affected

  up to 1.5.5

  What to do

  Affects up to 1.5.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 30, 2026Unauthenticated Cross Site Scripting (XSS) in Easy Google Maps <= 1.14.6 versions.CVE-2026-102395 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in Easy Google Maps <= 1.14.6 versions.

  Affected

  up to 1.14.6

  What to do

  Affects up to 1.14.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 30, 2026Unauthenticated Cross Site Scripting (XSS) in Ninja Forms <= 3.15.3 versions.CVE-2026-102385 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in Ninja Forms <= 3.15.3 versions.

  Affected

  up to 3.15.3

  What to do

  Affects up to 3.15.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 30, 2026Author Cross Site Scripting (XSS) in Supreme Modules Lite <= 2.5.63 versions.CVE-2026-102384 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Author Cross Site Scripting (XSS) in Supreme Modules Lite <= 2.5.63 versions.

  Affected

  up to 2.5.63

  What to do

  Affects up to 2.5.63. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 30, 2026Unauthenticated Denial of Service Attack in Two Factor <= 0.16.0 versions.CVE-2026-100508 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Unauthenticated Denial of Service Attack in Two Factor <= 0.16.0 versions.

  Affected

  up to 0.16.0

  What to do

  Affects up to 0.16.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 30, 2026WPMobile.App: Missing AuthorizationCVE-2026-96342 · WordPress plugins & themes · reported by PatchstackMedium 6.9

  Missing Authorization vulnerability in Amauri.IO WPMobile.App wpappninja allows Retrieve Embedded Sensitive Data.This issue affects WPMobile.App: from n/a through 11.83.

  Product

  WPMobile.App

  Affected

  up to 11.83

  What to do

  Affects up to 11.83. Update WPMobile.App to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 30, 2026InPost PL: Does not verify the authenticity of incoming shipment webhook requestsCVE-2026-93580 · WordPress plugins & themes · reported by WPScanMedium 5.3

  The InPost PL WordPress plugin before 1.9.8 does not verify the authenticity of incoming shipment webhook requests, relying only on a non-secret identifier and an IP check that is not enforced, allowing unauthenticated attackers who know a target order's parcel tracking number to forge its shipment status and prematurely mark the order completed.

  Product

  InPost PL

  Fixed in

  1.9.8

  What to do

  Update InPost PL to 1.9.8 or newer.

  Full record and what to do →NVD recordwpscan.com

• Sep 30, 2026Content Egg: Does not verify that a user running its bulk content-import feature is authorized for the import preset they selectCVE-2026-92424 · WordPress plugins & themes · reported by WPScanMedium 6.8

  The Content Egg WordPress plugin before 11.9.0 does not verify that a user running its bulk content-import feature is authorized for the import preset they select, and switches to the preset author's identity before creating the resulting post, allowing users with contributor-level access and above to store arbitrary web scripts unfiltered under a privileged user's account, executing in the context of anyone who later views that content.

  Product

  Content Egg

  Fixed in

  11.9.0

  What to do

  Update Content Egg to 11.9.0 or newer.

  Full record and what to do →NVD recordwpscan.com

• Sep 30, 2026EWWW Image Optimizer: Does not prevent authenticated users with author-level permissions from storing a serialized value in a post meta field that is deserializedCVE-2026-91051 · WordPress plugins & themes · reported by WPScanMedium 6.6

  The EWWW Image Optimizer WordPress plugin before 8.8.0 does not prevent authenticated users with author-level permissions from storing a serialized value in a post meta field that is deserialized when the post is rendered, allowing them to perform PHP Object Injection, which can lead to remote code execution when a suitable gadget chain is present via another installed EWWW Image Optimizer WordPress plugin before 8.8.0 or .

  Product

  EWWW Image Optimizer

  Fixed in

  8.8.0

  What to do

  Update EWWW Image Optimizer to 8.8.0 or newer.

  Full record and what to do →NVD recordwpscan.com

• Sep 30, 2026All in One Files Upload: Adds SVG to the site's allowed upload types and does not sanitise uploaded files or verify the authenticity of its public upload requestsCVE-2026-85573 · WordPress plugins & themes · reported by WPScanHigh 8.8

  The All in One Files Upload WordPress plugin before 2.0.17 adds SVG to the site's allowed upload types and does not sanitise uploaded files or verify the authenticity of its public upload requests, allowing unauthenticated users to store files containing active content which run in the site's origin when a victim opens them.

  Product

  All in One Files Upload

  Fixed in

  2.0.17

  What to do

  Update All in One Files Upload to 2.0.17 or newer.

  Full record and what to do →NVD recordwpscan.com

• Sep 30, 2026New User Approve: Does not properly verify authentication on a set of integration REST API routesCVE-2026-83560 · WordPress plugins & themes · reported by WPScanMedium 5.3

  The New User Approve WordPress plugin before 3.2.10 does not properly verify authentication on a set of integration REST API routes when the integration is unconfigured, allowing unauthenticated attackers to retrieve personal data (id, username, email address and registration date) of registered users.

