Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
5,555 results · page 22 of 112
Sep 12, 2026Yogeta WP Cloud: Does not validate a user-supplied file path before passing it to a file-read function on a public endpoint that lacks any authorization checkCVE-2026-80494 · WordPress plugins & themes · reported by WPScanHigh 8.6
The Yogeta WP Cloud WordPress plugin through 1.0 does not validate a user-supplied file path before passing it to a file-read function on a public endpoint that lacks any authorization check, allowing unauthenticated attackers to download arbitrary files from the server, including files containing sensitive credentials.
- Product
- Yogeta WP Cloud
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Yogeta WP Cloud to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 12, 2026SAMO Forms: Does not properly sanitise and escape user input before using it in SQL queries in several unauthenticated actionsCVE-2026-80491 · WordPress plugins & themes · reported by WPScanHigh 8.6
The SAMO Forms WordPress plugin through 1.0.0 does not properly sanitise and escape user input before using it in SQL queries in several unauthenticated actions, allowing unauthenticated attackers to perform SQL injection attacks.
- Product
- SAMO Forms
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update SAMO Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 12, 2026SureRank SEO: Does not exclude users' registered account email addresses from the structured data it outputs on public pages by defaultCVE-2026-78152 · WordPress plugins & themes · reported by WPScanMedium 5.3
The SureRank SEO WordPress plugin before 1.10.1 does not exclude users' registered account email addresses from the structured data it outputs on public pages by default, allowing unauthenticated visitors to obtain the email address of any user who has published content.
- Product
- SureRank SEO
- Fixed in
- 1.10.1
- What to do
- Update SureRank SEO to 1.10.1 or newer.
Sep 12, 2026Temporary Login Without Password: Does not prevent a temporary user from creating an Application PasswordCVE-2026-77753 · WordPress plugins & themes · reported by WPScanMedium 5.5
The Temporary Login Without Password WordPress plugin before 1.9.9 does not prevent a temporary user from creating an Application Password, and does not revoke one when the temporary access expires or is disabled, allowing the recipient of a temporary login to retain working access to the site over REST and XML-RPC after the administrator believes it has been withdrawn. The retained access carries whatever role was granted, which for the Temporary Login Without Password WordPress plugin before 1.9.9's main use case is Administrator.
- Product
- Temporary Login Without Password
- Fixed in
- 1.9.9
- What to do
- Update Temporary Login Without Password to 1.9.9 or newer.
Sep 12, 2026Temporary Login Without Password: Does not verify that the user requesting a temporary login holds network super admin rights before granting the new account those rightsCVE-2026-77752 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Temporary Login Without Password WordPress plugin before 1.9.9 does not verify that the user requesting a temporary login holds network super admin rights before granting the new account those rights, allowing an administrator of a single site on a multisite network to take over the whole network. The same missing check also allows an existing account, including the attacker's own, to be promoted.
- Product
- Temporary Login Without Password
- Fixed in
- 1.9.9
- What to do
- Update Temporary Login Without Password to 1.9.9 or newer.
Sep 12, 2026Booking for Appointments and Events Calendar: Does not verify that the user editing a customer or employee record is entitled to modify the WordPress account linked to itCVE-2026-77705 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Booking for Appointments and Events Calendar WordPress plugin before 2.4.10 does not verify that the user editing a customer or employee record is entitled to modify the WordPress account linked to it, allowing users holding Amelia's customer or employee management permissions to set the password and email address of other users' WordPress accounts and take them over.
- Product
- Booking for Appointments and Events Calendar
- Fixed in
- 2.4.10
- What to do
- Update Booking for Appointments and Events Calendar to 2.4.10 or newer.
Sep 12, 2026Booking for Appointments and Events Calendar: Does not verify that a payment was actually taken before recording a bookingCVE-2026-77689 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Booking for Appointments and Events Calendar WordPress plugin before 9.8.1 does not verify that a payment was actually taken before recording a booking as paid, trusting the payment gateway named in a public, unauthenticated booking request even when the site has never configured that gateway. This lets an unauthenticated attacker obtain confirmed, fully paid appointments and events without any payment being collected.
- Product
- Booking for Appointments and Events Calendar
- Fixed in
- 9.8.1
- What to do
- Update Booking for Appointments and Events Calendar to 9.8.1 or newer.
