Updated 6 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,767exploited flaws on CISA’s list

33added in the last 30 days

550new WordPress flaws this week

392,577entries in the database

462 results · page 2 of 10

Oct 2, 2026SiteOrigin Widgets Bundle: Local File InclusionCVE-2026-92174 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.73.2 via the 'theme' parameter parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. Exploitation requires sending a malicious widgetData payload containing a legacy top-level theme key alongside a non-empty columns array to the /wp-json/sowb/v1/widgets/previews REST endpoint, which bypasses field validation because update_fields() only processes declared form fields.
Product
SiteOrigin Widgets Bundle
Affected
up to 1.73.2
What to do
Affects up to 1.73.2. Update SiteOrigin Widgets Bundle to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 2, 2026Request a Quote: Does not perform an authorization check on one of its unauthenticated AJAX handlersCVE-2026-90988 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Request a Quote WordPress plugin through 2.5.6 does not perform an authorization check on one of its unauthenticated AJAX handlers, allowing unauthenticated users to read the contact records of quote-request submissions, including records the site has not published.
Product
Request a Quote
Affected
up to 2.5.6
What to do
Affects up to 2.5.6. Update Request a Quote to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Oct 1, 2026Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder: Stored Cross-Site ScriptingCVE-2026-96813 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Mark on Map Longitude/Latitude Fields in all versions up to, and including, 1.15.47 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder
Affected
up to 1.15.47
What to do
Affects up to 1.15.47. Update Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 1, 2026WP Fusion Lite: Does not require authentication on a settings handler that runs during admin initializationCVE-2026-90974 · WordPress plugins & themes · reported by WPScanMedium 6.5
The WP Fusion Lite WordPress plugin before 3.48.0 does not require authentication on a settings handler that runs during admin initialization, allowing unauthenticated users to overwrite the site's CRM integration endpoint and credentials, after which synced user data is delivered to an attacker-chosen host.
Product
WP Fusion Lite
Fixed in
3.48.0
What to do
Update WP Fusion Lite to 3.48.0 or newer.
Full record and what to do →NVD record wpscan.com
Oct 1, 2026WP Fusion Lite: Does not perform a capability check on two of its admin AJAX handlersCVE-2026-90972 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Fusion Lite WordPress plugin before 3.48.0 does not perform a capability check on two of its admin AJAX handlers, allowing any authenticated subscriber to read other users' email addresses and to trigger a cross-user CRM re-sync.
Product
WP Fusion Lite
Fixed in
3.48.0
What to do
Update WP Fusion Lite to 3.48.0 or newer.
Full record and what to do →NVD record wpscan.com
Sep 30, 2026Robin Image Optimizer: Does not escape values that its bundled HTML parser re-emits into element attributesCVE-2026-89193 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Robin Image Optimizer WordPress plugin before 2.0.8 does not escape values that its bundled HTML parser re-emits into element attributes when a non-default image delivery mode is enabled, allowing unauthenticated users to submit content that is stored and later executed as Cross-Site Scripting in the browser of any user viewing an affected page, including administrators.
Product
Robin Image Optimizer
Fixed in
2.0.8
What to do
Update Robin Image Optimizer to 2.0.8 or newer.
Full record and what to do →NVD record wpscan.com
Sep 30, 2026Robin Image Optimizer: Does not check the user's capabilities before dispatching one of its bundled admin framework's request handlersCVE-2026-89190 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Robin Image Optimizer WordPress plugin before 2.0.8 does not check the user's capabilities before dispatching one of its bundled admin framework's request handlers, allowing users with a subscriber-level account to render admin-only Robin Image Optimizer WordPress plugin before 2.0.8 pages and disclose the Robin Image Optimizer WordPress plugin before 2.0.8's stored settings.
Product
Robin Image Optimizer
Fixed in
2.0.8
What to do
Update Robin Image Optimizer to 2.0.8 or newer.
Full record and what to do →NVD record wpscan.com
Sep 27, 2026Verge3D Publishing and E-Commerce: Does not restrict access to a file-download handlerCVE-2026-92995 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Verge3D Publishing and E-Commerce WordPress plugin through 4.13.0 does not restrict access to a file-download handler, allowing unauthenticated users to download the digital-goods files attached to any order without authorization.
