Updated 4 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

474new WordPress flaws this week

390,714entries in the database

19,029 results · page 4 of 381

Oct 26, 2026JetSmartFilters: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-114708 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetSmartFilters jet-smart-filters allows Stored XSS.This issue affects JetSmartFilters: from n/a through 3.8.6.1.
Product
JetSmartFilters
Affected
up to 3.8.6.1
What to do
Affects up to 3.8.6.1. Update JetSmartFilters to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 26, 2026JetElements For Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-114707 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetElements For Elementor jet-elements allows Stored XSS.This issue affects JetElements For Elementor: from n/a through 2.9.2.5.
Product
JetElements For Elementor
Affected
up to 2.9.2.5
What to do
Affects up to 2.9.2.5. Update JetElements For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 26, 2026Media LIbrary Assistant: Cross-Site Request Forgery (CSRF)CVE-2026-97295 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in David Lingren Media LIbrary Assistant media-library-assistant allows Cross Site Request Forgery.This issue affects Media LIbrary Assistant: from n/a through 3.42.
Product
Media LIbrary Assistant
Affected
up to 3.42
What to do
Affects up to 3.42. Update Media LIbrary Assistant to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 26, 2026Royal Elementor Addons: Authorization Bypass Through User-Controlled KeyCVE-2026-97255 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Authorization Bypass Through User-Controlled Key vulnerability in WProyal Royal Elementor Addons royal-elementor-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Royal Elementor Addons: from n/a through 1.7.1069.
Product
Royal Elementor Addons
Affected
up to 1.7.1069
What to do
Affects up to 1.7.1069. Update Royal Elementor Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 26, 2026Royal Elementor Addons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-97254 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WProyal Royal Elementor Addons royal-elementor-addons allows Stored XSS.This issue affects Royal Elementor Addons: from n/a through 1.7.1069.
Product
Royal Elementor Addons
Affected
up to 1.7.1069
What to do
Affects up to 1.7.1069. Update Royal Elementor Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 26, 2026Image Gallery block – Create and display photo gallery/photo album.: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-115613 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Image Gallery block – Create and display photo gallery/photo album. 3d-image-gallery allows Stored XSS.This issue affects Image Gallery block – Create and display photo gallery/photo album.: from n/a through 2.4.1.
Product
Image Gallery block – Create and display photo gallery/photo album.
Affected
up to 2.4.1
What to do
Affects up to 2.4.1. Update Image Gallery block – Create and display photo gallery/photo album. to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 26, 2026Gutenberg Blocks by Kadence Blocks: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-115602 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / StellarWP Gutenberg Blocks by Kadence Blocks kadence-blocks allows Stored XSS.This issue affects Gutenberg Blocks by Kadence Blocks: from n/a through 3.8.0.1.
Product
Gutenberg Blocks by Kadence Blocks
Affected
up to 3.8.0.1
What to do
Affects up to 3.8.0.1. Update Gutenberg Blocks by Kadence Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 26, 2026Ad Inserter: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-114709 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Igor Funa Ad Inserter ad-inserter allows Reflected XSS.This issue affects Ad Inserter: from n/a through 2.8.18.
Product
Ad Inserter
Affected
up to 2.8.18
What to do
Affects up to 2.8.18. Update Ad Inserter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 26, 2026Royal Elementor Addons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-112865 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WProyal Royal Elementor Addons royal-elementor-addons allows DOM-Based XSS.This issue affects Royal Elementor Addons: from n/a through 1.7.1069.
Product
Royal Elementor Addons
Affected
up to 1.7.1069
What to do
Affects up to 1.7.1069. Update Royal Elementor Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 26, 2026FunnelKit Automations: Cross-Site Request Forgery (CSRF)CVE-2026-111841 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Cross-Site Request Forgery (CSRF) vulnerability in Aman FunnelKit Automations wp-marketing-automations allows Cross Site Request Forgery.This issue affects FunnelKit Automations: from n/a through 3.8.5.2.
Product
FunnelKit Automations
Affected
up to 3.8.5.2
What to do
Affects up to 3.8.5.2. Update FunnelKit Automations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 26, 2026Eurobank WooCommerce Payment Gateway: Does not verify that a payment-confirmation request genuinely originates from the payment providerCVE-2026-103300 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Eurobank WooCommerce Payment Gateway WordPress plugin through 2.1.1 does not verify that a payment-confirmation request genuinely originates from the payment provider, and ships with the secret that would authenticate it empty by default, allowing unauthenticated attackers to mark any pending order as paid, and to force any order into a failed status without any secret at all.
