Updated 1 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,769exploited flaws on CISA’s list

30added in the last 30 days

496new WordPress flaws this week

394,829entries in the database

24,770 results · page 4 of 496

Nov 7, 2026Event Tickets with Ticket Scanner: Does not check that a user may manage WooCommerce orders before returning or removing ticket data for any orderCVE-2026-121857 · WordPress plugins & themes · reported by WPScanMedium 4.2
The Event Tickets with Ticket Scanner WordPress plugin before 3.1.14 does not check that a user may manage WooCommerce orders before returning or removing ticket data for any order, allowing any role an administrator has granted access to the Event Tickets with Ticket Scanner WordPress plugin before 3.1.14's admin area (down to Subscriber) to view other customers' ticket codes and names and to remove tickets from their orders.
Product
Event Tickets with Ticket Scanner
Fixed in
3.1.14
What to do
Update Event Tickets with Ticket Scanner to 3.1.14 or newer.
Full record and what to do →NVD record wpscan.com
Nov 7, 2026Magic Link: Does not check that the user requesting a login link is authorised to generate one for the chosen accountCVE-2026-121848 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Magic Link WordPress plugin before 2.2.6 does not check that the user requesting a login link is authorised to generate one for the chosen account, allowing any authenticated user, such as a subscriber, to generate a working login link for an administrator and log in as them.
Product
Magic Link
Fixed in
2.2.6
What to do
Update Magic Link to 2.2.6 or newer.
Full record and what to do →NVD record wpscan.com
Nov 7, 2026Add From Server Lite: Does not restrict SVG uploads to users allowed to post unfiltered HTMLCVE-2026-121796 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Add From Server Lite WordPress plugin before 6.0.0 does not restrict SVG uploads to users allowed to post unfiltered HTML, allowing users with the Author role and above to upload SVG files containing JavaScript and perform Stored XSS attacks.
Product
Add From Server Lite
Fixed in
6.0.0
What to do
Update Add From Server Lite to 6.0.0 or newer.
Full record and what to do →NVD record wpscan.com
Nov 7, 2026Fiber Admin: Does not have authorisation checks in some of its AJAX actionsCVE-2026-121492 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Fiber Admin WordPress plugin before 4.0.1 does not have authorisation checks in some of its AJAX actions, allowing unauthenticated users to change the order of arbitrary posts, including drafts, private posts and navigation menu items, as well as the order of taxonomy terms when term ordering is enabled.
Product
Fiber Admin
Fixed in
4.0.1
What to do
Update Fiber Admin to 4.0.1 or newer.
Full record and what to do →NVD record wpscan.com
Nov 7, 2026Fiber Admin: Does not validate or escape a request header before writing it into a PHP file it regenerates on an unprotected admin hookCVE-2026-121491 · WordPress plugins & themes · reported by WPScanCritical 9
The Fiber Admin WordPress plugin before 4.0.1 does not validate or escape a request header before writing it into a PHP file it regenerates on an unprotected admin hook, allowing unauthenticated attackers to execute arbitrary code when its custom database error page is enabled and they win a race against an administrator saving its settings.
Product
Fiber Admin
Fixed in
4.0.1
What to do
Update Fiber Admin to 4.0.1 or newer.
Full record and what to do →NVD record wpscan.com
Nov 7, 2026Tournamatch: Does not restrict access to its team invitation listingCVE-2026-121380 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Tournamatch WordPress plugin before 4.7.1 does not restrict access to its team invitation listing, allowing unauthenticated users to retrieve the email addresses of people invited to join teams.
Product
Tournamatch
Fixed in
4.7.1
What to do
Update Tournamatch to 4.7.1 or newer.
Full record and what to do →NVD record wpscan.com
Nov 7, 2026Tournamatch: Does not validate or restrict the path of a previously stored profile or team image before deleting itCVE-2026-121379 · WordPress plugins & themes · reported by WPScanCritical 9.6
The Tournamatch WordPress plugin before 4.7.1 does not validate or restrict the path of a previously stored profile or team image before deleting it when a new image is uploaded, allowing users with a role as low as Subscriber to delete arbitrary files on the server, such as wp-config.php, which can lead to a full site takeover.
