Updated 4 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

585new WordPress flaws this week

391,310entries in the database

6,676 results · page 3 of 134

Oct 28, 2026Page Builder by SiteOrigin: Does not sanitize or escape a widget property before storing it and outputting it in the page builder interfaceCVE-2026-110506 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Page Builder by SiteOrigin WordPress plugin before 2.38.0 does not sanitize or escape a widget property before storing it and outputting it in the page builder interface, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks against higher-privileged users who open the affected post in the editor.
Product
Page Builder by SiteOrigin
Fixed in
2.38.0
What to do
Update Page Builder by SiteOrigin to 2.38.0 or newer.
Full record and what to do →NVD record wpscan.com
Oct 28, 2026PayPlug for WooCommerce (Official): Does not verify that the requester owns the WooCommerce order named in a payment requestCVE-2026-110292 · WordPress plugins & themes · reported by WPScanMedium 6.5
The PayPlug for WooCommerce (Official) WordPress plugin before 3.1.1 does not verify that the requester owns the WooCommerce order named in a payment request, allowing unauthenticated users to disclose another customer's order key and cancel their unpaid guest order.
Product
PayPlug for WooCommerce (Official)
Fixed in
3.1.1
What to do
Update PayPlug for WooCommerce (Official) to 3.1.1 or newer.
Full record and what to do →NVD record wpscan.com
Oct 28, 2026Customer Email Verification for WooCommerce: Authentication BypassCVE-2026-109236 · WordPress plugins & themes · reported by WordfenceMedium 4.8
The Customer Email Verification for WooCommerce plugin for WordPress is vulnerable to Authentication Bypass via a Predictable Email-Verification Token in all versions up to, and including, 2.8.2. This is due to the `authenticate_user_by_email_link()` function — hooked on the `wp` action and triggered by the `cusomer_email_verify` GET parameter — lacking any capability check or nonce verification, while the `secret_code` it validates is generated as `md5(email . time())` and the `verify_otp_nonce` required to trigger token issuance via the `wp_ajax_nopriv_resend_otp` handler is emitted to every front-end visitor through `wp_localize_script`. This makes it possible for unauthenticated attackers to log in as a newly created, verified WooCommerce customer bound to an arbitrary email address — or to flip an existing account's `customer_email_verified` meta to verified — fully bypassing the plugin's core email-verification control. Exploitation requires the `cev_user_log` table to contain a `password` column, which is absent from the fresh-install schema shipped in version 2.8.2 but is present on sites upgraded from an older version where that column was defined.
Product
Customer Email Verification for WooCommerce
Affected
up to 2.8.2
What to do
Affects up to 2.8.2. Update Customer Email Verification for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 28, 2026Royal Addons for Elementor: Does not perform any authorization check before using the site owner's stored Mailchimp credential to add subscriber records to an audience chosen by the requestCVE-2026-107097 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Royal Addons for Elementor WordPress plugin before 1.7.1070 does not perform any authorization check before using the site owner's stored Mailchimp credential to add subscriber records to an audience chosen by the request, allowing unauthenticated attackers to inject arbitrary email addresses and contact details into the site owner's Mailchimp account as confirmed subscribers.
Product
Royal Addons for Elementor
Fixed in
1.7.1070
What to do
Update Royal Addons for Elementor to 1.7.1070 or newer.
Full record and what to do →NVD record wpscan.com
Oct 28, 2026Court Reservation: Does not perform any authorisation or nonce verification on one of its challenge-management actionsCVE-2026-106002 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Court Reservation WordPress plugin before 1.12.4 does not perform any authorisation or nonce verification on one of its challenge-management actions, allowing unauthenticated users to delete arbitrary tournament-ladder challenge records, along with the linked court-booking event when one was scheduled.
Product
Court Reservation
Fixed in
1.12.4
What to do
Update Court Reservation to 1.12.4 or newer.
Full record and what to do →NVD record wpscan.com
Oct 28, 2026Menu Cart for WooCommerce: Does not sanitise and escape cart item variation data before outputting it in its cart slide-outCVE-2026-105972 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Menu Cart for WooCommerce WordPress plugin before 3.2.1 does not sanitise and escape cart item variation data before outputting it in its cart slide-out, allowing unauthenticated users to store a Cross-Site Scripting payload that can be delivered to and executed in the session of another user, including a logged-in administrator.
