Updated 5 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

456new WordPress flaws this week

390,714entries in the database

1,938 results · page 2 of 39

Oct 11, 2026click5 CRM add-on to Contact Form 7: Does not sanitise and escape content submitted through an unauthenticated endpoint before outputting it back in an admin pageCVE-2026-84261 · WordPress plugins & themes · reported by WPScanHigh 8.8
The click5 CRM add-on to Contact Form 7 WordPress plugin through 1.0.4 does not sanitise and escape content submitted through an unauthenticated endpoint before outputting it back in an admin page, leading to Stored XSS which could be used against high privilege users such as admin.
Product
click5 CRM add-on to Contact Form 7
Affected
up to 1.0.4
What to do
Affects up to 1.0.4. Update click5 CRM add-on to Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Oct 11, 2026click5 CRM add-on to Gravity Forms: Does not sanitise and escape content submitted through an unauthenticated endpoint before outputting it back in an admin pageCVE-2026-84260 · WordPress plugins & themes · reported by WPScanHigh 8.8
The click5 CRM add-on to Gravity Forms WordPress plugin through 1.0.3 does not sanitise and escape content submitted through an unauthenticated endpoint before outputting it back in an admin page, leading to Stored XSS which could be used against high privilege users such as admin.
Product
click5 CRM add-on to Gravity Forms
Affected
up to 1.0.3
What to do
Affects up to 1.0.3. Update click5 CRM add-on to Gravity Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Oct 11, 2026click5 CRM add-on to WPForms: Does not sanitise and escape content submitted through an unauthenticated endpoint before outputting it back in an admin pageCVE-2026-84259 · WordPress plugins & themes · reported by WPScanHigh 8.8
The click5 CRM add-on to WPForms WordPress plugin through 1.0.3 does not sanitise and escape content submitted through an unauthenticated endpoint before outputting it back in an admin page, leading to Stored XSS which could be used against high privilege users such as admin.
Product
click5 CRM add-on to WPForms
Affected
up to 1.0.3
What to do
Affects up to 1.0.3. Update click5 CRM add-on to WPForms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Oct 11, 2026click5 CRM add-on to Ninja Forms: Does not sanitise and escape content submitted through an unauthenticated endpoint before outputting it back in an admin pageCVE-2026-84258 · WordPress plugins & themes · reported by WPScanHigh 8.8
The click5 CRM add-on to Ninja Forms WordPress plugin through 1.0.1 does not sanitise and escape content submitted through an unauthenticated endpoint before outputting it back in an admin page, leading to Stored XSS which could be used against high privilege users such as admin.
Product
click5 CRM add-on to Ninja Forms
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update click5 CRM add-on to Ninja Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Oct 11, 2026Tcard WP: Does not sanitise and escape a parameter before using it in a SQL statement in one of its unauthenticated AJAX actionsCVE-2026-81420 · WordPress plugins & themes · reported by WPScanHigh 8.6
The Tcard WP WordPress plugin through 1.8.0 does not sanitise and escape a parameter before using it in a SQL statement in one of its unauthenticated AJAX actions, allowing unauthenticated users to perform SQL injection attacks.
Product
Tcard WP
Affected
up to 1.8.0
What to do
Affects up to 1.8.0. Update Tcard WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Oct 11, 2026Robo Gallery: Does not sanitise and escape some of its gallery settings before outputting them on the gallery edit screenCVE-2026-81156 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Robo Gallery WordPress plugin before 5.2.6 does not sanitise and escape some of its gallery settings before outputting them on the gallery edit screen, allowing users with the Contributor role and above to store JavaScript that executes in the context of an administrator who opens the gallery for editing.
Product
Robo Gallery
Fixed in
5.2.6
What to do
Update Robo Gallery to 5.2.6 or newer.
Full record and what to do →NVD record wpscan.com
Oct 11, 2026Robo Gallery: Does not sanitise and escape a gallery setting before outputting it on a frontend pageCVE-2026-81155 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Robo Gallery WordPress plugin before 5.2.6 does not sanitise and escape a gallery setting before outputting it on a frontend page, allowing users with the Author role and above to perform Stored Cross-Site Scripting attacks that execute in the browser of any visitor viewing a gallery, including administrators.