Sep 12, 2026WebTotem Backups: Does not validate a user-supplied file pathCVE-2026-77006 · WordPress plugins & themes · reported by WPScanCritical 9.6
The WebTotem Backups WordPress plugin before 1.1.0 does not validate a user-supplied file path, does not check the capability of the user making the request, and discards the result of its own CSRF check, allowing any authenticated user, such as a subscriber, to delete arbitrary files on the server, which can lead to a site takeover.
- Product
- WebTotem Backups
- Fixed in
- 1.1.0
- What to do
- Update WebTotem Backups to 1.1.0 or newer.
Sep 12, 2026CODE MONKEYS PROPOSALS: Does not validate a user-supplied file path before deleting a fileCVE-2026-77005 · WordPress plugins & themes · reported by WPScanCritical 9.6
The CODE MONKEYS PROPOSALS WordPress plugin through 1.0.1 does not validate a user-supplied file path before deleting a file, and does not check the capability of the user making the request, allowing any authenticated user, such as a subscriber, to delete arbitrary files on the server, which can lead to a site takeover.
- Product
- CODE MONKEYS PROPOSALS
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update CODE MONKEYS PROPOSALS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 12, 2026Frontegg SAML SSO: Does not verify the signature or issuer of SAML authentication responses before establishing a sessionCVE-2026-75800 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Frontegg SAML SSO WordPress plugin through 1.0.1 does not verify the signature or issuer of SAML authentication responses before establishing a session, allowing unauthenticated attackers to log in as any user, including administrators, as well as to create arbitrary accounts.
- Product
- Frontegg SAML SSO
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update Frontegg SAML SSO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 11, 2026MetForm: Does not properly neutralize newline characters in user-submitted values that are placed into notification email headersCVE-2026-86813 · WordPress plugins & themes · reported by WPScanMedium 4.8
The MetForm WordPress plugin before 4.1.9 does not properly neutralize newline characters in user-submitted values that are placed into notification email headers, allowing unauthenticated attackers to inject additional email headers, such as Bcc, into the emails the site sends when a submitted field value is configured to populate a header.
- Product
- MetForm
- Fixed in
- 4.1.9
- What to do
- Update MetForm to 4.1.9 or newer.
Sep 11, 2026The Persian Elementor WordPress plugin from 2.7.10 before 2.8.2 does not verify that the payment authority returned to its ZarinPal payment callback belongs to CVE-2026-86809 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Persian Elementor WordPress plugin from 2.7.10 before 2.8.2 does not verify that the payment authority returned to its ZarinPal payment callback belongs to the transaction being completed, allowing unauthenticated attackers to complete a pending order using a valid payment authority obtained from a different transaction.
- Fixed in
- 2.8.2
- What to do
- Update the plugin to 2.8.2 or newer.
Sep 11, 2026The Payment Gateway PayPay for WooCommerce WordPress plugin from 0.5 to 0.9.3 does not verify the authenticity of the payment notifications it receives before aCVE-2026-82215 · WordPress plugins & themes · reported by WPScanMedium 5.9
The Payment Gateway PayPay for WooCommerce WordPress plugin from 0.5 to 0.9.3 does not verify the authenticity of the payment notifications it receives before acting on them, allowing unauthenticated attackers who know the store's merchant identifier to mark arbitrary orders as paid, or to cancel or fail them.
- What to do
- Update the plugin to the newest version.
Sep 11, 2026The Nexi XPay Build WordPress plugin from 7.6.1 to 7.6.2 does not verify that the saved payment token being requested belongs to the current user, allowing unauCVE-2026-82213 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Nexi XPay Build WordPress plugin from 7.6.1 to 7.6.2 does not verify that the saved payment token being requested belongs to the current user, allowing unauthenticated attackers to retrieve other customers' stored card token references together with a valid authorisation signature.
- What to do
- Update the plugin to the newest version.
Sep 11, 2026BackWPup: Does not properly restrict access to several of its REST API routes for jobCVE-2026-86815 · WordPress plugins & themes · reported by WPScanMedium 5.5
The BackWPup WordPress plugin before 5.7.5 does not properly restrict access to several of its REST API routes for job, backup-destination, and backup-execution management, allowing users holding a BackWPup WordPress plugin before 5.7.5-defined, administrator-assigned limited role to create and run backup jobs and exfiltrate a full database backup to an attacker-controlled destination.
