Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
5,534 results · page 3 of 111
Nov 4, 2026FV Flowplayer Video Player: Does not properly verify record ownership before modifying or deleting stored video and meta recordsCVE-2026-108067 · WordPress plugins & themes · reported by WPScanLow 3.8
The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not properly verify record ownership before modifying or deleting stored video and meta records, allowing authenticated users with Contributor-level access and above to modify or delete arbitrary records belonging to other users, and to disclose the associated meta data in the response.
- Product
- FV Flowplayer Video Player
- Fixed in
- 7.5.56.7212
- What to do
- Update FV Flowplayer Video Player to 7.5.56.7212 or newer.
Nov 4, 2026SEOPress: Does not sanitise and escape some of its analytics tracking settings before outputting them in an inline script printed on every front-end pageCVE-2026-108041 · WordPress plugins & themes · reported by WPScanHigh 7.1
The SEOPress WordPress plugin before 10.4 does not sanitise and escape some of its analytics tracking settings before outputting them in an inline script printed on every front-end page, allowing users granted a SEOPress WordPress plugin before 10.4 capability that an administrator can delegate to lower-privileged roles to perform Stored Cross-Site Scripting attacks that execute in the browser of any site visitor, including a logged-in administrator viewing the front end.
- Product
- SEOPress
- Fixed in
- 10.4
- What to do
- Update SEOPress to 10.4 or newer.
Nov 4, 2026Kali Forms — Contact Form & Drag-and-Drop Builder: Does not prevent users with author-level access and above from storing arbitrary JavaScript in a form button configurationCVE-2026-106649 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.29 does not prevent users with author-level access and above from storing arbitrary JavaScript in a form button configuration, which is later output into a JavaScript execution context and runs in the browser session of any user who clicks the button, including an administrator.
- Product
- Kali Forms — Contact Form & Drag-and-Drop Builder
- Fixed in
- 2.4.29
- What to do
- Update Kali Forms — Contact Form & Drag-and-Drop Builder to 2.4.29 or newer.
Nov 4, 2026Booking Package: Does not require payment to be completed before saving a booking on calendars configured to require online paymentCVE-2026-106000 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Booking Package WordPress plugin before 1.7.34 does not require payment to be completed before saving a booking on calendars configured to require online payment, allowing unauthenticated users to create confirmed bookings without paying.
- Product
- Booking Package
- Fixed in
- 1.7.34
- What to do
- Update Booking Package to 1.7.34 or newer.
Nov 4, 2026Form Maker by 10Web: Does not consistently escape user-submitted field values before rendering them on its submissions admin pageCVE-2026-105413 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Form Maker by 10Web WordPress plugin before 1.15.51 does not consistently escape user-submitted field values before rendering them on its submissions admin page, allowing unauthenticated users to store a payload that executes as arbitrary web scripts in the session of an administrator who views the submissions.
- Product
- Form Maker by 10Web
- Fixed in
- 1.15.51
- What to do
- Update Form Maker by 10Web to 1.15.51 or newer.
Nov 4, 2026ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce: Does not perform a capability check on an AJAX action that returns the stored before-and-after values of a record changeCVE-2026-105191 · WordPress plugins & themes · reported by WPScanMedium 4.3
The ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce WordPress plugin before 1.17.11 does not perform a capability check on an AJAX action that returns the stored before-and-after values of a record change, allowing any authenticated user, including Subscribers, to read other users' sensitive HR, CRM and Accounting data by enumerating record identifiers.
- Product
- ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce
- Fixed in
- 1.17.11
- What to do
- Update ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce to 1.17.11 or newer.
Nov 4, 2026CookieYes: Does not correctly restrict who can write its cookie-category script fieldsCVE-2026-104719 · WordPress plugins & themes · reported by WPScanMedium 6.4
The CookieYes WordPress plugin before 3.5.8 does not correctly restrict who can write its cookie-category script fields, and does not sanitize or escape them, allowing users with the Contributor role to store JavaScript that executes in the browsers of site visitors and of an administrator reviewing the content.
- Product
- CookieYes
- Fixed in
- 3.5.8
- What to do
- Update CookieYes to 3.5.8 or newer.