Product
Robo Gallery
Fixed in
5.2.6
What to do
Update Robo Gallery to 5.2.6 or newer.
Full record and what to do →NVD record wpscan.com
Oct 11, 2026Robo Gallery: Does not sanitise and escape image alt text before outputting it in one of its gallery layoutsCVE-2026-81154 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Robo Gallery WordPress plugin before 5.2.6 does not sanitise and escape image alt text before outputting it in one of its gallery layouts, allowing users with the Author role and above to perform Stored Cross-Site Scripting attacks that execute in the browser of any user viewing the affected gallery, including administrators.
Product
Robo Gallery
Fixed in
5.2.6
What to do
Update Robo Gallery to 5.2.6 or newer.
Full record and what to do →NVD record wpscan.com
Oct 11, 2026Robo Gallery: Does not sanitise and escape some of its image settings before outputting them in a gallery pageCVE-2026-81153 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Robo Gallery WordPress plugin before 5.2.6 does not sanitise and escape some of its image settings before outputting them in a gallery page, allowing users with the Author role and above to perform Stored Cross-Site Scripting attacks that execute in the browser of any visitor viewing the gallery, including administrators, even where the unfiltered_html capability is disallowed such as on multisite.
Product
Robo Gallery
Fixed in
5.2.6
What to do
Update Robo Gallery to 5.2.6 or newer.
Full record and what to do →NVD record wpscan.com
Oct 11, 2026Mobile builder: Does not sanitise and escape a parameter before using it in a SQL statementCVE-2026-103695 · WordPress plugins & themes · reported by WPScanHigh 8.6
The Mobile builder WordPress plugin through 1.4.2 does not sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks.
Product
Mobile builder
Affected
up to 1.4.2
What to do
Affects up to 1.4.2. Update Mobile builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Oct 10, 2026Partiso: Deserialization of Untrusted DataCVE-2026-93934 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeREX Group Partiso partiso allows Object Injection.This issue affects Partiso: from n/a through 1.1.13.
Product
Partiso
Affected
up to 1.1.13
What to do
Affects up to 1.1.13. Update Partiso to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 10, 2026LTL Freight Quotes: Does not sanitise and escape a parameter before using it in a SQL statementCVE-2026-87781 · WordPress plugins & themes · reported by WPScanHigh 8.6
The LTL Freight Quotes WordPress plugin before 4.2.19 does not sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users.
Product
LTL Freight Quotes
Fixed in
4.2.19
What to do
Update LTL Freight Quotes to 4.2.19 or newer.
Full record and what to do →NVD record wpscan.com
Oct 10, 2026LTL Freight Quotes: Does not sanitise and escape values submitted through an unauthenticated endpoint before storing them and outputting them back in an administrative pageCVE-2026-87780 · WordPress plugins & themes · reported by WPScanHigh 8.8
The LTL Freight Quotes WordPress plugin before 4.2.19 does not sanitise and escape values submitted through an unauthenticated endpoint before storing them and outputting them back in an administrative page, leading to Stored XSS which will execute in the session of any administrator viewing it.
Product
LTL Freight Quotes
Fixed in
4.2.19
What to do
Update LTL Freight Quotes to 4.2.19 or newer.
Full record and what to do →NVD record wpscan.com
Oct 10, 2026Rank Math SEO: Does not properly sanitise and escape a parameter before using it in a SQL queryCVE-2026-104753 · WordPress plugins & themes · reported by WPScanMedium 4.1
The Rank Math SEO WordPress plugin before 1.0.280 does not properly sanitise and escape a parameter before using it in a SQL query, allowing high-privilege users such as administrators to perform SQL injection attacks.
Product
Rank Math SEO
Fixed in
1.0.280
What to do
Update Rank Math SEO to 1.0.280 or newer.
