Updated 3 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

584new WordPress flaws this week

391,288entries in the database

10,137 results · page 19 of 203

Sep 22, 2026wpForo Forum: Authorization bypassCVE-2026-91092 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The wpForo Forum plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.1.5. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to take over another guest author's forum post and modify its title, body, author name, and stored owner email address. This requires that guest posting and editing are enabled on the forum, and that the attacker knows the target guest author's email address.
Product
wpForo Forum
Affected
up to 3.1.5
What to do
Affects up to 3.1.5. Update wpForo Forum to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 22, 2026ThumbPress: Unauthorized accessCVE-2026-7622 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The ThumbPress plugin for WordPress is vulnerable to unauthorized access in versions up to and including 6.2.1. This is due to missing capability checks and nonce verification in the send_deactivation_survey() function registered via the wp_ajax_pl-plugin-deactivation AJAX action. This makes it possible for authenticated attackers, with Subscriber-level access and above, to deactivate the ThumbPress plugin on the affected site by sending a crafted POST request to admin-ajax.
Product
ThumbPress
Affected
up to 6.2.1
What to do
Affects up to 6.2.1. Update ThumbPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 22, 2026WP Table Builder – Drag & Drop Table Builder: Incorrect AuthorizationCVE-2026-6922 · WordPress plugins & themes · reported by WordfenceHigh 7.1
The WP Table Builder – Drag & Drop Table Builder plugin for WordPress is vulnerable to Incorrect Authorization in all versions up to, and including, 2.2.1. This is due to an operator precedence bug in the post-type guard within the trash_table_bulk() and restore_table_bulk() functions that causes the guard to never fire, combined with a permission callback that only verifies plugin role membership without per-post-type or ownership checks. This makes it possible for authenticated attackers, with subscriber-level access and above, to trash or restore any post, page, or custom post type on the site by supplying arbitrary post IDs.
Product
WP Table Builder – Drag & Drop Table Builder
Affected
up to 2.2.1
What to do
Affects up to 2.2.1. Update WP Table Builder – Drag & Drop Table Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 22, 2026RW Elephant Rental Inventory: Missing AuthorizationCVE-2026-4123 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The RW Elephant Rental Inventory plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including 2.3.13. This is due to a missing capability check on the toggle_cache() function which is hooked to the wp_ajax_toggle_cache AJAX action. The function also lacks nonce verification. This makes it possible for authenticated attackers, with Subscriber-level access and above, to toggle the plugin's cache setting on or off by sending a POST request to admin-ajax.
Product
RW Elephant Rental Inventory
Affected
up to 2.3.13
What to do
Affects up to 2.3.13. Update RW Elephant Rental Inventory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 22, 2026WP User Manager: Unauthorized modification of dataCVE-2026-18345 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP User Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the Connect::complete() function in versions up to, and including, 2.9.18. The function is registered on the admin_init hook (which fires for every authenticated user that reaches /wp-admin/, including Subscribers) and performs no current_user_can() or nonce verification before fetching Stripe credentials from the external WPUM connect service and writing them (publishable key, secret key, gateway mode, and connected Stripe account ID) into the wpum_settings option via wpum_update_option()/update_option(). This makes it possible for authenticated attackers, with Subscriber-level access and above, to hijack the site's Stripe integration by completing their own Stripe Connect OAuth flow and then invoking the callback on the target site, causing all subsequent Stripe payments to be routed to the attacker's Stripe account.
Product
WP User Manager
Affected
up to 2.9.18
What to do
Affects up to 2.9.18. Update WP User Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 22, 2026Handily: Unauthorized payment settings modificationCVE-2025-14487 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Handily plugin for WordPress is vulnerable to unauthorized payment settings modification due to missing authorization checks in all versions up to, and including, 1.0.3. This makes it possible for unauthenticated attackers to modify Stripe payment configuration settings, including publishable keys, secret keys, email addresses, success URLs, and cancel URLs via the payment settings parameters. This could allow attackers to redirect payments to their own Stripe accounts.