Nov 4, 2026Mollie Payments for WooCommerce: Does not verify a product's publication status before creating an order for it through its PayPal express-checkout endpointCVE-2026-101166 · WordPress plugins & themes · reported by WPScanLow 3.7
The Mollie Payments for WooCommerce WordPress plugin before 8.2.0 does not verify a product's publication status before creating an order for it through its PayPal express-checkout endpoint, allowing unauthenticated users to order draft or unpublished products.
- Product
- Mollie Payments for WooCommerce
- Fixed in
- 8.2.0
- What to do
- Update Mollie Payments for WooCommerce to 8.2.0 or newer.
Nov 4, 2026Mollie Payments for WooCommerce: Does not verify an order's payment state or the requested payment gateway before removing a configured payment-surcharge feeCVE-2026-101165 · WordPress plugins & themes · reported by WPScanLow 3.7
The Mollie Payments for WooCommerce WordPress plugin before 8.2.0 does not verify an order's payment state or the requested payment gateway before removing a configured payment-surcharge fee, allowing unauthenticated users to reduce an order's total before completing payment.
- Product
- Mollie Payments for WooCommerce
- Fixed in
- 8.2.0
- What to do
- Update Mollie Payments for WooCommerce to 8.2.0 or newer.
Nov 3, 2026The Eupago Gateway For Woocommerce WordPress plugin from 4.5.0 through 4.7.5 does not verify the authenticity of incoming payment-confirmation webhook requests CVE-2026-91075 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Eupago Gateway For Woocommerce WordPress plugin from 4.5.0 through 4.7.5 does not verify the authenticity of incoming payment-confirmation webhook requests in some configurations, allowing unauthenticated attackers to forge a payment confirmation and mark a pending order as paid without paying for it.
- Affected
- up to 4.7.5
- What to do
- Affects up to 4.7.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 3, 2026The CryptoCloud WordPress plugin from 3.0.0 through 3.0.1 does not verify the authenticity of the payment notifications received by its gateway callback, as theCVE-2026-103327 · WordPress plugins & themes · reported by WPScanMedium 5.3
The CryptoCloud WordPress plugin from 3.0.0 through 3.0.1 does not verify the authenticity of the payment notifications received by its gateway callback, as the integrity check is skipped while the webhook secret is left at its empty default, allowing unauthenticated attackers to mark arbitrary orders as paid or failed without any payment being made.
- Affected
- up to 3.0.1
- What to do
- Affects up to 3.0.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 3, 2026AZEXO Store Locator: Does not have a capability check or any authorization controlCVE-2026-115205 · WordPress plugins & themes · reported by WPScanMedium 6.5
The AZEXO Store Locator WordPress plugin through 1.4 does not have a capability check or any authorization control when deleting a post, allowing any authenticated user, such as a subscriber, to delete arbitrary posts and pages.
- Product
- AZEXO Store Locator
- Affected
- up to 1.4
- What to do
- Affects up to 1.4. Update AZEXO Store Locator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 3, 2026DT LMS: Does not perform capability or nonce checks on one of its AJAX actionsCVE-2026-106004 · WordPress plugins & themes · reported by WPScanMedium 5.3
The DT LMS WordPress plugin through 1.2 does not perform capability or nonce checks on one of its AJAX actions, allowing unauthenticated attackers to revoke any learner's course and class completion status.
- Product
- DT LMS
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update DT LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 3, 2026DT Directory Lite Addon: Does not perform nonce or capability checks on its settings handlersCVE-2026-105993 · WordPress plugins & themes · reported by WPScanMedium 5.3
The DT Directory Lite Addon WordPress plugin through 1.1 does not perform nonce or capability checks on its settings handlers, allowing unauthenticated attackers to modify the DT Directory Lite Addon WordPress plugin through 1.1's configuration and skin options.
- Product
- DT Directory Lite Addon
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update DT Directory Lite Addon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 3, 2026Gallery for Social Photo: Does not validate a user-supplied URL before using it to perform a server-side requestCVE-2026-105967 · WordPress plugins & themes · reported by WPScanMedium 5.8
The Gallery for Social Photo WordPress plugin through 1.0.0.41 does not validate a user-supplied URL before using it to perform a server-side request, allowing unauthenticated attackers to make the server issue requests to arbitrary internal hosts and read the responses.
