Updated 2 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

474new WordPress flaws this week

390,714entries in the database

7,673 results · page 3 of 154

Oct 21, 2026WholesaleX: Does not protect or remove the user-import file it keeps in a publicly accessible location under a predictable nameCVE-2026-111956 · WordPress plugins & themes · reported by WPScanMedium 5.9
The WholesaleX WordPress plugin before 3.0.9 does not protect or remove the user-import file it keeps in a publicly accessible location under a predictable name, allowing unauthenticated users to download the most recently imported user data, including any account passwords and customer contact and address details it contains.
Product
WholesaleX
Fixed in
3.0.9
What to do
Update WholesaleX to 3.0.9 or newer.
Full record and what to do →NVD record wpscan.com
Oct 21, 2026WholesaleX: Does not check that a stored account confirmation code is set before comparing it with the one supplied in a requestCVE-2026-111955 · WordPress plugins & themes · reported by WPScanMedium 6.5
The WholesaleX WordPress plugin before 3.0.9 does not check that a stored account confirmation code is set before comparing it with the one supplied in a request, allowing unauthenticated users to activate pending accounts and bypass the administrator approval required before login.
Product
WholesaleX
Fixed in
3.0.9
What to do
Update WholesaleX to 3.0.9 or newer.
Full record and what to do →NVD record wpscan.com
Oct 21, 2026User Profile Builder: Does not escape the current page URL before outputting it in a JavaScript context on one of its admin pagesCVE-2026-111948 · WordPress plugins & themes · reported by WPScanHigh 7.1
The User Profile Builder WordPress plugin before 4.0.1 does not escape the current page URL before outputting it in a JavaScript context on one of its admin pages, leading to Reflected Cross-Site Scripting against high-privilege users.
Product
User Profile Builder
Fixed in
4.0.1
What to do
Update User Profile Builder to 4.0.1 or newer.
Full record and what to do →NVD record wpscan.com
Oct 21, 2026Kliken: Ads + Pixel for Meta: Does not verify that a visitor holds an order's key before outputting that order's details on the order confirmation pageCVE-2026-111596 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Kliken: Ads + Pixel for Meta WordPress plugin before 1.2.3 does not verify that a visitor holds an order's key before outputting that order's details on the order confirmation page, allowing unauthenticated users to retrieve the billing location, purchased products and totals of other customers' orders by enumerating order IDs.
Product
Kliken: Ads + Pixel for Meta
Fixed in
1.2.3
What to do
Update Kliken: Ads + Pixel for Meta to 1.2.3 or newer.
Full record and what to do →NVD record wpscan.com
Oct 21, 2026AI Engine: Does not check that the caller is allowed to edit the targeted object before updating its title and excerptCVE-2026-110982 · WordPress plugins & themes · reported by WPScanMedium 4.9
The AI Engine WordPress plugin before 3.8.6 does not check that the caller is allowed to edit the targeted object before updating its title and excerpt, allowing users with the Editor role and above to modify arbitrary posts of any type, including content they cannot otherwise edit such as navigation menus, block templates, global styles and WooCommerce coupons.
Product
AI Engine
Fixed in
3.8.6
What to do
Update AI Engine to 3.8.6 or newer.
Full record and what to do →NVD record wpscan.com
Oct 21, 2026Productive Commerce: Does not perform a capability check in one of its AJAX actions and exposes the nonce that guards it on every admin-area pageCVE-2026-109926 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Productive Commerce WordPress plugin before 1.1.49 does not perform a capability check in one of its AJAX actions and exposes the nonce that guards it on every admin-area page, allowing any authenticated user such as a subscriber to activate arbitrary Productive Commerce WordPress plugin before 1.1.49 already installed on the site.
Product
Productive Commerce
Fixed in
1.1.49
What to do
Update Productive Commerce to 1.1.49 or newer.
Full record and what to do →NVD record wpscan.com
Oct 21, 2026Moloni: Does not perform capability or nonce checks on several of its authenticated AJAX actionsCVE-2026-106932 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Moloni WordPress plugin before 5.0.14 does not perform capability or nonce checks on several of its authenticated AJAX actions, relying only on whether the site holds a stored connection to its external invoicing provider, allowing any authenticated user such as a Subscriber to generate fiscal invoices for arbitrary orders, discard arbitrary orders, and create or modify products and stock.
