Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
40,725 results · page 38 of 815
Oct 7, 2026Element Pack Elementor Addons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-105871 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BdThemes Element Pack Elementor Addons bdthemes-element-pack-lite allows Stored XSS.This issue affects Element Pack Elementor Addons: from n/a through 8.8.6.
- Product
- Element Pack Elementor Addons
- Affected
- up to 8.8.6
- What to do
- Affects up to 8.8.6. Update Element Pack Elementor Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 7, 2026Happy Addons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-104393 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in weDevs Happy Addons for Elementor happy-elementor-addons allows Stored XSS.This issue affects Happy Addons for Elementor: from n/a through 3.50.0.
- Product
- Happy Addons for Elementor
- Affected
- up to 3.50.0
- What to do
- Affects up to 3.50.0. Update Happy Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 7, 2026Quiz And Survey Master: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-104391 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows Stored XSS.This issue affects Quiz And Survey Master: from n/a through 11.2.7.
- Product
- Quiz And Survey Master
- Affected
- up to 11.2.7
- What to do
- Affects up to 11.2.7. Update Quiz And Survey Master to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 7, 2026Booktics: Missing AuthorizationCVE-2026-104390 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Arraytics Booktics booktics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booktics: from n/a through 1.0.27.
- Product
- Booktics
- Affected
- up to 1.0.27
- What to do
- Affects up to 1.0.27. Update Booktics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 7, 2026Hustle: Missing AuthorizationCVE-2026-103075 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WPMU DEV Hustle wordpress-popup allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Hustle: from n/a through 7.8.14.2.
- Product
- Hustle
- Affected
- up to 7.8.14.2
- What to do
- Affects up to 7.8.14.2. Update Hustle to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 7, 2026OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy.: Stored Cross-Site ScriptingCVE-2026-89417 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 's' Search Parameter via comments-atom Feed in all versions up to, and including, 6.3.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires that the front-end server serves the retained .tmp file without a Content-Type or X-Content-Type-Options header, enabling MIME-sniffing browsers such as Chromium to execute the injected script — a condition present by default on many Apache and nginx/php-fpm deployments.
- Product
- OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy.
- Affected
- up to 6.3.10
- What to do
- Affects up to 6.3.10. Update OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 7, 2026PowerPress Podcasting plugin by Blubrry: Does not validate the destination of redirectsCVE-2026-97354 · WordPress plugins & themes · reported by WPScanMedium 4.1
The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.17.11 does not validate the destination of redirects when fetching a user-supplied media URL, allowing users with the contributor role and above to perform Server-Side Request Forgery attacks against internal services.
- Product
- PowerPress Podcasting plugin by Blubrry
- Fixed in
- 11.17.11
- What to do
- Update PowerPress Podcasting plugin by Blubrry to 11.17.11 or newer.
Oct 7, 2026User Private Files: Does not validate that a supplied user belongs to the document being operated on before returning that user's email addressCVE-2026-97331 · WordPress plugins & themes · reported by WPScanMedium 4.3
The User Private Files WordPress plugin before 2.1.9 does not validate that a supplied user belongs to the document being operated on before returning that user's email address, allowing any authenticated user, such as a Subscriber, to obtain the email address of any registered account, including administrators.
- Product
- User Private Files
- Fixed in
- 2.1.9
- What to do
- Update User Private Files to 2.1.9 or newer.
Oct 7, 2026String locator: Does not restrict the classes allowedCVE-2026-97188 · WordPress plugins & themes · reported by WPScanHigh 8.8
The String locator WordPress plugin before 2.6.8 does not restrict the classes allowed when deserializing the content of a database row saved through its database editor, allowing unauthenticated attackers to store a serialized PHP object that is instantiated when an administrator later opens and saves that row. If a suitable POP chain is present via another installed String locator WordPress plugin before 2.6.8 or , this can lead to arbitrary file deletion, sensitive data disclosure or remote code execution.