Product
Verge3D Publishing and E-Commerce
Affected
up to 4.13.0
What to do
Affects up to 4.13.0. Update Verge3D Publishing and E-Commerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Sep 27, 2026WebFacing™: Does not restrict access to one of its bundled scripts and does not validate a user-supplied path before using it to include a local fileCVE-2026-84069 · WordPress plugins & themes · reported by WPScanMedium 5.3
The WebFacing™ WordPress plugin before 5.4 does not restrict access to one of its bundled scripts and does not validate a user-supplied path before using it to include a local file, allowing unauthenticated users to perform Local File Inclusion.
Product
WebFacing™
Fixed in
5.4
What to do
Update WebFacing™ to 5.4 or newer.
Full record and what to do →NVD record wpscan.com
Sep 26, 2026wp-review-slider-pro: Does not sanitize a value stored through one of its AJAX handlersCVE-2026-84097 · WordPress plugins & themes · reported by WPScanMedium 6.5
The wp-review-slider-pro WordPress plugin before 12.7.12 does not sanitize a value stored through one of its AJAX handlers, which lacks a capability check, before using it in a SQL statement, allowing any authenticated user, such as a subscriber, to perform SQL injection attacks whose results are then returned to unauthenticated visitors.
Product
wp-review-slider-pro
Fixed in
12.7.12
What to do
Update wp-review-slider-pro to 12.7.12 or newer.
Full record and what to do →NVD record wpscan.com
Sep 26, 2026wp-review-slider-pro: Does not perform a capability check on the AJAX handler that saves its review submission formsCVE-2026-84096 · WordPress plugins & themes · reported by WPScanHigh 8
The wp-review-slider-pro WordPress plugin before 12.7.12 does not perform a capability check on the AJAX handler that saves its review submission forms, and the nonce protecting it is generated for every visitor, allowing any authenticated user, such as a subscriber, to overwrite a live form with field values that are output without escaping on public pages, leading to Stored Cross-Site Scripting.
Product
wp-review-slider-pro
Fixed in
12.7.12
What to do
Update wp-review-slider-pro to 12.7.12 or newer.
Full record and what to do →NVD record wpscan.com
Sep 26, 2026wp-review-slider-pro: Does not perform a capability check on one of its AJAX handlersCVE-2026-84095 · WordPress plugins & themes · reported by WPScanHigh 8
The wp-review-slider-pro WordPress plugin before 12.7.12 does not perform a capability check on one of its AJAX handlers, and the nonce protecting it is generated for every visitor, allowing any authenticated user, such as a subscriber, to store arbitrary review content which is later output without escaping on public pages, leading to Stored Cross-Site Scripting.
Product
wp-review-slider-pro
Fixed in
12.7.12
What to do
Update wp-review-slider-pro to 12.7.12 or newer.
Full record and what to do →NVD record wpscan.com
Sep 23, 2026Unauthenticated Sensitive Data Exposure in TrustedLogin Connector <= 2.0.3 versions.CVE-2026-95600 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Sensitive Data Exposure in TrustedLogin Connector <= 2.0.3 versions.
Affected
up to 2.0.3
What to do
Affects up to 2.0.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 23, 2026Contributor Cross Site Scripting (XSS) in Podcast Importer SecondLine <= 1.5.6 versions.CVE-2026-94682 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Cross Site Scripting (XSS) in Podcast Importer SecondLine <= 1.5.6 versions.
Affected
up to 1.5.6
What to do
Affects up to 1.5.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 23, 2026Paid Membership Subscriptions: Does not verify the reCAPTCHA on its registration handlerCVE-2026-90950 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Paid Membership Subscriptions WordPress plugin before 3.1.0 does not verify the reCAPTCHA on its registration handler when a form field is absent from the request, allowing unauthenticated users to create accounts without solving the reCAPTCHA the site has enabled.
Product
Paid Membership Subscriptions
Fixed in
3.1.0
What to do
Update Paid Membership Subscriptions to 3.1.0 or newer.
Full record and what to do →NVD record wpscan.com
Sep 23, 2026Points and Rewards for WooCommerce: Does not validate the claimed reward amount or restrict who can call its Win Wheel claim handlerCVE-2026-93510 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Points and Rewards for WooCommerce WordPress plugin before 2.10.4 does not validate the claimed reward amount or restrict who can call its Win Wheel claim handler, allowing authenticated users, Subscriber and above, to credit their own account with an arbitrary and unlimited amount of loyalty points and, where a companion wallet Points and Rewards for WooCommerce WordPress plugin before 2.10.4 is active, wallet balance.