- Product
- BackWPup
- Fixed in
- 5.7.5
- What to do
- Update BackWPup to 5.7.5 or newer.
Sep 11, 2026WPCafe: Does not correctly restrict access to a set of order-management REST endpoints because their permission callbacks return an incorrect type on failureCVE-2026-86812 · WordPress plugins & themes · reported by WPScanMedium 6.5
The WPCafe WordPress plugin before 3.0.18 does not correctly restrict access to a set of order-management REST endpoints because their permission callbacks return an incorrect type on failure, allowing unauthenticated users to disclose guest order information and to change the status of, or trash, any order.
- Product
- WPCafe
- Fixed in
- 3.0.18
- What to do
- Update WPCafe to 3.0.18 or newer.
Sep 11, 2026Visualizer: Does not properly authorise access to its chart-building actionsCVE-2026-86782 · WordPress plugins & themes · reported by WPScanMedium 5.5
The Visualizer WordPress plugin before 4.0.6 does not properly authorise access to its chart-building actions, allowing users with the Contributor role and above to publish, rename, and overwrite the content of posts and pages they do not own, including other users' private drafts.
- Product
- Visualizer
- Fixed in
- 4.0.6
- What to do
- Update Visualizer to 4.0.6 or newer.
Sep 11, 2026SSL Zen — SSL Certificate Installer & HTTPS Redirects: Does not perform capability or nonce checks on a certificate-file download routine that runs early in the WordPress admin request lifecycleCVE-2026-86781 · WordPress plugins & themes · reported by WPScanMedium 5.3
The SSL Zen — SSL Certificate Installer & HTTPS Redirects WordPress plugin before 4.7.40 does not perform capability or nonce checks on a certificate-file download routine that runs early in the WordPress admin request lifecycle, allowing any authenticated user, including Subscribers, to download the site's TLS private key, certificates, and diagnostic logs.
- Product
- SSL Zen — SSL Certificate Installer & HTTPS Redirects
- Fixed in
- 4.7.40
- What to do
- Update SSL Zen — SSL Certificate Installer & HTTPS Redirects to 4.7.40 or newer.
Sep 11, 2026Featured Image with URL: Does not sanitise and escape a stored image attribute value before outputting itCVE-2026-86780 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Featured Image with URL WordPress plugin before 1.0.6 does not sanitise and escape a stored image attribute value before outputting it, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks that execute in the browser of any user viewing the affected post, including higher-privileged users such as Editors and Administrators.
- Product
- Featured Image with URL
- Fixed in
- 1.0.6
- What to do
- Update Featured Image with URL to 1.0.6 or newer.
Sep 11, 2026Visualizer: Does not properly authorise chart-deletion requestsCVE-2026-86779 · WordPress plugins & themes · reported by WPScanLow 2.7
The Visualizer WordPress plugin before 4.0.6 does not properly authorise chart-deletion requests, performing only a site-wide capability check with no per-object ownership verification, allowing users with the Contributor role and above to permanently delete any chart on the site, including charts created by other users such as administrators.
- Product
- Visualizer
- Fixed in
- 4.0.6
- What to do
- Update Visualizer to 4.0.6 or newer.
Sep 11, 2026AI Builder: Does not sanitise custom JavaScript saved against a post before echoing it inside a script tag on the front endCVE-2026-85678 · WordPress plugins & themes · reported by WPScanMedium 6.8
The AI Builder WordPress plugin before 2.7.8 does not sanitise custom JavaScript saved against a post before echoing it inside a script tag on the front end, allowing users with contributor level access and above to store arbitrary JavaScript that will execute in the browser of anyone who views the post, including the editor or administrator who reviews it.
- Product
- AI Builder
- Fixed in
- 2.7.8
- What to do
- Update AI Builder to 2.7.8 or newer.
