Updated 8 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

456new WordPress flaws this week

390,714entries in the database

845 results · page 2 of 17

Oct 5, 2026Events Manager: Insertion of Sensitive Information Into Sent DataCVE-2026-105068 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Insertion of Sensitive Information Into Sent Data vulnerability in Pixelite Events Manager events-manager allows Retrieve Embedded Sensitive Data.This issue affects Events Manager: from n/a through 7.4.5.
Product
Events Manager
Affected
up to 7.4.5
What to do
Affects up to 7.4.5. Update Events Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 5, 2026Event Tickets: Missing AuthorizationCVE-2026-104675 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Tickets: from n/a through 5.30.0.
Product
Event Tickets
Affected
up to 5.30.0
What to do
Affects up to 5.30.0. Update Event Tickets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 3, 2026WP Ultimate Review: Does not prevent unauthenticated users from storing crafted review content that makes the reviewed page fail with a fatal error on every subsequent visitCVE-2026-101161 · WordPress plugins & themes · reported by WPScanHigh 7.5
The WP Ultimate Review WordPress plugin before 2.4.4 does not prevent unauthenticated users from storing crafted review content that makes the reviewed page fail with a fatal error on every subsequent visit, resulting in a persistent denial of service when the WP Ultimate Review WordPress plugin before 2.4.4's review display settings have never been saved.
Product
WP Ultimate Review
Fixed in
2.4.4
What to do
Update WP Ultimate Review to 2.4.4 or newer.
Full record and what to do →NVD record wpscan.com
Oct 2, 2026Event Tickets and Registration: Generic SQL InjectionCVE-2026-97634 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Event Tickets and Registration plugin for WordPress is vulnerable to generic SQL Injection via the 'orderby' parameter in all versions up to, and including, 5.29.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. A Contributor-level user can reach the vulnerable code path by supplying a post_id they authored, as the can_access_page() gate requires only post authorship rather than the edit_others_posts capability for post owners.
Product
Event Tickets and Registration
Affected
up to 5.29.5
What to do
Affects up to 5.29.5. Update Event Tickets and Registration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 2, 2026Events Calendar: Does not validate or sanitise data submitted to an unauthenticated AJAX action before merging it into its rendering contextCVE-2026-84740 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Events Calendar WordPress plugin before 6.17.5.1 does not validate or sanitise data submitted to an unauthenticated AJAX action before merging it into its rendering context, allowing unauthenticated users to execute arbitrary shortcodes registered on the site.
Product
Events Calendar
Fixed in
6.17.5.1
What to do
Update Events Calendar to 6.17.5.1 or newer.
Full record and what to do →NVD record wpscan.com
Oct 1, 2026Payments for Hubtel: Does not prevent public access to a debug log inCVE-2026-96255 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Payments for Hubtel WordPress plugin before 1.0.2 does not prevent public access to a debug log in which it records payment requests, including the store's payment gateway API credentials in plain text, allowing unauthenticated attackers to obtain those credentials.
Product
Payments for Hubtel
Fixed in
1.0.2
What to do
Update Payments for Hubtel to 1.0.2 or newer.
Full record and what to do →NVD record wpscan.com
Sep 30, 2026Event Tickets: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-97287 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Blind SQL Injection. This issue affects Event Tickets: from n/a through 5.29.5.
Product
Event Tickets
Affected
up to 5.29.5
What to do
Affects up to 5.29.5. Update Event Tickets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record intrudify.com patchstack.com
Sep 30, 2026Contributor Broken Access Control in The Events Calendar <= 6.17.5 versions.CVE-2026-97285 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Contributor Broken Access Control in The Events Calendar <= 6.17.5 versions.
Affected
up to 6.17.5
What to do
Affects up to 6.17.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 30, 2026Subscriber Broken Access Control in Prevent files / folders access <= 2.6.7 versions.CVE-2026-97267 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Subscriber Broken Access Control in Prevent files / folders access <= 2.6.7 versions.