Full record and what to do →NVD record wpscan.com
Oct 9, 2026Testimonials by BestWebSoft: Does not sanitise and escape a parameter before using it in a SQL queryCVE-2026-89235 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Testimonials by BestWebSoft WordPress plugin through 1.0.8 does not sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated attackers to append additional SQL to the query.
Product
Testimonials by BestWebSoft
Affected
up to 1.0.8
What to do
Affects up to 1.0.8. Update Testimonials by BestWebSoft to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Oct 9, 2026Code Snippets: Does not sanitise and escape a user-supplied parameter before using it in a SQL query in some of its snippet-migration import endpointsCVE-2026-106097 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Code Snippets WordPress plugin before 3.10.0 does not sanitise and escape a user-supplied parameter before using it in a SQL query in some of its snippet-migration import endpoints, which are accessible to any user holding site-administration capabilities; on a WordPress Multisite network those belong to subsite Administrators, allowing a subsite Administrator who is not a network Super Admin to perform UNION-based SQL injection against shared network tables and disclose network-wide data such as other users' password hashes.
Product
Code Snippets
Fixed in
3.10.0
What to do
Update Code Snippets to 3.10.0 or newer.
Full record and what to do →NVD record wpscan.com
Oct 8, 2026Image Photo Gallery Final Tiles Grid: Does not sanitise several gallery configuration values that can be overridden through its gallery shortcode before printing them into an inline script blockCVE-2026-104646 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.14 does not sanitise several gallery configuration values that can be overridden through its gallery shortcode before printing them into an inline script block, allowing users with contributor-level access and above to inject arbitrary JavaScript that executes in the session of anyone viewing the post, including an administrator previewing a pending submission. No gallery ownership is required: any gallery that already exists on the site can be referenced.
Product
Image Photo Gallery Final Tiles Grid
Fixed in
3.6.14
What to do
Update Image Photo Gallery Final Tiles Grid to 3.6.14 or newer.
Full record and what to do →NVD record wpscan.com
Oct 8, 2026Ultimate Multisite: Does not require authentication before a logged-out checkout is linked toCVE-2026-103646 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Ultimate Multisite WordPress plugin before 2.17.0 does not require authentication before a logged-out checkout is linked to, and logged in as, an existing WordPress account matching the submitted email address, and its duplicate-account check normalizes that address differently from the lookup used to create the customer, so an unauthenticated attacker can log in as any existing user, including a Network Super Admin, whose email address they know. This bypass is not addressed by the 2.15.1 fix for CVE-2026-75957 and remains exploitable in all versions up to and including 2.16.1, the releases that fix was expected to cover. Exploitation requires a checkout form configured without a password field (auto-generated password) and a target account that has no existing customer record in the Ultimate Multisite WordPress plugin before 2.17.0.
Product
Ultimate Multisite
Affected
up to 2.16.1
Fixed in
2.17.0
What to do
Update Ultimate Multisite to 2.17.0 or newer.
Full record and what to do →NVD record wpscan.com
Oct 7, 2026Magee Shortcodes: Does not sanitise and escape user input in some of its AJAX actionsCVE-2026-105316 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Magee Shortcodes WordPress plugin through 2.1.1 does not sanitise and escape user input in some of its AJAX actions, which are available to unauthenticated users, before reflecting it back in the response, leading to Reflected Cross-Site Scripting.
Product
Magee Shortcodes
Affected
up to 2.1.1
What to do
Affects up to 2.1.1. Update Magee Shortcodes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Oct 7, 2026Animated Number Counters: Does not sanitise or escape a value stored by an Editor-level user before concatenating it into a SQL query that runsCVE-2026-104667 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Animated Number Counters WordPress plugin before 3.1 does not sanitise or escape a value stored by an Editor-level user before concatenating it into a SQL query that runs when any unauthenticated visitor renders a page containing the counter, leading to second-order SQL injection that can read arbitrary data including password hashes.
Product
Animated Number Counters
Fixed in
3.1
What to do
Update Animated Number Counters to 3.1 or newer.
