Vulnerability database

6,233 results · page 2 of 125

• Oct 28, 2026Clean Login: Missing AuthorizationCVE-2026-116610 · WordPress plugins & themes · reported by WordfenceMedium 4.3

  The Clean Login plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.20.1 due to a missing capability check on the CleanLogin_Shortcode::get_pages_with_shortcodes() function hooked to the save_post action. This makes it possible for authenticated attackers, with Contributor-level access and above, to overwrite the plugin's cl_login_url/cl_login_id/cl_register_url/cl_register_id/cl_restore_url/cl_restore_id/cl_edit_url/cl_edit_id/cl_change_password_url/cl_change_password_id options with the ID and permalink of a post they themselves authored — simply by embedding the plugin's shortcodes in their own post content.

  Product

  Clean Login

  Affected

  up to 1.20.1

  What to do

  Affects up to 1.20.1. Update Clean Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Oct 28, 2026AI ChatBot for WooCommerce – WoowBot: Authorization bypassCVE-2026-111372 · WordPress plugins & themes · reported by WordfenceMedium 4.3

  The AI ChatBot for WooCommerce – WoowBot plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.0.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to repeatedly trigger RAG document sync operations that issue paid embedding API calls to OpenAI, Gemini, OpenRouter, or xAI charged to the site administrator's stored API key, draining their AI API credits and causing financial loss. The wp_chatbot nonce required to reach this endpoint is emitted to every authenticated frontend visitor via wp_localize_script, making it trivially obtainable by any subscriber-level account.

  Product

  AI ChatBot for WooCommerce – WoowBot

  Affected

  up to 5.0.0

  What to do

  Affects up to 5.0.0. Update AI ChatBot for WooCommerce – WoowBot to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Oct 28, 2026Travelly – Tour & Travel Booking Manager for WooCommerce: Authorization bypassCVE-2026-111213 · WordPress plugins & themes · reported by WordfenceMedium 4.3

  The Travelly – Tour & Travel Booking Manager for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.3.6 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to duplicate arbitrary posts — including private, draft, and pending posts authored by Administrators and Editors — into drafts they own, thereby exposing the original post's content, excerpt, title, taxonomies, and metadata. A Contributor can harvest a valid nonce from the Duplicate row-action on their own posts list and reuse it against any victim post ID, since the nonce action is the static string 'TTBM_Admin.php' and is not bound to any specific post.

  Product

  Travelly – Tour & Travel Booking Manager for WooCommerce

  Affected

  up to 2.3.6

  What to do

  Affects up to 2.3.6. Update Travelly – Tour & Travel Booking Manager for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordgithub.complugins.trac.wordpress.org

• Oct 28, 2026Rich Showcase for Google Reviews: Authorization bypassCVE-2026-110020 · WordPress plugins & themes · reported by WordfenceMedium 6.5

  The Rich Showcase for Google Reviews plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.1.6 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to retrieve the plugin's 127-character site-wide grw_auth_code authentication secret and use it to impersonate the WordPress site to the RichPlugins backend service at app.richplugins.com.

  Product

  Rich Showcase for Google Reviews

  Affected

  up to 7.1.6

  What to do

  Affects up to 7.1.6. Update Rich Showcase for Google Reviews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recorddownloads.wordpress.orgplugins.trac.wordpress.org

• Oct 28, 2026Royal MCP: Does not perform object-level or post-type authorisation checks in one of its search toolsCVE-2026-111960 · WordPress plugins & themes · reported by WPScanMedium 4.3

  The Royal MCP WordPress plugin before 1.5.10 does not perform object-level or post-type authorisation checks in one of its search tools, allowing authenticated users such as a subscriber to disclose the title and content of non-public entries, including personal data stored by a companion Royal MCP WordPress plugin before 1.5.10.

  Product

  Royal MCP

  Fixed in

  1.5.10

  What to do

  Update Royal MCP to 1.5.10 or newer.