- Product
- String locator
- Fixed in
- 2.6.8
- What to do
- Update String locator to 2.6.8 or newer.
Oct 7, 2026Optimole: Does not perform a capability check before exposing its stored image-optimization account data in a dashboard widgetCVE-2026-96530 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Optimole WordPress plugin before 4.2.15 does not perform a capability check before exposing its stored image-optimization account data in a dashboard widget, allowing any authenticated user, including Subscribers, to read the site's third-party service credentials.
- Product
- Optimole
- Fixed in
- 4.2.15
- What to do
- Update Optimole to 4.2.15 or newer.
Oct 7, 2026If-So Dynamic Content: Does not validate the URL scheme of a request-supplied value before reflecting it into a link on an admin pageCVE-2026-87971 · WordPress plugins & themes · reported by WPScanHigh 7.1
The If-So Dynamic Content WordPress plugin before 1.10.2 does not validate the URL scheme of a request-supplied value before reflecting it into a link on an admin page, allowing attackers to execute arbitrary JavaScript in the browser of a logged-in user who opens a crafted link.
- Product
- If-So Dynamic Content
- Fixed in
- 1.10.2
- What to do
- Update If-So Dynamic Content to 1.10.2 or newer.
Oct 7, 2026Koinonia Link: Does not check that a user is allowed to change roles before saving a role selection submitted with a profile updateCVE-2026-87782 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Koinonia Link WordPress plugin before 1.1.5 does not check that a user is allowed to change roles before saving a role selection submitted with a profile update, allowing any authenticated user, such as a subscriber, to grant themselves the Administrator role.
- Product
- Koinonia Link
- Fixed in
- 1.1.5
- What to do
- Update Koinonia Link to 1.1.5 or newer.
Oct 7, 2026MetForm: Does not sanitize or escape submitted form-field values before inserting them into the HTML body of its email notificationsCVE-2026-86833 · WordPress plugins & themes · reported by WPScanMedium 5.4
The MetForm WordPress plugin before 4.3.1 does not sanitize or escape submitted form-field values before inserting them into the HTML body of its email notifications, allowing unauthenticated attackers to inject arbitrary markup into the administrator and submitter notification emails the site sends.
- Product
- MetForm
- Fixed in
- 4.3.1
- What to do
- Update MetForm to 4.3.1 or newer.
Oct 7, 2026WPCafe: Does not restrict access to some of its REST API endpointsCVE-2026-86816 · WordPress plugins & themes · reported by WPScanMedium 5.3
The WPCafe WordPress plugin before 3.0.21 does not restrict access to some of its REST API endpoints, allowing unauthenticated attackers to read WooCommerce product data, including per-product sales counts, exact stock levels, and private product meta, that WooCommerce itself keeps behind authentication.
- Product
- WPCafe
- Fixed in
- 3.0.21
- What to do
- Update WPCafe to 3.0.21 or newer.
Oct 7, 2026Nexi XPay Build: Does not correctly validate the security token on its payment notification routeCVE-2026-82212 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Nexi XPay Build WordPress plugin through 7.6.2 does not correctly validate the security token on its payment notification route, accepting the request when the target order has no stored token, which allows unauthenticated attackers to mark arbitrary orders as paid, or to mark genuinely paid orders as failed.
- Product
- Nexi XPay Build
- Affected
- up to 7.6.2
- What to do
- Affects up to 7.6.2. Update Nexi XPay Build to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 7, 2026Nexi XPay Build: Does not verify the payment result supplied to several of its unauthenticated routesCVE-2026-82211 · WordPress plugins & themes · reported by WPScanHigh 8.2
The Nexi XPay Build WordPress plugin through 7.6.2 does not verify the payment result supplied to several of its unauthenticated routes, allowing attackers to mark arbitrary orders as paid or failed, to cancel them, and to obtain order keys which expose guest buyers' details.
