Updated 10 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

456new WordPress flaws this week

390,714entries in the database

2,482 results · page 2 of 50

Oct 16, 2026MAIO: Does not properly restrict access to its analytics dataCVE-2026-109930 · WordPress plugins & themes · reported by WPScanMedium 5.3
The MAIO WordPress plugin before 7.3.22 does not properly restrict access to its analytics data, treating a credential value shipped verbatim in its own public source as a valid API key, which allows unauthenticated attackers to retrieve the stored crawl-analytics log, including each recorded visitor's IP address, user agent and referer.
Product
MAIO
Fixed in
7.3.22
What to do
Update MAIO to 7.3.22 or newer.
Full record and what to do →NVD record wpscan.com
Oct 16, 2026Gravity Forms: Deserialization of Untrusted DataCVE-2026-97296 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Deserialization of Untrusted Data vulnerability in Rocketgenius, Inc Gravity Forms gravityforms allows Object Injection.This issue affects Gravity Forms: from n/a before 3.1.1.
Product
Gravity Forms
Fixed in
3.1.1
What to do
Update Gravity Forms to 3.1.1 or newer.
Full record and what to do →NVD record patchstack.com
Oct 16, 2026Wp Map Block: Unauthorized modification of dataCVE-2026-19798 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Wp Map Block plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the set_status() and bulk() functions in the Maps_Controller REST controller in versions up to, and including, 3.0.0. The plugin's permission_callback (can_edit()) only verifies current_user_can('edit_posts') and performs no object-level ownership check or verification of publish-level capabilities, while the handlers pass the caller-controlled map ID directly to wp_update_post() (and wp_delete_post() in the bulk delete branch) to change post_status between publish and draft. This makes it possible for authenticated attackers, with Contributor-level access and above, to publish or unpublish (and bulk-delete) any wpmb_map post, including maps owned by administrators, which hides published maps from all public pages site-wide or forces draft maps to become publicly visible.
Product
Wp Map Block
Affected
up to 3.0.0
What to do
Affects up to 3.0.0. Update Wp Map Block to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 16, 2026affiliate-toolkit: Does not validate a user-supplied sort value against an allowlist before using it in a database queryCVE-2026-110179 · WordPress plugins & themes · reported by WPScanMedium 6.8
The affiliate-toolkit WordPress plugin before 3.8.9 does not validate a user-supplied sort value against an allowlist before using it in a database query, and the affected administrative list screen requires only a lower-privilege capability rather than an administrator one, so users with editor-level access and above can perform SQL injection and read arbitrary information from the database. On multisite a sub-site editor can read the network-global users table, including the super administrator's password hash.
Product
affiliate-toolkit
Fixed in
3.8.9
What to do
Update affiliate-toolkit to 3.8.9 or newer.
Full record and what to do →NVD record wpscan.com
Oct 16, 2026Visual Form Builder: Does not perform an authorization check before displaying recent form submission data in a dashboard widgetCVE-2026-105974 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Visual Form Builder WordPress plugin through 3.1 does not perform an authorization check before displaying recent form submission data in a dashboard widget, allowing any authenticated user (Subscriber and above) to read other users' submitted contact information, including names, email addresses, form titles and timestamps.
Product
Visual Form Builder
Affected
up to 3.1
What to do
Affects up to 3.1. Update Visual Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Oct 16, 2026Schema & Structured Data for WP & AMP: Stored Cross-Site ScriptingCVE-2026-96570 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Schema & Structured Data for WP & AMP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'saswp_review_text' parameter in all versions up to, and including, 1.67 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The nonce that serves as the only authorization gate is publicly printed in the [saswp-reviews-form] shortcode HTML, making it obtainable by any anonymous visitor and rendering it ineffective as an access control boundary.
Product
Schema & Structured Data for WP & AMP
Affected
up to 1.67
What to do
Affects up to 1.67. Update Schema & Structured Data for WP & AMP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 15, 2026Infinite Uploads: Insertion of Sensitive Information Into Sent DataCVE-2026-110361 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Insertion of Sensitive Information Into Sent Data vulnerability in ClikIT Infinite Uploads infinite-uploads allows Retrieve Embedded Sensitive Data.This issue affects Infinite Uploads: from n/a through 3.4.1.
Product
Infinite Uploads
Affected
up to 3.4.1
What to do
Affects up to 3.4.1. Update Infinite Uploads to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 15, 2026Link Whisper Free: Deserialization of Untrusted DataCVE-2026-109686 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in Link Whisper INC Link Whisper Free link-whisper allows Object Injection.This issue affects Link Whisper Free: from n/a through 0.9.7.