Product
Handily
Affected
up to 1.0.3
What to do
Affects up to 1.0.3. Update Handily to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codecanyon.net wordfence.com
Sep 22, 2026PixelPlay: Unauthorized API key deletionCVE-2025-14486 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The PixelPlay plugin for WordPress is vulnerable to unauthorized API key deletion due to missing authorization checks in all versions up to, and including, 1.0.2. This makes it possible for unauthenticated attackers to delete arbitrary API keys (Pixabay, Unsplash, Pixels, OpenAI) configured by site administrators via the 'clear_api_type' parameter.
Product
PixelPlay
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update PixelPlay to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record elements.envato.com wordfence.com
Sep 22, 2026Image Buzz: Unauthorized API key modificationCVE-2025-14484 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Image Buzz plugin for WordPress is vulnerable to unauthorized API key modification due to missing authorization checks in all versions up to, and including, 1.0.3. This makes it possible for unauthenticated attackers to modify arbitrary API keys (Pixabay, Unsplash, Pixels) configured by site administrators via the 'pixabay_api', 'unsplash_api', or 'pixels_api' parameters.
Product
Image Buzz
Affected
up to 1.0.3
What to do
Affects up to 1.0.3. Update Image Buzz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codecanyon.net wordfence.com
Sep 22, 2026CMP – Coming Soon & Maintenance Plugin by NiteoThemes: Unauthorized modification of data that can lead to privilege escalationCVE-2026-12470 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The CMP – Coming Soon & Maintenance Plugin by NiteoThemes plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the 'cmp_ajax_import_settings' AJAX action in all versions up to, and including, 4.1.17. This makes it possible for authenticated attackers, with Editor-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.
Product
CMP – Coming Soon & Maintenance Plugin by NiteoThemes
Affected
up to 4.1.17
What to do
Affects up to 4.1.17. Update CMP – Coming Soon & Maintenance Plugin by NiteoThemes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 21, 2026Metaphor Creations Ditty (ditty-news-ticker) before 3.1.70 contains a stored cross-site scripting vulnerability that allows authenticated users with Author-leveCVE-2026-93339 · WordPress plugins & themes · reported by VulnCheckMedium 5.1
Metaphor Creations Ditty (ditty-news-ticker) before 3.1.70 contains a stored cross-site scripting vulnerability that allows authenticated users with Author-level privileges or higher to inject arbitrary HTML elements by supplying malicious wrapper attribute values in layout tags. The ditty_layout_render_tag_wrapper() function inserts caller-supplied wrapper attribute values directly as HTML element names without allowlist validation, bypassing wp_kses_post() sanitization because KSES runs at save time before layout tag attributes are resolved at render time, causing the payload to execute in the browser of any visitor viewing posts or pages embedding the affected Ditty item.
Fixed in
3.1.70
What to do
Update the plugin to 3.1.70 or newer.
Full record and what to do →NVD record lazytitan.ro wordpress.org
Sep 21, 2026To Do List Member: Does not have authorisation or nonce checks in an import routineCVE-2026-86802 · WordPress plugins & themes · reported by WPScanLow 3.7
The To Do List Member WordPress plugin through 1.6 does not have authorisation or nonce checks in an import routine, and does not validate the location it fetches the imported data from, allowing unauthenticated users to create arbitrary published posts and taxonomy terms on the site.
Product
To Do List Member
Affected
up to 1.6
What to do
Affects up to 1.6. Update To Do List Member to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Sep 20, 2026TikTok: Does not check that a request is authorised before acting on a sign-in code supplied in the URLCVE-2026-92965 · WordPress plugins & themes · reported by WPScanLow 3.7
The TikTok WordPress plugin before 1.4.2 does not check that a request is authorised before acting on a sign-in code supplied in the URL, so any visitor can make the site redeem a code of their choosing against the advertising platform, using the site's own credentials. It matches that code loosely, so URLs that merely resemble the expected one trigger it too, and the callback runs on every request to the site rather than only on the administrator's sign-in.
Product
TikTok
Fixed in
1.4.2
What to do
Update TikTok to 1.4.2 or newer.