  Product

  New User Approve

  Fixed in

  3.2.10

  What to do

  Update New User Approve to 3.2.10 or newer.

  Full record and what to do →NVD recordwpscan.com

• Sep 30, 2026Solace Extra: Does not perform any authorization or post-status checks on its front-end preview routesCVE-2026-80333 · WordPress plugins & themes · reported by WPScanMedium 5.3

  The Solace Extra WordPress plugin before 1.7.2 does not perform any authorization or post-status checks on its front-end preview routes, allowing unauthenticated visitors to read the rendered content of non-published posts and pages of any type that WordPress would otherwise not serve.

  Product

  Solace Extra

  Fixed in

  1.7.2

  What to do

  Update Solace Extra to 1.7.2 or newer.

  Full record and what to do →NVD recordwpscan.com

• Sep 28, 2026The Paymattic WordPress plugin from 4.6.20 before 4.6.26 does not verify that a confirmed Stripe payment belongs to the order it is applied to, allowing unautheCVE-2026-89411 · WordPress plugins & themes · reported by WPScanMedium 5.3

  The Paymattic WordPress plugin from 4.6.20 before 4.6.26 does not verify that a confirmed Stripe payment belongs to the order it is applied to, allowing unauthenticated users to mark an arbitrary pending order as paid by confirming a smaller payment of their own against it.

  Fixed in

  4.6.26

  What to do

  Update the plugin to 4.6.26 or newer.

  Full record and what to do →NVD recordwpscan.com

• Sep 28, 2026WP Verify API: Does not have any authorisation check in one of its REST routesCVE-2026-89300 · WordPress plugins & themes · reported by WPScanMedium 5.3

  The WP Verify API WordPress plugin through 1.0.0 does not have any authorisation check in one of its REST routes, allowing unauthenticated users to insert arbitrary data into its own database table, as well as to make the site send templated verification emails to arbitrary email addresses. The route is not rate limited either.

  Product

  WP Verify API

  Affected

  up to 1.0.0

  What to do

  Affects up to 1.0.0. Update WP Verify API to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordwpscan.com

• Sep 28, 2026The Blacklist Manager for WooCommerce WordPress plugin from 1.3.0 to 2.3.1 does not enforce its user blocking on every authentication path, allowing the holder CVE-2026-88828 · WordPress plugins & themes · reported by WPScanMedium 5.4

  The Blacklist Manager for WooCommerce WordPress plugin from 1.3.0 to 2.3.1 does not enforce its user blocking on every authentication path, allowing the holder of an account the site owner has blocked to keep authenticating with that account's privileges, without the block being enforced or recorded.

  What to do

  Update the plugin to the newest version.

  Full record and what to do →NVD recordwpscan.com

• Sep 27, 2026Optima Express IDX: Does not perform any authorisation check on one of its AJAX actions that is available to logged-out usersCVE-2026-96897 · WordPress plugins & themes · reported by WPScanMedium 5.3

  The Optima Express IDX WordPress plugin before 8.7.6 does not perform any authorisation check on one of its AJAX actions that is available to logged-out users, allowing unauthenticated attackers to force the creation of a fixed author-role account and to repeatedly rotate its application password on any connected install.

  Product

  Optima Express IDX

  Fixed in

  8.7.6

  What to do

  Update Optima Express IDX to 8.7.6 or newer.

  Full record and what to do →NVD recordwpscan.com

• Sep 27, 2026Malcure Malware Shield — Removal, Repair, Monitor: Does not perform an authorisation check on one of its AJAX actionsCVE-2026-96896 · WordPress plugins & themes · reported by WPScanHigh 7.2

  The Malcure Malware Shield — Removal, Repair, Monitor WordPress plugin before 19.9.7 does not perform an authorisation check on one of its AJAX actions, allowing users with a subsite administrator role on a multisite network to write and delete arbitrary files in the network's shared filesystem, which can lead to remote code execution.

  Product

  Malcure Malware Shield — Removal, Repair, Monitor

  Fixed in

  19.9.7

  What to do

  Update Malcure Malware Shield — Removal, Repair, Monitor to 19.9.7 or newer.

  Full record and what to do →NVD recordwpscan.com

• Sep 27, 2026Mailchimp for WooCommerce: Does not require authentication or verify ownership before loading a saved cart from a request-supplied identifier that is derived from a customer's email addressCVE-2026-92436 · WordPress plugins & themes · reported by WPScanMedium 5.3

  The Mailchimp for WooCommerce WordPress plugin before 6.3 does not require authentication or verify ownership before loading a saved cart from a request-supplied identifier that is derived from a customer's email address, allowing an unauthenticated attacker who knows a customer's email address to confirm that the customer shops at the store and to read that customer's saved cart contents.

  Product

  Mailchimp for WooCommerce

  Fixed in

  6.3

  What to do

  Update Mailchimp for WooCommerce to 6.3 or newer.