- Product
- Gallery for Social Photo
- Affected
- up to 1.0.0.41
- What to do
- Affects up to 1.0.0.41. Update Gallery for Social Photo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 3, 2026weMail: Does not restrict a site-wide third-party email-service API key to administratorsCVE-2026-104648 · WordPress plugins & themes · reported by WPScanMedium 4.9
The weMail WordPress plugin through 2.1.6 does not restrict a site-wide third-party email-service API key to administrators, exposing it in an admin screen that users with the Editor role can reach by default, which allows them to obtain a reusable credential usable without a WordPress session to impersonate other users and sever the site's email-service connection.
- Product
- weMail
- Affected
- up to 2.1.6
- What to do
- Affects up to 2.1.6. Update weMail to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 3, 2026weMail: Does not correctly verify user capabilities in its REST API permission checksCVE-2026-104647 · WordPress plugins & themes · reported by WPScanLow 3.8
The weMail WordPress plugin through 2.1.6 does not correctly verify user capabilities in its REST API permission checks, treating any user whose role is in the weMail WordPress plugin through 2.1.6's allowed-roles list (Editor and above by default) as authorised for every action, which allows such users to perform administrator-level actions including enumerating all registered users with their email addresses and modifying the weMail WordPress plugin through 2.1.6's own access-control configuration.
- Product
- weMail
- Affected
- up to 2.1.6
- What to do
- Affects up to 2.1.6. Update weMail to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 3, 2026WATI Chat and Notification: Does not require a validCVE-2026-103379 · WordPress plugins & themes · reported by WPScanMedium 5.3
The WATI Chat and Notification WordPress plugin through 1.1.8 does not require a valid, non-empty secret on a public endpoint that returns its stored API token, which an unauthenticated attacker can then present to a second public endpoint to obtain the order-received URL of any WooCommerce order and read the customer's name, address, phone number and email address. The endpoints are reachable in the WATI Chat and Notification WordPress plugin through 1.1.8's default state and are closed only once a WATI account is connected.
- Product
- WATI Chat and Notification
- Affected
- up to 1.1.8
- What to do
- Affects up to 1.1.8. Update WATI Chat and Notification to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 2, 2026The PayHere Payment Gateway WordPress plugin from 2.4.0 through 2.4.5 does not verify the authenticity of payment notifications when the merchant secret is unseCVE-2026-103310 · WordPress plugins & themes · reported by WPScanMedium 5.3
The PayHere Payment Gateway WordPress plugin from 2.4.0 through 2.4.5 does not verify the authenticity of payment notifications when the merchant secret is unset, which is the default state, allowing unauthenticated attackers to forge a payment confirmation and mark any order as paid without payment.
- Affected
- up to 2.4.5
- What to do
- Affects up to 2.4.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2026MapPress: Does not restrictCVE-2026-118168 · WordPress plugins & themes · reported by WPScanMedium 5.3
The MapPress WordPress plugin before 2.97.15 does not restrict which user's data its front-end map embed handler renders, allowing unauthenticated visitors to retrieve the email address and display name of any user on the site by enumerating user IDs.
- Product
- MapPress
- Fixed in
- 2.97.15
- What to do
- Update MapPress to 2.97.15 or newer.
Nov 1, 2026Media Library Assistant: Does not escape one of its shortcode attributes before outputting it in an attribute of generated linksCVE-2026-113482 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Media Library Assistant WordPress plugin before 3.44 does not escape one of its shortcode attributes before outputting it in an attribute of generated links, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Media Library Assistant
- Fixed in
- 3.44
- What to do
- Update Media Library Assistant to 3.44 or newer.
Nov 1, 2026Media Library Assistant: Does not check that the requesting user is allowed to view a post before disclosingCVE-2026-113481 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Media Library Assistant WordPress plugin before 3.44 does not check that the requesting user is allowed to view a post before disclosing which taxonomy terms are assigned to it, allowing any authenticated user, such as a subscriber, to learn the term assignments of private attachments and posts.
- Product
- Media Library Assistant
- Fixed in
- 3.44
- What to do
- Update Media Library Assistant to 3.44 or newer.