  Full record and what to do →NVD recordwpscan.com

• Oct 28, 2026GoSMTP: Does not perform a settings-management authorization check on its SMTP configuration pageCVE-2026-111577 · WordPress plugins & themes · reported by WPScanHigh 7.2

  The GoSMTP WordPress plugin before 1.2.5 does not perform a settings-management authorization check on its SMTP configuration page, which is gated only on the GoSMTP WordPress plugin before 1.2.5-activation capability, allowing users with a delegated role below administrator to change outbound mail delivery and achieve administrator account takeover.

  Product

  GoSMTP

  Fixed in

  1.2.5

  What to do

  Update GoSMTP to 1.2.5 or newer.

  Full record and what to do →NVD recordwpscan.com

• Oct 28, 2026Welcart e-Commerce: Does not properly verify authorization against the targeted product before processing SKU changesCVE-2026-111032 · WordPress plugins & themes · reported by WPScanLow 3.8

  The Welcart e-Commerce WordPress plugin before 2.12.6 does not properly verify authorization against the targeted product before processing SKU changes, because its capability check is not tied to the product being edited, allowing any authenticated user with Author-level access or higher to read, modify, create, delete and re-order the SKU data (including prices, confidential cost prices and stock levels) of any product, including those belonging to other users.

  Product

  Welcart e-Commerce

  Fixed in

  2.12.6

  What to do

  Update Welcart e-Commerce to 2.12.6 or newer.

  Full record and what to do →NVD recordwpscan.com

• Oct 28, 2026Royal Addons for Elementor: Does not perform any authorization check before using the site owner's stored Mailchimp credential to add subscriber records to an audience chosen by the requestCVE-2026-107097 · WordPress plugins & themes · reported by WPScanMedium 5.3

  The Royal Addons for Elementor WordPress plugin before 1.7.1070 does not perform any authorization check before using the site owner's stored Mailchimp credential to add subscriber records to an audience chosen by the request, allowing unauthenticated attackers to inject arbitrary email addresses and contact details into the site owner's Mailchimp account as confirmed subscribers.

  Product

  Royal Addons for Elementor

  Fixed in

  1.7.1070

  What to do

  Update Royal Addons for Elementor to 1.7.1070 or newer.

  Full record and what to do →NVD recordwpscan.com

• Oct 28, 2026Court Reservation: Does not perform any authorizationCVE-2026-106003 · WordPress plugins & themes · reported by WPScanMedium 5.3

  The Court Reservation WordPress plugin before 1.12.4 does not perform any authorization, authentication or nonce validation on one of its AJAX actions, allowing unauthenticated users to add or delete reservation types in the Court Reservation WordPress plugin before 1.12.4's configuration.

  Product

  Court Reservation

  Fixed in

  1.12.4

  What to do

  Update Court Reservation to 1.12.4 or newer.

  Full record and what to do →NVD recordwpscan.com

• Oct 28, 2026Court Reservation: Does not perform any authorisation or nonce verification on one of its challenge-management actionsCVE-2026-106002 · WordPress plugins & themes · reported by WPScanMedium 5.3

  The Court Reservation WordPress plugin before 1.12.4 does not perform any authorisation or nonce verification on one of its challenge-management actions, allowing unauthenticated users to delete arbitrary tournament-ladder challenge records, along with the linked court-booking event when one was scheduled.

  Product

  Court Reservation

  Fixed in

  1.12.4

  What to do

  Update Court Reservation to 1.12.4 or newer.

  Full record and what to do →NVD recordwpscan.com

• Oct 27, 2026Advanced Custom Fields: Extended: Authorization bypassCVE-2026-10752 · WordPress plugins & themes · reported by WordfenceMedium 4.8

  The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 0.9.2.6. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to permanently delete arbitrary WordPress media library attachments by supplying a numeric attachment ID in the form submission without any ownership or capability verification. Exploitation requires a site administrator to have configured a public-facing ACFE form with an Email action whose attachment row uses a dynamic {field:...} source bound to a submittable field with the Delete option enabled.