- Product
- Nexi XPay Build
- Affected
- up to 7.6.2
- What to do
- Affects up to 7.6.2. Update Nexi XPay Build to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 7, 2026Magee Shortcodes: Does not restrict the recipient of some of its unauthenticated contact-form actionsCVE-2026-105322 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Magee Shortcodes WordPress plugin through 2.1.1 does not restrict the recipient of some of its unauthenticated contact-form actions, allowing unauthenticated users to send arbitrary emails to any address through the site (mail relay).
- Product
- Magee Shortcodes
- Affected
- up to 2.1.1
- What to do
- Affects up to 2.1.1. Update Magee Shortcodes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 7, 2026Magee Shortcodes: Does not sanitise and escape user input in some of its AJAX actionsCVE-2026-105316 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Magee Shortcodes WordPress plugin through 2.1.1 does not sanitise and escape user input in some of its AJAX actions, which are available to unauthenticated users, before reflecting it back in the response, leading to Reflected Cross-Site Scripting.
- Product
- Magee Shortcodes
- Affected
- up to 2.1.1
- What to do
- Affects up to 2.1.1. Update Magee Shortcodes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 7, 2026MPG: Does not properly validate the structure of imported project data before using it in a database queryCVE-2026-104953 · WordPress plugins & themes · reported by WPScanMedium 6.8
The MPG WordPress plugin before 4.2.3 does not properly validate the structure of imported project data before using it in a database query, allowing users with the Editor role or higher to perform SQL injection attacks and read sensitive data such as password hashes.
- Product
- MPG
- Fixed in
- 4.2.3
- What to do
- Update MPG to 4.2.3 or newer.
Oct 7, 2026CP Media Player: Does not perform a capability check on its settings-page handlerCVE-2026-104678 · WordPress plugins & themes · reported by WPScanLow 2.7
The CP Media Player WordPress plugin before 1.3.4 does not perform a capability check on its settings-page handler, allowing users with only Contributor-level access to create, modify, duplicate and delete the site-wide media player configurations and change a CP Media Player WordPress plugin before 1.3.4 option that should require administrator access.
- Product
- CP Media Player
- Fixed in
- 1.3.4
- What to do
- Update CP Media Player to 1.3.4 or newer.
Oct 7, 2026WP Coder: Does not restrict access to its PHP code-execution feature to administratorsCVE-2026-104677 · WordPress plugins & themes · reported by WPScanHigh 7.2
The WP Coder WordPress plugin before 4.5.2 does not restrict access to its PHP code-execution feature to administrators, gating it on a content capability that the Editor role holds by default, which allows Editor-level users to save and execute arbitrary PHP code on the server and fully compromise the site.
- Product
- WP Coder
- Fixed in
- 4.5.2
- What to do
- Update WP Coder to 4.5.2 or newer.
Oct 7, 2026Animated Number Counters: Does not sanitise or escape a value stored by an Editor-level user before concatenating it into a SQL query that runsCVE-2026-104667 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Animated Number Counters WordPress plugin before 3.1 does not sanitise or escape a value stored by an Editor-level user before concatenating it into a SQL query that runs when any unauthenticated visitor renders a page containing the counter, leading to second-order SQL injection that can read arbitrary data including password hashes.
- Product
- Animated Number Counters
- Fixed in
- 3.1
- What to do
- Update Animated Number Counters to 3.1 or newer.
Oct 7, 2026Envira Gallery: Does not sanitise or escape user-supplied gallery display configuration values before storing them and outputting them in an image tag attributeCVE-2026-104653 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Envira Gallery WordPress plugin before 1.16.1 does not sanitise or escape user-supplied gallery display configuration values before storing them and outputting them in an image tag attribute, allowing users with the Author role and above to inject arbitrary web scripts that execute when any visitor, including an administrator, views a page containing the affected gallery.