Affected
up to 2.6.7
What to do
Affects up to 2.6.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 30, 2026EWWW Image Optimizer: Does not prevent authenticated users with author-level permissions from storing a serialized value in a post meta field that is deserializedCVE-2026-91051 · WordPress plugins & themes · reported by WPScanMedium 6.6
The EWWW Image Optimizer WordPress plugin before 8.8.0 does not prevent authenticated users with author-level permissions from storing a serialized value in a post meta field that is deserialized when the post is rendered, allowing them to perform PHP Object Injection, which can lead to remote code execution when a suitable gadget chain is present via another installed EWWW Image Optimizer WordPress plugin before 8.8.0 or .
Product
EWWW Image Optimizer
Fixed in
8.8.0
What to do
Update EWWW Image Optimizer to 8.8.0 or newer.
Full record and what to do →NVD record wpscan.com
Sep 30, 2026User Frontend: Does not prevent tampering with the role assigned by its registration formCVE-2026-75823 · WordPress plugins & themes · reported by WPScanHigh 7.4
The User Frontend WordPress plugin before 4.3.12 does not prevent tampering with the role assigned by its registration form, allowing unauthenticated users to register with a higher privileged role, such as Editor. This affects installations running a PHP build where the sodium extension is unavailable, and where a registration page has been configured. The administrator role cannot be obtained this way.
Product
User Frontend
Fixed in
4.3.12
What to do
Update User Frontend to 4.3.12 or newer.
Full record and what to do →NVD record wpscan.com
Sep 27, 2026Online Scheduling and Appointment Booking System: Does not prevent deserialization of untrusted input and does not correctly restrict a privileged maintenance feature to administratorsCVE-2026-86841 · WordPress plugins & themes · reported by WPScanMedium 4.7
The Online Scheduling and Appointment Booking System WordPress plugin before 28.3 does not prevent deserialization of untrusted input and does not correctly restrict a privileged maintenance feature to administrators, allowing users granted a custom booking-management capability, which an administrator must explicitly assign, to inject arbitrary PHP objects, overwrite privileged site options, and read stored integration secrets.
Product
Online Scheduling and Appointment Booking System
Fixed in
28.3
What to do
Update Online Scheduling and Appointment Booking System to 28.3 or newer.
Full record and what to do →NVD record wpscan.com
Sep 26, 2026File Manager: Does not prevent unauthenticated users from downloading its database backup archivesCVE-2026-19708 · WordPress plugins & themes · reported by WPScanMedium 5.9
The File Manager WordPress plugin before 8.0.5 does not prevent unauthenticated users from downloading its database backup archives, and in some cases writes them under a fixed filename, allowing unauthenticated attackers to retrieve a full database dump including every user's email address and password hash on servers that do not apply the directory's .htaccess file.
Product
File Manager
Fixed in
8.0.5
What to do
Update File Manager to 8.0.5 or newer.
Full record and what to do →NVD record wpscan.com
Sep 24, 2026Events Manager: Does not force the scope of its logged-in event and location searchCVE-2026-93662 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Events Manager WordPress plugin before 7.4.5 does not force the scope of its logged-in event and location search when a caller supplies their own owner value, letting a low-privileged user read other accounts' unpublished, pending or trashed event and venue content, including full street addresses.
Product
Events Manager
Fixed in
7.4.5
What to do
Update Events Manager to 7.4.5 or newer.
Full record and what to do →NVD record wpscan.com
Sep 24, 2026Events Manager: Does not stop a ticket-update request from replacing the identifiers of the ticket it was authorized againstCVE-2026-93661 · WordPress plugins & themes · reported by WPScanLow 2.7
The Events Manager WordPress plugin before 7.4.5 does not stop a ticket-update request from replacing the identifiers of the ticket it was authorized against, letting a user who can manage one event's tickets overwrite and reassign any ticket on the site to their own event.
Product
Events Manager
Fixed in
7.4.5
What to do
Update Events Manager to 7.4.5 or newer.
Full record and what to do →NVD record wpscan.com
Sep 23, 2026Unauthenticated Cross Site Scripting (XSS) in Event Tickets <= 5.29.4 versions.CVE-2026-93526 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Event Tickets <= 5.29.4 versions.
Affected
up to 5.29.4
What to do
Affects up to 5.29.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 23, 2026Event Booking Manager for WooCommerce: Does not restrict its event listing query to events the requesting user is permitted to readCVE-2026-91077 · WordPress plugins & themes · reported by WPScanLow 2.7
The Event Booking Manager for WooCommerce WordPress plugin before 5.7.3 does not restrict its event listing query to events the requesting user is permitted to read, so users with contributor-level access and above can retrieve other authors' private, draft and trashed events, together with event detail the standard listing does not show them. This discloses private events and their content that WordPress withholds from users lacking the read_private_posts capability.