Product
Eurobank WooCommerce Payment Gateway
Affected
up to 2.1.1
What to do
Affects up to 2.1.1. Update Eurobank WooCommerce Payment Gateway to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Oct 26, 2026Payment Gateway: Does not ensure a shared secret is configured before using it to authenticate the bank's payment-notification callbackCVE-2026-103299 · WordPress plugins & themes · reported by WPScan
The Payment Gateway WordPress plugin through 2.2.0 does not ensure a shared secret is configured before using it to authenticate the bank's payment-notification callback, allowing unauthenticated attackers to forge a valid notification and mark any WooCommerce order as paid on installs where the secret has not been set, and the same callback lets them move any pending order to a failed state whether or not the secret is configured.
Product
Payment Gateway
Affected
up to 2.2.0
What to do
Affects up to 2.2.0. Update Payment Gateway to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Oct 26, 2026CCAvenue Payment Gateway for WooCommerce: Does not verify that a payment-confirmation request genuinely originates from the payment providerCVE-2026-103298 · WordPress plugins & themes · reported by WPScanMedium 5.3
The CCAvenue Payment Gateway for WooCommerce WordPress plugin through 3.1 does not verify that a payment-confirmation request genuinely originates from the payment provider, and derives its verification key from a value that is empty on a default install, allowing unauthenticated attackers to forge a confirmation and mark any WooCommerce order as paid without payment.
Product
CCAvenue Payment Gateway for WooCommerce
Affected
up to 3.1
What to do
Affects up to 3.1. Update CCAvenue Payment Gateway for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Oct 25, 2026Chikkili- Google Pay India for Woocommerce: Does not verify that a payment notification actually originated from the payment provider before marking the associated orderCVE-2026-94295 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Chikkili- Google Pay India for Woocommerce WordPress plugin through 1.0.6 does not verify that a payment notification actually originated from the payment provider before marking the associated order as paid, allowing unauthenticated attackers to mark arbitrary orders as paid without any payment being made.
Product
Chikkili- Google Pay India for Woocommerce
Affected
up to 1.0.6
What to do
Affects up to 1.0.6. Update Chikkili- Google Pay India for Woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Oct 25, 2026Duplicator: Does not restrict its one-click upgrade routine to users allowed to install Duplicator WordPress plugin before 5CVE-2026-115251 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Duplicator WordPress plugin before 5.0.0 does not restrict its one-click upgrade routine to users allowed to install Duplicator WordPress plugin before 5.0.0, and additionally exposes the routine without authentication, allowing an administrator of a multisite child site who is not a network administrator to install and run arbitrary PHP in the network-wide shared Duplicator WordPress plugin before 5.0.0 directory.
Product
Duplicator
Fixed in
5.0.0
What to do
Update Duplicator to 5.0.0 or newer.
Full record and what to do →NVD record wpscan.com
Oct 25, 2026Datawiza Proxy Auth: Does not verify that the user-identity and role HTTP request headers it trusts originate from a trusted reverse proxyCVE-2026-115214 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Datawiza Proxy Auth Plugin WordPress plugin before 1.1.1 does not verify that the user-identity and role HTTP request headers it trusts originate from a trusted reverse proxy, allowing unauthenticated attackers to create and authenticate as a WordPress administrator.
Product
Datawiza Proxy Auth
Fixed in
1.1.1
What to do
Update Datawiza Proxy Auth to 1.1.1 or newer.
Full record and what to do →NVD record wpscan.com
Oct 25, 2026WPVR: Does not perform object-level ownership checksCVE-2026-114742 · WordPress plugins & themes · reported by WPScanLow 2.7
The WPVR WordPress plugin before 9.0.3 does not perform object-level ownership checks when updating virtual tours, allowing users with contributor-level access and above to modify, reconfigure and publish tours created by other users.
Product
WPVR
Fixed in
9.0.3
What to do
Update WPVR to 9.0.3 or newer.