Product
Tournamatch
Fixed in
4.7.1
What to do
Update Tournamatch to 4.7.1 or newer.
Full record and what to do →NVD record wpscan.com
Nov 7, 2026Live Composer: Does not escape a pagination setting supplied through its post-listing module shortcodes before outputting it in an HTML attributeCVE-2026-119073 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Live Composer WordPress plugin before 2.1.23 does not escape a pagination setting supplied through its post-listing module shortcodes before outputting it in an HTML attribute, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
Live Composer
Fixed in
2.1.23
What to do
Update Live Composer to 2.1.23 or newer.
Full record and what to do →NVD record wpscan.com
Nov 7, 2026Directorist: AI-Powered Business Directory, Listings & Classified Ads: Does not verify that the order targeted by its checkout payment-retry REST action belongs to the requesting userCVE-2026-118534 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.11 does not verify that the order targeted by its checkout payment-retry REST action belongs to the requesting user, allowing any authenticated user, such as a subscriber, to create payment-attempt records against other users' orders.
Product
Directorist: AI-Powered Business Directory, Listings & Classified Ads
Fixed in
8.11
What to do
Update Directorist: AI-Powered Business Directory, Listings & Classified Ads to 8.11 or newer.
Full record and what to do →NVD record wpscan.com
Nov 7, 2026Directorist: AI-Powered Business Directory, Listings & Classified Ads: Does not verify that the user requesting an order's payment receipt owns that orderCVE-2026-118533 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.11 does not verify that the user requesting an order's payment receipt owns that order, allowing any authenticated user, such as a subscriber, to disclose other users' order and payment information, including amounts, payment method, payment status and transaction ID.
Product
Directorist: AI-Powered Business Directory, Listings & Classified Ads
Fixed in
8.11
What to do
Update Directorist: AI-Powered Business Directory, Listings & Classified Ads to 8.11 or newer.
Full record and what to do →NVD record wpscan.com
Nov 7, 2026Directorist: AI-Powered Business Directory, Listings & Classified Ads: Does not verify ownership of attachment IDs suppliedCVE-2026-118532 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.11 does not verify ownership of attachment IDs supplied when updating a listing's images, allowing authenticated users with Subscriber-level access and above to permanently delete arbitrary media library attachments, including those uploaded by administrators, along with their files.
Product
Directorist: AI-Powered Business Directory, Listings & Classified Ads
Fixed in
8.11
What to do
Update Directorist: AI-Powered Business Directory, Listings & Classified Ads to 8.11 or newer.
Full record and what to do →NVD record wpscan.com
Nov 7, 2026Directorist: AI-Powered Business Directory, Listings & Classified Ads: Does not check that the acting user may edit each targeted userCVE-2026-118530 · WordPress plugins & themes · reported by WPScanMedium 5
The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.11 does not check that the acting user may edit each targeted user when handling an email-verification bulk action on multisite, allowing an Administrator of one site on the network to lock out users of other sites, including the network Super Administrator, until they re-verify their email.
Product
Directorist: AI-Powered Business Directory, Listings & Classified Ads
Fixed in
8.11
What to do
Update Directorist: AI-Powered Business Directory, Listings & Classified Ads to 8.11 or newer.
Full record and what to do →NVD record wpscan.com
Nov 7, 2026Directorist: AI-Powered Business Directory, Listings & Classified Ads: Does not verify that a user owns a listing before processing a featured-listing checkout for itCVE-2026-118529 · WordPress plugins & themes · reported by WPScanLow 3.1
The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.11 does not verify that a user owns a listing before processing a featured-listing checkout for it, allowing any authenticated user, such as a subscriber, to publish and feature another user's pending listing when the featured listing fee is set to zero.
Product
Directorist: AI-Powered Business Directory, Listings & Classified Ads
Fixed in
8.11
What to do
Update Directorist: AI-Powered Business Directory, Listings & Classified Ads to 8.11 or newer.
