Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
3,638 results · page 2 of 73
Oct 23, 2026Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO: Does not validate or escape some of its form shortcode attributesCVE-2026-94264 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not validate or escape some of its form shortcode attributes, which can be pointed at values taken from the visitor's own request and are then output without escaping, allowing users with a role as low as contributor to have arbitrary script run in the browser of anyone led to open a crafted link or page, including a logged-in administrator. This is an incomplete fix for CVE-2023-5292, whose deny-list covers only the three HTML wrapper attributes.
- Product
- Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO
- Fixed in
- 0.9.2.8
- What to do
- Update Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO to 0.9.2.8 or newer.
Oct 23, 2026LiteSpeed Cache: Does not limit one of its HTML optimization routines to stylesheet contentCVE-2026-113500 · WordPress plugins & themes · reported by WPScanHigh 7.5
The LiteSpeed Cache WordPress plugin before 7.9.2 does not limit one of its HTML optimization routines to stylesheet content, so it can delete the markup that closes an attribute in the rendered page, and combined with unescaped comment author output this allows unauthenticated users whose comments are published to inject event-handler attributes that run JavaScript in the browser of any visitor, including a logged-in administrator, viewing front-end pages while the optimization is enabled.
- Product
- LiteSpeed Cache
- Fixed in
- 7.9.2
- What to do
- Update LiteSpeed Cache to 7.9.2 or newer.
Oct 23, 2026LiteSpeed Cache: Does not restrict one of its HTML rewriting routines to stylesheet contentCVE-2026-113499 · WordPress plugins & themes · reported by WPScanHigh 7.5
The LiteSpeed Cache WordPress plugin before 7.9.2 does not restrict one of its HTML rewriting routines to stylesheet content, so it removes a quote that terminates an attribute in the rendered page, and combined with unescaped comment author output this allows unauthenticated users whose comment is published to inject attributes that execute JavaScript in the browser of any visitor, including a logged-in administrator, who views front-end pages while the affected option is enabled.
- Product
- LiteSpeed Cache
- Fixed in
- 7.9.2
- What to do
- Update LiteSpeed Cache to 7.9.2 or newer.
Oct 23, 2026Popup Builder: Does not perform authorization checks before trashing popup content in a maintenance routine that runs on unauthenticated requestsCVE-2026-112230 · WordPress plugins & themes · reported by WPScanLow 3.7
The Popup Builder WordPress plugin before 4.4.6 does not perform authorization checks before trashing popup content in a maintenance routine that runs on unauthenticated requests, allowing unauthenticated attackers to move affected popups into the Trash and overwrite their stored preview data.
- Product
- Popup Builder
- Fixed in
- 4.4.6
- What to do
- Update Popup Builder to 4.4.6 or newer.
Oct 23, 2026User Profile Builder: Does not sanitise and escape one of its shortcode attributes before outputting it back in a redirect messageCVE-2026-111966 · WordPress plugins & themes · reported by WPScanMedium 6.8
The User Profile Builder WordPress plugin before 4.0.5 does not sanitise and escape one of its shortcode attributes before outputting it back in a redirect message, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks against higher-privileged users who submit the affected form.
- Product
- User Profile Builder
- Fixed in
- 4.0.5
- What to do
- Update User Profile Builder to 4.0.5 or newer.
Oct 23, 2026Otter Blocks: Does not properly sanitize and escape user-supplied block styling values before writing them into an inline stylesheetCVE-2026-109933 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Otter Blocks WordPress plugin before 3.2.8 does not properly sanitize and escape user-supplied block styling values before writing them into an inline stylesheet, allowing users with contributor-level access and above to inject arbitrary web scripts that execute when any visitor, including administrators, views the affected post.
- Product
- Otter Blocks
- Fixed in
- 3.2.8
- What to do
- Update Otter Blocks to 3.2.8 or newer.
Oct 22, 2026ND Shortcodes For Visual Composer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-114702 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in nicdark ND Shortcodes For Visual Composer nd-shortcodes allows Stored XSS.This issue affects ND Shortcodes For Visual Composer: from n/a through 7.8.