Full record and what to do →NVD record wpscan.com
Sep 20, 2026Tripzzy: Does not have authorisation checksCVE-2026-87839 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Tripzzy WordPress plugin before 1.5.1 does not have authorisation checks, and does not validate the identifier of the object being removed, in an AJAX action available to unauthenticated users, allowing them to permanently delete arbitrary comments on the site.
Product
Tripzzy
Fixed in
1.5.1
What to do
Update Tripzzy to 1.5.1 or newer.
Full record and what to do →NVD record wpscan.com
Sep 19, 2026Partial Shipment for Woocommerce: Missing AuthorizationCVE-2026-9858 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Partial Shipment for Woocommerce plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 3.4 via the wxp_order_shipment, wxp_order_item_shipment, and wxp_order_set_shipped AJAX actions. This is due to the AJAX handlers in woocommerce-partial-shipment.php (registered at lines 60–62 and implemented at lines 228, 263, and 291) lacking both capability checks and nonce verification, and not validating the calling user's ownership of the supplied order_id. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read arbitrary order item details (names, quantities, shipped counts) belonging to any customer and to modify the shipment status / shipped quantities of any order, which can also trigger order status transitions via the wxp_order_status action.
Product
Partial Shipment for Woocommerce
Affected
up to 3.4
What to do
Affects up to 3.4. Update Partial Shipment for Woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 19, 2026Empik for Woocommerce: Authorization bypassCVE-2026-9766 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Empik for Woocommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.5.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to modify arbitrary WooCommerce product metadata, including Empik logistic class (_empik_logistic_klass), product state (_empik_product_state, _empik_product_state_all_variants), and Empik export and offer flags on any product in the store.
Product
Empik for Woocommerce
Affected
up to 1.5.1
What to do
Affects up to 1.5.1. Update Empik for Woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 19, 2026Datalogics Ecommerce Delivery – Datalogics: Authorization bypassCVE-2026-9613 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Datalogics Ecommerce Delivery – Datalogics plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6.65. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to create and cancel real shipping orders through the external logistics API using the store's stored authentication token, modify arbitrary WooCommerce order post meta on any order, overwrite the plugin's stored API token, and trigger shipping notification emails to customers.
Product
Datalogics Ecommerce Delivery – Datalogics
Affected
up to 2.6.65
What to do
Affects up to 2.6.65. Update Datalogics Ecommerce Delivery – Datalogics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 19, 2026YS LeadGen: Authorization bypass and Stored Cross-Site ScriptingCVE-2026-1256 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The YS LeadGen plugin for WordPress is vulnerable to authorization bypass and Stored Cross-Site Scripting via multiple AJAX endpoints in all versions up to, and including, 2.1.4 due to missing capability checks on popup management actions. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create arbitrary popups and inject malicious JavaScript that executes when the popup is displayed, leading to Stored XSS.
Product
YS LeadGen
Affected
up to 2.1.4
What to do
Affects up to 2.1.4. Update YS LeadGen to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 19, 2026TikTok: Authorization bypassCVE-2026-18346 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The TikTok plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.4.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to overwrite the merchant's stored TikTok integration access token in wp_options, hijacking the site's TikTok Business and product catalog integration. Successful exploitation requires the attacker to supply a valid TikTok OAuth auth_code issued for the merchant's registered TikTok app, as the plugin's token exchange must receive a message='OK' response from TikTok's API before the stored access token is overwritten.
Product
TikTok
Affected
up to 1.4.1
What to do
Affects up to 1.4.1. Update TikTok to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 19, 2026Flex Import: Missing AuthorizationCVE-2026-9615 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Flex Import plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.0. This is due to the license_activate_fleximp() and license_deactivate_fleximp() functions, hooked to the wp_ajax_license_activate_fleximp and wp_ajax_license_deactivate_fleximp AJAX actions, lacking both a capability check (current_user_can()) and nonce verification (the client-side script sends a 'wpnonce' value but the handlers never validate it). This makes it possible for authenticated attackers, with subscriber-level access and above, to activate an arbitrary/fraudulent license key (persisting it via update_option('fleximp_is_premium') and toggling validation, suspension, and bundle status options) or deactivate the site's legitimate license (deleting the stored key and setting fleximp_validation_status to false), thereby disrupting the plugin's premium functionality.