Nov 1, 2026Kali Forms — Contact Form & Drag-and-Drop Builder: Does not perform a capability check on its test-email handlerCVE-2026-107343 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.30 does not perform a capability check on its test-email handler, relying only on a nonce that is available to any logged-in user, so a low-privileged user such as a Subscriber can make the site send email to an arbitrary recipient with a spoofed sender address.
- Product
- Kali Forms — Contact Form & Drag-and-Drop Builder
- Fixed in
- 2.4.30
- What to do
- Update Kali Forms — Contact Form & Drag-and-Drop Builder to 2.4.30 or newer.
Nov 1, 2026Kali Forms — Contact Form & Drag-and-Drop Builder: Does not perform a capability checkCVE-2026-107342 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.30 does not perform a capability check when its test-email handler resolves and returns a user's email address, relying only on a nonce that is available to any logged-in user, allowing authenticated users with minimal privileges (Subscriber and above) to disclose the email address of any registered user, including administrators.
- Product
- Kali Forms — Contact Form & Drag-and-Drop Builder
- Fixed in
- 2.4.30
- What to do
- Update Kali Forms — Contact Form & Drag-and-Drop Builder to 2.4.30 or newer.
Oct 31, 2026Payable Payment Gateway for WooCommerce: Does not verify the authenticity of an incoming payment notification before marking a WooCommerce order paid or failedCVE-2026-94361 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Payable Payment Gateway for WooCommerce WordPress plugin before 1.3.1 does not verify the authenticity of an incoming payment notification before marking a WooCommerce order paid or failed, allowing unauthenticated attackers to change the payment status of any order in the store regardless of the payment method it was placed with.
- Product
- Payable Payment Gateway for WooCommerce
- Fixed in
- 1.3.1
- What to do
- Update Payable Payment Gateway for WooCommerce to 1.3.1 or newer.
Oct 31, 2026Quick Event Manager: Does not verify the status or type of the requested post before returning its details through a calendar exportCVE-2026-82214 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Quick Event Manager WordPress plugin before 9.19 does not verify the status or type of the requested post before returning its details through a calendar export, allowing unauthenticated users to read the content of draft and private posts.
- Product
- Quick Event Manager
- Fixed in
- 9.19
- What to do
- Update Quick Event Manager to 9.19 or newer.
Oct 31, 2026Mapster WP Maps: Does not perform any authorization check on a REST API route that writes post dataCVE-2026-118638 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Mapster WP Maps WordPress plugin before 2.0.6 does not perform any authorization check on a REST API route that writes post data, allowing unauthenticated attackers to overwrite the title of arbitrary posts, create arbitrary published posts, and overwrite the Mapster WP Maps WordPress plugin before 2.0.6's stored settings.
- Product
- Mapster WP Maps
- Fixed in
- 2.0.6
- What to do
- Update Mapster WP Maps to 2.0.6 or newer.
Oct 31, 2026All-in-One Video Gallery: Does not check a video's publication status before rendering it on its player pageCVE-2026-118629 · WordPress plugins & themes · reported by WPScanMedium 5.3
The All-in-One Video Gallery WordPress plugin before 5.0.0 does not check a video's publication status before rendering it on its player page, allowing unauthenticated users to view the title and source URLs of private, draft, pending, scheduled and trashed videos by their ID.
- Product
- All-in-One Video Gallery
- Fixed in
- 5.0.0
- What to do
- Update All-in-One Video Gallery to 5.0.0 or newer.
Oct 31, 2026Firelight Lightbox: Does not properly escape image attribute values before processing them in the browserCVE-2026-118438 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Firelight Lightbox WordPress plugin before 2.3.24 does not properly escape image attribute values before processing them in the browser, which could allow users with contributor-level access and above to inject arbitrary web scripts that execute when another user views or previews the affected content.
- Product
- Firelight Lightbox
- Fixed in
- 2.3.24
- What to do
- Update Firelight Lightbox to 2.3.24 or newer.
Oct 31, 2026BuddyForms: Does not properly verify ownership before deleting guest-uploaded attachmentsCVE-2026-118437 · WordPress plugins & themes · reported by WPScanLow 3.7
The BuddyForms WordPress plugin before 2.10.1 does not properly verify ownership before deleting guest-uploaded attachments, allowing unauthenticated attackers to permanently delete media files uploaded by other unauthenticated visitors.