Product
Event Booking Manager for WooCommerce
Fixed in
5.7.3
What to do
Update Event Booking Manager for WooCommerce to 5.7.3 or newer.
Full record and what to do →NVD record wpscan.com
Sep 23, 2026JSM Show Post Metadata: Does not properly escape a post meta key before outputting it into an inline event-handler attribute in an admin-facing meta boxCVE-2026-88997 · WordPress plugins & themes · reported by WPScanMedium 6.8
The JSM Show Post Metadata WordPress plugin before 4.9.1 does not properly escape a post meta key before outputting it into an inline event-handler attribute in an admin-facing meta box, allowing users with contributor-level access and above to inject arbitrary JavaScript that executes in the session of a higher-privileged user who reviews the affected post.
Product
JSM Show Post Metadata
Fixed in
4.9.1
What to do
Update JSM Show Post Metadata to 4.9.1 or newer.
Full record and what to do →NVD record wpscan.com
Sep 23, 2026Events Calendar: Does not perform a per-object capability check on one family of its REST write routesCVE-2026-84743 · WordPress plugins & themes · reported by WPScanLow 3.8
The Events Calendar WordPress plugin before 6.17.5 does not perform a per-object capability check on one family of its REST write routes, allowing users with a low-privilege role such as contributor to modify, unpublish, trash and take ownership of records belonging to other users, including administrators.
Product
Events Calendar
Fixed in
6.17.5
What to do
Update Events Calendar to 6.17.5 or newer.
Full record and what to do →NVD record wpscan.com
Sep 23, 2026Events Calendar: Does not check the capability required to publish content before creating or updating it through its REST APICVE-2026-84742 · WordPress plugins & themes · reported by WPScanLow 2.7
The Events Calendar WordPress plugin before 6.17.5 does not check the capability required to publish content before creating or updating it through its REST API, allowing users with a role that cannot normally publish, such as contributor, to publish content directly and bypass editorial review.
Product
Events Calendar
Fixed in
6.17.5
What to do
Update Events Calendar to 6.17.5 or newer.
Full record and what to do →NVD record wpscan.com
Sep 23, 2026Events Calendar: Does not check the post status of linked records before embedding their stored details into a public REST API responseCVE-2026-84741 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Events Calendar WordPress plugin before 6.17.5 does not check the post status of linked records before embedding their stored details into a public REST API response, allowing unauthenticated users to read the contents of records that have never been published.
Product
Events Calendar
Fixed in
6.17.5
What to do
Update Events Calendar to 6.17.5 or newer.
Full record and what to do →NVD record wpscan.com
Sep 22, 2026The Ninja Forms WordPress plugin 3.15.3 does not prevent user-submitted form field values from being deserialised when an administrator later exports form submiCVE-2026-91827 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Ninja Forms WordPress plugin 3.15.3 does not prevent user-submitted form field values from being deserialised when an administrator later exports form submissions to CSV, allowing unauthenticated attackers to perform PHP Object Injection; if a suitable POP chain is present via another installed plugin or theme, this can lead to actions such as arbitrary file operations or remote code execution.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record wpscan.com
Sep 18, 2026LatePoint – Calendar Booking Plugin for Appointments and Events: Insecure Direct Object ReferenceCVE-2026-13471 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.6.3 via the LatePointAbilityDeleteBooking::execute due to missing validation on a user controlled key. This makes it possible for attackers, with LatePoint Agent-level access and above, to read bookings and customer PII (full name, email, phone, and notes) assigned to other LatePoint agents, and delete arbitrary bookings by supplying any booking ID. This vulnerability is only exploitable when an administrator has enabled the Abilities API toggles (latepoint_abilities_api, latepoint_abilities_api_delete, and/or latepoint_abilities_api_edit) in the plugin settings.