Product
Flex Import
Affected
up to 3.0
What to do
Affects up to 3.0. Update Flex Import to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 19, 2026VW Writer Blog: Unauthorized modification of dataCVE-2026-2278 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The VW Writer Blog theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'vw_writer_blog_reset_all_settings' function in all versions up to, and including, 1.3.8. This makes it possible for authenticated attackers, with Subscriber-level access and above, to reset all theme customizer settings to their defaults.
Product
VW Writer Blog
Affected
up to 1.3.8
What to do
Affects up to 1.3.8. Update VW Writer Blog to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themes.trac.wordpress.org themes.trac.wordpress.org
Sep 19, 2026Ibtana – Ecommerce Product Addons: Unauthorized post meta modificationCVE-2026-1984 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Ibtana – Ecommerce Product Addons plugin for WordPress is vulnerable to unauthorized post meta modification due to a missing capability check on the 'iepa_use_gt_editor' AJAX action in all versions up to, and including, 0.4.7.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update or delete arbitrary post meta entries via the 'iepa_builder' meta key.
Product
Ibtana – Ecommerce Product Addons
Affected
up to 0.4.7.7
What to do
Affects up to 0.4.7.7. Update Ibtana – Ecommerce Product Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 19, 2026BlockSpare: Authorization bypassCVE-2026-1242 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The BlockSpare plugin for WordPress is vulnerable to authorization bypass due to incorrect logic in the permission callback in all versions up to, and including, 4.2.6 due to the use of an AND (&&) operator instead of an OR (||) operator. This makes it possible for authenticated attackers, with Subscriber-level access and above, to bypass authorization checks and create arbitrary posts.
Product
BlockSpare
Affected
up to 4.2.6
What to do
Affects up to 4.2.6. Update BlockSpare to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 19, 2026Metasync: Unauthorized modification of dataCVE-2026-15947 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Metasync plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_instant_indexing_settings() function in versions up to, and including, 2.6.23. This function is registered on the admin_init hook and only checks for the presence of $_POST['submit'] before writing attacker-supplied $_POST['metasync_post_types'] into the site-wide 'metasync_options_instant_indexing' option via update_option(); no current_user_can()/current_user_has_plugin_access() check and no nonce verification are performed. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify the site's Google Instant Indexing post-type configuration, controlling which post types are auto-submitted to Google's Instant Indexing service.
Product
Metasync
Affected
up to 2.6.23
What to do
Affects up to 2.6.23. Update Metasync to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 19, 2026Search Atlas SEO – Premier SEO Plugin for One-Click WP Publishing & Integrated AI Optimization: Authorization bypassCVE-2026-15946 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Search Atlas SEO – Premier SEO Plugin for One-Click WP Publishing & Integrated AI Optimization plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6.23. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to overwrite the whitelabel settings password to an attacker-controlled value, enabling them to unlock whitelabel-protected admin settings tabs including whitelabel, general, and advanced configuration.
Product
Search Atlas SEO – Premier SEO Plugin for One-Click WP Publishing & Integrated AI Optimization
Affected
up to 2.6.23
What to do
Affects up to 2.6.23. Update Search Atlas SEO – Premier SEO Plugin for One-Click WP Publishing & Integrated AI Optimization to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 19, 2026PDF Builder for WooCommerce. Create invoices,packing slips and more: Authorization bypassCVE-2026-11899 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The PDF Builder for WooCommerce. Create invoices,packing slips and more plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.0.11. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to retrieve invoice numbers, formatted invoice numbers, and creation timestamps for arbitrary WooCommerce orders by supplying any OrderNumber and InvoiceId values with a garbage nonce.