Product
Moloni
Fixed in
5.0.14
What to do
Update Moloni to 5.0.14 or newer.
Full record and what to do →NVD record wpscan.com
Oct 20, 2026Aspose PDF Exporter: Path traversalCVE-2015-20125 · WordPress plugins & themes · reported by VulnCheckHigh 8.7
Aspose PDF Exporter plugin for WordPress before 2.0 contains a path traversal vulnerability that allows unauthenticated attackers to download files through the unsanitized 'file' parameter passed to readfile(). Attackers can send GET requests to aspose_pdf_exporter_download.php with traversal sequences like ../../../wp-config.php to retrieve WordPress database credentials. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.
Product
Aspose PDF Exporter
Fixed in
2.0
What to do
Update Aspose PDF Exporter to 2.0 or newer.
Full record and what to do →NVD record github.com packetstorm.news
Oct 20, 2026Aspose Importer & Exporter: Path traversalCVE-2015-20124 · WordPress plugins & themes · reported by VulnCheckHigh 8.7
Aspose Importer & Exporter plugin for WordPress before 3.0 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files via the unsanitized 'file' parameter. Attackers can send GET requests to aspose_import_export_download.php with traversal sequences like ../../../wp-config.php to read database credentials. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-20.
Product
Aspose Importer & Exporter
Fixed in
3.0
What to do
Update Aspose Importer & Exporter to 3.0 or newer.
Full record and what to do →NVD record github.com packetstorm.news
Oct 20, 2026Aspose Doc Exporter: Path traversalCVE-2015-20123 · WordPress plugins & themes · reported by VulnCheckHigh 8.7
Aspose Doc Exporter plugin for WordPress before 2.0 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files by passing unsanitized paths to readfile(). Attackers can send GET requests to aspose_doc_exporter_download.php with the 'file' parameter set to values like ../../../wp-config.php to retrieve database credentials. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-23.
Product
Aspose Doc Exporter
Fixed in
2.0
What to do
Update Aspose Doc Exporter to 2.0 or newer.
Full record and what to do →NVD record github.com packetstorm.news
Oct 20, 2026Rootblox: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-111843 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CozyThemes Rootblox rootblox allows Stored XSS.This issue affects Rootblox: from n/a through 1.0.7.
Product
Rootblox
Affected
up to 1.0.7
What to do
Affects up to 1.0.7. Update Rootblox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 20, 2026Meta Box – WordPress Custom Fields Framework: Missing AuthorizationCVE-2026-109700 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in eLightUp Meta Box – WordPress Custom Fields Framework meta-box allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Meta Box – WordPress Custom Fields Framework: from n/a through 5.15.2.
Product
Meta Box – WordPress Custom Fields Framework
Affected
up to 5.15.2
What to do
Affects up to 5.15.2. Update Meta Box – WordPress Custom Fields Framework to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 20, 2026LearnPress before 4.4.10 contains a missing authorization vulnerability in the admin_course_editor, admin_quiz_editor and admin_question_editor lp-ajax actions,CVE-2026-113353 · WordPress plugins & themes · reported by VulnCheckMedium 5.3
LearnPress before 4.4.10 contains a missing authorization vulnerability in the admin_course_editor, admin_quiz_editor and admin_question_editor lp-ajax actions, allowing instructors to modify other instructors' content. Authenticated instructors can reuse their own generic editor nonce with another object's id parameter to alter courses, change quiz answers, and trash questions.
Fixed in
4.4.10
What to do
Update the plugin to 4.4.10 or newer.
Full record and what to do →NVD record github.com learnpresslms.com
Oct 20, 2026Easy Property Listings: Does not perform authorisation checks on several of its contact-management read AJAX actionsCVE-2026-96903 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Easy Property Listings WordPress plugin before 3.5.27 does not perform authorisation checks on several of its contact-management read AJAX actions, allowing any authenticated user with a role as low as subscriber to read other users' CRM contact and lead records, including their private activity notes.
Product
Easy Property Listings
Fixed in
3.5.27
What to do
Update Easy Property Listings to 3.5.27 or newer.