Full record and what to do →NVD record wpscan.com
Nov 7, 2026Directorist: AI-Powered Business Directory, Listings & Classified Ads: Does not validate that the requesting user owns the referenced listing before returning its metadata via an AJAX actionCVE-2026-118528 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.11 does not validate that the requesting user owns the referenced listing before returning its metadata via an AJAX action, allowing authenticated attackers with Subscriber-level access and above to disclose another user's private and unpublished draft listing details, including contact information.
Product
Directorist: AI-Powered Business Directory, Listings & Classified Ads
Fixed in
8.11
What to do
Update Directorist: AI-Powered Business Directory, Listings & Classified Ads to 8.11 or newer.
Full record and what to do →NVD record wpscan.com
Nov 7, 2026FV Flowplayer Video Player: Does not escape shortcode attribute values embedded in comments before rendering them into the media player markupCVE-2026-117525 · WordPress plugins & themes · reported by WPScanHigh 7.5
The FV Flowplayer Video Player WordPress plugin before 7.5.57.7212 does not escape shortcode attribute values embedded in comments before rendering them into the media player markup, allowing an unauthenticated visitor to store a script payload in a comment that executes in the session of any visitor, including an administrator, who plays the commented video, when the non-default comment-shortcode-parsing setting is enabled.
Product
FV Flowplayer Video Player
Fixed in
7.5.57.7212
What to do
Update FV Flowplayer Video Player to 7.5.57.7212 or newer.
Full record and what to do →NVD record wpscan.com
Nov 7, 2026Live Composer: Does not sanitise and escape some of its custom post type slug settings before using them in front-end linksCVE-2025-15708 · WordPress plugins & themes · reported by WPScanLow 3.5
The Live Composer WordPress plugin before 2.1.23 does not sanitise and escape some of its custom post type slug settings before using them in front-end links, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in a multisite setup).
Product
Live Composer
Fixed in
2.1.23
What to do
Update Live Composer to 2.1.23 or newer.
Full record and what to do →NVD record wpscan.com
Nov 7, 2026TranslatePress – Translate Multilingual sites with AI Translation: Stored Cross-Site ScriptingCVE-2026-119167 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 3.3.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires that at least one prior comment from the attacker's name and email pair has been approved under WordPress's default comment_previously_approved moderation setting, and that a secondary language is configured in TranslatePress.
Product
TranslatePress – Translate Multilingual sites with AI Translation
Affected
up to 3.3.8
What to do
Affects up to 3.3.8. Update TranslatePress – Translate Multilingual sites with AI Translation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 7, 2026Redux Framework: Authorization bypassCVE-2026-110705 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Redux Framework plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5.16. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to export the entire Redux options panel configuration — including API keys, SMTP credentials, licence keys, and third-party tokens — that is otherwise restricted to administrators. Exploitation requires that a theme or plugin registers a Redux import_export field on a user profile via Redux_Users::set_profile(), which causes the nonce to be printed into the subscriber's own /wp-admin/profile.php page source, making it directly readable without any additional privileges.
Product
Redux Framework
Affected
up to 4.5.16
What to do
Affects up to 4.5.16. Update Redux Framework to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Nov 6, 2026QODE Wishlist for WooCommerce: Stored Cross-Site ScriptingCVE-2026-121516 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The QODE Wishlist for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'qode_wishlist_for_woocommerce_guests_items' parameter in all versions up to, and including, 1.2.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable by guests because the required wp_rest nonce is publicly emitted to unauthenticated visitors on the /wishlist/ page, and the attacker controls the transient key, meaning the payload is stored site-wide and only requires a victim to open a crafted share URL and click the injected title link. Successful exploitation additionally requires an action by an administrator — the attacker cannot trigger the vulnerability on their own.
Product
QODE Wishlist for WooCommerce
Affected
up to 1.2.9
What to do
Affects up to 1.2.9. Update QODE Wishlist for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 6, 2026Jupiter X Core: Authorization bypassCVE-2026-120737 · WordPress plugins & themes · reported by WordfenceMedium 5.9
The Jupiter X Core plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.62.0 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to enumerate and render arbitrary published post types not intended for public listing — including Flamingo CF7 submission records containing submitter names, email addresses, phone numbers, full messages, and IP addresses — and perform meta_query boolean-oracle reads against the postmeta of any published post. Exploitation requires that a Posts or Advanced Posts widget on the site has 'Is Archive Template' enabled, which is the standard Jupiter X archive-template configuration used by most Jupiter X sites; additionally, the nonce verified by the second endpoint is minted via wp_create_nonce and printed on every frontend page as ravenTools.nonce, rendering it ineffective as an authorization barrier.