Full record and what to do →NVD record wpscan.com
Oct 25, 2026WPVR: Does not perform object-level authorization checksCVE-2026-114741 · WordPress plugins & themes · reported by WPScanLow 3.8
The WPVR WordPress plugin before 9.0.3 does not perform object-level authorization checks when reading and updating virtual tours, allowing users with contributor-level access and above to read and modify tours created by other users.
Product
WPVR
Fixed in
9.0.3
What to do
Update WPVR to 9.0.3 or newer.
Full record and what to do →NVD record wpscan.com
Oct 25, 2026GiveWP: Does not properly validate a user-supplied filename before reading it from diskCVE-2026-111978 · WordPress plugins & themes · reported by WPScanMedium 6
The GiveWP WordPress plugin before 4.19.0.1 does not properly validate a user-supplied filename before reading it from disk, allowing users with a high-privilege custom role to perform path traversal, disclose the contents of JSON-parseable files anywhere on the server, and overwrite the GiveWP WordPress plugin before 4.19.0.1's stored configuration.
Product
GiveWP
Fixed in
4.19.0.1
What to do
Update GiveWP to 4.19.0.1 or newer.
Full record and what to do →NVD record wpscan.com
Oct 24, 2026Ad Inserter: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-114194 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Igor Funa Ad Inserter ad-inserter allows Reflected XSS.This issue affects Ad Inserter: from n/a through 2.8.18.
Product
Ad Inserter
Affected
up to 2.8.18
What to do
Affects up to 2.8.18. Update Ad Inserter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 24, 2026QA Analytics: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-114697 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in QuarkA QA Analytics qa-heatmap-analytics allows Stored XSS.This issue affects QA Analytics: from n/a through 5.3.0.1.
Product
QA Analytics
Affected
up to 5.3.0.1
What to do
Affects up to 5.3.0.1. Update QA Analytics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 24, 2026VOD Infomaniak: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-114695 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Infomaniak Network VOD Infomaniak vod-infomaniak allows Stored XSS.This issue affects VOD Infomaniak: from n/a through 1.5.14.
Product
VOD Infomaniak
Affected
up to 1.5.14
What to do
Affects up to 1.5.14. Update VOD Infomaniak to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 24, 2026Events Manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-114694 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pixelite Events Manager events-manager allows Reflected XSS.This issue affects Events Manager: from n/a through 7.4.8.
Product
Events Manager
Affected
up to 7.4.8
What to do
Affects up to 7.4.8. Update Events Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 24, 2026All-in-One Video Gallery: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-114693 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Plugins360 Labs All-in-One Video Gallery all-in-one-video-gallery allows Stored XSS.This issue affects All-in-One Video Gallery: from n/a through 4.9.7.
Product
All-in-One Video Gallery
Affected
up to 4.9.7
What to do
Affects up to 4.9.7. Update All-in-One Video Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 24, 2026BP Better Messages: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-114179 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wordplus BP Better Messages bp-better-messages allows DOM-Based XSS.This issue affects BP Better Messages: from n/a through 3.1.3.
Product
BP Better Messages
Affected
up to 3.1.3
What to do
Affects up to 3.1.3. Update BP Better Messages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 24, 2026W3 Total Cache: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-114178 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bold Grid W3 Total Cache w3-total-cache allows Stored XSS.This issue affects W3 Total Cache: from n/a through 2.10.7.
Product
W3 Total Cache
Affected
up to 2.10.7
What to do
Affects up to 2.10.7. Update W3 Total Cache to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 24, 2026We’re Open!: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-112869 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Noah Hearle We’re Open! opening-hours allows Reflected XSS.This issue affects We’re Open!: from n/a through 2.6.
Product
We’re Open!
Affected
up to 2.6
What to do
Affects up to 2.6. Update We’re Open! to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 24, 2026WP Event Solution: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-112844 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Arraytics WP Event Solution wp-event-solution allows Stored XSS.This issue affects WP Event Solution: from n/a through 4.1.26.
Product
WP Event Solution
Affected
up to 4.1.26
What to do
Affects up to 4.1.26. Update WP Event Solution to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 24, 2026GeoDirectory: Does not correctly verify ownership of listings submitted by logged-out users before allowing them to be editedCVE-2026-113674 · WordPress plugins & themes · reported by WPScanLow 3.7
The GeoDirectory WordPress plugin before 2.8.194 does not correctly verify ownership of listings submitted by logged-out users before allowing them to be edited, allowing unauthenticated attackers to modify, unpublish, attach images to, or reassign any guest-submitted listing when guest posting is enabled.