Full record and what to do →NVD record wpscan.com
Oct 19, 2026Sensei LMS: Contains a broken access control vulnerability in the add_new_module_term AJAX handler that allows authenticated Teacher-role attackers to assign module taxonomy terms to arbitrary courses by supplying a crafCVE-2026-112328 · WordPress plugins & themes · reported by VulnCheckMedium 5.3
The Sensei LMS WordPress plugin before 4.26.4 contains a broken access control vulnerability in the add_new_module_term AJAX handler that allows authenticated Teacher-role attackers to assign module taxonomy terms to arbitrary courses by supplying a crafted course_id, since the handler validates only a generic nonce and checks manage_options solely for slug prefixing rather than verifying course edit permissions. Attackers can reuse a nonce obtained from their own course metabox to call wp_set_object_terms against courses owned by other teachers or administrators, enabling unauthorized modification of course content they do not own.
Product
Sensei LMS
Fixed in
4.26.4
What to do
Update Sensei LMS to 4.26.4 or newer.
Full record and what to do →NVD record senseilms.com vulncheck.com
Oct 19, 2026TrueBooker: Does not have authorisation checks in some of its AJAX actionsCVE-2026-94230 · WordPress plugins & themes · reported by WPScanMedium 5.3
The TrueBooker WordPress plugin before 1.3.0 does not have authorisation checks in some of its AJAX actions, and does not validate the submitted service price server-side, allowing unauthenticated users to create bookings at a price of their choosing and to attach them to arbitrary customer accounts.
Product
TrueBooker
Fixed in
1.3.0
What to do
Update TrueBooker to 1.3.0 or newer.
Full record and what to do →NVD record wpscan.com
Oct 19, 2026ElementsReady Addons for Elementor: Does not perform authorization checks that halt execution in several of its settings-save handlersCVE-2026-91046 · WordPress plugins & themes · reported by WPScanMedium 4.3
The ElementsReady Addons for Elementor WordPress plugin through 6.7.2 does not perform authorization checks that halt execution in several of its settings-save handlers, allowing users with subscriber-level access and above to overwrite the ElementsReady Addons for Elementor WordPress plugin through 6.7.2's stored settings, including its stored API credentials and its feature and template configuration.
Product
ElementsReady Addons for Elementor
Affected
up to 6.7.2
What to do
Affects up to 6.7.2. Update ElementsReady Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Oct 18, 2026The Bootstrap Shortcodes plugin for WordPress before 3.4.6 is vulnerable to stored XSS via the id attribute of the [bs_tcontent] shortcode.CVE-2026-112111 · WordPress plugins & themes · reported by MITREMedium 5.1
The Bootstrap Shortcodes plugin for WordPress before 3.4.6 is vulnerable to stored XSS via the id attribute of the [bs_tcontent] shortcode. The bs_tcontent() shortcode handler in inc/bs_tabs.php emits the id attribute value into an unquoted HTML attribute. esc_attr() is applied, but it does not encode space characters, so a space in the supplied value terminates the attribute and any following text is parsed as additional HTML attributes, including JavaScript event handlers. This allows authenticated attackers with Contributor-level access and above to inject arbitrary web script that executes in the browser of any user who views the page and interacts with the injected element.
Product
Bootstrap Shortcodes
Fixed in
3.4.6
What to do
Update Bootstrap Shortcodes to 3.4.6 or newer.
Full record and what to do →NVD record github.com github.com
Oct 18, 2026Support Genix: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-110895 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in DevItems Support Genix support-genix-lite allows SQL Injection.This issue affects Support Genix: from n/a through 1.4.54.
Product
Support Genix
Affected
up to 1.4.54
What to do
Affects up to 1.4.54. Update Support Genix to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 17, 2026PeachPay — Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net, NMI): Does not perform any capability or ownership check before returning an order's secret key in response to an unCVE-2026-103376 · WordPress plugins & themes · reported by WPScanMedium 5.3
The PeachPay — Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net, NMI) WordPress plugin before 1.120.70 does not perform any capability or ownership check before returning an order's secret key in response to an unauthenticated request, allowing anyone to retrieve the key for any paid order and use it to view that order's customer name, email address, postal address and contents.
Product
PeachPay — Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net, NMI)
Fixed in
1.120.70
What to do
Update PeachPay — Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net, NMI) to 1.120.70 or newer.