- Product
- ND Shortcodes For Visual Composer
- Affected
- up to 7.8
- What to do
- Affects up to 7.8. Update ND Shortcodes For Visual Composer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2026ShopMagic: Insertion of Sensitive Information into Externally-Accessible File or DirectoryCVE-2026-114195 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Insertion of Sensitive Information into Externally-Accessible File or Directory vulnerability in WP Desk ShopMagic shopmagic-for-woocommerce allows Retrieve Embedded Sensitive Data.This issue affects ShopMagic: from n/a through 4.9.1.
- Product
- ShopMagic
- Affected
- up to 4.9.1
- What to do
- Affects up to 4.9.1. Update ShopMagic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2026Sunshine Photo Cart: Missing AuthorizationCVE-2026-111842 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WP Sunshine Sunshine Photo Cart sunshine-photo-cart allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sunshine Photo Cart: from n/a through 3.7.5.
- Product
- Sunshine Photo Cart
- Affected
- up to 3.7.5
- What to do
- Affects up to 3.7.5. Update Sunshine Photo Cart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2026SureDash: Missing AuthorizationCVE-2026-110894 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Brainstorm Force SureDash suredash allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SureDash: from n/a through 1.12.2.
- Product
- SureDash
- Affected
- up to 1.12.2
- What to do
- Affects up to 1.12.2. Update SureDash to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2026SureDash: Missing AuthorizationCVE-2026-110893 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Brainstorm Force SureDash suredash allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SureDash: from n/a through 1.12.2.
- Product
- SureDash
- Affected
- up to 1.12.2
- What to do
- Affects up to 1.12.2. Update SureDash to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2026MasterStudy LMS: Does not verify that a user targeted through its student-enrolment feature has any relationship to the requesting instructorCVE-2026-88849 · WordPress plugins & themes · reported by WPScanLow 2.7
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.55 does not verify that a user targeted through its student-enrolment feature has any relationship to the requesting instructor, allowing users with the Instructor role to overwrite the first name, last name and public display name of any registered user on the site, including administrators, enabling impersonation and phishing.
- Product
- MasterStudy LMS
- Fixed in
- 3.7.55
- What to do
- Update MasterStudy LMS to 3.7.55 or newer.
Oct 22, 2026Photo Engine (Media Organizer & Lightroom): Does not sanitise and escape collection and gallery names before storing them and outputting them in an administrative dashboardCVE-2026-111971 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.5.8 does not sanitise and escape collection and gallery names before storing them and outputting them in an administrative dashboard, allowing authenticated users with the author role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Photo Engine (Media Organizer & Lightroom)
- Fixed in
- 6.5.8
- What to do
- Update Photo Engine (Media Organizer & Lightroom) to 6.5.8 or newer.
Oct 22, 2026WP Ultimate Review: Does not neutralise shortcodes in all of the review fields submitted through its public review formCVE-2026-103234 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Ultimate Review WordPress plugin before 2.4.5 does not neutralise shortcodes in all of the review fields submitted through its public review form, which is available to unauthenticated visitors, allowing them to execute arbitrary shortcodes when the affected field is displayed, provided user reviews and that field's display are enabled.
- Product
- WP Ultimate Review
- Fixed in
- 2.4.5
- What to do
- Update WP Ultimate Review to 2.4.5 or newer.
Oct 21, 2026Geo Mashup: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-111848 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dylan Kuhn Geo Mashup geo-mashup allows Reflected XSS.This issue affects Geo Mashup: from n/a through 1.13.22.
- Product
- Geo Mashup
- Affected
- up to 1.13.22
- What to do
- Affects up to 1.13.22. Update Geo Mashup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 21, 2026BjornTech Swish for WooCommerce: Missing AuthorizationCVE-2026-111835 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in bjorntech BjornTech Swish for WooCommerce woo-swish-e-commerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BjornTech Swish for WooCommerce: from n/a through 3.7.8.
- Product
- BjornTech Swish for WooCommerce
- Affected
- up to 3.7.8
- What to do
- Affects up to 3.7.8. Update BjornTech Swish for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 21, 2026Simple Shopping Cart: Does not verify submitted product prices against a value only the site owner can setCVE-2026-104642 · WordPress plugins & themes · reported by WPScanLow 2.7
The Simple Shopping Cart WordPress plugin before 5.3.3 does not verify submitted product prices against a value only the site owner can set, allowing users with the Contributor role and above to register attacker-chosen prices for existing products, which any visitor can then use to add those products to the cart at that price.