Full record and what to do →NVD record wpscan.com
Oct 7, 2026Envira Gallery: Does not sanitise or escape user-supplied gallery display configuration values before storing them and outputting them in an image tag attributeCVE-2026-104653 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Envira Gallery WordPress plugin before 1.16.1 does not sanitise or escape user-supplied gallery display configuration values before storing them and outputting them in an image tag attribute, allowing users with the Author role and above to inject arbitrary web scripts that execute when any visitor, including an administrator, views a page containing the affected gallery.
Product
Envira Gallery
Fixed in
1.16.1
What to do
Update Envira Gallery to 1.16.1 or newer.
Full record and what to do →NVD record wpscan.com
Oct 7, 2026Envira Gallery: Does not sanitise and escape a gallery item identifier before outputting it in an image tag attributeCVE-2026-104652 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Envira Gallery WordPress plugin before 1.16.1 does not sanitise and escape a gallery item identifier before outputting it in an image tag attribute, allowing users with the Author role and above to inject arbitrary web scripts that execute when any visitor, including an administrator, views a page embedding the gallery.
Product
Envira Gallery
Fixed in
1.16.1
What to do
Update Envira Gallery to 1.16.1 or newer.
Full record and what to do →NVD record wpscan.com
Oct 4, 2026WP Statistics: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-97276 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VeronaLabs WP Statistics wp-statistics allows Reflected XSS.This issue affects WP Statistics: from n/a through 14.16.14.
Product
WP Statistics
Affected
up to 14.16.14
What to do
Affects up to 14.16.14. Update WP Statistics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 4, 2026User Private Files: Does not properly protect its stored private files on multisite installationsCVE-2026-97332 · WordPress plugins & themes · reported by WPScanMedium 5.3
The User Private Files WordPress plugin before 2.2.0 does not properly protect its stored private files on multisite installations, where the rewrite rule it relies on to route file requests through its access check is never reached, allowing unauthenticated users to retrieve other users' private files directly.
Product
User Private Files
Fixed in
2.2.0
What to do
Update User Private Files to 2.2.0 or newer.
Full record and what to do →NVD record wpscan.com github.com
Oct 4, 2026Horizontal scrolling announcements: Does not sanitise and escape one of its announcement settings before outputting it into an attribute context on the front endCVE-2026-17005 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Horizontal scrolling announcements WordPress plugin through 2.6 does not sanitise and escape one of its announcement settings before outputting it into an attribute context on the front end, allowing users granted access to the announcement management page (Contributor and above, once permitted) to perform Stored Cross-Site Scripting attacks that execute in the browser of anyone viewing the announcement.
Product
Horizontal scrolling announcements
Affected
up to 2.6
What to do
Affects up to 2.6. Update Horizontal scrolling announcements to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Oct 3, 2026Burst Statistics – Simple WordPress Analytics (Google Analytics Alternative): Improper Authentication leading to Account PersistenceCVE-2026-97343 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Burst Statistics – Simple WordPress Analytics (Google Analytics Alternative) plugin for WordPress is vulnerable to Improper Authentication leading to Account Persistence in all versions up to, and including, 3.7.1. This is due to the `maybe_load_shared_dashboard()` handler issuing a genuine WordPress session cookie for the `burst_statistics_viewer` account to any visitor presenting a valid share token via `wp_set_auth_cookie()`, while the plugin only blocks Application Passwords for the resulting `burst_viewer` role and does not restrict the core `/wp-json/wp/v2/users/me` password update endpoint or filter the `edit_user` capability for that account — leaving WordPress core's built-in rule that any authenticated user may update their own account fully in effect. This makes it possible for unauthenticated attackers to set an attacker-chosen password on the `burst_statistics_viewer` WordPress account, constituting a permanent takeover of that limited-privilege (`view_burst_statistics`) account that persists through share-token revocation, share-token expiration, and execution of the plugin's daily `cleanup_viewer_sessions()` routine. Exploitation requires that the attacker have o
Product
Burst Statistics – Simple WordPress Analytics (Google Analytics Alternative)
Affected
up to 3.7.1
What to do
Affects up to 3.7.1. Update Burst Statistics – Simple WordPress Analytics (Google Analytics Alternative) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Oct 3, 2026WP Visitor Statistics (Real Time Traffic): Generic SQL InjectionCVE-2026-96267 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The WP Visitor Statistics (Real Time Traffic) plugin for WordPress is vulnerable to generic SQL Injection via the 'fullRef' parameter in all versions up to, and including, 8.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This is a second-order SQL injection: an unauthenticated attacker submits a crafted referrer URL to the wmcTrack tracking endpoint, which persists the raw unescaped value into the wp_logVisit table, and the injection is triggered when an administrator next views the Traffic Sources dashboard.