Product
LatePoint – Calendar Booking Plugin for Appointments and Events
Affected
up to 5.6.3
What to do
Affects up to 5.6.3. Update LatePoint – Calendar Booking Plugin for Appointments and Events to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 17, 2026Booking for Appointments and Events Calendar – Amelia: Unauthorized modification of dataCVE-2026-16582 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to unauthorized modification of data in all versions up to, and including, 2.4.5. This is due to the plugin accepting a client-supplied package-redemption identifier as proof of payment without validating it. This makes it possible for unauthenticated attackers to create approved appointment bookings without completing payment
Product
Booking for Appointments and Events Calendar – Amelia
Affected
up to 2.4.5
What to do
Affects up to 2.4.5. Update Booking for Appointments and Events Calendar – Amelia to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 17, 2026Booking for Appointments and Events Calendar – Amelia: Unauthorized access and modification of dataCVE-2026-14311 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing ownership verification on /users/customers/<id> endpoint in all versions up to, and including, 2.4.4. This makes it possible for authenticated attackers, with wpamelia-provider role, to view and modify arbitrary customers, including password reset. Takeover of WordPress user accounts, with the roles up to Editor, is also possible if that user had made an Amelia booking. This vulnerability affects only the Premium version of the plugin, where the Employee Panel is present.
Product
Booking for Appointments and Events Calendar – Amelia
Affected
up to 2.4.4
What to do
Affects up to 2.4.4. Update Booking for Appointments and Events Calendar – Amelia to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 17, 2026Event Booking Manager for WooCommerce: Does not restrict who can view its stored payment gateway configurationCVE-2026-91019 · WordPress plugins & themes · reported by WPScanMedium 4.9
The Event Booking Manager for WooCommerce WordPress plugin before 5.6.0 does not restrict who can view its stored payment gateway configuration, allowing users with Contributor-level access and above to read the site's PayPal and Stripe credentials, including their secret keys.
Product
Event Booking Manager for WooCommerce
Fixed in
5.6.0
What to do
Update Event Booking Manager for WooCommerce to 5.6.0 or newer.
Full record and what to do →NVD record wpscan.com
Sep 17, 2026Event Booking Manager for WooCommerce: Does not perform an ownership or authorization check before rendering booking confirmation detailsCVE-2026-91008 · WordPress plugins & themes · reported by WPScanLow 3.7
The Event Booking Manager for WooCommerce WordPress plugin before 5.3.8 does not perform an ownership or authorization check before rendering booking confirmation details, allowing unauthenticated attackers to retrieve registered attendees' personal information (full name, email address, phone number, and custom registration fields) by supplying an enumerable booking reference. Exploitation is limited to sites configured to use the Event Booking Manager for WooCommerce WordPress plugin before 5.3.8's native (non-WooCommerce) checkout, which is not the default.
Product
Event Booking Manager for WooCommerce
Fixed in
5.3.8
What to do
Update Event Booking Manager for WooCommerce to 5.3.8 or newer.
Full record and what to do →NVD record wpscan.com
Sep 16, 2026Eventin: Does not verify that a completed payment corresponds to the order it is applied toCVE-2026-84906 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Eventin WordPress plugin before 4.1.24 does not verify that a completed payment corresponds to the order it is applied to, confirming only that the payment gateway reports the transaction as successful, not its amount, currency, or which order it belongs to, allowing unauthenticated visitors to mark unpaid orders of any value as paid by replaying the transaction of a single genuine low-value payment.
Product
Eventin
Fixed in
4.1.24
What to do
Update Eventin to 4.1.24 or newer.
Full record and what to do →NVD record wpscan.com
Sep 16, 2026Formidable Forms: Does not prevent a request-derived value from reaching the WordPress shortcode parserCVE-2026-19857 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Formidable Forms WordPress plugin before 6.35 does not prevent a request-derived value from reaching the WordPress shortcode parser when it substitutes a supported token into a form's custom HTML, allowing unauthenticated visitors to have arbitrary shortcodes, with attacker-chosen attributes, executed server-side on any page displaying an affected form.
Product
Formidable Forms
Fixed in
6.35
What to do
Update Formidable Forms to 6.35 or newer.