Product
PDF Builder for WooCommerce. Create invoices,packing slips and more
Affected
up to 2.0.11
What to do
Affects up to 2.0.11. Update PDF Builder for WooCommerce. Create invoices,packing slips and more to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 19, 2026Rede Itaú for WooCommerce — Payment PIX, Credit Card and Debit: Does not verify the authenticity of its PIX payment webhook before updating an order's statusCVE-2026-92430 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Rede Itaú for WooCommerce — Payment PIX, Credit Card and Debit WordPress plugin before 5.4.7 does not verify the authenticity of its PIX payment webhook before updating an order's status, allowing unauthenticated attackers to mark a pending order as paid without paying.
Product
Rede Itaú for WooCommerce — Payment PIX, Credit Card and Debit
Fixed in
5.4.7
What to do
Update Rede Itaú for WooCommerce — Payment PIX, Credit Card and Debit to 5.4.7 or newer.
Full record and what to do →NVD record wpscan.com
Sep 19, 2026Hydra Booking — Appointment Scheduling & Booking Calendar: Does not perform object-level authorisation checks on several of its host-management operationsCVE-2026-92425 · WordPress plugins & themes · reported by WPScanMedium 5.5
The Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.4 does not perform object-level authorisation checks on several of its host-management operations, allowing users who hold its own administrator-assigned custom role to read, modify and permanently delete other hosts' records and the WordPress user accounts linked to them.
Product
Hydra Booking — Appointment Scheduling & Booking Calendar
Fixed in
1.2.4
What to do
Update Hydra Booking — Appointment Scheduling & Booking Calendar to 1.2.4 or newer.
Full record and what to do →NVD record wpscan.com
Sep 19, 2026MgoSync: Does not have authorization controls on one of its REST API endpointsCVE-2026-92404 · WordPress plugins & themes · reported by WPScanHigh 7.5
The MgoSync WordPress plugin before 2.1.7 does not have authorization controls on one of its REST API endpoints, allowing unauthenticated users to retrieve the stored WooCommerce API credentials, including a read/write consumer key and secret, from a configured site.
Product
MgoSync
Fixed in
2.1.7
What to do
Update MgoSync to 2.1.7 or newer.
Full record and what to do →NVD record wpscan.com
Sep 19, 2026WPGraphQL Smart Cache: Does not require authorisation or validate a caller-supplied query identifier before storing a persisted query from a requestCVE-2026-92099 · WordPress plugins & themes · reported by WPScanMedium 6.5
The WPGraphQL Smart Cache WordPress plugin before 2.3.2 does not require authorisation or validate a caller-supplied query identifier before storing a persisted query from a request, allowing unauthenticated users to publish arbitrary query documents and claim query aliases before a site's own frontend registers them.
Product
WPGraphQL Smart Cache
Fixed in
2.3.2
What to do
Update WPGraphQL Smart Cache to 2.3.2 or newer.
Full record and what to do →NVD record wpscan.com
Sep 19, 2026Online Scheduling and Appointment Booking System: Does not verify that the requester owns the AI booking-assistant conversation named in its unauthenticated conversation actionsCVE-2026-91847 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Online Scheduling and Appointment Booking System WordPress plugin before 28.2 does not verify that the requester owns the AI booking-assistant conversation named in its unauthenticated conversation actions, allowing any unauthenticated visitor to read another visitor's assistant messages and to inject messages into their in-progress conversation.
Product
Online Scheduling and Appointment Booking System
Fixed in
28.2
What to do
Update Online Scheduling and Appointment Booking System to 28.2 or newer.
Full record and what to do →NVD record wpscan.com
Sep 19, 2026Master Blocks: Does not have authorisation on one of its REST routesCVE-2026-88824 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Master Blocks WordPress plugin before 1.5.0 does not have authorisation on one of its REST routes, allowing unauthenticated users to update its settings, including a value that is output unescaped in the admin area, leading to Stored XSS that executes in the session of any administrator visiting a wp-admin page.
Product
Master Blocks
Fixed in
1.5.0
What to do
Update Master Blocks to 1.5.0 or newer.