- Product
- Envira Gallery
- Fixed in
- 1.16.1
- What to do
- Update Envira Gallery to 1.16.1 or newer.
Oct 7, 2026Envira Gallery: Does not sanitise and escape a gallery item identifier before outputting it in an image tag attributeCVE-2026-104652 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Envira Gallery WordPress plugin before 1.16.1 does not sanitise and escape a gallery item identifier before outputting it in an image tag attribute, allowing users with the Author role and above to inject arbitrary web scripts that execute when any visitor, including an administrator, views a page embedding the gallery.
- Product
- Envira Gallery
- Fixed in
- 1.16.1
- What to do
- Update Envira Gallery to 1.16.1 or newer.
Oct 7, 2026Yaad Sarig Payment Gateway For WC: Does not verify authorization or that the requesting user owns the target order in several of its order payment-processing actionsCVE-2026-104651 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Yaad Sarig Payment Gateway For WC WordPress plugin before 2.2.13 does not verify authorization or that the requesting user owns the target order in several of its order payment-processing actions, allowing any authenticated user, including subscribers, to act on and alter orders belonging to other customers.
- Product
- Yaad Sarig Payment Gateway For WC
- Fixed in
- 2.2.13
- What to do
- Update Yaad Sarig Payment Gateway For WC to 2.2.13 or newer.
Oct 7, 2026Academy LMS: Does not verify that a quiz question belongs to the course the requesting user is authorized to access before returning that question's answer optionsCVE-2026-104050 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Academy LMS WordPress plugin before 4.0.0 does not verify that a quiz question belongs to the course the requesting user is authorized to access before returning that question's answer options, allowing any authenticated user with access to a single course, such as an enrolled student, to read the quiz answer options of questions belonging to other courses they are not enrolled in.
- Product
- Academy LMS
- Fixed in
- 4.0.0
- What to do
- Update Academy LMS to 4.0.0 or newer.
Oct 7, 2026Academy LMS: Does not verify course enrollment or object ownershipCVE-2026-104049 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Academy LMS WordPress plugin before 4.0.0 does not verify course enrollment or object ownership when returning a lesson's content through one of its REST API routes, allowing users with a self-registerable student account to read the full content of arbitrary lessons, including lessons of paid or private courses they are not enrolled in.
- Product
- Academy LMS
- Fixed in
- 4.0.0
- What to do
- Update Academy LMS to 4.0.0 or newer.
Oct 7, 2026Frontend Dashboard: Does not perform a capability check in one of its AJAX actionsCVE-2026-103681 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Frontend Dashboard WordPress plugin before 3.0.0 does not perform a capability check in one of its AJAX actions, allowing authenticated users with low privileges, such as subscribers, to delete the Frontend Dashboard WordPress plugin before 3.0.0's configured profile and post form fields.
- Product
- Frontend Dashboard
- Fixed in
- 3.0.0
- What to do
- Update Frontend Dashboard to 3.0.0 or newer.
Oct 7, 2026Geliver Akıllı Kargo Pazaryeri: Does not prevent unauthenticated access to a log file it stores within its own web-accessible directoryCVE-2026-103378 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Geliver Akıllı Kargo Pazaryeri WordPress plugin before 3.1.1 does not prevent unauthenticated access to a log file it stores within its own web-accessible directory, into which it writes the site's carrier integration key while processing requests from unauthenticated users, allowing attackers to retrieve the key and use it to modify WooCommerce order statuses. The same log file also exposes customer information from orders the shop has processed.
- Product
- Geliver Akıllı Kargo Pazaryeri
- Fixed in
- 3.1.1
- What to do
- Update Geliver Akıllı Kargo Pazaryeri to 3.1.1 or newer.