Product
Points and Rewards for WooCommerce
Fixed in
2.10.4
What to do
Update Points and Rewards for WooCommerce to 2.10.4 or newer.
Full record and what to do →NVD record wpscan.com
Sep 23, 2026JSM Show Post Metadata: Does not properly escape a post meta key before outputting it into an inline event-handler attribute in an admin-facing meta boxCVE-2026-88997 · WordPress plugins & themes · reported by WPScanMedium 6.8
The JSM Show Post Metadata WordPress plugin before 4.9.1 does not properly escape a post meta key before outputting it into an inline event-handler attribute in an admin-facing meta box, allowing users with contributor-level access and above to inject arbitrary JavaScript that executes in the session of a higher-privileged user who reviews the affected post.
Product
JSM Show Post Metadata
Fixed in
4.9.1
What to do
Update JSM Show Post Metadata to 4.9.1 or newer.
Full record and what to do →NVD record wpscan.com
Sep 22, 2026WPC Product Bundles for WooCommerce: Stored Cross-Site ScriptingCVE-2026-93836 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The WPC Product Bundles for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'qty' parameter in all versions up to, and including, 8.6.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The float cast used during quantity validation allows a numeric-prefixed payload such as '1<img src=x onerror=...>' to pass validation while retaining its malicious HTML, which is then stored verbatim in order item metadata under the '_woosb_ids' key.
Product
WPC Product Bundles for WooCommerce
Affected
up to 8.6.6
What to do
Affects up to 8.6.6. Update WPC Product Bundles for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 19, 2026WordLift – AI powered SEO – Schema: Sensitive Information ExposureCVE-2026-9289 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WordLift – AI powered SEO – Schema plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.54.10 via the JSON-LD REST API endpoints. This is due to the plugin registering the /wordlift/v1/jsonld/ routes (jsonld/{id}, jsonld/http/{item_id}, jsonld/post-meta/{meta_key}, jsonld/meta/{meta_key}, and jsonld/{post_type}/{post_name}) with a permission_callback of '__return_true' and the downstream converter retrieving the post via get_post() without verifying the post status or the requesting user's capabilities. This makes it possible for unauthenticated attackers to read the title, content/description, author, publication and modification dates, word count, comment count, and other metadata of private, draft, and pending posts by enumerating post IDs, bypassing WordPress core access controls.
Product
WordLift – AI powered SEO – Schema
Affected
up to 3.54.10
What to do
Affects up to 3.54.10. Update WordLift – AI powered SEO – Schema to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 18, 2026Photo Gallery by 10Web – Mobile-Friendly Image Gallery: Time-based SQL InjectionCVE-2026-85652 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to time-based SQL Injection via 'album_id' Shortcode Attribute in all versions up to, and including, 1.8.44 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with author-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. An Author-level user can store a SQL injection payload inside a published post's shortcode attribute, causing the payload to execute when any visitor renders the post; notably, the unsanitized value appears on both sides of a UNION query, potentially doubling the observable time-based delay.
Product
Photo Gallery by 10Web – Mobile-Friendly Image Gallery
Affected
up to 1.8.44
What to do
Affects up to 1.8.44. Update Photo Gallery by 10Web – Mobile-Friendly Image Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 18, 2026Clean Login: Does not check whether user registration is enabled before creating an account in its registration handlerCVE-2026-90976 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Clean Login WordPress plugin before 1.19 does not check whether user registration is enabled before creating an account in its registration handler, allowing unauthenticated users to create accounts even when the site has registration disabled.
Product
Clean Login
Fixed in
1.19
What to do
Update Clean Login to 1.19 or newer.
Full record and what to do →NVD record wpscan.com
Sep 18, 2026Filter Gallery: Does not verify the nonce on several of its AJAX handlersCVE-2026-90978 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Filter Gallery WordPress plugin before 1.1.5 does not verify the nonce on several of its AJAX handlers when the nonce field is omitted, and applies no capability check, allowing low-privileged users to overwrite the content of arbitrary posts and delete the Filter Gallery WordPress plugin before 1.1.5's stored gallery options.
Product
Filter Gallery
Fixed in
1.1.5
What to do
Update Filter Gallery to 1.1.5 or newer.