Sep 11, 2026Gutenverse News: Does not restrict the extra HTML it adds to WordPress's allowed elements to the context it is meant forCVE-2026-85677 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Gutenverse News WordPress plugin before 3.3.3 does not restrict the extra HTML it adds to WordPress's allowed elements to the context it is meant for, applying the same relaxed list to every sanitisation context including untrusted comments, allowing unauthenticated users to store JavaScript that will execute in the browser of any administrator who reviews the comment queue, and of any visitor to the post once the comment is approved.
- Product
- Gutenverse News
- Fixed in
- 3.3.3
- What to do
- Update Gutenverse News to 3.3.3 or newer.
Sep 11, 2026CoolClock: Does not properly escape a skin setting before outputting it within an HTML attributeCVE-2026-83546 · WordPress plugins & themes · reported by WPScanMedium 6.8
The CoolClock WordPress plugin before 4.3.8 does not properly escape a skin setting before outputting it within an HTML attribute, allowing users with contributor-level access and above to inject arbitrary web scripts that execute when the content is viewed.
- Product
- CoolClock
- Fixed in
- 4.3.8
- What to do
- Update CoolClock to 4.3.8 or newer.
Sep 11, 2026CoolClock: Does not properly escape a custom skin setting before outputting it inside an inline scriptCVE-2026-83545 · WordPress plugins & themes · reported by WPScanMedium 6.8
The CoolClock WordPress plugin before 4.3.8 does not properly escape a custom skin setting before outputting it inside an inline script, allowing users with contributor-level access and above to inject arbitrary JavaScript that executes when the content is viewed.
- Product
- CoolClock
- Fixed in
- 4.3.8
- What to do
- Update CoolClock to 4.3.8 or newer.
Sep 11, 2026YITH WooCommerce Wishlist: Does not verify that a user is authorised to rename a given wishlistCVE-2026-82305 · WordPress plugins & themes · reported by WPScanMedium 5.3
The YITH WooCommerce Wishlist WordPress plugin before 4.18.1 does not verify that a user is authorised to rename a given wishlist, allowing unauthenticated users to rename any wishlist on the site.
- Product
- YITH WooCommerce Wishlist
- Fixed in
- 4.18.1
- What to do
- Update YITH WooCommerce Wishlist to 4.18.1 or newer.
Sep 11, 2026MultiVendorX: Does not restrict who can update its role and capability settingsCVE-2026-74925 · WordPress plugins & themes · reported by WPScanHigh 7.2
The MultiVendorX WordPress plugin before 5.0.16 does not restrict who can update its role and capability settings, allowing users holding its vendor role to grant that role administrator-level capabilities and take over the site.
- Product
- MultiVendorX
- Fixed in
- 5.0.16
- What to do
- Update MultiVendorX to 5.0.16 or newer.
Sep 11, 2026advanced-customized-prompts: Does not perform any capabilityCVE-2026-14566 · WordPress plugins & themes · reported by WPScanMedium 4.3
The advanced-customized-prompts WordPress plugin through 1.0.1 does not perform any capability, ownership, or nonce check before updating WooCommerce order item metadata for a supplied order, allowing any authenticated user such as a subscriber to tamper with the custom metadata of orders belonging to other customers.
- Product
- advanced-customized-prompts
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update advanced-customized-prompts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 11, 2026advanced-customized-prompts: Does not perform any capabilityCVE-2026-14565 · WordPress plugins & themes · reported by WPScanMedium 5.4
The advanced-customized-prompts WordPress plugin through 1.0.1 does not perform any capability, ownership, or nonce check before saving popup configuration to a product, nor escape the stored values on output, allowing any authenticated user such as a subscriber to store JavaScript that executes in the browser of visitors viewing the affected product.
- Product
- advanced-customized-prompts
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update advanced-customized-prompts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 11, 2026advanced-customized-prompts: Does not verify the password before issuing an authenticated session for a supplied email address in an unauthenticated actionCVE-2026-14563 · WordPress plugins & themes · reported by WPScanCritical 9.8
The advanced-customized-prompts WordPress plugin through 1.0.1 does not verify the password before issuing an authenticated session for a supplied email address in an unauthenticated action, allowing unauthenticated attackers to log in as any registered user, including administrators, or to create arbitrary new accounts.