Product
WP Visitor Statistics (Real Time Traffic)
Affected
up to 8.7
What to do
Affects up to 8.7. Update WP Visitor Statistics (Real Time Traffic) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 3, 2026Visitor Traffic Real Time Statistics: Stored DOM-Based Cross-Site ScriptingCVE-2026-97341 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Visitor Traffic Real Time Statistics plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via 'X-Real-IP' HTTP Header in all versions up to, and including, 8.16 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires no authentication, no nonce, and no capability — the wp_ajax_nopriv_ahcfree_track_visitor endpoint accepts the forged X-Real-IP header from any unauthenticated HTTP request and stores the entity-encoded payload verbatim in the database.
Product
Visitor Traffic Real Time Statistics
Affected
up to 8.16
What to do
Affects up to 8.16. Update Visitor Traffic Real Time Statistics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 3, 2026Loco Translate: Does not sanitise and escape some bundle configuration values before outputting them back in an admin pageCVE-2026-94239 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Loco Translate WordPress plugin before 2.8.9 does not sanitise and escape some bundle configuration values before outputting them back in an admin page, allowing users with the translator capability and above to perform Stored Cross-Site Scripting attacks against high privilege users such as administrators.
Product
Loco Translate
Fixed in
2.8.9
What to do
Update Loco Translate to 2.8.9 or newer.
Full record and what to do →NVD record wpscan.com
Oct 3, 2026Unlimited Elements for Elementor: Does not sanitise and escape a parameter before using it in a SQL statementCVE-2026-92923 · WordPress plugins & themes · reported by WPScanMedium 6.3
The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not sanitise and escape a parameter before using it in a SQL statement, allowing users with a role as low as subscriber to perform blind SQL injection attacks and read arbitrary data from the database. Version 2.0.18 removed the subscriber-level access, so from 2.0.18 onward the issue requires a Contributor role or above.
Product
Unlimited Elements for Elementor
Fixed in
2.0.21
What to do
Update Unlimited Elements for Elementor to 2.0.21 or newer.
Full record and what to do →NVD record wpscan.com
Oct 3, 2026SaveTo Wishlist Lite: Does not sanitise and escape parameters before using them in the ORDER BY clause of a SQL queryCVE-2026-89236 · WordPress plugins & themes · reported by WPScanHigh 8.6
The SaveTo Wishlist Lite WordPress plugin before 1.1.5 does not sanitise and escape parameters before using them in the ORDER BY clause of a SQL query, allowing unauthenticated attackers to append additional SQL queries and extract sensitive information from the database.
Product
SaveTo Wishlist Lite
Fixed in
1.1.5
What to do
Update SaveTo Wishlist Lite to 1.1.5 or newer.
Full record and what to do →NVD record wpscan.com
Oct 3, 2026Unlimited Elements for Elementor: Does not sanitise file paths inside uploaded archives before extracting themCVE-2026-85015 · WordPress plugins & themes · reported by WPScanMedium 6.6
The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not sanitise file paths inside uploaded archives before extracting them, allowing authenticated users with access to its asset-management feature (Administrators by default, or Editors when a non-default Unlimited Elements for Elementor WordPress plugin before 2.0.21 setting is enabled) to write arbitrary files, including executable PHP, outside the intended upload directory on servers where the PHP zip extension is unavailable, leading to Remote Code Execution.