Product
Link Whisper Free
Affected
up to 0.9.7
What to do
Affects up to 0.9.7. Update Link Whisper Free to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 15, 2026FluentCart: Insertion of Sensitive Information Into Sent DataCVE-2026-109695 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Insertion of Sensitive Information Into Sent Data vulnerability in WPManageNinja FluentCart fluent-cart allows Retrieve Embedded Sensitive Data.This issue affects FluentCart: from n/a through 1.7.1.
Product
FluentCart
Affected
up to 1.7.1
What to do
Affects up to 1.7.1. Update FluentCart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 14, 2026Polylang: Deserialization of Untrusted DataCVE-2026-97278 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Deserialization of Untrusted Data vulnerability in WP SYNTEX Polylang polylang allows Object Injection.This issue affects Polylang: from n/a through 3.8.9.
Product
Polylang
Affected
up to 3.8.9
What to do
Affects up to 3.8.9. Update Polylang to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 14, 2026Affiliates: Deserialization of Untrusted DataCVE-2026-108291 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in itthinx Affiliates affiliates allows Object Injection.This issue affects Affiliates: from n/a through 7.0.1.
Product
Affiliates
Affected
up to 7.0.1
What to do
Affects up to 7.0.1. Update Affiliates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 14, 2026SureCart: Deserialization of Untrusted DataCVE-2026-106599 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in Brainstorm Force SureCart surecart allows Object Injection.This issue affects SureCart: from n/a through 4.9.3.
Product
SureCart
Affected
up to 4.9.3
What to do
Affects up to 4.9.3. Update SureCart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 14, 2026JNews - Jeg Elementor Kit: Unauthorized access of dataCVE-2026-103907 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The JNews - Jeg Elementor Kit plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on both the 'jkit_post_block' and 'jeg_find_author' AJAX actions in versions up to, and including, 3.2.19. The 'wp_ajax_jkit_post_block' handler (registered generically for every element via wp_ajax_{$element_id} in Elements_Option_Abstract::setup_hook) returns the element's full option schema — including a freshly minted wp_create_nonce('jeg_find_author') — to any authenticated caller, and the 'wp_ajax_jeg_find_author' handler then runs a WP_User_Query with the attacker-supplied 'query' wrapped in '*…*' against search_columns that include user_email, echoing the ID and display_name of every matching user. This makes it possible for authenticated attackers, with Subscriber-level access and above, to enumerate every registered user of the site and to reconstruct arbitrary users' email addresses one character at a time by using the substring search as an oracle.
Product
JNews - Jeg Elementor Kit
Affected
up to 3.2.19
What to do
Affects up to 3.2.19. Update JNews - Jeg Elementor Kit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 14, 2026File Upload to Order: Does not validate or confine a file path taken from attacker-controlled session data before deleting the fileCVE-2026-107594 · WordPress plugins & themes · reported by WPScanCritical 10
The File Upload to Order WordPress plugin before 1.1.4 does not validate or confine a file path taken from attacker-controlled session data before deleting the file, and the action that performs the deletion is reachable by unauthenticated users, allowing them to delete arbitrary files on the server, including files whose removal leads to full site compromise.
Product
File Upload to Order
Fixed in
1.1.4
What to do
Update File Upload to Order to 1.1.4 or newer.
Full record and what to do →NVD record wpscan.com
Oct 14, 2026LTL Freight Quotes: Does not perform any authorization check or validation on one of its REST routes that writes to the databaseCVE-2026-107158 · WordPress plugins & themes · reported by WPScanMedium 5.3
The LTL Freight Quotes WordPress plugin before 4.2.19 does not perform any authorization check or validation on one of its REST routes that writes to the database, allowing unauthenticated users to modify some of the LTL Freight Quotes WordPress plugin before 4.2.19's stored settings.
Product
LTL Freight Quotes
Fixed in
4.2.19
What to do
Update LTL Freight Quotes to 4.2.19 or newer.
Full record and what to do →NVD record wpscan.com
Oct 14, 2026WP Data Access: Does not restrict its database table export action to authorized usersCVE-2026-106099 · WordPress plugins & themes · reported by WPScanMedium 5.3
The WP Data Access WordPress plugin before 5.5.84 does not restrict its database table export action to authorized users, gating it only with a token that the WP Data Access WordPress plugin before 5.5.84 itself prints into the public pages on which it displays a table, allowing unauthenticated attackers to export the complete contents of any publicly displayed table, including columns and rows withheld from the display shown to visitors.