Full record and what to do →NVD record wpscan.com
Oct 17, 2026User Registration & Membership: Arbitrary Shortcode ExecutionCVE-2026-92798 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The User Registration & Membership plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 5.2.8 This is due to insufficient input sanitization in the 'referrer_url' branch of UR_Smart_Tags::process(), where the attacker-controlled HTTP_REFERER header is only passed through sanitize_text_field() — which does not strip WordPress shortcode delimiters — before being substituted into a Content Restriction message that is subsequently executed via apply_shortcodes()/do_shortcode(). This makes it possible for unauthenticated attackers to execute arbitrary registered shortcodes on any restricted page whose message uses the supported {{referrer_url}} smart tag.
Product
User Registration & Membership
Affected
up to 5.2.8
What to do
Affects up to 5.2.8. Update User Registration & Membership to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 17, 2026Post Export Import with Media: Directory TraversalCVE-2026-110268 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The Post Export Import with Media plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.17.2 via the 'theme_slug' parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to perform actions on files outside of the originally intended directory. Exploitation requires the peiwm_enable_admin_download_buttons feature to be enabled in the plugin settings.
Product
Post Export Import with Media
Affected
up to 1.17.2
What to do
Affects up to 1.17.2. Update Post Export Import with Media to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.svn.wordpress.org plugins.trac.wordpress.org
Oct 17, 2026xSpeed Cache: AI-Powered Performance Hub with MCP, Caching & CDN: Stored Cross-Site ScriptingCVE-2026-109985 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The xSpeed Cache: AI-Powered Performance Hub with MCP, Caching & CDN plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content' parameter in all versions up to, and including, 1.4.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
xSpeed Cache: AI-Powered Performance Hub with MCP, Caching & CDN
Affected
up to 1.4.2
What to do
Affects up to 1.4.2. Update xSpeed Cache: AI-Powered Performance Hub with MCP, Caching & CDN to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 17, 2026WP Booking System – Booking Calendar: Sensitive Information ExposureCVE-2026-109368 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.1.0.3 via the 'id' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract private per-event booking descriptions and booking IDs from any calendar managed by the site.
Product
WP Booking System – Booking Calendar
Affected
up to 2.1.0.3
What to do
Affects up to 2.1.0.3. Update WP Booking System – Booking Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 16, 2026Appointment Booking Plugin – LatePoint | Calendar & Scheduling for: Sensitive Information ExposureCVE-2026-111602 · WordPress plugins & themes · reported by WordfenceLow 3.7
The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.7.4 via the 'params (customer[uuid])' parameter. This makes it possible for unauthenticated attackers to extract the first name, last name, email address, phone number, and notes of every customer record in the database by enumerating uuid prefixes via the unauthenticated steps__load_step AJAX endpoint. This vulnerability is only exploitable when the LatePoint plugin is configured with the 'Field used for authentication' setting set to 'Disable ability to login' (guest checkout mode).
Product
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for
Affected
up to 5.7.4
What to do
Affects up to 5.7.4. Update Appointment Booking Plugin – LatePoint | Calendar & Scheduling for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 16, 2026YITH PayPal Express Checkout for WooCommerce: Missing AuthorizationCVE-2026-111409 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in YITH YITH PayPal Express Checkout for WooCommerce yith-paypal-express-checkout-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YITH PayPal Express Checkout for WooCommerce: from n/a through 1.61.0.
Product
YITH PayPal Express Checkout for WooCommerce
Affected
up to 1.61.0
What to do
Affects up to 1.61.0. Update YITH PayPal Express Checkout for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 16, 2026Squeeze: Does not perform a capability check on one of its AJAX actionsCVE-2026-110029 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Squeeze WordPress plugin before 1.8.1 does not perform a capability check on one of its AJAX actions, allowing authenticated users with a role as low as Subscriber to revert any attachment to its backup copy and to permanently delete that backup and the plugin's generated WebP derivatives, regardless of ownership.
Product
Squeeze
Fixed in
1.8.1
What to do
Update Squeeze to 1.8.1 or newer.