Product
Menu Cart for WooCommerce
Fixed in
3.2.1
What to do
Update Menu Cart for WooCommerce to 3.2.1 or newer.
Full record and what to do →NVD record wpscan.com
Oct 28, 2026Checkout Files Upload for WooCommerce: Does not validate uploaded file typesCVE-2026-103688 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Checkout Files Upload for WooCommerce WordPress plugin before 2.4.0 does not validate uploaded file types when its accepted file types setting is left empty, which it documents as the way to accept all files, allowing unauthenticated users to upload arbitrary files, including PHP files that lead to remote code execution on servers that execute PHP from the uploads directory.
Product
Checkout Files Upload for WooCommerce
Fixed in
2.4.0
What to do
Update Checkout Files Upload for WooCommerce to 2.4.0 or newer.
Full record and what to do →NVD record wpscan.com
Oct 28, 2026UniPAY Payment Gateway For WooCommerce: Does not properly verify the authenticity of payment notificationsCVE-2026-103331 · WordPress plugins & themes · reported by WPScanMedium 5.3
The UniPAY Payment Gateway For WooCommerce WordPress plugin through 2.3 does not properly verify the authenticity of payment notifications, as their signature is checked against a merchant secret that is empty by default, allowing unauthenticated attackers to forge a valid notification and mark arbitrary orders as paid.
Product
UniPAY Payment Gateway For WooCommerce
Affected
up to 2.3
What to do
Affects up to 2.3. Update UniPAY Payment Gateway For WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Oct 27, 2026AMP for WP – Accelerated Mobile Pages: Stored Cross-Site ScriptingCVE-2026-97019 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'headline-*' Shortcode Attribute in all versions up to, and including, 1.1.17 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. A Subscriber-level user can store a malicious shortcode in their biographical info field; because WordPress core's wp_filter_kses() only strips HTML tags and not shortcode syntax, and because AMP content sanitizers run before do_shortcode() processes the archive description, the synthesized markup is never post-sanitized.
Product
AMP for WP – Accelerated Mobile Pages
Affected
up to 1.1.17
What to do
Affects up to 1.1.17. Update AMP for WP – Accelerated Mobile Pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 27, 2026Advanced Custom Fields: Extended: Authorization bypassCVE-2026-10752 · WordPress plugins & themes · reported by WordfenceMedium 4.8
The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 0.9.2.6. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to permanently delete arbitrary WordPress media library attachments by supplying a numeric attachment ID in the form submission without any ownership or capability verification. Exploitation requires a site administrator to have configured a public-facing ACFE form with an Email action whose attachment row uses a dynamic {field:...} source bound to a submittable field with the Delete option enabled.
Product
Advanced Custom Fields: Extended
Affected
up to 0.9.2.6
What to do
Affects up to 0.9.2.6. Update Advanced Custom Fields: Extended to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 27, 2026Advanced Views – Display Framework for Gutenberg & Elementor: Stored Cross-Site ScriptingCVE-2026-109995 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Advanced Views – Display Framework for Gutenberg & Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 3.9.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability is exploitable even against pending or unapproved comments, as the plugin's get_comment() lookup applies no approval-status filter, meaning a payload executes for any visitor loading an avf-layout block bound to the attacker's comment ID before the comment is ever reviewed.
Product
Advanced Views – Display Framework for Gutenberg & Elementor
Affected
up to 3.9.6
What to do
Affects up to 3.9.6. Update Advanced Views – Display Framework for Gutenberg & Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 27, 2026PayDunya WooCommerce Payment Gateway: Does not verify the authenticity of incoming payment notifications andCVE-2026-103359 · WordPress plugins & themes · reported by WPScanMedium 5.3
The PayDunya WooCommerce Payment Gateway WordPress plugin through 1.1.6 does not verify the authenticity of incoming payment notifications and, until the gateway is configured, authenticates them with a value derived from an empty secret that anyone can compute, allowing unauthenticated attackers to mark arbitrary WooCommerce orders as paid and completed.