  Product

  Advanced Custom Fields: Extended

  Affected

  up to 0.9.2.6

  What to do

  Affects up to 0.9.2.6. Update Advanced Custom Fields: Extended to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Oct 26, 2026Customer Coupons for WooCommerce: Missing AuthorizationCVE-2026-112839 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in VillaTheme Customer Coupons for WooCommerce woo-customer-coupons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Customer Coupons for WooCommerce: from n/a through 1.3.14.

  Product

  Customer Coupons for WooCommerce

  Affected

  up to 1.3.14

  What to do

  Affects up to 1.3.14. Update Customer Coupons for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 26, 2026Amelia: Missing AuthorizationCVE-2026-116388 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in TMS Amelia ameliabooking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Amelia: from n/a through 2.4.10.

  Product

  Amelia

  Affected

  up to 2.4.10

  What to do

  Affects up to 2.4.10. Update Amelia to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 26, 2026LearnPress: Missing AuthorizationCVE-2026-115598 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LearnPress: from n/a through 4.4.11.

  Product

  LearnPress

  Affected

  up to 4.4.11

  What to do

  Affects up to 4.4.11. Update LearnPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 26, 2026LearnPress: Missing AuthorizationCVE-2026-115597 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LearnPress: from n/a through 4.4.11.

  Product

  LearnPress

  Affected

  up to 4.4.11

  What to do

  Affects up to 4.4.11. Update LearnPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 26, 2026APIExperts Square for WooCommerce: Missing AuthorizationCVE-2026-115960 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in WPExperts APIExperts Square for WooCommerce woosquare allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects APIExperts Square for WooCommerce: from n/a through 4.7.5.

  Product

  APIExperts Square for WooCommerce

  Affected

  up to 4.7.5

  What to do

  Affects up to 4.7.5. Update APIExperts Square for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 26, 2026APIExperts Square for WooCommerce: Missing AuthorizationCVE-2026-115959 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in WPExperts APIExperts Square for WooCommerce woosquare allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects APIExperts Square for WooCommerce: from n/a through 4.7.5.

  Product

  APIExperts Square for WooCommerce

  Affected

  up to 4.7.5

  What to do

  Affects up to 4.7.5. Update APIExperts Square for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 26, 2026Geo Mashup: Missing AuthorizationCVE-2026-115954 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Missing Authorization vulnerability in Dylan Kuhn Geo Mashup geo-mashup allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Geo Mashup: from n/a through 1.13.22.

  Product

  Geo Mashup

  Affected

  up to 1.13.22

  What to do

  Affects up to 1.13.22. Update Geo Mashup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 26, 2026Contact Form by Supsystic: Missing AuthorizationCVE-2026-115595 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in Supsystic Contact Form by Supsystic contact-form-by-supsystic allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Contact Form by Supsystic: from n/a through 1.10.7.

  Product

  Contact Form by Supsystic

  Affected

  up to 1.10.7

  What to do

  Affects up to 1.10.7. Update Contact Form by Supsystic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 26, 2026Royal Elementor Addons: Authorization Bypass Through User-Controlled KeyCVE-2026-97255 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Authorization Bypass Through User-Controlled Key vulnerability in WProyal Royal Elementor Addons royal-elementor-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Royal Elementor Addons: from n/a through 1.7.1069.

  Product

  Royal Elementor Addons

  Affected

  up to 1.7.1069

  What to do

  Affects up to 1.7.1069. Update Royal Elementor Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 26, 2026WP Discussion Board: Missing AuthorizationCVE-2026-115958 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in WP Discussion Board WP Discussion Board wp-discussion-board allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Discussion Board: from n/a through 2.6.0.

  Product

  WP Discussion Board

  Affected

  up to 2.6.0

  What to do

  Affects up to 2.6.0. Update WP Discussion Board to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 26, 2026Better Post & Filter Widgets for Elementor: Missing AuthorizationCVE-2026-115949 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Missing Authorization vulnerability in WP Smart Widgets Better Post & Filter Widgets for Elementor better-post-filter-widgets-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Better Post & Filter Widgets for Elementor: from n/a through 1.9.1.