Full record and what to do →NVD record wpscan.com
Sep 19, 2026Botiga Pro: Does not perform any authorisation checks on one of its REST routesCVE-2026-86591 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Botiga Pro WordPress plugin before 1.6.5 does not perform any authorisation checks on one of its REST routes, allowing unauthenticated users to update arbitrary WordPress options with arbitrary values, which could lead to privilege escalation and a full site takeover. The same route also allows unauthenticated users to store arbitrary web scripts which are then executed on every page of the site's front end, as well as to move arbitrary posts to the trash.
Product
Botiga Pro
Fixed in
1.6.5
What to do
Update Botiga Pro to 1.6.5 or newer.
Full record and what to do →NVD record wpscan.com
Sep 19, 2026Unbounce Landing Pages: Does not perform any authorisation checkCVE-2026-85574 · WordPress plugins & themes · reported by WPScanHigh 8
The Unbounce Landing Pages WordPress plugin before 1.1.5 does not perform any authorisation check when updating the configuration its front-end proxy relies on, allowing any authenticated user, such as a subscriber, to point that proxy at a host they control and have arbitrary content served from the site's own origin.
Product
Unbounce Landing Pages
Fixed in
1.1.5
What to do
Update Unbounce Landing Pages to 1.1.5 or newer.
Full record and what to do →NVD record wpscan.com
Sep 19, 2026Estatik Real Estate: Does not sanitise and escape several values decoded from a request parameter before reflecting them back in an unauthenticated AJAX responseCVE-2026-76790 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Estatik Real Estate Plugin WordPress plugin before 4.3.5 does not sanitise and escape several values decoded from a request parameter before reflecting them back in an unauthenticated AJAX response, leading to Reflected Cross-Site Scripting.
Product
Estatik Real Estate
Fixed in
4.3.5
What to do
Update Estatik Real Estate to 4.3.5 or newer.
Full record and what to do →NVD record wpscan.com
Sep 19, 2026Nimble Page Builder: Does not perform an authorization checkCVE-2026-16557 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Nimble Page Builder WordPress plugin through 3.3.8 does not perform an authorization check when returning page-builder content through an authenticated AJAX action, allowing any authenticated user (Subscriber+) to disclose the page-builder content of arbitrary non-public (draft, pending, private, scheduled) posts and pages.
Product
Nimble Page Builder
Affected
up to 3.3.8
What to do
Affects up to 3.3.8. Update Nimble Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Sep 18, 2026Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots: Authorization bypassCVE-2026-89334 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.15.33. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with custom-level access and above, to access the full message transcript, thread metadata, and user data of any chat-room thread without authentication. This is only exploitable when the chat room's only_joined_can_read setting retains its default value of '0'.
Product
Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots
Affected
up to 2.15.33
What to do
Affects up to 2.15.33. Update Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 18, 2026Tutor LMS – eLearning and online course solution: Authorization bypassCVE-2026-88944 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.0.8. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to permanently delete arbitrary WordPress posts — including pages, courses, quizzes, and WooCommerce products — via wp_delete_post( $id, true ). The exploit chain requires the attacker to first trigger the profile-photo upload flow to obtain an authored wp_posts attachment row, then create a Tutor topic reparented to that attachment, before invoking the lesson deletion handler against any target post ID.
Product
Tutor LMS – eLearning and online course solution
Affected
up to 4.0.8
What to do
Affects up to 4.0.8. Update Tutor LMS – eLearning and online course solution to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 18, 2026SEO Booster: Missing AuthorizationCVE-2026-15660 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The SEO Booster plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 7.4.7. This is due to a missing capability check on the handle_oauth_callback() function which is hooked to admin_init and processes $_GET['access_token'] and $_GET['google_email'] without verifying the caller's role. This makes it possible for authenticated attackers, with Subscriber-level access and above, to overwrite the seobooster_access_token, seobooster_google_email, and seobooster_gsc_sites options and delete the seobooster_needs_reauth flag by visiting a crafted /wp-admin/ URL, disrupting the Google Search Console integration and injecting attacker-chosen data into site options via the attacker-supplied token that drives an outbound Google API request whose response is stored.