Oct 7, 2026Integration for Epos Now and WooCommerce: Does not perform an authorization check on one of its REST endpointsCVE-2026-103323 · WordPress plugins & themes · reported by WPScanMedium 5.9
The Integration for Epos Now and WooCommerce WordPress plugin before 4.11.2 does not perform an authorization check on one of its REST endpoints, allowing unauthenticated users to retrieve the site's scheduled background tasks and their arguments, which include order identifiers and, when WooCommerce's deferred emails feature is enabled, the plaintext passwords of newly registered customers.
- Product
- Integration for Epos Now and WooCommerce
- Fixed in
- 4.11.2
- What to do
- Update Integration for Epos Now and WooCommerce to 4.11.2 or newer.
Oct 7, 2026Kirki – Freeform Page Builder, Website Builder & Customizer: Stored Cross-Site ScriptingCVE-2026-102173 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via registration metadata in all versions up to, and including, 6.3.1 This is due to insufficient escaping in `ExceptionalElements::image_element()`, which concatenates a user-meta value straight into an `<img src="…">` attribute. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute whenever a user accesses a page rendering a Kirki users collection whose image element is bound to one of the nine registration meta fields. Requires public user registration to be enabled and a published page carrying a `kirki-register` element, which prints the required element nonce into the public markup.
- Product
- Kirki – Freeform Page Builder, Website Builder & Customizer
- Affected
- up to 6.3.1
- What to do
- Affects up to 6.3.1. Update Kirki – Freeform Page Builder, Website Builder & Customizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 6, 2026WordPress: Insertion of Sensitive Information Into Sent DataCVE-2026-66666 · WordPress plugins & themes · reported by PatchstackMedium 6.9
Insertion of Sensitive Information Into Sent Data vulnerability in Automattic WordPress allows Retrieve Embedded Sensitive Data. This issue affects WordPress: from 7.1 through 7.1.2, from 7.0 through 7.0.6, from 6.9 through 6.9.9, from 6.8 through 6.8.10, from 6.7 through 6.7.9, and from 6.6 through 6.6.9.
- Product
- WordPress
- Affected
- up to 7.1.2
- What to do
- Affects up to 7.1.2. Update WordPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Oct 6, 2026Unauthenticated Bypass Vulnerability in Login Lockdown <= 2.17 versions.CVE-2026-97308 · WordPress plugins & themes · reported by PatchstackMedium 4.8
Unauthenticated Bypass Vulnerability in Login Lockdown <= 2.17 versions.
- Affected
- up to 2.17
- What to do
- Affects up to 2.17. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2026SMS Alert Order Notifications: Incorrect Privilege AssignmentCVE-2026-95594 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Incorrect Privilege Assignment vulnerability in Cozy Vision Technologies Pvt. Ltd. SMS Alert Order Notifications sms-alert allows Privilege Escalation.This issue affects SMS Alert Order Notifications: from n/a through 4.0.0.
- Product
- SMS Alert Order Notifications
- Affected
- up to 4.0.0
- What to do
- Affects up to 4.0.0. Update SMS Alert Order Notifications to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2026Unauthenticated Broken Access Control in BEAR <= 1.2.2 versions.CVE-2026-95526 · WordPress plugins & themes · reported by PatchstackHigh 7.3
Unauthenticated Broken Access Control in BEAR <= 1.2.2 versions.
- Affected
- up to 1.2.2
- What to do
- Affects up to 1.2.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2026Unauthenticated Cross Site Scripting (XSS) in Fluent Forms Pro Add On Pack <= 6.2.13 versions.CVE-2026-94675 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Fluent Forms Pro Add On Pack <= 6.2.13 versions.
- Affected
- up to 6.2.13
- What to do
- Affects up to 6.2.13. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2026Subscriber Broken Access Control in Progress Planner <= 1.10.0 versions.CVE-2026-62072 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Subscriber Broken Access Control in Progress Planner <= 1.10.0 versions.
- Affected
- up to 1.10.0
- What to do
- Affects up to 1.10.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2026Unauthenticated Broken Access Control in Sermon'e <= 1.0.2 versions.CVE-2026-48199 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in Sermon'e <= 1.0.2 versions.