Product
Unlimited Elements for Elementor
Fixed in
2.0.21
What to do
Update Unlimited Elements for Elementor to 2.0.21 or newer.
Full record and what to do →NVD record wpscan.com
Oct 3, 2026WP Ultimate CSV Importer: Does not properly validate the file types contained in an uploaded archive nor sanitise their content before storing them in a publicly served locationCVE-2026-80517 · WordPress plugins & themes · reported by WPScanLow 3.5
The WP Ultimate CSV Importer WordPress plugin before 9.2 does not properly validate the file types contained in an uploaded archive nor sanitise their content before storing them in a publicly served location, allowing high privilege users such as administrators to achieve Stored Cross-Site Scripting. On Multisite installations a site Administrator does not hold the unfiltered_html capability, so this lets them run scripts in the session of users who view the file, including Network Super Admins.
Product
WP Ultimate CSV Importer
Fixed in
9.2
What to do
Update WP Ultimate CSV Importer to 9.2 or newer.
Full record and what to do →NVD record wpscan.com
Oct 3, 2026WP Ultimate Review: Does not properly sanitise and escape reviews submitted through its public review formCVE-2026-101159 · WordPress plugins & themes · reported by WPScanHigh 7.5
The WP Ultimate Review WordPress plugin before 2.4.4 does not properly sanitise and escape reviews submitted through its public review form, which is available to unauthenticated visitors, allowing them to perform Stored Cross-Site Scripting attacks against any user, including administrators, viewing a page displaying the review, when user reviews are enabled.
Product
WP Ultimate Review
Fixed in
2.4.4
What to do
Update WP Ultimate Review to 2.4.4 or newer.
Full record and what to do →NVD record wpscan.com
Oct 2, 2026WP Statistics – Simple, privacy-friendly Google Analytics alternative: Reflected Cross-Site ScriptingCVE-2026-97652 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WP Statistics – Simple, privacy-friendly Google Analytics alternative plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via REQUEST_URI Query-Parameter Key in all versions up to, and including, 14.16.14 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
WP Statistics – Simple, privacy-friendly Google Analytics alternative
Affected
up to 14.16.14
What to do
Affects up to 14.16.14. Update WP Statistics – Simple, privacy-friendly Google Analytics alternative to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Oct 2, 2026Events Calendar: Does not validate or sanitise data submitted to an unauthenticated AJAX action before merging it into its rendering contextCVE-2026-84740 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Events Calendar WordPress plugin before 6.17.5.1 does not validate or sanitise data submitted to an unauthenticated AJAX action before merging it into its rendering context, allowing unauthenticated users to execute arbitrary shortcodes registered on the site.
Product
Events Calendar
Fixed in
6.17.5.1
What to do
Update Events Calendar to 6.17.5.1 or newer.
Full record and what to do →NVD record wpscan.com
Oct 2, 2026BuildKit: Does not properly sanitise and escape data submitted by contributor-level users before storing it and later using it in a SQL queryCVE-2026-94298 · WordPress plugins & themes · reported by WPScanMedium 6.2
The BuildKit WordPress plugin before 1.0.29 does not properly sanitise and escape data submitted by contributor-level users before storing it and later using it in a SQL query, allowing a Contributor to inject SQL that runs against the database once the resulting content is published and viewed by any unauthenticated visitor.
Product
BuildKit
Fixed in
1.0.29
What to do
Update BuildKit to 1.0.29 or newer.
Full record and what to do →NVD record wpscan.com
Oct 2, 2026Motors: Does not sanitise and escape a listing badge setting before outputting it inside an HTML attributeCVE-2026-91022 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Motors WordPress plugin before 1.4.124 does not sanitise and escape a listing badge setting before outputting it inside an HTML attribute, allowing users with a custom, administrator-assigned listing-management role to inject arbitrary web scripts that execute when a listing is viewed by any visitor, including an administrator.