Product
Jupiter X Core
Affected
up to 4.62.0
What to do
Affects up to 4.62.0. Update Jupiter X Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 6, 2026Greenshift – animation and page builder blocks: Sensitive Information ExposureCVE-2026-120520 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 13.2.2 via the 'img (or any key the publisher references in {{GET:key}})' parameter. This makes it possible for unauthenticated attackers to extract authenticated users' HttpOnly WordPress session cookies, specifically wordpress_logged_in_* tokens, by injecting a nested {{COOKIE:}} placeholder via a GET parameter that causes the victim's browser to transmit the cookie value to an attacker-controlled host as an image src URL. Exploitation requires that a site publisher has configured a public GreenShift Element image block whose src attribute contains a {{GET:}} placeholder, and that a logged-in user can be induced to open the attacker's crafted link — neither condition is part of the plugin's default state.
Product
Greenshift – animation and page builder blocks
Affected
up to 13.2.2
What to do
Affects up to 13.2.2. Update Greenshift – animation and page builder blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 6, 2026Greenshift – animation and page builder blocks: Stored DOM-Based Cross-Site ScriptingCVE-2026-119218 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'url (comment_author_url)' parameter in all versions up to, and including, 13.2.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the affected page to be configured with a GreenShift Interaction Layer attach-attribute action that copies a comment-author anchor's href into a Counter block's data-prefix or data-postfix attribute; given that configuration, the payload executes for every visitor who loads the Counter into the viewport once the comment is published.
Product
Greenshift – animation and page builder blocks
Affected
up to 13.2.2
What to do
Affects up to 13.2.2. Update Greenshift – animation and page builder blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 6, 2026Fluent Support – Helpdesk & Customer Support Ticket System: Unauthenticated modification of a linked customer's stored profile fieldsCVE-2026-119213 · WordPress plugins & themes · reported by WordfenceLow 3.7
The Fluent Support – Helpdesk & Customer Support Ticket System plugin for WordPress is vulnerable to unauthenticated modification of a linked customer's stored profile fields in versions up to, and including, 2.4.7 Its first-party Fluent Forms integration (FeedIntegration::notify()) opens a ticket from each public form submission and, for a logged-out submitter, resolves the submitted email to an existing WordPress account via get_user_by('email', ...) without verifying the submitter controls that address, then passes the attacker-supplied data to Customer::maybeCreateCustomer(). This makes it possible for unauthenticated attackers to overwrite a limited set of a registered customer's stored profile fields where an administrator has enabled a FluentSupport feed on a public form. The email address, role and status are never changed; first and last name are overwritten only when the target user has no name set in user meta; and other fields (title, address, city, state, zip, country) are writable only where an administrator has mapped them in the feed.
Product
Fluent Support – Helpdesk & Customer Support Ticket System
Affected
up to 2.4.7
What to do
Affects up to 2.4.7. Update Fluent Support – Helpdesk & Customer Support Ticket System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 6, 2026Appointment Booking Plugin – LatePoint | Calendar & Scheduling for: Stored Cross-Site ScriptingCVE-2026-119152 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'customer[email] (inside params)' parameter in all versions up to, and including, 5.7.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. An unauthenticated visitor can exploit this by registering as a LatePoint customer via the public booking form — receiving an active customer session with no WordPress account — and then submitting a quoted local-part email address containing an HTML payload (e.g. a tag with no spaces) that passes FILTER_VALIDATE_EMAIL but is stored and rendered unescaped.