Product
PayDunya WooCommerce Payment Gateway
Affected
up to 1.1.6
What to do
Affects up to 1.1.6. Update PayDunya WooCommerce Payment Gateway to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Oct 27, 2026TiendaCrypto para WooCommerce: Does not correctly verify the authenticity of its payment webhookCVE-2026-103325 · WordPress plugins & themes · reported by WPScanLow 3.7
The TiendaCrypto para WooCommerce WordPress plugin through 1.2.1 does not correctly verify the authenticity of its payment webhook, validating the request signature against a key that is always empty, which allows unauthenticated attackers to forge webhook notifications and mark arbitrary WooCommerce orders as paid on web servers that preserve request header case.
Product
TiendaCrypto para WooCommerce
Affected
up to 1.2.1
What to do
Affects up to 1.2.1. Update TiendaCrypto para WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Oct 27, 2026Payex Payment Gateway for Woocommerce: Does not properly verify the authenticity of incoming payment notificationsCVE-2026-103332 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Payex Payment Gateway for Woocommerce WordPress plugin through 1.2.10 does not properly verify the authenticity of incoming payment notifications, relying on a validation secret that is empty by default, allowing unauthenticated attackers to forge a valid payment confirmation and mark any order as paid.
Product
Payex Payment Gateway for Woocommerce
Affected
up to 1.2.10
What to do
Affects up to 1.2.10. Update Payex Payment Gateway for Woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Oct 26, 2026Customer Coupons for WooCommerce: Missing AuthorizationCVE-2026-112839 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in VillaTheme Customer Coupons for WooCommerce woo-customer-coupons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Customer Coupons for WooCommerce: from n/a through 1.3.14.
Product
Customer Coupons for WooCommerce
Affected
up to 1.3.14
What to do
Affects up to 1.3.14. Update Customer Coupons for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 26, 2026Photo Reviews for WooCommerce: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')CVE-2026-111404 · WordPress plugins & themes · reported by PatchstackLow 3.7
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in VillaTheme Photo Reviews for WooCommerce woo-photo-reviews allows Leveraging Race Conditions.This issue affects Photo Reviews for WooCommerce: from n/a through 1.2.31.
Product
Photo Reviews for WooCommerce
Affected
up to 1.2.31
What to do
Affects up to 1.2.31. Update Photo Reviews for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 26, 2026Easy Digital Downloads: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')CVE-2026-116403 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Awesomemotive Easy Digital Downloads easy-digital-downloads allows Leveraging Race Conditions.This issue affects Easy Digital Downloads: from n/a through 3.7.1.
Product
Easy Digital Downloads
Affected
up to 3.7.1
What to do
Affects up to 3.7.1. Update Easy Digital Downloads to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 26, 2026APIExperts Square for WooCommerce: Missing AuthorizationCVE-2026-115960 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WPExperts APIExperts Square for WooCommerce woosquare allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects APIExperts Square for WooCommerce: from n/a through 4.7.5.
Product
APIExperts Square for WooCommerce
Affected
up to 4.7.5
What to do
Affects up to 4.7.5. Update APIExperts Square for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 26, 2026APIExperts Square for WooCommerce: Missing AuthorizationCVE-2026-115959 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WPExperts APIExperts Square for WooCommerce woosquare allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects APIExperts Square for WooCommerce: from n/a through 4.7.5.
Product
APIExperts Square for WooCommerce
Affected
up to 4.7.5
What to do
Affects up to 4.7.5. Update APIExperts Square for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 26, 2026Advanced Post Block - Post Grid for WordPress block editor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-115955 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Advanced Post Block - Post Grid for WordPress block editor advanced-post-block allows Stored XSS.This issue affects Advanced Post Block - Post Grid for WordPress block editor: from n/a through 2.5.1.
Product
Advanced Post Block - Post Grid for WordPress block editor
Affected
up to 2.5.1
What to do
Affects up to 2.5.1. Update Advanced Post Block - Post Grid for WordPress block editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 26, 2026Gutenberg Blocks by Kadence Blocks: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-115602 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / StellarWP Gutenberg Blocks by Kadence Blocks kadence-blocks allows Stored XSS.This issue affects Gutenberg Blocks by Kadence Blocks: from n/a through 3.8.0.1.