Full record and what to do →NVD record wpscan.com
Oct 16, 2026WP User Avatar / ProfilePress: Arbitrary Shortcode ExecutionCVE-2026-104003 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The WP User Avatar / ProfilePress plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 4.17.5. This is due to the get_user_profile_structure() function assembling the front-end profile buffer — which includes raw comment excerpts inlined by author_comment_query() — and passing the entire buffer to do_shortcode() after only a narrow neutralization pass (ppress_neutralize_buffer_shortcodes) that blocks pp-custom-html and bracket fragments containing HTML delimiters but leaves any other well-formed shortcode intact. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary shortcodes (from any active plugin or theme) with attacker-chosen attributes by posting a comment whose body contains the shortcode markup; the shortcode is then executed server-side when any visitor loads the target's front-end profile Comments tab, letting the attacker reach capability-gated or data-returning shortcodes and inject raw HTML markup into a publicly viewable page.
Product
WP User Avatar / ProfilePress
Affected
up to 4.17.5
What to do
Affects up to 4.17.5. Update WP User Avatar / ProfilePress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record pastebin.com plugins.trac.wordpress.org
Oct 16, 2026FiboSearch – Ajax Search for WooCommerce: Stored Cross-Site ScriptingCVE-2026-100106 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The FiboSearch – Ajax Search for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'purchased_plan' parameter in all versions up to, and including, 1.34.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that the site owner has previously completed the standard Freemius opt-in flow; once that condition is met, any Subscriber can reach the vulnerable handler simply by loading /wp-admin/profile.php with the requisite query parameters.
Product
FiboSearch – Ajax Search for WooCommerce
Affected
up to 1.34.2
What to do
Affects up to 1.34.2. Update FiboSearch – Ajax Search for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 16, 2026WX Subscribe 微信支付付费订阅: Does not sanitise and escape a parameter before using it in a SQL statementCVE-2026-91833 · WordPress plugins & themes · reported by WPScanMedium 6.8
The WX Subscribe 微信支付付费订阅 WordPress plugin through 1.2.1 does not sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated attackers to perform SQL injection attacks on installs where the payment key has not been configured.
Product
WX Subscribe 微信支付付费订阅
Affected
up to 1.2.1
What to do
Affects up to 1.2.1. Update WX Subscribe 微信支付付费订阅 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Oct 16, 2026Product Delivery Date for WooCommerce: Does not perform a capability check before disclosing order details through its calendar view AJAX actionsCVE-2026-110191 · WordPress plugins & themes · reported by WPScanLow 2.7
The Product Delivery Date for WooCommerce WordPress plugin before 3.3.2 does not perform a capability check before disclosing order details through its calendar view AJAX actions, allowing users with a role as low as Contributor to view other customers' order information.
Product
Product Delivery Date for WooCommerce
Fixed in
3.3.2
What to do
Update Product Delivery Date for WooCommerce to 3.3.2 or newer.
Full record and what to do →NVD record wpscan.com
Oct 16, 2026MB Custom Post Types & Custom Taxonomies: Does not perform a capability check or validate a nonce on its migration actionsCVE-2026-109982 · WordPress plugins & themes · reported by WPScanMedium 4.2
The MB Custom Post Types & Custom Taxonomies WordPress plugin before 2.12.2 does not perform a capability check or validate a nonce on its migration actions, allowing any authenticated user, such as a subscriber, to trigger a one-way migration that creates published records and permanently deletes a companion MB Custom Post Types & Custom Taxonomies WordPress plugin before 2.12.2's entire post-type and taxonomy configuration.
Product
MB Custom Post Types & Custom Taxonomies
Fixed in
2.12.2
What to do
Update MB Custom Post Types & Custom Taxonomies to 2.12.2 or newer.
Full record and what to do →NVD record wpscan.com
Oct 16, 2026WP Mail Logging: Sensitive Information ExposureCVE-2026-109401 · WordPress plugins & themes · reported by WordfenceLow 2.7
The WP Mail Logging plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.17.0 via the 'email_address' parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to extract complete logged mail rows belonging to other users — including recipient addresses, message subjects, full message bodies, and any URLs contained therein — whose addresses happen to match the wildcard. Exploitation requires an administrator to process a personal-data export request for the attacker's email address via the standard WordPress privacy workflow, and the attacker's address must contain a LIKE wildcard character (such as an underscore) that matches at least one other user's address in the mail log.