  Full record and what to do →NVD recordwpscan.com

• Sep 26, 2026miniOrange OTP Login, Verification and SMS Notifications: Authentication BypassCVE-2026-85984 · WordPress plugins & themes · reported by WordfenceCritical 9.8

  The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress is vulnerable to Authentication Bypass via the mo_wp_login_intent parameter in all versions up to, and including, 5.5.5. This is due to a missing password-intent guard in the skip_pass_fallback-enabled configuration branch of the mo_by_pass_login() function, which treats administrator role membership alone as sufficient authentication whenever the unauthenticated, unverified POST parameter mo_wp_login_intent is submitted with the value otp, causing mo_get_user() to skip wp_authenticate_username_password() and resolve a WP_User purely from a username lookup. This makes it possible for unauthenticated attackers to log in as any existing administrator account by supplying only a known username and an empty password alongside mo_wp_login_intent=otp, with no password or OTP verification required. Exploitation is conditional on a site administrator having simultaneously enabled the following plugin options: WP Login OTP, Login with Only OTP, Allow Users to Login with Username and Password, and Admin OTP Bypass.

  Product

  miniOrange OTP Login, Verification and SMS Notifications

  Affected

  up to 5.5.5

  What to do

  Affects up to 5.5.5. Update miniOrange OTP Login, Verification and SMS Notifications to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Sep 26, 2026MCP Server for WordPress: Does not perform an object-level authorization check on one of its workflow REST routesCVE-2026-96526 · WordPress plugins & themes · reported by WPScanLow 2.7

  The MCP Server for WordPress WordPress plugin before 1.8.2 does not perform an object-level authorization check on one of its workflow REST routes, allowing users with the Contributor role to disclose the title and publication status of any post, page or custom post type, including other users' private, draft, pending and scheduled content.

  Product

  MCP Server for WordPress

  Fixed in

  1.8.2

  What to do

  Update MCP Server for WordPress to 1.8.2 or newer.

  Full record and what to do →NVD recordwpscan.com

• Sep 26, 2026MCP Server for WordPress: Does not correctly verify the WordPress REST API nonce for cookie-authenticated requestsCVE-2026-96524 · WordPress plugins & themes · reported by WPScanHigh 8.8

  The MCP Server for WordPress WordPress plugin before 1.8.2 does not correctly verify the WordPress REST API nonce for cookie-authenticated requests when a condition an attacker can influence is present, allowing unauthenticated attackers to perform administrator-only actions, including creating a new administrator account, by tricking a logged-in administrator into visiting a crafted page.

  Product

  MCP Server for WordPress

  Fixed in

  1.8.2

  What to do

  Update MCP Server for WordPress to 1.8.2 or newer.

  Full record and what to do →NVD recordwpscan.com

• Sep 26, 2026File Manager: Does not prevent unauthenticated users from downloading its database backup archivesCVE-2026-19708 · WordPress plugins & themes · reported by WPScanMedium 5.9

  The File Manager WordPress plugin before 8.0.5 does not prevent unauthenticated users from downloading its database backup archives, and in some cases writes them under a fixed filename, allowing unauthenticated attackers to retrieve a full database dump including every user's email address and password hash on servers that do not apply the directory's .htaccess file.

  Product

  File Manager

  Fixed in

  8.0.5

  What to do

  Update File Manager to 8.0.5 or newer.

  Full record and what to do →NVD recordwpscan.com

• Sep 26, 2026Team Members: Does not perform any authorization or visibility check in an unauthenticated AJAX action that returns full team member records by IDCVE-2026-11871 · WordPress plugins & themes · reported by WPScanMedium 5.3

  The Team Members WordPress plugin before 9.3 does not perform any authorization or visibility check in an unauthenticated AJAX action that returns full team member records by ID, allowing unauthenticated attackers to enumerate and disclose details, including email addresses and phone numbers, of team members the administrator has not published publicly.

  Product

  Team Members

  Fixed in

  9.3

  What to do

  Update Team Members to 9.3 or newer.

  Full record and what to do →NVD recordwpscan.com

• Sep 25, 2026Modula Image Gallery – Photo Grid & Video Gallery: Unauthorized disclosure of private gallery contentsCVE-2026-89406 · WordPress plugins & themes · reported by WordfenceHigh 7.5

  The Modula Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to unauthorized disclosure of private gallery contents in versions up to, and including, 3.0.1. This is due to the Modula_Meta::add_metas() function being hooked to wp_head on every frontend request and looking up any post via get_post( $_GET['modula_gallery_id'] ) without verifying the gallery's post_status or the requester's capability to read it — the gallery-side input guard is bugged (empty('modula_gallery_id') tests a nonempty string literal instead of the GET parameter, so it is always false), the only object validation is a post_type === 'modula-gallery' check, and no is_user_logged_in()/current_user_can('read_post', $gallery_id) check is performed. This makes it possible for unauthenticated attackers to enumerate private modula-gallery posts and their member attachments and recover the image's title, description, dimensions, and original upload URL via Open Graph/Twitter meta tags emitted in the response, which then allows direct unauthenticated download of the original private image bytes.

  Product

  Modula Image Gallery – Photo Grid & Video Gallery

  Affected

  up to 3.0.1

  What to do

  Affects up to 3.0.1. Update Modula Image Gallery – Photo Grid & Video Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.