Product
GeoDirectory
Fixed in
2.8.194
What to do
Update GeoDirectory to 2.8.194 or newer.
Full record and what to do →NVD record wpscan.com
Oct 24, 2026GeoDirectory: Does not properly escape administrator-defined text before writing it into a generated PHP file in its own folderCVE-2026-113673 · WordPress plugins & themes · reported by WPScanHigh 7.2
The GeoDirectory WordPress plugin before 2.8.194 does not properly escape administrator-defined text before writing it into a generated PHP file in its own folder, allowing high privilege users such as a subsite administrator on a multisite network, who cannot otherwise run code, to achieve Remote Code Execution that any unauthenticated visitor can trigger.
Product
GeoDirectory
Fixed in
2.8.194
What to do
Update GeoDirectory to 2.8.194 or newer.
Full record and what to do →NVD record wpscan.com
Oct 24, 2026GeoDirectory: Does not validate a user-supplied image URL before using itCVE-2026-113491 · WordPress plugins & themes · reported by WPScanMedium 6.4
The GeoDirectory WordPress plugin before 2.8.194 does not validate a user-supplied image URL before using it as a local file path when saving a front-end listing, allowing users with Subscriber-level access and above to read files from outside the web root and to delete files on the server, limited to file names that carry an allowed media extension. A disclosed file is re-published at a public URL and its original is deleted as a side effect.
Product
GeoDirectory
Fixed in
2.8.194
What to do
Update GeoDirectory to 2.8.194 or newer.
Full record and what to do →NVD record wpscan.com
Oct 24, 2026Download Monitor: Does not properly validate that a clicked link belongs to the site before fetching it client-side and rendering part of the response in the pageCVE-2026-112207 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Download Monitor WordPress plugin before 5.3.4 does not properly validate that a clicked link belongs to the site before fetching it client-side and rendering part of the response in the page, which allows unauthenticated attackers to execute arbitrary JavaScript in the browser of any user who is tricked into clicking a crafted link.
Product
Download Monitor
Fixed in
5.3.4
What to do
Update Download Monitor to 5.3.4 or newer.
Full record and what to do →NVD record wpscan.com
Oct 23, 2026The GTM Server Side plugin by stape.io implements server-side tracking on WordPress websites.CVE-2026-55826 · WordPress plugins & themes · reported by GitHubHigh 8.7
The GTM Server Side plugin by stape.io implements server-side tracking on WordPress websites. From version 2.0.0 to before version 2.1.48, the WooCommerce purchase event tracking mechanism allows an unauthenticated attacker to trigger the rendering of another customer's full order data — including personally identifiable information (PII) — into the page's JavaScript dataLayer. This issue has been patched in version 2.1.48.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record github.com github.com
Oct 23, 2026KALLYAS: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-112863 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Hogash KALLYAS kallyas allows Reflected XSS.This issue affects KALLYAS: from n/a through 4.25.0.
Product
KALLYAS
Affected
up to 4.25.0
What to do
Affects up to 4.25.0. Update KALLYAS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 23, 2026Hostme v2: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-112849 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AivahThemes Hostme v2 hostmev2 allows DOM-Based XSS.This issue affects Hostme v2: from n/a through 7.0.
Product
Hostme v2
Affected
up to 7.0
What to do
Affects up to 7.0. Update Hostme v2 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 23, 2026VikRentCar: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-112838 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e4jvikwp VikRentCar vikrentcar allows Stored XSS.This issue affects VikRentCar: from n/a through 1.4.8.
Product
VikRentCar
Affected
up to 1.4.8
What to do
Affects up to 1.4.8. Update VikRentCar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 23, 2026VikRentCar: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-112835 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e4jvikwp VikRentCar vikrentcar allows Reflected XSS.This issue affects VikRentCar: from n/a through 1.4.8.