- Product
- BuddyForms
- Fixed in
- 2.10.1
- What to do
- Update BuddyForms to 2.10.1 or newer.
Oct 31, 2026Security Optimizer: Does not limit the number of two-factor authentication codes that can be submitted for a pending loginCVE-2026-118185 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Security Optimizer WordPress plugin before 1.6.9 does not limit the number of two-factor authentication codes that can be submitted for a pending login, allowing an attacker who already knows a user's password to brute force the second factor and take over the account.
- Product
- Security Optimizer
- Fixed in
- 1.6.9
- What to do
- Update Security Optimizer to 1.6.9 or newer.
Oct 31, 2026Premium Packages: Does not prevent unauthenticated visitors from overwriting the stored price of items in their shopping cartCVE-2026-118184 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Premium Packages WordPress plugin before 7.2.2 does not prevent unauthenticated visitors from overwriting the stored price of items in their shopping cart, allowing them to create orders for any product at an arbitrary total of their choosing.
- Product
- Premium Packages
- Fixed in
- 7.2.2
- What to do
- Update Premium Packages to 7.2.2 or newer.
Oct 31, 2026Bulk Media Register: Does not properly validate a user-supplied path before moving a file on the serverCVE-2026-118043 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Bulk Media Register WordPress plugin before 2.01 does not properly validate a user-supplied path before moving a file on the server, allowing users with the Author role to move or rename arbitrary files, including outside the WordPress root, which can defeat directory-level access controls and disclose protected files.
- Product
- Bulk Media Register
- Fixed in
- 2.01
- What to do
- Update Bulk Media Register to 2.01 or newer.
Oct 31, 2026Essential Addons for Elementor: Does not correctly restrict who may set the role assigned to accounts created through its registration formCVE-2026-110808 · WordPress plugins & themes · reported by WPScanMedium 4.2
The Essential Addons for Elementor WordPress plugin before 6.8.8 does not correctly restrict who may set the role assigned to accounts created through its registration form, allowing authenticated users with Author-level access and above to cause newly registered accounts, including those created by unauthenticated visitors through the public registration form, to be granted a higher role such as Editor. This is an incomplete fix of CVE-2026-5193: the role-validation control added in 6.6.0 can be circumvented by a lower-privileged user, so versions 6.6.0 through 6.8.7 remain affected even on sites that are patched against that advisory.
- Product
- Essential Addons for Elementor
- Affected
- up to 6.8.7
- Fixed in
- 6.8.8
- What to do
- Update Essential Addons for Elementor to 6.8.8 or newer.
Oct 31, 2026Payment Forms for Paystack: Does not properly restrict access to a page that displays its stored configurationCVE-2026-110042 · WordPress plugins & themes · reported by WPScanMedium 4.9
The Payment Forms for Paystack WordPress plugin before 4.0.6 does not properly restrict access to a page that displays its stored configuration, allowing users with the Contributor role and above to view secret payment-gateway API credentials, both the live and test secret keys, which grant full access to the site owner's payment account.
- Product
- Payment Forms for Paystack
- Fixed in
- 4.0.6
- What to do
- Update Payment Forms for Paystack to 4.0.6 or newer.
Oct 30, 2026The PDF Invoices & Packing Slips for WooCommerce WordPress plugin from 5.16.2 before 5.16.5 does not properly escape several customer-supplied order fields — inCVE-2026-111578 · WordPress plugins & themes · reported by WPScanHigh 7.5
The PDF Invoices & Packing Slips for WooCommerce WordPress plugin from 5.16.2 before 5.16.5 does not properly escape several customer-supplied order fields — including the billing and shipping address values and the customer order note — before they are output in generated invoice and packing-slip documents, allowing unauthenticated users placing guest orders to store a malicious script that executes when a shop administrator views the document, leading to Stored Cross-Site Scripting.
- Fixed in
- 5.16.5
- What to do
- Update the plugin to 5.16.5 or newer.
Oct 30, 2026Firelight Lightbox: Does not escape the URL of links it opens in its Classic lightbox before inserting it into the pageCVE-2026-118165 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Firelight Lightbox WordPress plugin before 2.3.23 does not escape the URL of links it opens in its Classic lightbox before inserting it into the page as HTML, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks against users who click a crafted link.