Full record and what to do →NVD record wpscan.com
Sep 16, 2026Eventin: Does not properly authorise order finalisationCVE-2026-84907 · WordPress plugins & themes · reported by WPScanLow 3.7
The Eventin WordPress plugin before 4.1.24 does not properly authorise order finalisation when its offline (local) payment method is enabled, relying on a nonce that is exposed to unauthenticated visitors and never checking that the caller owns the order, allowing unauthenticated attackers to reset any existing order and its attendees to a pending state and thereby invalidate paid tickets.
Product
Eventin
Fixed in
4.1.24
What to do
Update Eventin to 4.1.24 or newer.
Full record and what to do →NVD record wpscan.com
Sep 16, 2026Eventin: Does not verify a user's capability to create accountsCVE-2026-84905 · WordPress plugins & themes · reported by WPScanLow 2.7
The Eventin WordPress plugin before 4.1.24 does not verify a user's capability to create accounts when adding a speaker, allowing users with contributor-level access and above to create new WordPress user accounts that carry capabilities beyond their own, including publishing content and uploading files, and, by supplying an email address they control, to obtain a working login to the created account.
Product
Eventin
Fixed in
4.1.24
What to do
Update Eventin to 4.1.24 or newer.
Full record and what to do →NVD record wpscan.com
Sep 16, 2026Eventin: Does not prevent the token issued to a guest at checkout from being used to change that order's tickets afterwardsCVE-2026-77702 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Eventin WordPress plugin before 4.1.24 does not prevent the token issued to a guest at checkout from being used to change that order's tickets afterwards, allowing unauthenticated users to replace a paid ticket with a free one and complete the order at no charge.
Product
Eventin
Fixed in
4.1.24
What to do
Update Eventin to 4.1.24 or newer.
Full record and what to do →NVD record wpscan.com
Sep 15, 2026Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce: Privilege EscalationCVE-2026-75983 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.1.23. This is due to the `PermissionManager::manage_permissions()` function being registered as a callback on WordPress core's `map_meta_cap` filter and unconditionally returning the always-true `'exist'` primitive for every capability check whenever the evaluated user ID is 1, without scoping this behavior to plugin-specific capabilities. This makes it possible for authenticated attackers whose account is user ID 1, even subscribers, to pass every WordPress capability check, including `manage_options`, `edit_plugins`, `edit_themes`, `promote_users`, and `update_core`, thereby elevating their privileges to administrator-equivalent power and achieving full site takeover, including remote code execution via the plugin and theme editors. Exploitation is only impactful when user ID 1 has been deliberately demoted to a lower-privilege role as a common administrator-account hardening practice; on default installations where user ID 1 retains the administrator role, no incremental privilege gain occurs.
Product
Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce
Affected
up to 4.1.23
What to do
Affects up to 4.1.23. Update Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 15, 2026Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered): Stored Cross-Site ScriptingCVE-2026-15402 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'etn_shedule_objective' schedule_slot Parameter in all versions up to, and including, 4.1.23 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered)
Affected
up to 4.1.23
What to do
Affects up to 4.1.23. Update Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 13, 2026MDJM Event Management: And the Mobile Events Manager WordPress plugin through 1CVE-2026-88802 · WordPress plugins & themes · reported by WPScanHigh 7.5
The MDJM Event Management WordPress plugin before 1.7.8.5 and the Mobile Events Manager WordPress plugin through 1.4.8.3 do not check a capability, a nonce or the type of the record before permanently deleting the post identified in a request to their playlist entry removal, allowing unauthenticated attackers to destroy arbitrary posts, pages and media attachments, bypassing the trash.
Product
MDJM Event Management
Affected
up to 1.4.8.3
Fixed in
1.7.8.5
What to do
Update MDJM Event Management to 1.7.8.5 or newer.
Full record and what to do →NVD record wpscan.com
Sep 13, 2026Really Simple Security: Does not prevent an unauthenticated request from resetting an account's completed email two-factor enrolmentCVE-2026-89080 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Really Simple Security WordPress plugin before 9.8.1 does not prevent an unauthenticated request from resetting an account's completed email two-factor enrolment, allowing an attacker who already knows the account's password to bypass the second factor and obtain that user's session, up to administrator.
Product
Really Simple Security
Fixed in
9.8.1
What to do
Update Really Simple Security to 9.8.1 or newer.