Product
WP Mail Logging
Affected
up to 1.17.0
What to do
Affects up to 1.17.0. Update WP Mail Logging to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 16, 2026HUSKY – Products Filter for WooCommerce Professional: Sensitive Information ExposureCVE-2026-107646 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The HUSKY – Products Filter for WooCommerce Professional plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.5 via the 'woof_settings[woof_stat][server_options]' parameter. This makes it possible for unauthenticated attackers to extract the external MySQL host, database name, username, and plaintext password stored in woof_settings[woof_stat][server_options] from the inline woof_tm_data script object on any public frontend filter page. This is only exploitable when an administrator has enabled the Statistics extension, saved external MySQL connection credentials, and enabled Turbo Mode — all supported, documented plugin configurations.
Product
HUSKY – Products Filter for WooCommerce Professional
Affected
up to 1.4.5
What to do
Affects up to 1.4.5. Update HUSKY – Products Filter for WooCommerce Professional to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.svn.wordpress.org plugins.trac.wordpress.org
Oct 16, 2026Lightweight Cookie Notice – Cookie Banner for Cookie Consent: Sensitive Information ExposureCVE-2026-12272 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Lightweight Cookie Notice – Cookie Banner for Cookie Consent plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.19 This is due to the W3TC_DYNAMIC_SECURITY constant being hardcoded to a publicly known value. This makes it possible for unauthenticated attackers to know the W3 Total Cache mfunc security key, which when W3 Total Cache is installed may allow arbitrary PHP code injection.
Product
Lightweight Cookie Notice – Cookie Banner for Cookie Consent
Affected
up to 1.19
What to do
Affects up to 1.19. Update Lightweight Cookie Notice – Cookie Banner for Cookie Consent to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 16, 2026The NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar plugin for WordPCVE-2026-109513 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name' parameter in all versions up to, and including, 3.3.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires that an administrator has previously enabled a WordPress.org Reviews campaign and placed the notificationx-pro/notificationx dynamic block on a public page, both of which are documented, supported plugin workflows.
Affected
up to 3.3.3
What to do
Affects up to 3.3.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 16, 2026Search Regex: PHP Object Injection in version 3CVE-2026-104932 · WordPress plugins & themes · reported by WordfenceHigh 8
The Search Regex plugin for WordPress is vulnerable to PHP Object Injection in version 3.5 via deserialization of untrusted input in the replace_all function. This allows authenticated attackers, with subscriber-level access and above, to inject a PHP Object. The additional presence of a POP chain allows attackers to execute code.
Product
Search Regex
What to do
Update Search Regex to the newest version.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 16, 2026The Slim SEO – AI SEO Plugin, Lightweight, Fast & Automated: Arbitrary shortcode executionCVE-2026-104001 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The The Slim SEO – AI SEO Plugin, Lightweight, Fast & Automated plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 4.11.1 This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for authenticated attackers, with subscriber-level access and above, to execute arbitrary shortcodes. A Subscriber-level user need only save the shortcode payload to their own Biographical Info field via the REST API or wp-admin profile page; the shortcode then executes on any unauthenticated front-end request that resolves that author's description, such as requests using the ?author= query parameter when auto_redirection is disabled.
Product
The Slim SEO – AI SEO Plugin, Lightweight, Fast & Automated
Affected
up to 4.11.1
What to do
Affects up to 4.11.1. Update The Slim SEO – AI SEO Plugin, Lightweight, Fast & Automated to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Oct 16, 2026ELEX WordPress HelpDesk & Customer Ticketing System: Arbitrary File UploadCVE-2026-103768 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.3.7 via the initMailPart function. This is due to insufficient file type validation when saving IMAP email attachments. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible.
Product
ELEX WordPress HelpDesk & Customer Ticketing System
Affected
up to 3.3.7
What to do
Affects up to 3.3.7. Update ELEX WordPress HelpDesk & Customer Ticketing System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 16, 2026The Broken Link Checker: Arbitrary shortcode executionCVE-2026-96562 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The The Broken Link Checker plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.4.14.1. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. Exploitation requires that a submitted comment containing the shortcode payload in an href or src attribute is approved through the site's normal comment moderation workflow; once approved, the shortcode is executed automatically via WP-Cron without any further attacker interaction.