Product
VikRentCar
Affected
up to 1.4.8
What to do
Affects up to 1.4.8. Update VikRentCar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 23, 2026Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO: Does not resolve the target of the update-user action in its front-end Forms module consistently between the stage tCVE-2026-94268 · WordPress plugins & themes · reported by WPScanHigh 8.1
The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not resolve the target of the update-user action in its front-end Forms module consistently between the stage that authorises the request and the stage that carries it out, which allows unauthenticated visitors to bypass the guard protecting administrator accounts, take over the site administrator's account and be issued a valid session for it. Exploitation requires the site to publish two separate front-end form configurations whose targets are mapped to visitor-submitted values.
Product
Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO
Fixed in
0.9.2.8
What to do
Update Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO to 0.9.2.8 or newer.
Full record and what to do →NVD record wpscan.com
Oct 23, 2026Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO: Does not verify that the requester is authorised to edit the targeted user account in the update-user action of its CVE-2026-94262 · WordPress plugins & themes · reported by WPScanHigh 8.1
The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not verify that the requester is authorised to edit the targeted user account in the update-user action of its front-end Forms module, performing that check only when the target account holds an administrator role, which allows unauthenticated visitors to overwrite any non-administrator account's credentials and obtain a session for that account. Exploitation requires the site to publish a form whose user-update action maps its target to a visitor-submitted value rather than to the default current user.
Product
Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO
Fixed in
0.9.2.8
What to do
Update Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO to 0.9.2.8 or newer.
Full record and what to do →NVD record wpscan.com
Oct 23, 2026LiteSpeed Cache: Does not perform a capability check on its admin-notice dismissal handlerCVE-2026-113501 · WordPress plugins & themes · reported by WPScanLow 3.1
The LiteSpeed Cache WordPress plugin before 7.9.2 does not perform a capability check on its admin-notice dismissal handler, and the nonce it relies on is not bound to the specific notice being dismissed, so on sites in certain configurations a low-privileged authenticated user (Subscriber) can dismiss administrative notices the LiteSpeed Cache WordPress plugin before 7.9.2 marks as non-dismissible, including a warning that sensitive files may be publicly accessible.
Product
LiteSpeed Cache
Fixed in
7.9.2
What to do
Update LiteSpeed Cache to 7.9.2 or newer.
Full record and what to do →NVD record wpscan.com
Oct 23, 2026Depicter — Popup & Slider Builder: Does not properly validate uploaded files in its editor media-upload endpointCVE-2026-113472 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Depicter — Popup & Slider Builder WordPress plugin before 4.8.2 does not properly validate uploaded files in its editor media-upload endpoint, checking only the client-supplied MIME type and a case-sensitive block of the .php extension, which allows users with the Editor role and above to upload files with other active extensions into the public uploads directory, leading to stored script execution in the site origin and, depending on the server's handler mapping, to code execution.
Product
Depicter — Popup & Slider Builder
Fixed in
4.8.2
What to do
Update Depicter — Popup & Slider Builder to 4.8.2 or newer.
Full record and what to do →NVD record wpscan.com
Oct 23, 2026User Profile Builder: Does not verify that a user is authorized to edit the specific account selected on its front-end Edit Profile formCVE-2026-111982 · WordPress plugins & themes · reported by WPScanHigh 7.2
The User Profile Builder WordPress plugin before 4.0.5 does not verify that a user is authorized to edit the specific account selected on its front-end Edit Profile form, allowing an Administrator of a Multisite subsite to change any other user's account email, including a Network Super Admin's, and take over that account through the password-reset flow.
Product
User Profile Builder
Fixed in
4.0.5
What to do
Update User Profile Builder to 4.0.5 or newer.
Full record and what to do →NVD record wpscan.com
Oct 23, 2026Speed Optimizer: Does not verify network-level privilege before applying an option change to the whole multisite networkCVE-2026-111738 · WordPress plugins & themes · reported by WPScanMedium 5.5
The Speed Optimizer WordPress plugin before 7.8.5 does not verify network-level privilege before applying an option change to the whole multisite network, nor restrict which option may be changed, allowing a site administrator who is not a Super Admin to create or overwrite network-wide options.
Product
Speed Optimizer
Fixed in
7.8.5
What to do
Update Speed Optimizer to 7.8.5 or newer.