Product
Gutenberg Blocks by Kadence Blocks
Affected
up to 3.8.0.1
What to do
Affects up to 3.8.0.1. Update Gutenberg Blocks by Kadence Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 26, 2026Bopo – WooCommerce Product Bundle Builder: Missing AuthorizationCVE-2026-110377 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in VillaTheme Bopo – WooCommerce Product Bundle Builder bopo-woo-product-bundle-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Bopo – WooCommerce Product Bundle Builder: from n/a through 1.2.3.
Product
Bopo – WooCommerce Product Bundle Builder
Affected
up to 1.2.3
What to do
Affects up to 1.2.3. Update Bopo – WooCommerce Product Bundle Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 26, 2026GiveWP: Does not restrict the currency of a donation to the one the site or form acceptsCVE-2026-111974 · WordPress plugins & themes · reported by WPScanMedium 5.3
The GiveWP WordPress plugin before 4.19.0.1 does not restrict the currency of a donation to the one the site or form accepts, while comparing its amount limits as bare numbers, allowing unauthenticated users to make donations below a form's configured minimum or fixed amount.
Product
GiveWP
Fixed in
4.19.0.1
What to do
Update GiveWP to 4.19.0.1 or newer.
Full record and what to do →NVD record wpscan.com
Oct 26, 2026Mintpay for WooCommerce: Does not verify the authenticity of the payment callback it processesCVE-2026-103381 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Mintpay for WooCommerce WordPress plugin through 2.2.3 does not verify the authenticity of the payment callback it processes, allowing unauthenticated attackers to mark arbitrary orders as paid, to cancel arbitrary orders, and to disclose order details including customer contact information.
Product
Mintpay for WooCommerce
Affected
up to 2.2.3
What to do
Affects up to 2.2.3. Update Mintpay for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Oct 26, 2026OPay Payment Gateway for WooCommerce: Does not properly verify that payment notifications originate from the payment providerCVE-2026-103319 · WordPress plugins & themes · reported by WPScanMedium 5.3
The OPay Payment Gateway for WooCommerce WordPress plugin through 2.5.5 does not properly verify that payment notifications originate from the payment provider, as the secret used to validate their signature is empty by default, allowing unauthenticated attackers to forge a valid notification and mark arbitrary orders as paid, cancelled or failed.
Product
OPay Payment Gateway for WooCommerce
Affected
up to 2.5.5
What to do
Affects up to 2.5.5. Update OPay Payment Gateway for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Oct 26, 2026Eurobank WooCommerce Payment Gateway: Does not verify that a payment-confirmation request genuinely originates from the payment providerCVE-2026-103300 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Eurobank WooCommerce Payment Gateway WordPress plugin through 2.1.1 does not verify that a payment-confirmation request genuinely originates from the payment provider, and ships with the secret that would authenticate it empty by default, allowing unauthenticated attackers to mark any pending order as paid, and to force any order into a failed status without any secret at all.
Product
Eurobank WooCommerce Payment Gateway
Affected
up to 2.1.1
What to do
Affects up to 2.1.1. Update Eurobank WooCommerce Payment Gateway to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Oct 26, 2026CCAvenue Payment Gateway for WooCommerce: Does not verify that a payment-confirmation request genuinely originates from the payment providerCVE-2026-103298 · WordPress plugins & themes · reported by WPScanMedium 5.3
The CCAvenue Payment Gateway for WooCommerce WordPress plugin through 3.1 does not verify that a payment-confirmation request genuinely originates from the payment provider, and derives its verification key from a value that is empty on a default install, allowing unauthenticated attackers to forge a confirmation and mark any WooCommerce order as paid without payment.
Product
CCAvenue Payment Gateway for WooCommerce
Affected
up to 3.1
What to do
Affects up to 3.1. Update CCAvenue Payment Gateway for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Oct 25, 2026Chikkili- Google Pay India for Woocommerce: Does not verify that a payment notification actually originated from the payment provider before marking the associated orderCVE-2026-94295 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Chikkili- Google Pay India for Woocommerce WordPress plugin through 1.0.6 does not verify that a payment notification actually originated from the payment provider before marking the associated order as paid, allowing unauthenticated attackers to mark arbitrary orders as paid without any payment being made.