Product
SEO Booster
Affected
up to 7.4.7
What to do
Affects up to 7.4.7. Update SEO Booster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 18, 2026WP Easy Pay – Payment and Donation form Builder for Square: Authorization bypassCVE-2026-12739 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP Easy Pay – Payment and Donation form Builder for Square plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to permanently delete arbitrary posts, pages, and custom post types (bypassing the trash via force deletion) or change any published post to draft status.
Product
WP Easy Pay – Payment and Donation form Builder for Square
Affected
up to 4.5.0
What to do
Affects up to 4.5.0. Update WP Easy Pay – Payment and Donation form Builder for Square to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 18, 2026Filter Gallery: Authorization bypassCVE-2026-89413 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Filter Gallery plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.1.4. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete any arbitrary Filter Gallery records — including all associated filters, image mappings, settings, and details options — by supplying attacker-controlled gallery IDs. The nonce bypass requires omitting the nonce POST field entirely rather than submitting an invalid value, as a present-but-invalid nonce is correctly rejected.
Product
Filter Gallery
Affected
up to 1.1.4
What to do
Affects up to 1.1.4. Update Filter Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 18, 2026Filter Gallery: Authorization bypassCVE-2026-89138 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Filter Gallery plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.1.4. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to overwrite the title and content of arbitrary WordPress posts, write the _wp_attachment_image_alt meta key on arbitrary posts, and create or overwrite arbitrary ufg_gallery_* options.
Product
Filter Gallery
Affected
up to 1.1.4
What to do
Affects up to 1.1.4. Update Filter Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 18, 2026Magazine Blocks – Blog Designer, Magazine & Newspaper Website Builder, Page Builder with Posts Blocks, Post Grid: Authorization bypassCVE-2026-75017 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Magazine Blocks – Blog Designer, Magazine & Newspaper Website Builder, Page Builder with Posts Blocks, Post Grid plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.8.6. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to demote administrator-owned published builder templates (header, footer, front page, single, archive, 404, and search) to draft status and replace them with attacker-authored block content rendered site-wide, enabling defacement, phishing, and SEO spam. This is possible because the mzb-builder-template post type is registered with capability_type='post' and exposed via the REST API, and the _mzb_template meta key is accessible to any user with edit_posts capability, meaning Contributor-level users and above can trigger the vulnerable save_post() hook.
Product
Magazine Blocks – Blog Designer, Magazine & Newspaper Website Builder, Page Builder with Posts Blocks, Post Grid
Affected
up to 1.8.6
What to do
Affects up to 1.8.6. Update Magazine Blocks – Blog Designer, Magazine & Newspaper Website Builder, Page Builder with Posts Blocks, Post Grid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 18, 2026Foxtool All-in-One: Contact chat button, Custom login, Media optimize images: Authorization bypassCVE-2026-18317 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Foxtool All-in-One: Contact chat button, Custom login, Media optimize images plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.5.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to modify arbitrary subkeys of the foxtool_settings option, including enabling site-wide SVG uploads by toggling the media-up3 key, which can facilitate stored cross-site scripting via malicious SVG files.
Product
Foxtool All-in-One: Contact chat button, Custom login, Media optimize images
Affected
up to 2.5.3
What to do
Affects up to 2.5.3. Update Foxtool All-in-One: Contact chat button, Custom login, Media optimize images to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 18, 2026Bookit — Booking & Appointment Calendar: Does not perform an authorization check on one of its appointment-retrieval actionsCVE-2026-89008 · WordPress plugins & themes · reported by WPScanLow 2.7
The Bookit — Booking & Appointment Calendar WordPress plugin before 2.6.0.5 does not perform an authorization check on one of its appointment-retrieval actions, allowing users with a low-privilege Bookit — Booking & Appointment Calendar WordPress plugin before 2.6.0.5-specific role to read other users' appointment records, including customer names, email addresses, phone numbers and private booking comments.
Product
Bookit — Booking & Appointment Calendar
Fixed in
2.6.0.5
What to do
Update Bookit — Booking & Appointment Calendar to 2.6.0.5 or newer.