- Product
- advanced-customized-prompts
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update advanced-customized-prompts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 11, 2026teddy-bear-customize-addon: Does not perform any authorization or ownership checks before returning WooCommerce order metadata and the URLs of customer-uploaded attachmentsCVE-2026-14562 · WordPress plugins & themes · reported by WPScanMedium 5.3
The teddy-bear-customize-addon WordPress plugin through 1.0.5 does not perform any authorization or ownership checks before returning WooCommerce order metadata and the URLs of customer-uploaded attachments, allowing unauthenticated attackers to disclose other customers' order and attachment data.
- Product
- teddy-bear-customize-addon
- Affected
- up to 1.0.5
- What to do
- Affects up to 1.0.5. Update teddy-bear-customize-addon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 11, 2026teddy-bear-customize-addon: Does not properly validate uploaded filesCVE-2026-14560 · WordPress plugins & themes · reported by WPScanCritical 10
The teddy-bear-customize-addon WordPress plugin through 1.0.5 does not properly validate uploaded files, relying on a client-supplied content type and preserving the original filename, allowing unauthenticated attackers to upload arbitrary PHP files and execute code on the server.
- Product
- teddy-bear-customize-addon
- Affected
- up to 1.0.5
- What to do
- Affects up to 1.0.5. Update teddy-bear-customize-addon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 11, 2026teddy-bear-customize-addon: Does not verify a user's password before authenticating themCVE-2026-14559 · WordPress plugins & themes · reported by WPScanCritical 9.8
The teddy-bear-customize-addon WordPress plugin through 1.0.5 does not verify a user's password before authenticating them, allowing unauthenticated attackers to log in as any registered user, including administrators, by supplying only that user's email address.
- Product
- teddy-bear-customize-addon
- Affected
- up to 1.0.5
- What to do
- Affects up to 1.0.5. Update teddy-bear-customize-addon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 11, 2026Translate WordPress with GTranslate: Does not validate one of its settings before the bundled front-end scripts build markup from itCVE-2025-15695 · WordPress plugins & themes · reported by WPScanLow 3.5
The Translate WordPress with GTranslate WordPress plugin before 3.0.10 does not validate one of its settings before the bundled front-end scripts build markup from it, allowing users with a role as high as administrator to store JavaScript that runs in the session of any visitor to the site.
- Product
- Translate WordPress with GTranslate
- Fixed in
- 3.0.10
- What to do
- Update Translate WordPress with GTranslate to 3.0.10 or newer.
Sep 10, 2026Site Reviews: Does not prevent request data from being deserializedCVE-2026-82925 · WordPress plugins & themes · reported by WPScanHigh 8.1
The Site Reviews WordPress plugin before 8.3.0 does not prevent request data from being deserialized, and derives the key protecting that data by padding out the site's WordPress nonce key, which makes the key publicly computable on installs where that key is absent, left at its sample value, or too short to be secret. This allows unauthenticated users to inject arbitrary PHP objects on such installs. The Site Reviews WordPress plugin before 8.3.0's own code contains no chain onward from the injected object, so how far it reaches depends on the other code present on the site.
- Product
- Site Reviews
- Fixed in
- 8.3.0
- What to do
- Update Site Reviews to 8.3.0 or newer.
Sep 10, 2026Registration Form for WooCommerce: Does not validate that the form referenced during registration is a legitimate registration formCVE-2026-81431 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Registration Form for WooCommerce WordPress plugin before 1.1.3 does not validate that the form referenced during registration is a legitimate registration form, reading the permitted-role allow-list from an arbitrary attacker-controlled post instead. A user able to create a post (Contributor and above) can therefore register a new account with an arbitrary role, including Administrator, leading to full site takeover. This is an incomplete fix of CVE-2026-54807.
- Product
- Registration Form for WooCommerce
- Fixed in
- 1.1.3
- What to do
- Update Registration Form for WooCommerce to 1.1.3 or newer.
Sep 10, 2026zipMoney(Zip Co) Payments Plugin for WooCommerce: Does not perform any authorisation checks on one of its front-end request handlersCVE-2026-78361 · WordPress plugins & themes · reported by WPScanCritical 9.1
The zipMoney(Zip Co) Payments Plugin for WooCommerce WordPress plugin before 2.4.0 does not perform any authorisation checks on one of its front-end request handlers, and does not restrict which option name a caller may supply, allowing unauthenticated users to delete arbitrary WordPress options. This can be used to destroy site and access control configuration, deactivate every installed zipMoney(Zip Co) Payments Plugin for WooCommerce WordPress plugin before 2.4.0, and take the site offline.