Product
Chikkili- Google Pay India for Woocommerce
Affected
up to 1.0.6
What to do
Affects up to 1.0.6. Update Chikkili- Google Pay India for Woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Oct 24, 2026UPI QR Code Payment Gateway for WooCommerce: Missing AuthorizationCVE-2026-114191 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in Knit Pay UPI QR Code Payment Gateway for WooCommerce upi-qr-code-payment-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects UPI QR Code Payment Gateway for WooCommerce: from n/a through 1.6.3.
Product
UPI QR Code Payment Gateway for WooCommerce
Affected
up to 1.6.3
What to do
Affects up to 1.6.3. Update UPI QR Code Payment Gateway for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 24, 2026GeoDirectory: Does not verify that a referenced attachment belongs to the listing being savedCVE-2026-113489 · WordPress plugins & themes · reported by WPScanMedium 4.3
The GeoDirectory WordPress plugin before 2.8.194 does not verify that a referenced attachment belongs to the listing being saved, allowing users with Subscriber-level access and above to modify the title, caption, moderation status and featured flag of images belonging to other users' listings, and to claim another user's image as their own featured image.
Product
GeoDirectory
Fixed in
2.8.194
What to do
Update GeoDirectory to 2.8.194 or newer.
Full record and what to do →NVD record wpscan.com
Oct 24, 2026Advanced Twenty Seventeen: Does not perform any capability or nonce check on the action that creates and activates its bundled childCVE-2026-107887 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Advanced Twenty Seventeen WordPress plugin through 1.3.1 does not perform any capability or nonce check on the action that creates and activates its bundled child , allowing any authenticated user such as a subscriber to switch the site's active site-wide, and allowing the same action to be triggered against any logged-in user including an administrator via CSRF.
Product
Advanced Twenty Seventeen
Affected
up to 1.3.1
What to do
Affects up to 1.3.1. Update Advanced Twenty Seventeen to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Oct 24, 2026Pixel Tag Manager for WooCommerce: Does not perform a capability check in one of its AJAX actionsCVE-2026-105199 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Pixel Tag Manager for WooCommerce WordPress plugin before 2.2.3 does not perform a capability check in one of its AJAX actions, and exposes the nonce protecting it to any user able to access the admin dashboard, allowing users with a role as low as Contributor to overwrite the Pixel Tag Manager for WooCommerce WordPress plugin before 2.2.3's tracking configuration and have arbitrary JavaScript executed in the browsers of all visitors, including administrators.
Product
Pixel Tag Manager for WooCommerce
Fixed in
2.2.3
What to do
Update Pixel Tag Manager for WooCommerce to 2.2.3 or newer.
Full record and what to do →NVD record wpscan.com
Oct 23, 2026Holistic Center: Deserialization of Untrusted DataCVE-2026-112854 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in axiomthemes Holistic Center holistic-center allows Object Injection.This issue affects Holistic Center: from n/a through 1.2.6.
Product
Holistic Center
Affected
up to 1.2.6
What to do
Affects up to 1.2.6. Update Holistic Center to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 23, 2026The Advanced Custom Fields: Extended and Advanced Custom Fields: Extended PRO WordPress plugins from 0.9.2.4 to 0.9.2.7 do not consistently disable shortcode prCVE-2026-94263 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Advanced Custom Fields: Extended and Advanced Custom Fields: Extended PRO WordPress plugins from 0.9.2.4 to 0.9.2.7 do not consistently disable shortcode processing in the confirmation message of their front-end forms, allowing unauthenticated visitors to have arbitrary shortcodes executed server-side when they submit a form whose stored configuration does not carry the relevant setting.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record wpscan.com
Oct 23, 2026The Profile Builder WordPress plugin from 4.0.0 to 4.0.4 does not enforce its reCAPTCHA verification on all comment submission paths, allowing authenticated useCVE-2026-111965 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Profile Builder WordPress plugin from 4.0.0 to 4.0.4 does not enforce its reCAPTCHA verification on all comment submission paths, allowing authenticated users to bypass the anti-spam protection an administrator configured for the WordPress comment form.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record wpscan.com
Oct 23, 2026Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO: Does not resolve the target of the update-user action in its front-end Forms module consistently between the stage tCVE-2026-94268 · WordPress plugins & themes · reported by WPScanHigh 8.1
The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not resolve the target of the update-user action in its front-end Forms module consistently between the stage that authorises the request and the stage that carries it out, which allows unauthenticated visitors to bypass the guard protecting administrator accounts, take over the site administrator's account and be issued a valid session for it. Exploitation requires the site to publish two separate front-end form configurations whose targets are mapped to visitor-submitted values.