Product
The Broken Link Checker
Affected
up to 2.4.14.1
What to do
Affects up to 2.4.14.1. Update The Broken Link Checker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 16, 2026Nexter Extension – Security, Performance, Code Snippets & Site Toolkit: Privilege EscalationCVE-2026-111114 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Nexter Extension – Security, Performance, Code Snippets & Site Toolkit plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.7.11 The vulnerability exists because the `/?reset-view` handler in `role_switcher_to_view_admin_as()` performs no nonce or capability check when the supplied username matches the authenticated caller, and because the plugin's only cleanup mechanism — the `profile_update` hook — does not fire when WordPress performs a bulk role change via `wp-admin/users.php?action=promote`, which calls `WP_User::set_role()` directly and leaves a stale `administrator` value in the `nxtext_view_admin_original_role` user meta. This makes it possible for authenticated attackers with Subscriber-level access or above to restore the stale stored Administrator role to their own account, effectively escalating their privileges to Administrator. Exploitation requires that the attacker's account previously held the Administrator role and used the View Admin Role Switcher feature before being demoted specifically through the bulk role-change control rather than the Edit User screen, as only the bulk path bypasses the `profile_update` hook
Product
Nexter Extension – Security, Performance, Code Snippets & Site Toolkit
Affected
up to 4.7.11
What to do
Affects up to 4.7.11. Update Nexter Extension – Security, Performance, Code Snippets & Site Toolkit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 16, 2026NotificationX: Missing Authorization leading to arbitrary content injectionCVE-2026-110721 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The NotificationX plugin for WordPress is vulnerable to Missing Authorization leading to arbitrary content injection in versions up to, and including, 3.3.3 The /notificationx/v1/popup-submit REST route is registered with permission_callback => '__return_true', and the handler at PopupNotification::handle_popup_submission() accepts an attacker-controlled nx_id, loads whichever NotificationX campaign that id points to, and copies that campaign's own source into the new entry without verifying that the campaign is a Popup Notification or Exit Intent Popup (the two sources this form is intended to serve). This makes it possible for unauthenticated attackers to inject forged social-proof entries (name, title, message, email, theme) into any enabled non-popup NotificationX campaign — WP Comments, WooCommerce/EDD/Give sales, reviews, etc.
Product
NotificationX
Affected
up to 3.3.3
What to do
Affects up to 3.3.3. Update NotificationX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 16, 2026Image Hub – Free Images from Unsplash, Pixabay, Pexels, Openverse & Giphy: Sensitive Information ExposureCVE-2026-109191 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Image Hub – Free Images from Unsplash, Pixabay, Pexels, Openverse & Giphy plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.2.0 via the 'image_hub_api_keys_* (6 options)' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract the plaintext API credentials for six third-party services — Giphy, Openverse (client ID and secret), Pexels, Pixabay, and Unsplash — emitted verbatim into every admin page's HTML via wp_localize_script. The leaked page HTML also contains a valid image_hub_nonce AJAX nonce, which — combined with the absence of any capability check in the image_hub_update_settings AJAX handler — allows the same Subscriber-level attacker to overwrite all six stored API credential options via update_option().
Product
Image Hub – Free Images from Unsplash, Pixabay, Pexels, Openverse & Giphy
Affected
up to 1.2.0
What to do
Affects up to 1.2.0. Update Image Hub – Free Images from Unsplash, Pixabay, Pexels, Openverse & Giphy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 16, 2026Modula Image Gallery – Photo Grid & Video Gallery: Sensitive Information ExposureCVE-2026-107659 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Modula Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.0.11 via the 'id (post ID in /wp-json/wp/v2/modula-gallery/{id}) or none for collection route' parameter. This makes it possible for unauthenticated attackers to extract the plaintext Password Protect password and username for every published gallery from the modulaSettings REST field. The plugin's own /wp-json/modula/v2/gallery/{id}/settings endpoint correctly redacts the password for unauthenticated callers via redact_settings_for_public(), but no equivalent redaction is applied on the core /wp-json/wp/v2/modula-gallery path exposed by show_in_rest=true CPT registration.