Full record and what to do →NVD record wpscan.com
Sep 17, 2026Faust.js is a headless WordPress toolkit.CVE-2026-54239 · WordPress plugins & themes · reported by GitHubHigh 8.8
Faust.js is a headless WordPress toolkit. Prior to 1.8.11, the FaustWP WordPress plugin authenticates only the ciphertext in its token envelope and excludes the 16-byte initialization vector from the HMAC in WPE\FaustWP\Auth\encrypt() and WPE\FaustWP\Auth\decrypt() in plugins/faustwp/includes/auth/functions.php. A logged-in non-administrator who obtains an authorization code from GET /generate can modify the unauthenticated initialization vector so that CBC decryption changes the token type and user identifier while the HMAC remains valid. This can produce an access token for an Administrator and permit full WordPress REST API access, administrator-account creation, plugin installation, and arbitrary code execution. This issue is fixed in repository version 1.8.11.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record github.com github.com
Sep 17, 2026Unauthenticated Broken Authentication in Headless Single Sign On <= 1.7.0 versions.CVE-2026-62108 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated Broken Authentication in Headless Single Sign On <= 1.7.0 versions.
Affected
up to 1.7.0
What to do
Affects up to 1.7.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 17, 2026HT Mega Addons for Elementor: Does not restrict the HTML tag name used to render the section headline in several of its widgets and blocks to a safe allowlistCVE-2026-86788 · WordPress plugins & themes · reported by WPScanMedium 6.8
The HT Mega Addons for Elementor WordPress plugin before 3.2.6 does not restrict the HTML tag name used to render the section headline in several of its widgets and blocks to a safe allowlist, allowing users with contributor-level access and above to store a crafted tag name that executes arbitrary JavaScript when the content is viewed, including by higher-privileged users who review or publish it.
Product
HT Mega Addons for Elementor
Fixed in
3.2.6
What to do
Update HT Mega Addons for Elementor to 3.2.6 or newer.
Full record and what to do →NVD record wpscan.com
Sep 17, 2026Pressengine: Does not stop its login handler from issuing a sessionCVE-2026-86709 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Pressengine WordPress plugin through 1.0 does not stop its login handler from issuing a session when authentication fails, allowing unauthenticated attackers to log in as any user, including administrators.
Product
Pressengine
Affected
up to 1.0
What to do
Affects up to 1.0. Update Pressengine to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Sep 17, 2026Photo Gallery by 10Web – Mobile-Friendly Image Gallery: Stored Cross-Site ScriptingCVE-2026-86311 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Shortcode Attributes in all versions up to, and including, 1.8.44 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Photo Gallery by 10Web – Mobile-Friendly Image Gallery
Affected
up to 1.8.44
What to do
Affects up to 1.8.44. Update Photo Gallery by 10Web – Mobile-Friendly Image Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 16, 2026LearnPress: Does not check the user's capabilities in one of its administrative template handlersCVE-2026-86445 · WordPress plugins & themes · reported by WPScanMedium 5.3
The LearnPress WordPress plugin before 4.4.7 does not check the user's capabilities in one of its administrative template handlers, allowing unauthenticated attackers to retrieve the text, identifier and type of every published quiz question on the site, along with a keyword search over them, which is content the LearnPress WordPress plugin before 4.4.7 otherwise keeps non-public.
Product
LearnPress
Fixed in
4.4.7
What to do
Update LearnPress to 4.4.7 or newer.
Full record and what to do →NVD record wpscan.com
Sep 12, 2026BEAR: Does not perform ownership checks on several handlers that return product data by a user-supplied identifierCVE-2026-84025 · WordPress plugins & themes · reported by WPScanLow 2.2
The BEAR WordPress plugin before 1.2.2 does not perform ownership checks on several handlers that return product data by a user-supplied identifier, allowing users who are restricted to their own products to read other owners' product information, including protected downloadable file URLs and private product metadata.
Product
BEAR
Fixed in
1.2.2
What to do
Update BEAR to 1.2.2 or newer.
Full record and what to do →NVD record wpscan.com
Sep 11, 2026Translate WordPress with GTranslate: Does not validate one of its settings before the bundled front-end scripts build markup from itCVE-2025-15695 · WordPress plugins & themes · reported by WPScanLow 3.5
The Translate WordPress with GTranslate WordPress plugin before 3.0.10 does not validate one of its settings before the bundled front-end scripts build markup from it, allowing users with a role as high as administrator to store JavaScript that runs in the session of any visitor to the site.