- Product
- Simple Shopping Cart
- Fixed in
- 5.3.3
- What to do
- Update Simple Shopping Cart to 5.3.3 or newer.
Oct 21, 2026Simple Shopping Cart: Does not verify that a PayPal payment notification is for a payment received by the site owner's PayPal account in its default configurationCVE-2026-104641 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Simple Shopping Cart WordPress plugin before 5.3.3 does not verify that a PayPal payment notification is for a payment received by the site owner's PayPal account in its default configuration, allowing unauthenticated attackers to have their orders marked as paid using a payment made to an account they control.
- Product
- Simple Shopping Cart
- Fixed in
- 5.3.3
- What to do
- Update Simple Shopping Cart to 5.3.3 or newer.
Oct 21, 2026TI WooCommerce Wishlist: Does not enforce the same owner-only access control on its REST API that it applies on the front-endCVE-2026-15261 · WordPress plugins & themes · reported by WPScanMedium 5.3
The TI WooCommerce Wishlist WordPress plugin before 2.13.0 does not enforce the same owner-only access control on its REST API that it applies on the front-end, allowing unauthenticated users to read the metadata and item contents of private wishlists.
- Product
- TI WooCommerce Wishlist
- Fixed in
- 2.13.0
- What to do
- Update TI WooCommerce Wishlist to 2.13.0 or newer.
Oct 21, 2026HireZoot: Does not sanitise and escape some of its stored data before outputting it in the admin dashboardCVE-2026-107790 · WordPress plugins & themes · reported by WPScanMedium 6.8
The HireZoot WordPress plugin before 4.1.1 does not sanitise and escape some of its stored data before outputting it in the admin dashboard, and additionally reverses the HTML-entity encoding that would otherwise neutralise it, allowing users with the Author role to perform Stored Cross-Site Scripting attacks that execute in the context of a logged-in administrator.
- Product
- HireZoot
- Fixed in
- 4.1.1
- What to do
- Update HireZoot to 4.1.1 or newer.
Oct 21, 2026Uncanny Toolkit for LearnDash: Does not verify that the acting user is permitted to manage the targeted accounts before changing their verification stateCVE-2026-107128 · WordPress plugins & themes · reported by WPScanMedium 5
The Uncanny Toolkit for LearnDash WordPress plugin before 3.8.2 does not verify that the acting user is permitted to manage the targeted accounts before changing their verification state, allowing a subsite administrator on a multisite network to mark arbitrary network users outside their own site as unverified and prevent those users from logging in.
- Product
- Uncanny Toolkit for LearnDash
- Fixed in
- 3.8.2
- What to do
- Update Uncanny Toolkit for LearnDash to 3.8.2 or newer.
Oct 21, 2026Uncanny Toolkit for LearnDash: Does not validate the origin of a password-reset requestCVE-2026-107127 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Uncanny Toolkit for LearnDash WordPress plugin before 3.8.2 does not validate the origin of a password-reset request, allowing an unauthenticated attacker to set the password of a user who is partway through a password reset to an attacker-chosen value through a forged request, resulting in full account takeover.
- Product
- Uncanny Toolkit for LearnDash
- Fixed in
- 3.8.2
- What to do
- Update Uncanny Toolkit for LearnDash to 3.8.2 or newer.
Oct 19, 2026YITH WooCommerce Wishlist: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-112199 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in YITH YITH WooCommerce Wishlist yith-woocommerce-wishlist allows Stored XSS.This issue affects YITH WooCommerce Wishlist: from n/a through 4.18.1.
- Product
- YITH WooCommerce Wishlist
- Affected
- up to 4.18.1
- What to do
- Affects up to 4.18.1. Update YITH WooCommerce Wishlist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 19, 2026Document Gallery: Does not sanitise or escape several gallery shortcode attributes before embedding them in a single-quoted HTML attribute in the rendered gallery markupCVE-2026-74921 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Document Gallery WordPress plugin through 5.1.1 does not sanitise or escape several gallery shortcode attributes before embedding them in a single-quoted HTML attribute in the rendered gallery markup, allowing users with the Contributor role and above to inject arbitrary event handlers that execute when a higher privileged user views the content.