Product
Motors
Fixed in
1.4.124
What to do
Update Motors to 1.4.124 or newer.
Full record and what to do →NVD record wpscan.com
Oct 2, 2026Visitors Traffic Real Time Statistics Pro: Unauthenticated stored Cross-Site ScriptingCVE-2026-93367 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Visitors Traffic Real Time Statistics Pro plugin for WordPress is vulnerable to unauthenticated stored Cross-Site Scripting in all versions up to, and including, 11.22 via the page_title parameter of the ahcpro_track_visitor AJAX action. The action is registered for logged-out callers (wp_ajax_nopriv_ahcpro_track_visitor) and stores $_POST['page_title'] with NO sanitization, keeping it raw in the ahc_title_traffic.til_page_title column. When an administrator opens the plugin's dashboard, the 'Traffic by Title' DataTable renders that stored value as innerHTML without output escaping, executing arbitrary JavaScript. This makes it possible for unauthenticated attackers to inject web scripts that run in an administrator's session.
Product
Visitors Traffic Real Time Statistics Pro
Affected
up to 11.22
What to do
Affects up to 11.22. Update Visitors Traffic Real Time Statistics Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordfence.com wp-buy.com
Oct 1, 2026Subscriber Broken Access Control in Gratisfaction <= 4.6.3 versions.CVE-2026-97297 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Subscriber Broken Access Control in Gratisfaction <= 4.6.3 versions.
Affected
up to 4.6.3
What to do
Affects up to 4.6.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 1, 2026Ultimate Multisite – WordPress Multisite SaaS & WaaS Platform: Authentication BypassCVE-2026-75957 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Ultimate Multisite – WordPress Multisite SaaS & WaaS Platform plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 2.15.0 via the `checkout_form` parameter of the `login_customer_after_checkout` function. This is due to the publicly accessible `wu_ajax_nopriv_wu_validate_form` AJAX handler accepting a freely obtainable checkout nonce, and the `checkout_form=wu-finish-checkout` parameter causing `get_validation_rules()` to discard all validation rules while `finish_checkout_form_fields()` returns an empty step list — forcing `is_last_step()` to return true and routing the request directly into full order processing — after which `maybe_create_customer()` resolves the attacker-supplied `email_address` to an existing WordPress user ID without any authentication or ownership verification, and `login_customer_after_checkout()` calls `wp_set_auth_cookie()` for that user ID via a passwordless code path. This makes it possible for unauthenticated attackers to log in as any existing WordPress user — including a Network Super Admin — simply by knowing their email address. Exploitation requires that the targeted user account has no pre-existing
Product
Ultimate Multisite – WordPress Multisite SaaS & WaaS Platform
Affected
up to 2.15.0
What to do
Affects up to 2.15.0. Update Ultimate Multisite – WordPress Multisite SaaS & WaaS Platform to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 1, 2026Download Manager: Does not sufficiently sanitise and escape a package setting before outputting it back in a pageCVE-2026-86610 · WordPress plugins & themes · reported by WPScanMedium 6.4
The Download Manager WordPress plugin before 3.3.71 does not sufficiently sanitise and escape a package setting before outputting it back in a page, which could allow users with the Author role and above to perform Stored Cross-Site Scripting attacks against any visitor who opens the package's download dialogue, including administrators. Only sites running PHP below 8.1 are affected, as the sanitisation applied when the setting is saved does not neutralise single quotes there.
Product
Download Manager
Fixed in
3.3.71
What to do
Update Download Manager to 3.3.71 or newer.
Full record and what to do →NVD record wpscan.com
Sep 30, 2026Unauthenticated Cross Site Scripting (XSS) in WP Statistics <= 14.16.13 versions.CVE-2026-93770 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in WP Statistics <= 14.16.13 versions.