Product
Translate WordPress with GTranslate
Fixed in
3.0.10
What to do
Update Translate WordPress with GTranslate to 3.0.10 or newer.
Full record and what to do →NVD record wpscan.com
Sep 10, 2026zipMoney(Zip Co) Payments Plugin for WooCommerce: Does not perform any authorisation checks on one of its front-end request handlersCVE-2026-78361 · WordPress plugins & themes · reported by WPScanCritical 9.1
The zipMoney(Zip Co) Payments Plugin for WooCommerce WordPress plugin before 2.4.0 does not perform any authorisation checks on one of its front-end request handlers, and does not restrict which option name a caller may supply, allowing unauthenticated users to delete arbitrary WordPress options. This can be used to destroy site and access control configuration, deactivate every installed zipMoney(Zip Co) Payments Plugin for WooCommerce WordPress plugin before 2.4.0, and take the site offline.
Product
zipMoney(Zip Co) Payments Plugin for WooCommerce
Fixed in
2.4.0
What to do
Update zipMoney(Zip Co) Payments Plugin for WooCommerce to 2.4.0 or newer.
Full record and what to do →NVD record wpscan.com
Sep 10, 2026Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder: Reflected Cross-Site ScriptingCVE-2026-85645 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the bulk_action parameter in all versions up to, and including, 1.15.46 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder
Affected
up to 1.15.46
What to do
Affects up to 1.15.46. Update Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.svn.wordpress.org plugins.svn.wordpress.org
Sep 9, 2026WP Travel: Does not verify that the requester is authorized to act on the booking targeted by one of its front-end payment-message handlersCVE-2026-18042 · WordPress plugins & themes · reported by WPScanMedium 5.3
The WP Travel WordPress plugin before 12.0.2 does not verify that the requester is authorized to act on the booking targeted by one of its front-end payment-message handlers, allowing unauthenticated attackers to cancel the payment on any customer's booking.
Product
WP Travel
Fixed in
12.0.2
What to do
Update WP Travel to 12.0.2 or newer.
Full record and what to do →NVD record wpscan.com
Sep 9, 2026WP Travel: Does not properly verify that the requester is authorized to modify the targeted booking on one branch of its bank-deposit handlerCVE-2026-13144 · WordPress plugins & themes · reported by WPScanLow 3.7
The WP Travel WordPress plugin before 12.0.2 does not properly verify that the requester is authorized to modify the targeted booking on one branch of its bank-deposit handler, allowing an unauthenticated attacker who knows the target customer's email address to reset that customer's booking payment to an unpaid state and wipe its stored deposit-reconciliation data.
Product
WP Travel
Fixed in
12.0.2
What to do
Update WP Travel to 12.0.2 or newer.
Full record and what to do →NVD record wpscan.com
Sep 9, 2026Podlove Podcast Publisher: Stored Cross-Site ScriptingCVE-2026-75966 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Podlove Podcast Publisher plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'episode_contributor[..][..][comment]' Parameter in all versions up to, and including, 4.5.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The contributor comment is stored in a plugin-managed custom table, bypassing WordPress core's wp_kses_post filter, and the save_post hook fires without a nonce check, meaning any user who can edit posts can exploit this without further preconditions.
Product
Podlove Podcast Publisher
Affected
up to 4.5.5
What to do
Affects up to 4.5.5. Update Podlove Podcast Publisher to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 5, 2026Search Atlas SEO: Does not perform a nonce or capability check before processing a settings update in one of its early-priority handlersCVE-2026-15247 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Search Atlas SEO WordPress plugin before 2.6.24 does not perform a nonce or capability check before processing a settings update in one of its early-priority handlers, allowing any authenticated user such as a Subscriber to overwrite or delete the site's stored Google service-account credentials.
Product
Search Atlas SEO
Fixed in
2.6.24
What to do
Update Search Atlas SEO to 2.6.24 or newer.
Full record and what to do →NVD record wpscan.com
Sep 4, 2026WPFunnels: Does not perform any authorisation or nonce check in one of its opt-in submission handlersCVE-2026-79632 · WordPress plugins & themes · reported by WPScanMedium 5.3
The WPFunnels WordPress plugin before 3.13.0 does not perform any authorisation or nonce check in one of its opt-in submission handlers, and takes the notification recipients and subject from the request, allowing unauthenticated users to make the site send emails to arbitrary recipients with an arbitrary subject.