Full record and what to do →NVD record wpscan.com
Sep 12, 2026Booking for Appointments and Events Calendar: Stored Cross-Site ScriptingCVE-2026-10148 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Booking for Appointments and Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple Elementor widgets in versions up to and including 2.4.9. This is due to insufficient input sanitization and output escaping on the 'load_manually' parameter in the render() methods of classes. This makes it possible for authenticated attackers, with Contributor-level access and above who can use Elementor, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerability was partially patched in version 2.4.8.
Product
Booking for Appointments and Events Calendar
Affected
up to 2.4.9
What to do
Affects up to 2.4.9. Update Booking for Appointments and Events Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 12, 2026The Events Calendar: Remote Code ExecutionCVE-2026-78159 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The The Events Calendar plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 6.17.3 via the parse_array function. This is due to insufficient validation of the widget 'classes' map, allowing a plain-array payload to bypass the is_safe_widget_instance() object check and reach the callable-invocation sink in Element_Classes::parse_array(). This makes it possible for unauthenticated attackers to execute code on the server. Exploitation requires that the targeted site has comments enabled on tribe_events posts and that at least one comment containing a crafted wp:legacy-widget block has been submitted, as the attack chain is triggered when do_blocks() processes the single-event HTML including the comment area.
Product
The Events Calendar
Affected
up to 6.17.3
What to do
Affects up to 6.17.3. Update The Events Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 12, 2026The Events Calendar: Remote Code ExecutionCVE-2026-78006 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The The Events Calendar plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 6.17.4 via the is_safe_widget_instance function. This is due to insufficient protection in is_safe_widget_instance, which can be bypassed because PHP fires magic methods during its pre-parse, combined with enable_rendering_widget_copied() forging a valid wp_hash integrity attribute before unserialize() is reached. This makes it possible for unauthenticated attackers to execute code on the server. This is exploitable without authentication or approval because the plugin's V2 single-event template runs do_blocks() over buffered comment HTML, and WordPress returns a moderation-hash URL that allows an unauthenticated commenter to immediately view their own pending comment, delivering the injected block markup to the vulnerable code path before any moderation occurs. This does require comments to be enabled and visible on events.
Product
The Events Calendar
Affected
up to 6.17.4
What to do
Affects up to 6.17.4. Update The Events Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 12, 2026wpstorecart: Does not prevent directCVE-2026-84099 · WordPress plugins & themes · reported by WPScanHigh 8.1
The wpstorecart WordPress plugin through 5.0.7 does not prevent direct, unauthenticated access to a bundled add-on that deserializes user-supplied input without restricting the permitted classes, allowing unauthenticated attackers to inject arbitrary PHP objects, which may be escalated further when a suitable gadget chain is present on the site.
Product
wpstorecart
Affected
up to 5.0.7
What to do
Affects up to 5.0.7. Update wpstorecart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Sep 12, 2026Masteriyo LMS: Does not prevent user-supplied values heldCVE-2026-82845 · WordPress plugins & themes · reported by WPScanCritical 9.9
The Masteriyo LMS WordPress plugin before 3.4.1 does not prevent user-supplied values held as metadata from being deserialized when they are read back, allowing users with a minimal account to inject arbitrary PHP objects and, by way of a class shipped in a library bundled with the Masteriyo LMS WordPress plugin before 3.4.1, write and execute arbitrary code on the server. A weaker form of the same issue is reachable without an account and yields an arbitrary file write rather than code execution.
Product
Masteriyo LMS
Fixed in
3.4.1
What to do
Update Masteriyo LMS to 3.4.1 or newer.
Full record and what to do →NVD record wpscan.com
Sep 12, 2026Temporary Login Without Password: Does not prevent a temporary user from creating an Application PasswordCVE-2026-77753 · WordPress plugins & themes · reported by WPScanMedium 5.5
The Temporary Login Without Password WordPress plugin before 1.9.9 does not prevent a temporary user from creating an Application Password, and does not revoke one when the temporary access expires or is disabled, allowing the recipient of a temporary login to retain working access to the site over REST and XML-RPC after the administrator believes it has been withdrawn. The retained access carries whatever role was granted, which for the Temporary Login Without Password WordPress plugin before 1.9.9's main use case is Administrator.
Product
Temporary Login Without Password
Fixed in
1.9.9
What to do
Update Temporary Login Without Password to 1.9.9 or newer.