Product
WP Data Access
Fixed in
5.5.84
What to do
Update WP Data Access to 5.5.84 or newer.
Full record and what to do →NVD record wpscan.com
Oct 14, 2026WP Data Access: Does not correctly check authorization on one of its application REST endpointsCVE-2026-106098 · WordPress plugins & themes · reported by WPScanMedium 5.3
The WP Data Access WordPress plugin before 5.5.77 does not correctly check authorization on one of its application REST endpoints, verifying only read permission before performing a write, which allows unauthenticated attackers to modify data in an application exposed for anonymous read access even when update actions have been disabled by the administrator.
Product
WP Data Access
Fixed in
5.5.77
What to do
Update WP Data Access to 5.5.77 or newer.
Full record and what to do →NVD record wpscan.com
Oct 14, 2026Rank Math SEO: Does not perform a capability or nonce check before clearing its stored SEO analysis dataCVE-2026-104751 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Rank Math SEO WordPress plugin before 1.0.280 does not perform a capability or nonce check before clearing its stored SEO analysis data, allowing unauthenticated users to delete it.
Product
Rank Math SEO
Fixed in
1.0.280
What to do
Update Rank Math SEO to 1.0.280 or newer.
Full record and what to do →NVD record wpscan.com
Oct 13, 2026Database Addon for Contact Form 7 – CFDB7: Arbitrary File DeletionCVE-2026-107652 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Database Addon for Contact Form 7 – CFDB7 plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 1.4.1. This is due to the plugin storing arbitrary (non-form-tag) submission fields in its db7_forms row and the process_bulk_action() delete handler then matching any stored key whose name contains the substring 'cfdb7_file' and passing the stored value directly to unlink() without validating that the file actually belongs to the submission being deleted or constraining the filename with basename()/realpath(). This makes it possible for unauthenticated attackers to inject a crafted multipart field.
Product
Database Addon for Contact Form 7 – CFDB7
Affected
up to 1.4.1
What to do
Affects up to 1.4.1. Update Database Addon for Contact Form 7 – CFDB7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 13, 2026Active Products Tables for WooCommerce: Insertion of Sensitive Information Into Sent DataCVE-2026-108489 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Insertion of Sensitive Information Into Sent Data vulnerability in PluginUs.Net Active Products Tables for WooCommerce profit-products-tables-for-woocommerce allows Retrieve Embedded Sensitive Data.This issue affects Active Products Tables for WooCommerce: from n/a through 2.1.3.
Product
Active Products Tables for WooCommerce
Affected
up to 2.1.3
What to do
Affects up to 2.1.3. Update Active Products Tables for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 12, 2026Booster Elite for WooCommerce: Insertion of Sensitive Information Into Sent DataCVE-2023-25996 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Insertion of Sensitive Information Into Sent Data vulnerability in Pluggabl LLC. Booster Elite for WooCommerce booster-elite-for-woocommerce allows Retrieve Embedded Sensitive Data.This issue affects Booster Elite for WooCommerce: from n/a before 8.4.0.
Product
Booster Elite for WooCommerce
Fixed in
8.4.0
What to do
Update Booster Elite for WooCommerce to 8.4.0 or newer.
Full record and what to do →NVD record patchstack.com
Oct 11, 2026Datalist it: Does not sanitize and escape several request parameters before using them to build a SQL queryCVE-2026-89285 · WordPress plugins & themes · reported by WPScanHigh 8.6
The Datalist it WordPress plugin through 0.0.3 does not sanitize and escape several request parameters before using them to build a SQL query, allowing unauthenticated attackers to perform SQL injection and read arbitrary data from the database.
Product
Datalist it
Affected
up to 0.0.3
What to do
Affects up to 0.0.3. Update Datalist it to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Oct 11, 2026SmugMug Embed: Does not have authorisation or CSRF checks on an AJAX action that stores gallery dataCVE-2026-88826 · WordPress plugins & themes · reported by WPScanHigh 8.8
The SmugMug Embed WordPress plugin through 3.13 does not have authorisation or CSRF checks on an AJAX action that stores gallery data, and does not sanitise or escape that data before outputting it, allowing unauthenticated users to store arbitrary web scripts that execute when an administrator views the SmugMug Embed WordPress plugin through 3.13's settings screen.