- Product
- Document Gallery
- Affected
- up to 5.1.1
- What to do
- Affects up to 5.1.1. Update Document Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 18, 2026The Bootstrap Shortcodes plugin for WordPress before 3.4.6 is vulnerable to stored XSS via the id attribute of the [bs_tcontent] shortcode.CVE-2026-112111 · WordPress plugins & themes · reported by MITREMedium 5.1
The Bootstrap Shortcodes plugin for WordPress before 3.4.6 is vulnerable to stored XSS via the id attribute of the [bs_tcontent] shortcode. The bs_tcontent() shortcode handler in inc/bs_tabs.php emits the id attribute value into an unquoted HTML attribute. esc_attr() is applied, but it does not encode space characters, so a space in the supplied value terminates the attribute and any following text is parsed as additional HTML attributes, including JavaScript event handlers. This allows authenticated attackers with Contributor-level access and above to inject arbitrary web script that executes in the browser of any user who views the page and interacts with the injected element.
- Product
- Bootstrap Shortcodes
- Fixed in
- 3.4.6
- What to do
- Update Bootstrap Shortcodes to 3.4.6 or newer.
Oct 17, 2026PeachPay — Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net, NMI): Does not perform any capability or ownership check before returning an order's secret key in response to an unCVE-2026-103376 · WordPress plugins & themes · reported by WPScanMedium 5.3
The PeachPay — Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net, NMI) WordPress plugin before 1.120.70 does not perform any capability or ownership check before returning an order's secret key in response to an unauthenticated request, allowing anyone to retrieve the key for any paid order and use it to view that order's customer name, email address, postal address and contents.
- Product
- PeachPay — Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net, NMI)
- Fixed in
- 1.120.70
- What to do
- Update PeachPay — Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net, NMI) to 1.120.70 or newer.
Oct 17, 2026The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin CVE-2026-96660 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Checkbox Field Value in all versions up to, and including, 5.2.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The nopriv AJAX action user_registration_user_form_submit reaches ur_process_registration() without nonce validation, meaning any unauthenticated request can reach the vulnerable code path.
- Affected
- up to 5.2.8
- What to do
- Affects up to 5.2.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 17, 2026The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin CVE-2026-92978 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.2.8 This is due to missing or incorrect nonce validation on the trigger_bulk_action function. This makes it possible for unauthenticated attackers to force administrators to approve pending user registrations or deny arbitrary user accounts, locking targeted users out of the site via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. An attacker can bypass the earlier nonce check in trigger_query_actions() by supplying an empty new_role parameter, which causes that handler to return early and cede control to the unprotected trigger_bulk_action() handler; the exit() call at the end of that handler additionally prevents WordPress core's own bulk-users nonce validation from executing.
- Affected
- up to 5.2.8
- What to do
- Affects up to 5.2.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 17, 2026User Registration & Membership: Arbitrary Shortcode ExecutionCVE-2026-92798 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The User Registration & Membership plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 5.2.8 This is due to insufficient input sanitization in the 'referrer_url' branch of UR_Smart_Tags::process(), where the attacker-controlled HTTP_REFERER header is only passed through sanitize_text_field() — which does not strip WordPress shortcode delimiters — before being substituted into a Content Restriction message that is subsequently executed via apply_shortcodes()/do_shortcode(). This makes it possible for unauthenticated attackers to execute arbitrary registered shortcodes on any restricted page whose message uses the supported {{referrer_url}} smart tag.
- Product
- User Registration & Membership
- Affected
- up to 5.2.8
- What to do
- Affects up to 5.2.8. Update User Registration & Membership to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 16, 2026WP User Avatar / ProfilePress: Arbitrary Shortcode ExecutionCVE-2026-104003 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The WP User Avatar / ProfilePress plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 4.17.5. This is due to the get_user_profile_structure() function assembling the front-end profile buffer — which includes raw comment excerpts inlined by author_comment_query() — and passing the entire buffer to do_shortcode() after only a narrow neutralization pass (ppress_neutralize_buffer_shortcodes) that blocks pp-custom-html and bracket fragments containing HTML delimiters but leaves any other well-formed shortcode intact. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary shortcodes (from any active plugin or theme) with attacker-chosen attributes by posting a comment whose body contains the shortcode markup; the shortcode is then executed server-side when any visitor loads the target's front-end profile Comments tab, letting the attacker reach capability-gated or data-returning shortcodes and inject raw HTML markup into a publicly viewable page.