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2026PublishPress Capabilities: Incorrect Privilege AssignmentCVE-2026-48197 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Incorrect Privilege Assignment vulnerability in PublishPress PublishPress Capabilities capability-manager-enhanced allows Privilege Escalation.This issue affects PublishPress Capabilities: from n/a through 2.45.0.
- Product
- PublishPress Capabilities
- Affected
- up to 2.45.0
- What to do
- Affects up to 2.45.0. Update PublishPress Capabilities to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2026Easy Digital Downloads: Missing AuthorizationCVE-2026-42638 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in Awesomemotive Easy Digital Downloads easy-digital-downloads allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Digital Downloads: from n/a through 3.7.1.
- Product
- Easy Digital Downloads
- Affected
- up to 3.7.1
- What to do
- Affects up to 3.7.1. Update Easy Digital Downloads to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2026Unauthenticated Settings Change in PayPlug for WooCommerce (Official) <= 3.1.0 versions.CVE-2026-42637 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Settings Change in PayPlug for WooCommerce (Official) <= 3.1.0 versions.
- Affected
- up to 3.1.0
- What to do
- Affects up to 3.1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2026Unauthenticated Cross Site Scripting (XSS) in WP Cookie Notice for GDPR, CCPA & ePrivacy Consent <= 4.4.6 versions.CVE-2026-42636 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in WP Cookie Notice for GDPR, CCPA & ePrivacy Consent <= 4.4.6 versions.
- Affected
- up to 4.4.6
- What to do
- Affects up to 4.4.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2026Unauthenticated Cross Site Scripting (XSS) in WooCommerce Simple Auctions <= 3.0.10 versions.CVE-2026-42635 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in WooCommerce Simple Auctions <= 3.0.10 versions.
- Affected
- up to 3.0.10
- What to do
- Affects up to 3.0.10. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2026Unauthenticated Cross Site Scripting (XSS) in Video Background Block – Use video as background in the section.CVE-2026-42634 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Video Background Block – Use video as background in the section. <= 2.0.3 versions.
- Affected
- up to 2.0.3
- What to do
- Affects up to 2.0.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2026Social Rocket: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-42418 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Socialrocket Social Rocket social-rocket allows Reflected XSS.This issue affects Social Rocket: from n/a through 1.3.5.
- Product
- Social Rocket
- Affected
- up to 1.3.5
- What to do
- Affects up to 1.3.5. Update Social Rocket to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2026Unauthenticated SQL Injection in ARMember Premium <= 7.8 versions.CVE-2026-42417 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in ARMember Premium <= 7.8 versions.
- Affected
- up to 7.8
- What to do
- Affects up to 7.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2026Subscriber SQL Injection in UDesign Core <= 4.15.0 versions.CVE-2026-42416 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Subscriber SQL Injection in UDesign Core <= 4.15.0 versions.
- Affected
- up to 4.15.0
- What to do
- Affects up to 4.15.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2026Unauthenticated SQL Injection in Porto Theme - Functionality <= 3.9.3 versions.CVE-2026-42415 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in Porto Theme - Functionality <= 3.9.3 versions.
- Affected
- up to 3.9.3
- What to do
- Affects up to 3.9.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2026Subscriber SQL Injection in ListingPro <= 2.9.12 versions.CVE-2026-42414 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Subscriber SQL Injection in ListingPro <= 2.9.12 versions.
- Affected
- up to 2.9.12
- What to do
- Affects up to 2.9.12. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2026Unauthenticated Sensitive Data Exposure in Snapshotify – All-in-One Backup & Restore & Migrate <= 1.3.2 versions.CVE-2026-42413 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Sensitive Data Exposure in Snapshotify – All-in-One Backup & Restore & Migrate <= 1.3.2 versions.
- Affected
- up to 1.3.2
- What to do
- Affects up to 1.3.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.