- Product
- Firelight Lightbox
- Fixed in
- 2.3.23
- What to do
- Update Firelight Lightbox to 2.3.23 or newer.
Oct 30, 2026BuddyForms: Does not verify that a user editing an existing entry is the author of the target postCVE-2026-118101 · WordPress plugins & themes · reported by WPScanMedium 5.3
The BuddyForms WordPress plugin before 2.10.1 does not verify that a user editing an existing entry is the author of the target post, allowing users who have been granted edit access to a form, as low as Subscriber, to overwrite the title, content and status of any other user's posts or pages, including those of administrators.
- Product
- BuddyForms
- Fixed in
- 2.10.1
- What to do
- Update BuddyForms to 2.10.1 or newer.
Oct 30, 2026BuddyForms: Does not check that the requester is allowed to manage a form before exporting its configurationCVE-2026-118100 · WordPress plugins & themes · reported by WPScanMedium 5.3
The BuddyForms WordPress plugin before 2.10.3 does not check that the requester is allowed to manage a form before exporting its configuration, allowing unauthenticated users to download any form's stored settings, including notification recipient email addresses and reCAPTCHA secret keys that are not shown on the public form.
- Product
- BuddyForms
- Fixed in
- 2.10.3
- What to do
- Update BuddyForms to 2.10.3 or newer.
Oct 30, 2026Fraud Prevention For WooCommerce and EDD: Does not check that a user is allowed to manage orders before letting them add an order's customer details to the store's fraud blacklistCVE-2026-118072 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Fraud Prevention For WooCommerce and EDD WordPress plugin before 2.3.6 does not check that a user is allowed to manage orders before letting them add an order's customer details to the store's fraud blacklist, which could allow users with the Subscriber role and above to prevent arbitrary legitimate customers from placing orders.
- Product
- Fraud Prevention For WooCommerce and EDD
- Fixed in
- 2.3.6
- What to do
- Update Fraud Prevention For WooCommerce and EDD to 2.3.6 or newer.
Oct 30, 2026Joinchat: Does not escape the message of its button block before outputting it in an HTML attribute on the front endCVE-2026-118071 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Joinchat WordPress plugin before 6.4.2 does not escape the message of its button block before outputting it in an HTML attribute on the front end, which could allow users with the Author role and above to perform Stored Cross-Site Scripting attacks against any visitor of the post, including administrators.
- Product
- Joinchat
- Fixed in
- 6.4.2
- What to do
- Update Joinchat to 6.4.2 or newer.
Oct 30, 2026WP Visitor Statistics (Real Time Traffic): Does not sanitize and escape a parameter before using it in a SQL statementCVE-2026-117572 · WordPress plugins & themes · reported by WPScanMedium 4.1
The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 8.8 does not sanitize and escape a parameter before using it in a SQL statement, allowing high-privilege users such as administrators to perform SQL injection attacks.
- Product
- WP Visitor Statistics (Real Time Traffic)
- Fixed in
- 8.8
- What to do
- Update WP Visitor Statistics (Real Time Traffic) to 8.8 or newer.
Oct 30, 2026WP Visitor Statistics (Real Time Traffic): Does not sanitize and escape tracking data derived from public visitor requests before storing it and outputting it in the administrative statistics dashboardCVE-2026-117571 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 8.8 does not sanitize and escape tracking data derived from public visitor requests before storing it and outputting it in the administrative statistics dashboard, allowing unauthenticated attackers to inject arbitrary web scripts that execute when a logged-in administrator views the statistics pages.
- Product
- WP Visitor Statistics (Real Time Traffic)
- Fixed in
- 8.8
- What to do
- Update WP Visitor Statistics (Real Time Traffic) to 8.8 or newer.
Oct 30, 2026User Frontend: Does not sanitise and escape some user-supplied values before reflecting them into HTML attributes in a publicly reachable AJAX responseCVE-2026-115277 · WordPress plugins & themes · reported by WPScanMedium 4.7
The User Frontend WordPress plugin before 4.3.14 does not sanitise and escape some user-supplied values before reflecting them into HTML attributes in a publicly reachable AJAX response, leading to Reflected Cross-Site Scripting. The affected action is gated by an anonymous nonce that only validates for logged-out requests, so the payload executes against logged-out visitors rather than authenticated users.