Product
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for
Affected
up to 5.7.6
What to do
Affects up to 5.7.6. Update Appointment Booking Plugin – LatePoint | Calendar & Scheduling for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 6, 2026JS Help Desk – AI-Powered Support & Ticketing System: Stored DOM-Based Cross-Site ScriptingCVE-2026-118046 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The JS Help Desk – AI-Powered Support & Ticketing System plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'jsticket_message' parameter in all versions up to, and including, 5.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload fires specifically when an administrator or agent opens the affected ticket and the page initializes VenoBox, which reads the browser-decoded data-title attribute and passes it to jQuery .html(), making routine ticket review the trigger condition.
Product
JS Help Desk – AI-Powered Support & Ticketing System
Affected
up to 5.0.2
What to do
Affects up to 5.0.2. Update JS Help Desk – AI-Powered Support & Ticketing System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record downloads.wordpress.org plugins.trac.wordpress.org
Nov 6, 2026Motors – Car Dealership & Classified Listings: Stored Cross-Site ScriptingCVE-2026-116562 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'stm_f_s[make]' parameter in all versions up to, and including, 1.4.128 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the Free Listing Submission feature to be enabled, which is shipped on by default via the Setup Wizard demo configuration.
Product
Motors – Car Dealership & Classified Listings
Affected
up to 1.4.128
What to do
Affects up to 1.4.128. Update Motors – Car Dealership & Classified Listings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.svn.wordpress.org plugins.trac.wordpress.org
Nov 6, 2026MC4WP: Missing AuthorizationCVE-2026-27356 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in ibericode MC4WP mailchimp-for-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MC4WP: from n/a through 4.14.1.
Product
MC4WP
Affected
up to 4.14.1
What to do
Affects up to 4.14.1. Update MC4WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 6, 2026myCred: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)CVE-2026-123471 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in myCred myCred mycred allows Code Injection.This issue affects myCred: from n/a through 4.0.2.
Product
myCred
Affected
up to 4.0.2
What to do
Affects up to 4.0.2. Update myCred to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 6, 2026Polylang: Missing AuthorizationCVE-2026-122670 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in WP SYNTEX Polylang polylang allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Polylang: from n/a through 3.9.
Product
Polylang
Affected
up to 3.9
What to do
Affects up to 3.9. Update Polylang to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 6, 2026PublishPress Revisions: Missing AuthorizationCVE-2026-120851 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in PublishPress PublishPress Revisions revisionary allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PublishPress Revisions: from n/a through 4.2.0.
Product
PublishPress Revisions
Affected
up to 4.2.0
What to do
Affects up to 4.2.0. Update PublishPress Revisions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 6, 2026Smush Image Compression and Optimization: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-120845 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPMU DEV Smush Image Compression and Optimization wp-smushit allows Stored XSS.This issue affects Smush Image Compression and Optimization: from n/a through 4.3.5.
Product
Smush Image Compression and Optimization
Affected
up to 4.3.5
What to do
Affects up to 4.3.5. Update Smush Image Compression and Optimization to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 6, 2026Royal Elementor Addons: Missing AuthorizationCVE-2026-119519 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WProyal Royal Elementor Addons royal-elementor-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Royal Elementor Addons: from n/a through 1.7.1068.
Product
Royal Elementor Addons
Affected
up to 1.7.1068
What to do
Affects up to 1.7.1068. Update Royal Elementor Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 6, 2026Upsell Order Bump Offer for WooCommerce: Missing AuthorizationCVE-2026-115431 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Missing Authorization vulnerability in WP Swings Upsell Order Bump Offer for WooCommerce upsell-order-bump-offer-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Upsell Order Bump Offer for WooCommerce: from n/a through 3.1.6.
Product
Upsell Order Bump Offer for WooCommerce
Affected
up to 3.1.6
What to do
Affects up to 3.1.6. Update Upsell Order Bump Offer for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 6, 2026Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI: Insecure Direct Object ReferenceCVE-2026-89101 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.6.2 via the get_entry due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with custom-level access and above, to view, read, and permanently delete forms and entries belonging to any other user — including personally identifiable information submitted through public contact and lead forms — regardless of form ownership.
Product
Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI
Affected
up to 3.6.2
What to do
Affects up to 3.6.2. Update Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 6, 2026All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos: Stored DOM-Based Cross-Site ScriptingCVE-2026-116545 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'custom_fields[].value.label (for key='track')' parameter in all versions up to, and including, 5.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the site's Player Library option to be configured as Plyr/Vidstack (aiovg_player_settings[player]='vidstack') rather than the Video.js default, as the DOM innerHTML sink exists only in the Plyr/Vidstack template path.