- Product
- zipMoney(Zip Co) Payments Plugin for WooCommerce
- Fixed in
- 2.4.0
- What to do
- Update zipMoney(Zip Co) Payments Plugin for WooCommerce to 2.4.0 or newer.
Sep 10, 2026miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA: Does not scope its second-factor attempt limit to the account being attackedCVE-2026-77771 · WordPress plugins & themes · reported by WPScanHigh 7.5
The miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA WordPress plugin before 19.3 does not scope its second-factor attempt limit to the account being attacked, keying it instead to an identifier the client supplies and can change at will, allowing an attacker who already knows a victim's password to make unlimited one-time-passcode guesses and defeat the second factor. A second validation endpoint applies no attempt limit at all.
- Product
- miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA
- Fixed in
- 6.3.1
- What to do
- Update miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA to 6.3.1 or newer.
Sep 10, 2026miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA: Does not require a validated transaction before deleting site options whose names come from unauthenticated request inputCVE-2026-77770 · WordPress plugins & themes · reported by WPScanCritical 10
The miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA WordPress plugin before 19.3 does not require a validated transaction before deleting site options whose names come from unauthenticated request input, allowing any visitor to delete arbitrary options, which can lock every administrator out of the dashboard or deactivate every miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA WordPress plugin before 19.3 on the site.
- Product
- miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA
- Fixed in
- 6.3.1
- What to do
- Update miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA to 6.3.1 or newer.
Sep 10, 2026Notiqoo: Does not have capability checks on several of its AJAX actions and builds the name of the option to write from user inputCVE-2026-19840 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Notiqoo WordPress plugin before 1.4.14 does not have capability checks on several of its AJAX actions and builds the name of the option to write from user input, allowing users with a role as low as contributor to modify arbitrary WordPress options, which can be used to deactivate Notiqoo WordPress plugin before 1.4.14 and to lock every administrator out of the site.
- Product
- Notiqoo
- Fixed in
- 1.4.14
- What to do
- Update Notiqoo to 1.4.14 or newer.
Sep 10, 2026Ultimate Gift Cards for WooCommerce: Does not have any authorisation checkCVE-2026-19439 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Ultimate Gift Cards for WooCommerce WordPress plugin before 3.2.10 does not have any authorisation check when displaying gift card details, allowing unauthenticated users to retrieve the gift cards attached to arbitrary orders and disclose customer personal data, balances, dates and, in 3.2.9, the live redemption code, which anyone holding it can spend. Versions from 3.0.3 to 3.2.8 disclose the same data without the redemption code.
- Product
- Ultimate Gift Cards for WooCommerce
- Fixed in
- 3.2.10
- What to do
- Update Ultimate Gift Cards for WooCommerce to 3.2.10 or newer.
Sep 10, 2026Ultimate Gift Cards for WooCommerce: Does not reconcile the value of the gift card coupon it issues against the amount actually collected at checkoutCVE-2026-19436 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Ultimate Gift Cards for WooCommerce WordPress plugin before 3.2.10 does not reconcile the value of the gift card coupon it issues against the amount actually collected at checkout, allowing unauthenticated users to obtain store credit worth more than they paid.
- Product
- Ultimate Gift Cards for WooCommerce
- Fixed in
- 3.2.10
- What to do
- Update Ultimate Gift Cards for WooCommerce to 3.2.10 or newer.
Sep 9, 2026WP Express Checkout: Does not verify server-side that a payment was actually completed before marking an orderCVE-2026-83537 · WordPress plugins & themes · reported by WPScanMedium 5.3
The WP Express Checkout WordPress plugin before 2.5.0 does not verify server-side that a payment was actually completed before marking an order as paid, allowing unauthenticated users to forge a completed order without paying.
- Product
- WP Express Checkout
- Fixed in
- 2.5.0
- What to do
- Update WP Express Checkout to 2.5.0 or newer.