Product
WPFunnels
Fixed in
3.13.0
What to do
Update WPFunnels to 3.13.0 or newer.
Full record and what to do →NVD record wpscan.com
Sep 2, 2026The Developer Tools WordPress plugin through 1.1.3 contains an unauthenticated arbitrary file upload vulnerability in the bundled SWFUpload componentCVE-2025-9314 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Developer Tools WordPress plugin through 1.1.3 contains an unauthenticated arbitrary file upload vulnerability in the bundled SWFUpload component
Product
Developer Tools
Affected
up to 1.1.3
What to do
Affects up to 1.1.3. Update Developer Tools to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Sep 2, 2026Passster: Does not handle input properly in an AJAX actionCVE-2025-15489 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Passster WordPress plugin before 4.2.24 does not handle input properly in an AJAX action, allowing unauthenticated users to retrieve the value of password protected content
Product
Passster
Fixed in
4.2.24
What to do
Update Passster to 4.2.24 or newer.
Full record and what to do →NVD record wpscan.com
Sep 2, 2026FormLayer: Does not perform any authorization check before returning a form's full stored configuration in the response to its public submission handlerCVE-2026-78151 · WordPress plugins & themes · reported by WPScanMedium 5.3
The FormLayer WordPress plugin before 1.0.9 does not perform any authorization check before returning a form's full stored configuration in the response to its public submission handler, allowing unauthenticated users to disclose notification recipient addresses, confirmation redirect targets and integration settings, including those of unpublished forms.
Product
FormLayer
Fixed in
1.0.9
What to do
Update FormLayer to 1.0.9 or newer.
Full record and what to do →NVD record wpscan.com
Sep 2, 2026Social Media Share Buttons & Social Sharing Icons: Does not properly escape a value taken from the incoming request before outputting it in an inline JavaScript event handlerCVE-2026-19723 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Social Media Share Buttons & Social Sharing Icons WordPress plugin before 3.0.1 does not properly escape a value taken from the incoming request before outputting it in an inline JavaScript event handler, leading to Reflected Cross-Site Scripting which is triggered when a user interacts with the affected button. Exploitation requires the Social Media Share Buttons & Social Sharing Icons WordPress plugin before 3.0.1 to be running a non-default icon display configuration.
Product
Social Media Share Buttons & Social Sharing Icons
Fixed in
3.0.1
What to do
Update Social Media Share Buttons & Social Sharing Icons to 3.0.1 or newer.
Full record and what to do →NVD record wpscan.com
Sep 2, 2026Social Media Share Buttons & Social Sharing Icons: Does not escape the post title before outputting it in an inline JavaScript event handlerCVE-2026-19719 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Social Media Share Buttons & Social Sharing Icons WordPress plugin before 3.0.1 does not escape the post title before outputting it in an inline JavaScript event handler, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks which are triggered when a visitor interacts with the affected button. Exploitation requires the Social Media Share Buttons & Social Sharing Icons WordPress plugin before 3.0.1 to be running a non-default icon display configuration.
Product
Social Media Share Buttons & Social Sharing Icons
Fixed in
3.0.1
What to do
Update Social Media Share Buttons & Social Sharing Icons to 3.0.1 or newer.
Full record and what to do →NVD record wpscan.com
Sep 2, 2026Ultimate Before After Image Slider & Gallery: Does not properly escape the slider's before-label value before its bundled client-side script re-injects it into the DOMCVE-2025-15664 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Ultimate Before After Image Slider & Gallery WordPress plugin before 4.7.19 does not properly escape the slider's before-label value before its bundled client-side script re-injects it into the DOM, allowing users with the Author role and above to store a payload that executes in the browser of anyone (including an administrator) who views the slider.
Product
Ultimate Before After Image Slider & Gallery
Fixed in
4.7.19
What to do
Update Ultimate Before After Image Slider & Gallery to 4.7.19 or newer.