Product
SmugMug Embed
Affected
up to 3.13
What to do
Affects up to 3.13. Update SmugMug Embed to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Oct 10, 2026Unauthenticated Sensitive Data Exposure in Contact Form 7 – Dynamic Text Extension <= 5.0.7 versions.CVE-2026-62043 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Sensitive Data Exposure in Contact Form 7 – Dynamic Text Extension <= 5.0.7 versions.
Affected
up to 5.0.7
What to do
Affects up to 5.0.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 10, 2026Unauthenticated Sensitive Data Exposure in Web Plura Backup & Restore Manager <= 0.2.25 versions.CVE-2026-42630 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Sensitive Data Exposure in Web Plura Backup & Restore Manager <= 0.2.25 versions.
Affected
up to 0.2.25
What to do
Affects up to 0.2.25. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 10, 2026Unauthenticated Sensitive Data Exposure in Swish Migrate and Backup <= 1.4.0 versions.CVE-2026-42419 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Unauthenticated Sensitive Data Exposure in Swish Migrate and Backup <= 1.4.0 versions.
Affected
up to 1.4.0
What to do
Affects up to 1.4.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 10, 2026Super Video Player: Deserialization of Untrusted DataCVE-2026-62044 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Deserialization of Untrusted Data vulnerability in bPlugins Super Video Player super-video-player allows Object Injection.This issue affects Super Video Player: from n/a through 1.8.13.
Product
Super Video Player
Affected
up to 1.8.13
What to do
Affects up to 1.8.13. Update Super Video Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 10, 2026AFFI – Affiliate Marketing for WooCommerce: Deserialization of Untrusted DataCVE-2026-104398 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in VillaTheme AFFI – Affiliate Marketing for WooCommerce affi-affiliate-marketing-for-woo allows Object Injection.This issue affects AFFI – Affiliate Marketing for WooCommerce: from n/a through 1.0.10.
Product
AFFI – Affiliate Marketing for WooCommerce
Affected
up to 1.0.10
What to do
Affects up to 1.0.10. Update AFFI – Affiliate Marketing for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 10, 2026Tainacan: Deserialization of Untrusted DataCVE-2026-94676 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Deserialization of Untrusted Data vulnerability in Tainacan Community Tainacan tainacan allows Object Injection.This issue affects Tainacan: from n/a through 1.3.0.
Product
Tainacan
Affected
up to 1.3.0
What to do
Affects up to 1.3.0. Update Tainacan to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 10, 2026WP Rollback: Insertion of Sensitive Information Into Sent DataCVE-2026-66435 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Insertion of Sensitive Information Into Sent Data vulnerability in Devin Walker WP Rollback wp-rollback allows Retrieve Embedded Sensitive Data.This issue affects WP Rollback: from n/a through 3.1.2.
Product
WP Rollback
Affected
up to 3.1.2
What to do
Affects up to 3.1.2. Update WP Rollback to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 10, 2026Slider by 10Web: Deserialization of Untrusted DataCVE-2026-105885 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in 10Web Slider by 10Web slider-wd allows Object Injection.This issue affects Slider by 10Web: from n/a through 1.2.62.
Product
Slider by 10Web
Affected
up to 1.2.62
What to do
Affects up to 1.2.62. Update Slider by 10Web to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 10, 2026Balance: Deserialization of Untrusted DataCVE-2026-93945 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in Axiomthemes Balance balance allows Object Injection.This issue affects Balance: from n/a through 1.12.0.
Product
Balance
Affected
up to 1.12.0
What to do
Affects up to 1.12.0. Update Balance to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 10, 2026Camelia: Deserialization of Untrusted DataCVE-2026-93944 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeREX Group Camelia camelia allows Object Injection.This issue affects Camelia: from n/a through 1.2.15.
Product
Camelia
Affected
up to 1.2.15
What to do
Affects up to 1.2.15. Update Camelia to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 10, 2026Convex: Deserialization of Untrusted DataCVE-2026-93943 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeREX Group Convex convex allows Object Injection.This issue affects Convex: from n/a through 1.16.0.
Product
Convex
Affected
up to 1.16.0
What to do
Affects up to 1.16.0. Update Convex to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 10, 2026Dwell: Deserialization of Untrusted DataCVE-2026-93942 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeREX Group Dwell dwell allows Object Injection.This issue affects Dwell: from n/a through 1.16.0.
Product
Dwell
Affected
up to 1.16.0
What to do
Affects up to 1.16.0. Update Dwell to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 10, 2026Edema: Deserialization of Untrusted DataCVE-2026-93941 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeREX Group Edema edema allows Object Injection.This issue affects Edema: from n/a through 1.2.2.2.