  Product

  Better Post & Filter Widgets for Elementor

  Affected

  up to 1.9.1

  What to do

  Affects up to 1.9.1. Update Better Post & Filter Widgets for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 26, 2026Booking and Rental Manager: Missing AuthorizationCVE-2026-115614 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in Magepeople inc. Booking and Rental Manager booking-and-rental-manager-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booking and Rental Manager: from n/a through 2.8.2.

  Product

  Booking and Rental Manager

  Affected

  up to 2.8.2

  What to do

  Affects up to 2.8.2. Update Booking and Rental Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 26, 2026Bopo – WooCommerce Product Bundle Builder: Missing AuthorizationCVE-2026-110377 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in VillaTheme Bopo – WooCommerce Product Bundle Builder bopo-woo-product-bundle-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Bopo – WooCommerce Product Bundle Builder: from n/a through 1.2.3.

  Product

  Bopo – WooCommerce Product Bundle Builder

  Affected

  up to 1.2.3

  What to do

  Affects up to 1.2.3. Update Bopo – WooCommerce Product Bundle Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 26, 2026AI Engine: Missing AuthorizationCVE-2026-112828 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in Meow Apps AI Engine ai-engine allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AI Engine: from n/a through 3.8.6.

  Product

  AI Engine

  Affected

  up to 3.8.6

  What to do

  Affects up to 3.8.6. Update AI Engine to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 26, 2026DEPART: Missing AuthorizationCVE-2026-110376 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in VillaTheme DEPART depart-deposit-and-part-payment-for-woo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects DEPART: from n/a through 1.0.10.

  Product

  DEPART

  Affected

  up to 1.0.10

  What to do

  Affects up to 1.0.10. Update DEPART to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 25, 2026WPVR: Does not perform object-level authorization checksCVE-2026-114741 · WordPress plugins & themes · reported by WPScanLow 3.8

  The WPVR WordPress plugin before 9.0.3 does not perform object-level authorization checks when reading and updating virtual tours, allowing users with contributor-level access and above to read and modify tours created by other users.

  Product

  WPVR

  Fixed in

  9.0.3

  What to do

  Update WPVR to 9.0.3 or newer.

  Full record and what to do →NVD recordwpscan.com

• Oct 24, 2026WpEvently: Missing AuthorizationCVE-2026-114192 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Missing Authorization vulnerability in Magepeople inc. WpEvently mage-eventpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WpEvently: from n/a through 5.7.8.

  Product

  WpEvently

  Affected

  up to 5.7.8

  What to do

  Affects up to 5.7.8. Update WpEvently to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 24, 2026UPI QR Code Payment Gateway for WooCommerce: Missing AuthorizationCVE-2026-114191 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Missing Authorization vulnerability in Knit Pay UPI QR Code Payment Gateway for WooCommerce upi-qr-code-payment-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects UPI QR Code Payment Gateway for WooCommerce: from n/a through 1.6.3.

  Product

  UPI QR Code Payment Gateway for WooCommerce

  Affected

  up to 1.6.3

  What to do

  Affects up to 1.6.3. Update UPI QR Code Payment Gateway for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 24, 2026WP Social Feed Gallery: Missing AuthorizationCVE-2026-114705 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Missing Authorization vulnerability in quadlayers WP Social Feed Gallery insta-gallery allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Social Feed Gallery: from n/a through 5.0.13.

  Product

  WP Social Feed Gallery

  Affected

  up to 5.0.13

  What to do

  Affects up to 5.0.13. Update WP Social Feed Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 24, 2026SureDash: Missing AuthorizationCVE-2026-110892 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Missing Authorization vulnerability in Brainstorm Force SureDash suredash allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SureDash: from n/a through 1.12.2.