Full record and what to do →NVD record wpscan.com
Sep 2, 2026Ultimate Before After Image Slider & Gallery: Does not properly escape the slider's after-label value before its bundled client-side script re-injects it into the DOMCVE-2025-15663 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Ultimate Before After Image Slider & Gallery WordPress plugin before 4.7.19 does not properly escape the slider's after-label value before its bundled client-side script re-injects it into the DOM, allowing users with the Author role and above to store a payload that executes in the browser of anyone (including an administrator) who views the slider.
Product
Ultimate Before After Image Slider & Gallery
Fixed in
4.7.19
What to do
Update Ultimate Before After Image Slider & Gallery to 4.7.19 or newer.
Full record and what to do →NVD record wpscan.com
Aug 29, 2026MStore API: Does not verify that the order targeted by its wallet payment handling belongs to the requesterCVE-2026-18234 · WordPress plugins & themes · reported by WPScanMedium 6.5
The MStore API WordPress plugin before 4.21.1 does not verify that the order targeted by its wallet payment handling belongs to the requester, and does not deduct the wallet balance for most payment methods, allowing any authenticated user, including Subscribers, to mark arbitrary orders as paid without any payment being taken.
Product
MStore API
Fixed in
4.21.1
What to do
Update MStore API to 4.21.1 or newer.
Full record and what to do →NVD record wpscan.com
Aug 28, 2026Shared Files WordPress plugin before 1.7.67, shared-files-pro: Do not perform a capability check in their file-upload handlerCVE-2026-12514 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Shared Files WordPress plugin before 1.7.67, shared-files-pro WordPress plugin before 1.7.70 do not perform a capability check in their file-upload handler, which is registered for unauthenticated users and protected only by a nonce that is output on public pages, so an unauthenticated visitor can upload files to a publicly accessible directory and read the server's absolute path from the response. Uploads are limited to WordPress's allowed MIME types, so executable PHP cannot be uploaded.
Product
Shared Files WordPress plugin before 1.7.67, shared-files-pro
Fixed in
1.7.67
What to do
Update Shared Files WordPress plugin before 1.7.67, shared-files-pro to 1.7.67 or newer.
Full record and what to do →NVD record wpscan.com
Aug 22, 2026Slider Hero with Video Background, Animation: Does not have authorisation and nonce checks on two of its request handlersCVE-2026-76789 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Slider Hero with Video Background, Animation WordPress plugin before 9.1.3 does not have authorisation and nonce checks on two of its request handlers, and does not escape a stored setting before outputting it, allowing unauthenticated users to store malicious JavaScript which will be executed in the context of an administrator viewing the Slider Hero with Video Background, Animation WordPress plugin before 9.1.3's admin area, as well as any visitor of a page embedding a slider.
Product
Slider Hero with Video Background, Animation
Fixed in
9.1.3
What to do
Update Slider Hero with Video Background, Animation to 9.1.3 or newer.
Full record and what to do →NVD record wpscan.com
Aug 21, 2026Media Library Assistant: Does not validate a search parameter before concatenating it into a SQL query in one of its media-library query handlersCVE-2026-16959 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Media Library Assistant WordPress plugin before 3.40 does not validate a search parameter before concatenating it into a SQL query in one of its media-library query handlers, allowing users with the Author role to perform SQL injection.
Product
Media Library Assistant
Fixed in
3.40
What to do
Update Media Library Assistant to 3.40 or newer.
Full record and what to do →NVD record wpscan.com
Aug 20, 2026Unauthenticated Cross Site Scripting (XSS) in Podlove Podcast Publisher <= 4.5.4 versions.CVE-2026-66615 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Podlove Podcast Publisher <= 4.5.4 versions.
Affected
up to 4.5.4
What to do
Affects up to 4.5.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 19, 2026WP Statistics – Simple, privacy-friendly Google Analytics alternative: Stored Cross-Site ScriptingCVE-2026-15780 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The WP Statistics – Simple, privacy-friendly Google Analytics alternative plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'utm_campaign' parameter in all versions up to, and including, 14.16.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload can be planted without authentication via the public /wp-statistics/v2/hit REST endpoint, because the required signature is exposed on the public homepage and a base64-encoded page_uri POST parameter overrides the previously sanitized REQUEST_URI, allowing the malicious utm_campaign value to bypass sanitization and be stored in the database.
Product
WP Statistics – Simple, privacy-friendly Google Analytics alternative
Affected
up to 14.16.8
What to do
Affects up to 14.16.8. Update WP Statistics – Simple, privacy-friendly Google Analytics alternative to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.