Full record and what to do →NVD record wpscan.com
Sep 18, 2026iGMS Direct Booking: Does not authorise or escape its widget appearance settingsCVE-2026-88825 · WordPress plugins & themes · reported by WPScanHigh 8.8
The iGMS Direct Booking WordPress plugin before 2.0 does not authorise or escape its widget appearance settings, allowing unauthenticated users to store arbitrary web scripts that execute in the context of an administrator viewing the iGMS Direct Booking WordPress plugin before 2.0 settings, and in the browser of any visitor to a page displaying the booking widget.
Product
iGMS Direct Booking
Fixed in
2.0
What to do
Update iGMS Direct Booking to 2.0 or newer.
Full record and what to do →NVD record wpscan.com
Sep 18, 2026Easy Appointments: Does not perform an ownership or authorization check on its unauthenticated appointment-reservation endpoint before updating an existing appointment identified by a request-supplied idCVE-2026-87966 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Easy Appointments WordPress plugin before 4.0.2.2 does not perform an ownership or authorization check on its unauthenticated appointment-reservation endpoint before updating an existing appointment identified by a request-supplied id, allowing unauthenticated attackers to overwrite, and through a follow-on cleanup delete, arbitrary appointments.
Product
Easy Appointments
Fixed in
4.0.2.2
What to do
Update Easy Appointments to 4.0.2.2 or newer.
Full record and what to do →NVD record wpscan.com
Sep 18, 2026Easy Appointments: Does not use an unguessable token to authorize its mail-link appointment cancellation and confirmation actionCVE-2026-87965 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Easy Appointments WordPress plugin before 4.0.2.2 does not use an unguessable token to authorize its mail-link appointment cancellation and confirmation action, deriving the token from a hardcoded source-embedded salt and the appointment's creation timestamp, so unauthenticated attackers who know or guess that timestamp can cancel or confirm arbitrary appointments.
Product
Easy Appointments
Fixed in
4.0.2.2
What to do
Update Easy Appointments to 4.0.2.2 or newer.
Full record and what to do →NVD record wpscan.com
Sep 18, 2026Tz Weekly Radio Schedule: Does not sanitize and escape a parameter before using it to build a SQL query on an AJAX action available to unauthenticated usersCVE-2026-87775 · WordPress plugins & themes · reported by WPScanHigh 8.6
The Tz Weekly Radio Schedule WordPress plugin through 1.8.1 does not sanitize and escape a parameter before using it to build a SQL query on an AJAX action available to unauthenticated users, allowing unauthenticated attackers to perform SQL injection attacks and extract sensitive data from the database.
Product
Tz Weekly Radio Schedule
Affected
up to 1.8.1
What to do
Affects up to 1.8.1. Update Tz Weekly Radio Schedule to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Sep 18, 2026Tz Weekly Radio Schedule: Does not sanitize and escape a parameter before using it to build a SQL query on an AJAX action available to unauthenticated usersCVE-2026-87774 · WordPress plugins & themes · reported by WPScanHigh 8.6
The Tz Weekly Radio Schedule WordPress plugin through 1.8.1 does not sanitize and escape a parameter before using it to build a SQL query on an AJAX action available to unauthenticated users, allowing unauthenticated attackers to perform SQL injection attacks and extract sensitive data from the database.
Product
Tz Weekly Radio Schedule
Affected
up to 1.8.1
What to do
Affects up to 1.8.1. Update Tz Weekly Radio Schedule to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Sep 18, 2026Product Question and Answer: Does not sanitize and escape parameters before using them in SQL queries on AJAX actions available to unauthenticated usersCVE-2026-87771 · WordPress plugins & themes · reported by WPScanHigh 8.6
The Product Question and Answer WordPress plugin through 1.1.0 does not sanitize and escape parameters before using them in SQL queries on AJAX actions available to unauthenticated users, allowing unauthenticated attackers to perform SQL injection attacks and extract sensitive data from the database.
Product
Product Question and Answer
Affected
up to 1.1.0
What to do
Affects up to 1.1.0. Update Product Question and Answer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.