- Product
- WP User Avatar / ProfilePress
- Affected
- up to 4.17.5
- What to do
- Affects up to 4.17.5. Update WP User Avatar / ProfilePress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpastebin.complugins.trac.wordpress.org
Oct 16, 2026SureDash – Community, Courses & Member Dashboard: Stored Cross-Site ScriptingCVE-2026-96870 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The SureDash – Community, Courses & Member Dashboard plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'display_name' parameter in all versions up to, and including, 1.12.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit is triggered when any user hovers over a comment's like counter on a community page, as the plugin's tooltip handler assigns the attacker-controlled data-tooltip-description attribute value directly to innerHTML, re-parsing the browser-decoded entity payload as live HTML.
- Product
- SureDash – Community, Courses & Member Dashboard
- Affected
- up to 1.12.0
- What to do
- Affects up to 1.12.0. Update SureDash – Community, Courses & Member Dashboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 16, 2026Social Share Buttons: Stored Cross-Site ScriptingCVE-2026-100108 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Social Share Buttons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'form (containing share_url)' parameter in all versions up to, and including, 1.30 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that the 7-day review-nag timer has elapsed since the attacker's first wp-admin visit, as the nonce needed to reach the save-network handler is only rendered in the DOM once that timer has passed.
- Product
- Social Share Buttons
- Affected
- up to 1.30
- What to do
- Affects up to 1.30. Update Social Share Buttons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 16, 2026Document Gallery: Does not perform any capability or ownership checkCVE-2026-74923 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Document Gallery WordPress plugin through 5.1.1 does not perform any capability or ownership check when generating a gallery on demand, allowing unauthenticated users to enumerate and disclose the titles, descriptions and direct file URLs of media attached to unpublished, private or trashed content.
- Product
- Document Gallery
- Affected
- up to 5.1.1
- What to do
- Affects up to 5.1.1. Update Document Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 16, 2026The The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder pluCVE-2026-15222 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.2.8. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for authenticated attackers, with subscriber-level access and above, to execute arbitrary shortcodes.
- Affected
- up to 5.2.8
- What to do
- Affects up to 5.2.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Oct 16, 2026Smush: Does not restrict changes to a network-wide access setting to network administratorsCVE-2026-110039 · WordPress plugins & themes · reported by WPScanLow 2.7
The Smush WordPress plugin before 4.3.4 does not restrict changes to a network-wide access setting to network administrators, allowing an administrator of a single site on a multisite network to change it for the entire network.
- Product
- Smush
- Fixed in
- 4.3.4
- What to do
- Update Smush to 4.3.4 or newer.
Oct 16, 2026Visual Form Builder: Does not perform an authorization check before displaying recent form submission data in a dashboard widgetCVE-2026-105974 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Visual Form Builder WordPress plugin through 3.1 does not perform an authorization check before displaying recent form submission data in a dashboard widget, allowing any authenticated user (Subscriber and above) to read other users' submitted contact information, including names, email addresses, form titles and timestamps.
- Product
- Visual Form Builder
- Affected
- up to 3.1
- What to do
- Affects up to 3.1. Update Visual Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 16, 2026Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers: PHP Object InjectionCVE-2026-104730 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.7.4 via deserialization of untrusted input . This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present. If a POP chain is present via an additional plugin or theme installed on the target system, the attacker can store the malicious payload unauthenticated via the public favorites page and trigger deserialization by viewing any image in a non-viewable or private gallery.
- Product
- Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers
- Affected
- up to 3.7.4
- What to do
- Affects up to 3.7.4. Update Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 16, 2026Salon Booking System – Appointment Booking for Salons, Barbershops & Spas: Stored Cross-Site ScriptingCVE-2026-109232 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Salon Booking System – Appointment Booking for Salons, Barbershops & Spas plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'sln[<checkout-field-key>]' parameter in all versions up to, and including, 10.31.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that the site administrator has configured at least one custom checkout field of type Html or File, which is a standard documented plugin feature.