Product
Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO
Fixed in
0.9.2.8
What to do
Update Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO to 0.9.2.8 or newer.
Full record and what to do →NVD record wpscan.com
Oct 23, 2026Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO: Does not perform any capability checkCVE-2026-94267 · WordPress plugins & themes · reported by WPScanCritical 9
The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not perform any capability check when updating a post through one of its front-end form actions, allowing unauthenticated visitors to overwrite arbitrary posts, including the ones in which the site stores its own field definitions, which in turn leads to arbitrary code execution on the server. Exploitation requires the site to publish a form whose post-update action maps both its target and its content to visitor-submitted values.
Product
Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO
Fixed in
0.9.2.8
What to do
Update Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO to 0.9.2.8 or newer.
Full record and what to do →NVD record wpscan.com
Oct 23, 2026Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO: Does not validate or escape some of its form shortcode attributesCVE-2026-94264 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not validate or escape some of its form shortcode attributes, which can be pointed at values taken from the visitor's own request and are then output without escaping, allowing users with a role as low as contributor to have arbitrary script run in the browser of anyone led to open a crafted link or page, including a logged-in administrator. This is an incomplete fix for CVE-2023-5292, whose deny-list covers only the three HTML wrapper attributes.
Product
Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO
Fixed in
0.9.2.8
What to do
Update Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO to 0.9.2.8 or newer.
Full record and what to do →NVD record wpscan.com
Oct 23, 2026Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO: Does not verify that the requester is authorised to edit the targeted user account in the update-user action of its CVE-2026-94262 · WordPress plugins & themes · reported by WPScanHigh 8.1
The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not verify that the requester is authorised to edit the targeted user account in the update-user action of its front-end Forms module, performing that check only when the target account holds an administrator role, which allows unauthenticated visitors to overwrite any non-administrator account's credentials and obtain a session for that account. Exploitation requires the site to publish a form whose user-update action maps its target to a visitor-submitted value rather than to the default current user.
Product
Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO
Fixed in
0.9.2.8
What to do
Update Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO to 0.9.2.8 or newer.
Full record and what to do →NVD record wpscan.com
Oct 23, 2026LiteSpeed Cache: Does not perform a capability check on its admin-notice dismissal handlerCVE-2026-113501 · WordPress plugins & themes · reported by WPScanLow 3.1
The LiteSpeed Cache WordPress plugin before 7.9.2 does not perform a capability check on its admin-notice dismissal handler, and the nonce it relies on is not bound to the specific notice being dismissed, so on sites in certain configurations a low-privileged authenticated user (Subscriber) can dismiss administrative notices the LiteSpeed Cache WordPress plugin before 7.9.2 marks as non-dismissible, including a warning that sensitive files may be publicly accessible.
Product
LiteSpeed Cache
Fixed in
7.9.2
What to do
Update LiteSpeed Cache to 7.9.2 or newer.
Full record and what to do →NVD record wpscan.com
Oct 23, 2026Popup Builder: Does not perform authorization checks before trashing popup content in a maintenance routine that runs on unauthenticated requestsCVE-2026-112230 · WordPress plugins & themes · reported by WPScanLow 3.7
The Popup Builder WordPress plugin before 4.4.6 does not perform authorization checks before trashing popup content in a maintenance routine that runs on unauthenticated requests, allowing unauthenticated attackers to move affected popups into the Trash and overwrite their stored preview data.
Product
Popup Builder
Fixed in
4.4.6
What to do
Update Popup Builder to 4.4.6 or newer.
Full record and what to do →NVD record wpscan.com
Oct 23, 2026Otter Blocks: Does not enforce its block visibility conditionsCVE-2026-109935 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Otter Blocks WordPress plugin before 3.2.8 does not enforce its block visibility conditions when a published post is rendered through the WordPress REST API, allowing unauthenticated users to read block content that the site owner restricted to specific roles, logged-in users, the post author, categories or tags, or (on the Pro tier) Stripe purchasers.
Product
Otter Blocks
Fixed in
3.2.8
What to do
Update Otter Blocks to 3.2.8 or newer.