Affected
up to 14.16.13
What to do
Affects up to 14.16.13. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 30, 2026All in One Files Upload: Adds SVG to the site's allowed upload types and does not sanitise uploaded files or verify the authenticity of its public upload requestsCVE-2026-85573 · WordPress plugins & themes · reported by WPScanHigh 8.8
The All in One Files Upload WordPress plugin before 2.0.17 adds SVG to the site's allowed upload types and does not sanitise uploaded files or verify the authenticity of its public upload requests, allowing unauthenticated users to store files containing active content which run in the site's origin when a victim opens them.
Product
All in One Files Upload
Fixed in
2.0.17
What to do
Update All in One Files Upload to 2.0.17 or newer.
Full record and what to do →NVD record wpscan.com
Sep 30, 2026EmbedPress: Does not sanitise and escape one of its Elementor widget settings before outputting it into an HTML attributeCVE-2026-85001 · WordPress plugins & themes · reported by WPScanMedium 6.8
The EmbedPress WordPress plugin before 4.6.7 does not sanitise and escape one of its Elementor widget settings before outputting it into an HTML attribute, which could allow users with the Contributor role or above to inject arbitrary web scripts that execute when the affected content is viewed.
Product
EmbedPress
Fixed in
4.6.7
What to do
Update EmbedPress to 4.6.7 or newer.
Full record and what to do →NVD record wpscan.com
Sep 28, 2026SPS-Suite: Does not sanitise the search query before using it in a SQL queryCVE-2026-93000 · WordPress plugins & themes · reported by WPScanMedium 6.8
The SPS-Suite WordPress plugin through 1.4.0 does not sanitise the search query before using it in a SQL query when its static-page search feature is enabled, allowing unauthenticated attackers to perform SQL injection attacks.
Product
SPS-Suite
Affected
up to 1.4.0
What to do
Affects up to 1.4.0. Update SPS-Suite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Sep 27, 2026Download Manager: Does not sanitise and escape data submitted through its email-locked download subscription form before outputting it back in an admin pageCVE-2026-86609 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Download Manager WordPress plugin before 7.5.6 does not sanitise and escape data submitted through its email-locked download subscription form before outputting it back in an admin page, which could allow unauthenticated attackers to perform Stored Cross-Site Scripting attacks against administrators. This affects the commercial Pro edition only; the free Download Manager WordPress plugin before 7.5.6 published under the same slug does not ship the affected feature.
Product
Download Manager
Fixed in
7.5.6
What to do
Update Download Manager to 7.5.6 or newer.
Full record and what to do →NVD record wpscan.com
Sep 26, 2026Bluff Post: Does not sanitise and escape parameters before using themCVE-2026-89237 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Bluff Post WordPress plugin through 1.1.1 does not sanitise and escape parameters before using them as identifiers in a SQL query, allowing unauthenticated attackers to append additional SQL and extract sensitive information from the database.
Product
Bluff Post
Affected
up to 1.1.1
What to do
Affects up to 1.1.1. Update Bluff Post to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Sep 24, 2026WPeMatico RSS Feed Fetcher: Does not sanitise and escape one of its campaign configuration fieldsCVE-2026-89005 · WordPress plugins & themes · reported by WPScanMedium 6.8
The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.26 does not sanitise and escape one of its campaign configuration fields when a certain feature is enabled, which allows users with the Contributor role and above to perform Stored Cross-Site Scripting attacks that execute in the session of any higher-privileged user who later views the campaign.
Product
WPeMatico RSS Feed Fetcher
Fixed in
2.8.26
What to do
Update WPeMatico RSS Feed Fetcher to 2.8.26 or newer.
Full record and what to do →NVD record wpscan.com
Sep 23, 2026Subscribe Forms: Does not sanitise and escape one of its form settings before outputting it in a pageCVE-2026-91073 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Subscribe Forms WordPress plugin before 1.6.3 does not sanitise and escape one of its form settings before outputting it in a page, allowing authenticated users with the Author role and above to perform Stored Cross-Site Scripting attacks that execute in the browser of any visitor who views a page embedding the form, including logged-out visitors and administrators.
Product
Subscribe Forms
Fixed in
1.6.3
What to do
Update Subscribe Forms to 1.6.3 or newer.
Full record and what to do →NVD record wpscan.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.