  Product

  SureDash

  Affected

  up to 1.12.2

  What to do

  Affects up to 1.12.2. Update SureDash to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 23, 2026Car Rental Manager: Missing AuthorizationCVE-2026-112825 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Missing Authorization vulnerability in Magepeople inc. Car Rental Manager car-rental-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Car Rental Manager: from n/a through 1.5.3.

  Product

  Car Rental Manager

  Affected

  up to 1.5.3

  What to do

  Affects up to 1.5.3. Update Car Rental Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 23, 2026Knit Pay: Missing AuthorizationCVE-2026-112821 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Missing Authorization vulnerability in Knit Pay Knit Pay knit-pay allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Knit Pay: from n/a through 9.6.3.0.

  Product

  Knit Pay

  Affected

  up to 9.6.3.0

  What to do

  Affects up to 9.6.3.0. Update Knit Pay to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 23, 2026WPMobile.App: Missing AuthorizationCVE-2026-112359 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Missing Authorization vulnerability in Amauri.IO WPMobile.App wpappninja allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPMobile.App: from n/a through 11.86.

  Product

  WPMobile.App

  Affected

  up to 11.86

  What to do

  Affects up to 11.86. Update WPMobile.App to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 23, 2026Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO: Does not verify that the requester is authorised to edit the targeted user account in the update-user action of its CVE-2026-94262 · WordPress plugins & themes · reported by WPScanHigh 8.1

  The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not verify that the requester is authorised to edit the targeted user account in the update-user action of its front-end Forms module, performing that check only when the target account holds an administrator role, which allows unauthenticated visitors to overwrite any non-administrator account's credentials and obtain a session for that account. Exploitation requires the site to publish a form whose user-update action maps its target to a visitor-submitted value rather than to the default current user.

  Product

  Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO

  Fixed in

  0.9.2.8

  What to do

  Update Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO to 0.9.2.8 or newer.

  Full record and what to do →NVD recordwpscan.com

• Oct 23, 2026Popup Builder: Does not perform authorization checks before trashing popup content in a maintenance routine that runs on unauthenticated requestsCVE-2026-112230 · WordPress plugins & themes · reported by WPScanLow 3.7

  The Popup Builder WordPress plugin before 4.4.6 does not perform authorization checks before trashing popup content in a maintenance routine that runs on unauthenticated requests, allowing unauthenticated attackers to move affected popups into the Trash and overwrite their stored preview data.

  Product

  Popup Builder

  Fixed in

  4.4.6

  What to do

  Update Popup Builder to 4.4.6 or newer.

  Full record and what to do →NVD recordwpscan.com

• Oct 23, 2026User Profile Builder: Does not verify that a user is authorized to edit the specific account selected on its front-end Edit Profile formCVE-2026-111982 · WordPress plugins & themes · reported by WPScanHigh 7.2

  The User Profile Builder WordPress plugin before 4.0.5 does not verify that a user is authorized to edit the specific account selected on its front-end Edit Profile form, allowing an Administrator of a Multisite subsite to change any other user's account email, including a Network Super Admin's, and take over that account through the password-reset flow.

  Product

  User Profile Builder

  Fixed in

  4.0.5

  What to do

  Update User Profile Builder to 4.0.5 or newer.

  Full record and what to do →NVD recordwpscan.com

• Oct 22, 2026Paid Member Subscriptions: Missing AuthorizationCVE-2026-112842 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Missing Authorization vulnerability in Cozmoslabs Paid Member Subscriptions paid-member-subscriptions allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Paid Member Subscriptions: from n/a through 3.1.2.

  Product

  Paid Member Subscriptions

  Affected

  up to 3.1.2

  What to do

  Affects up to 3.1.2. Update Paid Member Subscriptions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 22, 2026ЮKassa для WooCommerce: Missing AuthorizationCVE-2026-114699 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in yoomoney ЮKassa для WooCommerce yookassa allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ЮKassa для WooCommerce: from n/a through 2.17.3.