Full record and what to do →NVD record wpscan.com
Sep 12, 2026Booking for Appointments and Events Calendar: Does not verify that the user editing a customer or employee record is entitled to modify the WordPress account linked to itCVE-2026-77705 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Booking for Appointments and Events Calendar WordPress plugin before 2.4.10 does not verify that the user editing a customer or employee record is entitled to modify the WordPress account linked to it, allowing users holding Amelia's customer or employee management permissions to set the password and email address of other users' WordPress accounts and take them over.
Product
Booking for Appointments and Events Calendar
Fixed in
2.4.10
What to do
Update Booking for Appointments and Events Calendar to 2.4.10 or newer.
Full record and what to do →NVD record wpscan.com
Sep 12, 2026Booking for Appointments and Events Calendar: Does not verify that a payment was actually taken before recording a bookingCVE-2026-77689 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Booking for Appointments and Events Calendar WordPress plugin before 9.8.1 does not verify that a payment was actually taken before recording a booking as paid, trusting the payment gateway named in a public, unauthenticated booking request even when the site has never configured that gateway. This lets an unauthenticated attacker obtain confirmed, fully paid appointments and events without any payment being collected.
Product
Booking for Appointments and Events Calendar
Fixed in
9.8.1
What to do
Update Booking for Appointments and Events Calendar to 9.8.1 or newer.
Full record and what to do →NVD record wpscan.com
Sep 10, 2026Subscriber Cross Site Scripting (XSS) in EventON <= 2.5.7 versions.CVE-2026-81791 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Subscriber Cross Site Scripting (XSS) in EventON <= 2.5.7 versions.
Affected
up to 2.5.7
What to do
Affects up to 2.5.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 10, 2026Site Reviews: Does not prevent request data from being deserializedCVE-2026-82925 · WordPress plugins & themes · reported by WPScanHigh 8.1
The Site Reviews WordPress plugin before 8.3.0 does not prevent request data from being deserialized, and derives the key protecting that data by padding out the site's WordPress nonce key, which makes the key publicly computable on installs where that key is absent, left at its sample value, or too short to be secret. This allows unauthenticated users to inject arbitrary PHP objects on such installs. The Site Reviews WordPress plugin before 8.3.0's own code contains no chain onward from the injected object, so how far it reaches depends on the other code present on the site.
Product
Site Reviews
Fixed in
8.3.0
What to do
Update Site Reviews to 8.3.0 or newer.
Full record and what to do →NVD record wpscan.com
Sep 9, 2026Hustle: Does not prevent shortcodes in submitted form values from being executedCVE-2026-80440 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Hustle WordPress plugin before 7.8.14.2 does not prevent shortcodes in submitted form values from being executed when it substitutes those values into the message it returns after submission, because the guard it applies can be defeated by nesting, allowing unauthenticated users to run any shortcode registered on the site.
Product
Hustle
Fixed in
7.8.14.2
What to do
Update Hustle to 7.8.14.2 or newer.
Full record and what to do →NVD record wpscan.com
Sep 9, 2026CleanTalk: Does not prevent unauthenticatedCVE-2026-19855 · WordPress plugins & themes · reported by WPScanMedium 6.5
The CleanTalk WordPress plugin before 6.87 does not prevent unauthenticated, user-supplied comment content from being passed to WordPress's shortcode engine, allowing any visitor to have arbitrary shortcodes registered on the site executed server-side and rendered to every subsequent visitor of the page.
Product
CleanTalk
Fixed in
6.87
What to do
Update CleanTalk to 6.87 or newer.
Full record and what to do →NVD record wpscan.com
Sep 9, 2026Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered): Authorization bypassCVE-2026-11821 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.1.17. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to view, create, update, clone, and delete notification flow event automation workflows that should be restricted to administrators.
Product
Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered)
Affected
up to 4.1.17
What to do
Affects up to 4.1.17. Update Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 9, 2026My Calendar – Accessible Event Manager: Stored Cross-Site ScriptingCVE-2026-77187 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'before' and 'after' Shortcode Attributes in all versions up to, and including, 3.8.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
My Calendar – Accessible Event Manager
Affected
up to 3.8.3
What to do
Affects up to 3.8.3. Update My Calendar – Accessible Event Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.