- Product
- Salon Booking System – Appointment Booking for Salons, Barbershops & Spas
- Affected
- up to 10.31.9
- What to do
- Affects up to 10.31.9. Update Salon Booking System – Appointment Booking for Salons, Barbershops & Spas to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 16, 2026The Slim SEO – AI SEO Plugin, Lightweight, Fast & Automated: Arbitrary shortcode executionCVE-2026-104001 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The The Slim SEO – AI SEO Plugin, Lightweight, Fast & Automated plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 4.11.1 This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for authenticated attackers, with subscriber-level access and above, to execute arbitrary shortcodes. A Subscriber-level user need only save the shortcode payload to their own Biographical Info field via the REST API or wp-admin profile page; the shortcode then executes on any unauthenticated front-end request that resolves that author's description, such as requests using the ?author= query parameter when auto_redirection is disabled.
- Product
- The Slim SEO – AI SEO Plugin, Lightweight, Fast & Automated
- Affected
- up to 4.11.1
- What to do
- Affects up to 4.11.1. Update The Slim SEO – AI SEO Plugin, Lightweight, Fast & Automated to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.complugins.trac.wordpress.org
Oct 16, 2026The Broken Link Checker: Arbitrary shortcode executionCVE-2026-96562 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The The Broken Link Checker plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.4.14.1. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. Exploitation requires that a submitted comment containing the shortcode payload in an href or src attribute is approved through the site's normal comment moderation workflow; once approved, the shortcode is executed automatically via WP-Cron without any further attacker interaction.
- Product
- The Broken Link Checker
- Affected
- up to 2.4.14.1
- What to do
- Affects up to 2.4.14.1. Update The Broken Link Checker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 16, 2026Image Hub – Free Images from Unsplash, Pixabay, Pexels, Openverse & Giphy: Sensitive Information ExposureCVE-2026-109191 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Image Hub – Free Images from Unsplash, Pixabay, Pexels, Openverse & Giphy plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.2.0 via the 'image_hub_api_keys_* (6 options)' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract the plaintext API credentials for six third-party services — Giphy, Openverse (client ID and secret), Pexels, Pixabay, and Unsplash — emitted verbatim into every admin page's HTML via wp_localize_script. The leaked page HTML also contains a valid image_hub_nonce AJAX nonce, which — combined with the absence of any capability check in the image_hub_update_settings AJAX handler — allows the same Subscriber-level attacker to overwrite all six stored API credential options via update_option().
- Product
- Image Hub – Free Images from Unsplash, Pixabay, Pexels, Openverse & Giphy
- Affected
- up to 1.2.0
- What to do
- Affects up to 1.2.0. Update Image Hub – Free Images from Unsplash, Pixabay, Pexels, Openverse & Giphy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 16, 2026The Forminator Forms – Contact Form, Payment Form & Custom Form Builder: Arbitrary shortcode executionCVE-2026-103911 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.58.1. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. This is exploitable on any block-theme install via a single unauthenticated GET request to the search results page, or by submitting an anonymous comment on any post with comments enabled; no Forminator-specific content or configuration is required to trigger execution.
- Product
- The Forminator Forms – Contact Form, Payment Form & Custom Form Builder
- Affected
- up to 1.58.1
- What to do
- Affects up to 1.58.1. Update The Forminator Forms – Contact Form, Payment Form & Custom Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 16, 2026Forminator Forms – Contact Form, Payment Form & Custom Form Builder: Arbitrary Shortcode ExecutionCVE-2026-101335 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 1.58.1. This is due to the forminator_replace_quiz_form_data() helper invoking do_shortcode() on the fully expanded notification body once the {quiz_result} merge tag has been substituted, while the earlier-substituted {user_agent} and {refer_url} merge tags carry unauthenticated attacker-controlled bytes (the User-Agent header and the referer_url POST parameter) through sanitize_text_field()/esc_html(), neither of which strip the '[' and ']' shortcode delimiters. This makes it possible for unauthenticated attackers to execute arbitrary WordPress shortcodes registered on the site by submitting a quiz whose notification template contains {quiz_result}; the resulting impact depends on the shortcodes exposed by other installed plugins/themes and can range from arbitrary content injection to information disclosure.