Sep 9, 2026Hustle: Does not prevent shortcodes in submitted form values from being executedCVE-2026-80440 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Hustle WordPress plugin before 7.8.14.2 does not prevent shortcodes in submitted form values from being executed when it substitutes those values into the message it returns after submission, because the guard it applies can be defeated by nesting, allowing unauthenticated users to run any shortcode registered on the site.
- Product
- Hustle
- Fixed in
- 7.8.14.2
- What to do
- Update Hustle to 7.8.14.2 or newer.
Sep 9, 2026CleanTalk: Does not prevent unauthenticatedCVE-2026-19855 · WordPress plugins & themes · reported by WPScanMedium 6.5
The CleanTalk WordPress plugin before 6.87 does not prevent unauthenticated, user-supplied comment content from being passed to WordPress's shortcode engine, allowing any visitor to have arbitrary shortcodes registered on the site executed server-side and rendered to every subsequent visitor of the page.
- Product
- CleanTalk
- Fixed in
- 6.87
- What to do
- Update CleanTalk to 6.87 or newer.
Sep 9, 2026Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More: Does not validate a user-supplied HTML tag name in one of its Beaver Builder widgets before echoing it into the rendered markupCVE-2026-85418 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More WordPress plugin before 3.0.9 does not validate a user-supplied HTML tag name in one of its Beaver Builder widgets before echoing it into the rendered markup, allowing users with contributor-level access and above to inject arbitrary web scripts that execute when any visitor views the affected page.
- Product
- Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More
- Fixed in
- 3.0.9
- What to do
- Update Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More to 3.0.9 or newer.
Sep 9, 2026WPLP Cookie Consent: Does not perform nonce or capability checks on several of its settings AJAX actionsCVE-2026-85133 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WPLP Cookie Consent WordPress plugin before 4.4.2 does not perform nonce or capability checks on several of its settings AJAX actions, allowing any authenticated user, such as a subscriber, to read and destroy scan data belonging to the administrator and to overwrite the WPLP Cookie Consent WordPress plugin before 4.4.2's stored configuration.
- Product
- WPLP Cookie Consent
- Fixed in
- 4.4.2
- What to do
- Update WPLP Cookie Consent to 4.4.2 or newer.
Sep 9, 2026WPLP Cookie Consent: Does not perform nonce or capability checks on one of its cookie scanner AJAX actionsCVE-2026-85132 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WPLP Cookie Consent WordPress plugin before 4.4.2 does not perform nonce or capability checks on one of its cookie scanner AJAX actions, allowing any authenticated user, such as a subscriber, to read back the automated scan schedule the administrator configured.
- Product
- WPLP Cookie Consent
- Fixed in
- 4.4.2
- What to do
- Update WPLP Cookie Consent to 4.4.2 or newer.
Sep 9, 2026Sunshine Photo Cart: Does not validate that a client-supplied price identifier belongs to the item being purchasedCVE-2026-85037 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Sunshine Photo Cart WordPress plugin before 3.7 does not validate that a client-supplied price identifier belongs to the item being purchased when it is added to the cart, allowing unauthenticated users to buy items at a lower price defined elsewhere on the site and complete an order at that price, resulting in financial loss for the site owner.
- Product
- Sunshine Photo Cart
- Fixed in
- 3.7
- What to do
- Update Sunshine Photo Cart to 3.7 or newer.
Sep 9, 2026Kirki: Does not check whether the requester is allowed to read a post before rendering and returning its page contentCVE-2026-84222 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Kirki WordPress plugin before 6.3.0 does not check whether the requester is allowed to read a post before rendering and returning its page content, allowing unauthenticated users to retrieve the content of pages that are not publicly available, such as private, draft, pending and trashed ones.
- Product
- Kirki
- Fixed in
- 6.3.0
- What to do
- Update Kirki to 6.3.0 or newer.
Sep 9, 2026Quentn WP: Does not properly sanitise and escape a parameter before using it in an SQL queryCVE-2026-84113 · WordPress plugins & themes · reported by WPScanMedium 4.1
The Quentn WP WordPress plugin before 1.2.15 does not properly sanitise and escape a parameter before using it in an SQL query, allowing high privilege users such as administrators to perform SQL injection attacks.
- Product
- Quentn WP
- Fixed in
- 1.2.15
- What to do
- Update Quentn WP to 1.2.15 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.