Product
Modula Image Gallery – Photo Grid & Video Gallery
Affected
up to 3.0.11
What to do
Affects up to 3.0.11. Update Modula Image Gallery – Photo Grid & Video Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 16, 2026The Forminator Forms – Contact Form, Payment Form & Custom Form Builder: Arbitrary shortcode executionCVE-2026-103911 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.58.1. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. This is exploitable on any block-theme install via a single unauthenticated GET request to the search results page, or by submitting an anonymous comment on any post with comments enabled; no Forminator-specific content or configuration is required to trigger execution.
Product
The Forminator Forms – Contact Form, Payment Form & Custom Form Builder
Affected
up to 1.58.1
What to do
Affects up to 1.58.1. Update The Forminator Forms – Contact Form, Payment Form & Custom Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 16, 2026Forminator Forms – Contact Form, Payment Form & Custom Form Builder: Arbitrary Shortcode ExecutionCVE-2026-101335 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 1.58.1. This is due to the forminator_replace_quiz_form_data() helper invoking do_shortcode() on the fully expanded notification body once the {quiz_result} merge tag has been substituted, while the earlier-substituted {user_agent} and {refer_url} merge tags carry unauthenticated attacker-controlled bytes (the User-Agent header and the referer_url POST parameter) through sanitize_text_field()/esc_html(), neither of which strip the '[' and ']' shortcode delimiters. This makes it possible for unauthenticated attackers to execute arbitrary WordPress shortcodes registered on the site by submitting a quiz whose notification template contains {quiz_result}; the resulting impact depends on the shortcodes exposed by other installed plugins/themes and can range from arbitrary content injection to information disclosure.
Product
Forminator Forms – Contact Form, Payment Form & Custom Form Builder
Affected
up to 1.58.1
What to do
Affects up to 1.58.1. Update Forminator Forms – Contact Form, Payment Form & Custom Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 15, 2026Popup Box: Arbitrary Shortcode ExecutionCVE-2026-100159 · WordPress plugins & themes · reported by WordfenceMedium 4.8
The Popup Box plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions 6.4.1 to 6.4.2. This is due to the ays_popup_get_user_ip() function reading the client-controlled Client-IP / X-Forwarded-For / Forwarded / X-Forwarded / Forwarded-For request headers, sanitizing them only with sanitize_text_field() (which does not strip the bracket, quote, space, or '=' characters used by shortcode syntax), substituting the value into a popup body wherever the %%user_ip_address%% token appears (a raw str_replace with no escaping in Ays_Pb_Data::replace_message_variables()), and then passing the resulting body to do_shortcode() in Ays_Pb_Public::ays_autoembed() at output on the wp_footer hook. This makes it possible for unauthenticated attackers to execute arbitrary registered shortcodes with attacker-supplied attributes on the server whenever an administrator has added the %%user_ip_address%% token to a popup's Custom Content body, which can be leveraged to read arbitrary data or perform other actions exposed by shortcodes installed on the site.
Product
Popup Box
Affected
6.4.1 to 6.4.2
What to do
Affects 6.4.1 to 6.4.2. Update Popup Box to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 15, 2026Flexible Quantity – Measurement Price Calculator for WooCommerce: Missing AuthorizationCVE-2026-110364 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WP Desk Flexible Quantity – Measurement Price Calculator for WooCommerce flexible-quantity-measurement-price-calculator-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Flexible Quantity – Measurement Price Calculator for WooCommerce: from n/a through 2.3.23.
Product
Flexible Quantity – Measurement Price Calculator for WooCommerce
Affected
up to 2.3.23
What to do
Affects up to 2.3.23. Update Flexible Quantity – Measurement Price Calculator for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 15, 2026Ajax Search Lite: Missing AuthorizationCVE-2026-110360 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WPdreams Ajax Search Lite ajax-search-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ajax Search Lite: from n/a through 4.14.5.
Product
Ajax Search Lite
Affected
up to 4.14.5
What to do
Affects up to 4.14.5. Update Ajax Search Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 15, 2026ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes: Authorization Bypass Through User-Controlled KeyCVE-2026-103083 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Authorization Bypass Through User-Controlled Key vulnerability in ELEXtensions ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes elex-bulk-edit-products-prices-attributes-for-woocommerce-basic allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes: from n/a through 1.5.3.
Product
ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes
Affected
up to 1.5.3
What to do
Affects up to 1.5.3. Update ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.