Full record and what to do →NVD record wpscan.com
Oct 23, 2026Speed Optimizer: Does not sanitise or escape some of its settings before outputting them in the head of front-end pagesCVE-2026-111737 · WordPress plugins & themes · reported by WPScanLow 3.5
The Speed Optimizer WordPress plugin before 7.8.5 does not sanitise or escape some of its settings before outputting them in the head of front-end pages, which could allow high-privilege users such as admins to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in a multisite setup).
Product
Speed Optimizer
Fixed in
7.8.5
What to do
Update Speed Optimizer to 7.8.5 or newer.
Full record and what to do →NVD record wpscan.com
Oct 23, 2026Essential Addons for Elementor: Does not verify that an administrator may manage the specific user accounts targeted by its login-approval featureCVE-2026-110537 · WordPress plugins & themes · reported by WPScanLow 3.8
The Essential Addons for Elementor WordPress plugin before 6.8.7 does not verify that an administrator may manage the specific user accounts targeted by its login-approval feature, checking only a site-level capability, which on WordPress Multisite could allow a subsite administrator to change the approval and login state of accounts belonging to other sites on the network.
Product
Essential Addons for Elementor
Fixed in
6.8.7
What to do
Update Essential Addons for Elementor to 6.8.7 or newer.
Full record and what to do →NVD record wpscan.com
Oct 23, 2026Otter Blocks: Does not correctly bound a pattern it uses to rewrite its dynamic-content tokens while rendering blocksCVE-2026-109936 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Otter Blocks WordPress plugin before 3.2.8 does not correctly bound a pattern it uses to rewrite its dynamic-content tokens while rendering blocks, so the pattern can consume the quote that closes an HTML attribute and pull adjacent unescaped data into the markup as new attributes. This allows unauthenticated users to achieve stored Cross-Site Scripting that executes in the browser of any visitor who views an affected page, including a logged-in administrator.
Product
Otter Blocks
Fixed in
3.2.8
What to do
Update Otter Blocks to 3.2.8 or newer.
Full record and what to do →NVD record wpscan.com
Oct 23, 2026Otter Blocks: Does not properly sanitize and escape user-supplied block styling values before writing them into an inline stylesheetCVE-2026-109933 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Otter Blocks WordPress plugin before 3.2.8 does not properly sanitize and escape user-supplied block styling values before writing them into an inline stylesheet, allowing users with contributor-level access and above to inject arbitrary web scripts that execute when any visitor, including administrators, views the affected post.
Product
Otter Blocks
Fixed in
3.2.8
What to do
Update Otter Blocks to 3.2.8 or newer.
Full record and what to do →NVD record wpscan.com
Oct 23, 2026Anti-Spam by CleanTalk – Spam Protection Without CAPTCHA: Stored Cross-Site ScriptingCVE-2026-109198 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Anti-Spam by CleanTalk – Spam Protection Without CAPTCHA plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'user_email' parameter in all versions up to, and including, 6.89.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires user registration to be open on the site, and script execution is triggered when an Administrator subsequently runs the plugin's user-spam scan and views the resulting Non-checkable users or Spam users tab — the plugin's own documented workflow.
Product
Anti-Spam by CleanTalk – Spam Protection Without CAPTCHA
Affected
up to 6.89.1
What to do
Affects up to 6.89.1. Update Anti-Spam by CleanTalk – Spam Protection Without CAPTCHA to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 22, 2026JetBackup: Symlink-based arbitrary file writeCVE-2026-104068 · WordPress plugins & themes · reported by VulnCheckHigh 8.6
JetBackup plugin for WordPress before 3.1.24.10 contains a symlink-based arbitrary file write vulnerability that allows an authenticated WordPress administrator to write attacker-controlled file contents outside the intended restore destination during backup import and restore. Attackers can craft a backup archive containing a symbolic link that archive extraction follows without validating targets or enforcing destination containment, potentially leading to server-side code execution depending on the writable destination and server configuration.
Product
JetBackup
Fixed in
3.1.24.10
What to do
Update JetBackup to 3.1.24.10 or newer.
Full record and what to do →NVD record wordpress.org vulncheck.com
Oct 22, 2026ACF Extended: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-112313 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ACF Extended ACF Extended acf-extended allows Stored XSS.This issue affects ACF Extended: from n/a through 0.9.2.7.
Product
ACF Extended
Affected
up to 0.9.2.7
What to do
Affects up to 0.9.2.7. Update ACF Extended to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.