- Product
- User Frontend
- Fixed in
- 4.3.14
- What to do
- Update User Frontend to 4.3.14 or newer.
Oct 30, 2026Security Plugin, Firewall & Malware Scanner with Auto Removal: Does not restrict its File System Watcher file viewer to Super Admins or to the files it legitimately tracksCVE-2026-114444 · WordPress plugins & themes · reported by WPScanMedium 4.4
The Security Plugin, Firewall & Malware Scanner with Auto Removal WordPress plugin before 2.191 does not restrict its File System Watcher file viewer to Super Admins or to the files it legitimately tracks, allowing a non-super-admin administrator, including a subsite administrator on WordPress multisite, to read the contents of sensitive tracked files such as the main configuration file and disclose the site's authentication keys, salts and, on a standard install, database credentials.
- Product
- Security Plugin, Firewall & Malware Scanner with Auto Removal
- Fixed in
- 2.191
- What to do
- Update Security Plugin, Firewall & Malware Scanner with Auto Removal to 2.191 or newer.
Oct 30, 2026Security Plugin, Firewall & Malware Scanner with Auto Removal: Does not verify the account password before accepting an authenticator-app two-factor code at loginCVE-2026-114443 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Security Plugin, Firewall & Malware Scanner with Auto Removal WordPress plugin before 2.191 does not verify the account password before accepting an authenticator-app two-factor code at login, allowing anyone who holds a user's current authenticator code to log in as that user, including an administrator, without the password.
- Product
- Security Plugin, Firewall & Malware Scanner with Auto Removal
- Fixed in
- 2.191
- What to do
- Update Security Plugin, Firewall & Malware Scanner with Auto Removal to 2.191 or newer.
Oct 30, 2026Enable Media Replace: Does not restrict the classes allowedCVE-2026-114422 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Enable Media Replace WordPress plugin before 4.2.3 does not restrict the classes allowed when deserializing stored metadata during its media replace-and-update-links routine, allowing unauthenticated users to inject a PHP object that is instantiated when a user with upload access performs a routine media replacement, resulting in PHP Object Injection and local file inclusion of existing PHP/HTML files, which can be escalated to remote code execution where an attacker-influenced PHP or HTML file is present on the server. This is a regression of CVE-2023-4643, which was fixed in 4.1.3 and reintroduced in 4.1.4.
- Product
- Enable Media Replace
- Fixed in
- 4.2.3
- What to do
- Update Enable Media Replace to 4.2.3 or newer.
Oct 29, 2026Contact Form by Supsystic: Does not strip CR/LF characters or re-validate submitted field values before concatenating them into outgoing email headersCVE-2026-115303 · WordPress plugins & themes · reported by WPScanLow 3.7
The Contact Form by Supsystic WordPress plugin before 1.11.1 does not strip CR/LF characters or re-validate submitted field values before concatenating them into outgoing email headers when a form is configured to map a submitted field into its Reply-To, From or Cc header, allowing unauthenticated users to inject arbitrary email headers such as additional Bcc or Cc recipients into the notification email.
- Product
- Contact Form by Supsystic
- Fixed in
- 1.11.1
- What to do
- Update Contact Form by Supsystic to 1.11.1 or newer.
Oct 29, 2026vTables: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2026-89216 · WordPress plugins & themes · reported by WPScanHigh 8.6
The vTables WordPress plugin before 0.3 does not properly sanitise and escape a parameter before using it in a SQL statement, which allows unauthenticated attackers to perform SQL injection attacks and extract data from the database.
- Product
- vTables
- Fixed in
- 0.3
- What to do
- Update vTables to 0.3 or newer.
Oct 29, 2026PAYCOMET for WooCommerce: Does not verify the cryptographic signature on its payment notification endpointCVE-2026-88928 · WordPress plugins & themes · reported by WPScanMedium 6.5
The PAYCOMET for WooCommerce WordPress plugin before 5.46 does not verify the cryptographic signature on its payment notification endpoint when the request references a tokenisation operation, allowing unauthenticated attackers to overwrite the stored payment token associated with existing orders and delete saved card records.
- Product
- PAYCOMET for WooCommerce
- Fixed in
- 5.46
- What to do
- Update PAYCOMET for WooCommerce to 5.46 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.