Product
Edema
Affected
up to 1.2.2.2
What to do
Affects up to 1.2.2.2. Update Edema to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 10, 2026Greeny: Deserialization of Untrusted DataCVE-2026-93940 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeREX Group Greeny greeny allows Object Injection.This issue affects Greeny: from n/a through 2.10.0.
Product
Greeny
Affected
up to 2.10.0
What to do
Affects up to 2.10.0. Update Greeny to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 10, 2026Hogwords: Deserialization of Untrusted DataCVE-2026-93938 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeREX Group Hogwords hogwords allows Object Injection.This issue affects Hogwords: from n/a through 1.2.7.
Product
Hogwords
Affected
up to 1.2.7
What to do
Affects up to 1.2.7. Update Hogwords to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 10, 2026Hygia: Deserialization of Untrusted DataCVE-2026-93937 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeREX Group Hygia hygia allows Object Injection.This issue affects Hygia: from n/a through 1.21.0.
Product
Hygia
Affected
up to 1.21.0
What to do
Affects up to 1.21.0. Update Hygia to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 10, 2026IPharm: Deserialization of Untrusted DataCVE-2026-93936 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeREX Group IPharm ipharm allows Object Injection.This issue affects IPharm: from n/a through 1.2.4.
Product
IPharm
Affected
up to 1.2.4
What to do
Affects up to 1.2.4. Update IPharm to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 10, 2026Let's Play: Deserialization of Untrusted DataCVE-2026-93935 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeREX Group Let's Play playhockey allows Object Injection.This issue affects Let's Play: from n/a through 1.1.15.
Product
Let's Play
Affected
up to 1.1.15
What to do
Affects up to 1.1.15. Update Let's Play to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 10, 2026Partiso: Deserialization of Untrusted DataCVE-2026-93934 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeREX Group Partiso partiso allows Object Injection.This issue affects Partiso: from n/a through 1.1.13.
Product
Partiso
Affected
up to 1.1.13
What to do
Affects up to 1.1.13. Update Partiso to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 10, 2026Rosalinda: Deserialization of Untrusted DataCVE-2026-93933 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeREX Group Rosalinda rosalinda allows Object Injection.This issue affects Rosalinda: from n/a through 1.2.4.
Product
Rosalinda
Affected
up to 1.2.4
What to do
Affects up to 1.2.4. Update Rosalinda to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 10, 2026Smart Casa: Deserialization of Untrusted DataCVE-2026-93932 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeREX Group Smart Casa smart-casa allows Object Injection.This issue affects Smart Casa: from n/a through 1.0.12.
Product
Smart Casa
Affected
up to 1.0.12
What to do
Affects up to 1.0.12. Update Smart Casa to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 10, 2026Smash: Deserialization of Untrusted DataCVE-2026-93931 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeREX Group Smash smash allows Object Injection.This issue affects Smash: from n/a through 1.12.0.
Product
Smash
Affected
up to 1.12.0
What to do
Affects up to 1.12.0. Update Smash to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 10, 2026Tantra: Deserialization of Untrusted DataCVE-2026-93930 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeREX Group Tantra tantra allows Object Injection.This issue affects Tantra: from n/a through 2.9.0.
Product
Tantra
Affected
up to 2.9.0
What to do
Affects up to 2.9.0. Update Tantra to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 10, 2026Travesia: Deserialization of Untrusted DataCVE-2026-93929 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeREX Group Travesia travesia allows Object Injection.This issue affects Travesia: from n/a through 1.1.16.
Product
Travesia
Affected
up to 1.1.16
What to do
Affects up to 1.1.16. Update Travesia to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 10, 2026Veto: Deserialization of Untrusted DataCVE-2026-93927 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in Axiomthemes Veto veto allows Object Injection.This issue affects Veto: from n/a through 1.6.0.
Product
Veto
Affected
up to 1.6.0
What to do
Affects up to 1.6.0. Update Veto to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 10, 2026Gutentype: Deserialization of Untrusted DataCVE-2026-62046 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeREX Group Gutentype gutentype allows Object Injection.This issue affects Gutentype: from n/a through 2.1.12.
Product
Gutentype
Affected
up to 2.1.12
What to do
Affects up to 2.1.12. Update Gutentype to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 10, 2026Booklovers: Deserialization of Untrusted DataCVE-2026-62045 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeREX Group Booklovers booklovers allows Object Injection.This issue affects Booklovers: from n/a through 2.13.0.
Product
Booklovers
Affected
up to 2.13.0
What to do
Affects up to 2.13.0. Update Booklovers to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.