- Product
- Forminator Forms – Contact Form, Payment Form & Custom Form Builder
- Affected
- up to 1.58.1
- What to do
- Affects up to 1.58.1. Update Forminator Forms – Contact Form, Payment Form & Custom Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 15, 2026Popup Box: Arbitrary Shortcode ExecutionCVE-2026-100159 · WordPress plugins & themes · reported by WordfenceMedium 4.8
The Popup Box plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions 6.4.1 to 6.4.2. This is due to the ays_popup_get_user_ip() function reading the client-controlled Client-IP / X-Forwarded-For / Forwarded / X-Forwarded / Forwarded-For request headers, sanitizing them only with sanitize_text_field() (which does not strip the bracket, quote, space, or '=' characters used by shortcode syntax), substituting the value into a popup body wherever the %%user_ip_address%% token appears (a raw str_replace with no escaping in Ays_Pb_Data::replace_message_variables()), and then passing the resulting body to do_shortcode() in Ays_Pb_Public::ays_autoembed() at output on the wp_footer hook. This makes it possible for unauthenticated attackers to execute arbitrary registered shortcodes with attacker-supplied attributes on the server whenever an administrator has added the %%user_ip_address%% token to a popup's Custom Content body, which can be leveraged to read arbitrary data or perform other actions exposed by shortcodes installed on the site.
- Product
- Popup Box
- Affected
- 6.4.1 to 6.4.2
- What to do
- Affects 6.4.1 to 6.4.2. Update Popup Box to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 15, 2026Sunshine Photo Cart: Missing AuthorizationCVE-2026-109689 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WP Sunshine Sunshine Photo Cart sunshine-photo-cart allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sunshine Photo Cart: from n/a through 3.7.4.
- Product
- Sunshine Photo Cart
- Affected
- up to 3.7.4
- What to do
- Affects up to 3.7.4. Update Sunshine Photo Cart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 15, 2026Social Share Buttons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-109702 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in maxfoundry Social Share Buttons share-button allows Stored XSS.This issue affects Social Share Buttons: from n/a through 1.31.
- Product
- Social Share Buttons
- Affected
- up to 1.31
- What to do
- Affects up to 1.31. Update Social Share Buttons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 15, 2026The Ocean Extra: Arbitrary shortcode executionCVE-2026-86803 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The The Ocean Extra plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.6.0 This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
- Product
- The Ocean Extra
- Affected
- up to 2.6.0
- What to do
- Affects up to 2.6.0. Update The Ocean Extra to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Oct 14, 2026Frontend Dashboard: Incorrect Privilege AssignmentCVE-2026-107424 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Incorrect Privilege Assignment vulnerability in M A Vinoth Kumar Frontend Dashboard frontend-dashboard allows Privilege Escalation.This issue affects Frontend Dashboard: from n/a through 3.0.7.
- Product
- Frontend Dashboard
- Affected
- up to 3.0.7
- What to do
- Affects up to 3.0.7. Update Frontend Dashboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 14, 2026Push Notification for Post and BuddyPress: Missing AuthorizationCVE-2026-107417 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Muralidharan Ramasamy Push Notification for Post and BuddyPress push-notification-for-post-and-buddypress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Push Notification for Post and BuddyPress: from n/a through 3.23.
- Product
- Push Notification for Post and BuddyPress
- Affected
- up to 3.23
- What to do
- Affects up to 3.23. Update Push Notification for Post and BuddyPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 14, 2026ShopMagic – email automation for: Local File InclusionCVE-2026-103367 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The ShopMagic – email automation for WordPress plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.9.0 via the 'billing_address.first_name' parameter parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. Exploitation requires a published recipe that processes the {{ customer.first_name }} placeholder — the plugin's built-in "New Order email with social media profile links" recipe satisfies this requirement out of the box, making the default configuration exploitable with no account, cookie, or nonce by simply submitting a guest checkout with the payload as the billing first name.
- Product
- ShopMagic – email automation for
- Affected
- up to 4.9.0
- What to do
- Affects up to 4.9.0. Update ShopMagic – email automation for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.