Full record and what to do →NVD record wpscan.com
Oct 23, 2026Music Store – WordPress eCommerce: Directory TraversalCVE-2026-115497 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Music Store – WordPress eCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.4.7 via the 'f' parameter parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. Exploitation requires a valid purchase_id token, which any user can obtain by making a single low-cost purchase or receiving a shared download link.
Product
Music Store – WordPress eCommerce
Affected
up to 1.4.7
What to do
Affects up to 1.4.7. Update Music Store – WordPress eCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 22, 2026Waitlist Woocommerce ( Back in stock notifier ): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-114701 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in xootix Waitlist Woocommerce ( Back in stock notifier ) waitlist-woocommerce allows Stored XSS.This issue affects Waitlist Woocommerce ( Back in stock notifier ): from n/a through 2.9.1.
Product
Waitlist Woocommerce ( Back in stock notifier )
Affected
up to 2.9.1
What to do
Affects up to 2.9.1. Update Waitlist Woocommerce ( Back in stock notifier ) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 22, 2026ЮKassa для WooCommerce: Missing AuthorizationCVE-2026-114699 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in yoomoney ЮKassa для WooCommerce yookassa allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ЮKassa для WooCommerce: from n/a through 2.17.3.
Product
ЮKassa для WooCommerce
Affected
up to 2.17.3
What to do
Affects up to 2.17.3. Update ЮKassa для WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 22, 2026ShopMagic: Insertion of Sensitive Information into Externally-Accessible File or DirectoryCVE-2026-114195 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Insertion of Sensitive Information into Externally-Accessible File or Directory vulnerability in WP Desk ShopMagic shopmagic-for-woocommerce allows Retrieve Embedded Sensitive Data.This issue affects ShopMagic: from n/a through 4.9.1.
Product
ShopMagic
Affected
up to 4.9.1
What to do
Affects up to 4.9.1. Update ShopMagic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 22, 2026Infility Global: Does not perform any authorisation or nonce check on an AJAX action available to unauthenticated usersCVE-2026-109931 · WordPress plugins & themes · reported by WPScanLow 3.7
The Infility Global WordPress plugin before 2.16.25 does not perform any authorisation or nonce check on an AJAX action available to unauthenticated users, allowing any visitor to overwrite a machine-translation configuration value belonging to a companion Infility Global WordPress plugin before 2.16.25.
Product
Infility Global
Fixed in
2.16.25
What to do
Update Infility Global to 2.16.25 or newer.
Full record and what to do →NVD record wpscan.com
Oct 22, 2026FluentCart A New Era of eCommerce: Does not verify that a stored customer address selected during checkout belongs to the requesterCVE-2026-100142 · WordPress plugins & themes · reported by WPScanMedium 5.3
The FluentCart A New Era of eCommerce WordPress plugin before 2.2.0 does not verify that a stored customer address selected during checkout belongs to the requester, allowing unauthenticated attackers to attach any customer's stored address to an order they place and read it back, disclosing customers' postal addresses, phone numbers and company details.
Product
FluentCart A New Era of eCommerce
Fixed in
2.2.0
What to do
Update FluentCart A New Era of eCommerce to 2.2.0 or newer.
Full record and what to do →NVD record wpscan.com
Oct 21, 2026BjornTech Swish for WooCommerce: Missing AuthorizationCVE-2026-111835 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in bjorntech BjornTech Swish for WooCommerce woo-swish-e-commerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BjornTech Swish for WooCommerce: from n/a through 3.7.8.
Product
BjornTech Swish for WooCommerce
Affected
up to 3.7.8
What to do
Affects up to 3.7.8. Update BjornTech Swish for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 21, 2026Jane Menu: Does not have any capability or nonce checks on one of its form handlersCVE-2026-85683 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Jane Menu WordPress plugin before 1.5.1 does not have any capability or nonce checks on one of its form handlers, which is reachable by unauthenticated users, allowing them to bind any published page to a remote document of their choosing. The plugin then fetches that document and outputs its head and body into the page without escaping, so an unauthenticated attacker can run arbitrary JavaScript in the browser of any visitor to that page, including an administrator.
Product
Jane Menu
Fixed in
1.5.1
What to do
Update Jane Menu to 1.5.1 or newer.
Full record and what to do →NVD record wpscan.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.