  Product

  ЮKassa для WooCommerce

  Affected

  up to 2.17.3

  What to do

  Affects up to 2.17.3. Update ЮKassa для WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 22, 2026myCred: Authorization Bypass Through User-Controlled KeyCVE-2026-114698 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Authorization Bypass Through User-Controlled Key vulnerability in myCred myCred mycred allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects myCred: from n/a through 4.0.0-beta.1.

  Product

  myCred

  Affected

  up to 4.0.0-beta.1

  What to do

  Affects up to 4.0.0-beta.1. Update myCred to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 22, 2026Page Restriction WordPress (WP): Missing AuthorizationCVE-2026-114696 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in miniOrange Page Restriction WordPress (WP) page-and-post-restriction allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Page Restriction WordPress (WP): from n/a through 1.6.0.

  Product

  Page Restriction WordPress (WP)

  Affected

  up to 1.6.0

  What to do

  Affects up to 1.6.0. Update Page Restriction WordPress (WP) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 22, 2026ACF Extended: Missing AuthorizationCVE-2026-112312 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Missing Authorization vulnerability in ACF Extended ACF Extended acf-extended allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ACF Extended: from n/a through 0.9.2.7.

  Product

  ACF Extended

  Affected

  up to 0.9.2.7

  What to do

  Affects up to 0.9.2.7. Update ACF Extended to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 22, 2026Majestic Support: Missing AuthorizationCVE-2026-112218 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in Ahmad Majestic Support majestic-support allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Majestic Support: from n/a through 1.2.1.

  Product

  Majestic Support

  Affected

  up to 1.2.1

  What to do

  Affects up to 1.2.1. Update Majestic Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 22, 2026Sunshine Photo Cart: Missing AuthorizationCVE-2026-111842 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in WP Sunshine Sunshine Photo Cart sunshine-photo-cart allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sunshine Photo Cart: from n/a through 3.7.5.

  Product

  Sunshine Photo Cart

  Affected

  up to 3.7.5

  What to do

  Affects up to 3.7.5. Update Sunshine Photo Cart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 22, 2026SureDash: Missing AuthorizationCVE-2026-110894 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in Brainstorm Force SureDash suredash allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SureDash: from n/a through 1.12.2.

  Product

  SureDash

  Affected

  up to 1.12.2

  What to do

  Affects up to 1.12.2. Update SureDash to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 22, 2026SureDash: Missing AuthorizationCVE-2026-110893 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in Brainstorm Force SureDash suredash allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SureDash: from n/a through 1.12.2.

  Product

  SureDash

  Affected

  up to 1.12.2

  What to do

  Affects up to 1.12.2. Update SureDash to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 22, 2026PowerPack Addons for Elementor: Missing AuthorizationCVE-2026-114182 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in IdeaBox Creations PowerPack Addons for Elementor powerpack-lite-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PowerPack Addons for Elementor: from n/a through 3.1.0.

  Product

  PowerPack Addons for Elementor

  Affected

  up to 3.1.0

  What to do

  Affects up to 3.1.0. Update PowerPack Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 22, 2026Metform: Missing AuthorizationCVE-2026-114180 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in Wpmet Metform metform allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Metform: from n/a through 4.3.2.

  Product

  Metform

  Affected

  up to 4.3.2

  What to do

  Affects up to 4.3.2. Update Metform to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 22, 2026eRoom: Missing AuthorizationCVE-2026-114175 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Missing Authorization vulnerability in DigitalME eRoom eroom-zoom-meetings-webinar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects eRoom: from n/a through 1.7.1.

  Product

  eRoom

  Affected

  up to 1.7.1

  What to do

  Affects up to 1.7.1. Update eRoom to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 22, 2026Strong Testimonials: Missing AuthorizationCVE-2026-112843 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in WP Chill Strong Testimonials strong-testimonials allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Strong Testimonials: from n/a through 3.3.14.

  Product

  Strong Testimonials

  Affected

  up to 3.3.14

  What to do

  Affects up to 3.3.14. Update Strong Testimonials to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.