Product
All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos
Affected
up to 5.0.0
What to do
Affects up to 5.0.0. Update All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 6, 2026ELEX WordPress HelpDesk & Customer Ticketing System: Arbitrary file deletionCVE-2026-114630 · WordPress plugins & themes · reported by WordfenceCritical 9.1
The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the factory_reset function in all versions up to, and including, 3.3.8 This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). This vulnerability is exploitable via a two-step chain: an unauthenticated attacker first stores an arbitrary ticket_attachment_path value by submitting a ticket through the nopriv eh_crm_new_ticket_post AJAX endpoint (whose nonce is publicly exposed via the [wsdesk_support] shortcode), then triggers the factory_reset routine via a GET request to wp-admin/admin.php?page=wsdesk_factory_reset, which is guarded only by is_admin() — a request-type check — rather than a capability check, causing unlink() to be called on the attacker-supplied path.
Product
ELEX WordPress HelpDesk & Customer Ticketing System
Affected
up to 3.3.8
What to do
Affects up to 3.3.8. Update ELEX WordPress HelpDesk & Customer Ticketing System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 6, 2026WPSyncSheets For Contact Form 7 – CF7 Google Sheets Connector & Save to Database: Remote Code ExecutionCVE-2026-104010 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The WPSyncSheets For Contact Form 7 – CF7 Google Sheets Connector & Save to Database plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.8.0 via the 'any non-system CF7 field (e.g., your-message)' parameter parameter. This is due to insufficient sanitization of CF7 submission field values before database storage and the absence of an allowed_classes restriction on maybe_unserialize() during admin retrieval. This makes it possible for unauthenticated attackers to execute code on the server. Successful exploitation of the remote code execution gadget chain requires that a Google Sheets access token be configured in the plugin (its primary advertised feature), as this triggers autoloading of the bundled Monolog 2.10.0 library whose classes form the exploitable gadget chain; however, the underlying PHP Object Injection occurs regardless.
Product
WPSyncSheets For Contact Form 7 – CF7 Google Sheets Connector & Save to Database
Affected
up to 1.8.0
What to do
Affects up to 1.8.0. Update WPSyncSheets For Contact Form 7 – CF7 Google Sheets Connector & Save to Database to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 6, 2026The AMP for WP – Accelerated Mobile Pages: Arbitrary shortcode executionCVE-2026-103908 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.1.18. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for authenticated attackers, with custom-level access and above, to execute arbitrary shortcodes. The vulnerable output block is gated by the 'ampforwp-cat-description' setting, which is enabled by default, meaning the vast majority of installations are affected without any additional configuration change.
Product
The AMP for WP – Accelerated Mobile Pages
Affected
up to 1.1.18
What to do
Affects up to 1.1.18. Update The AMP for WP – Accelerated Mobile Pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 6, 2026Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping, AI & Social Channels: PHP Code InjectionCVE-2026-87964 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping, AI & Social Channels plugin for WordPress is vulnerable to PHP Code Injection in all versions up to, and including, 8.0.26. This is due to insufficient sanitization of the `feedConfigCustom2` parameter — only `wp_unslash()` is applied before the value is stored verbatim via `update_option()`, and during feed generation the `Custom2Template::evaluate_return()` method passes the stored `{(return ...)}` template expressions directly to PHP's `eval()` function without any code-level sanitization. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to inject and execute arbitrary PHP code on the server, escalating their privileges beyond what the role normally permits to full remote code execution and site takeover. The `ctxfeed_custom2_eval_enabled` option defaults to `true`, meaning no additional administrator configuration is required for this attack path to be exploitable out of the box.
Product
Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping, AI & Social Channels
Affected
up to 8.0.26
What to do
Affects up to 8.0.26. Update Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping, AI & Social Channels to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 6, 2026Redirection for Contact Form 7: Authorization bypassCVE-2026-120659 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Redirection for Contact Form 7 plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.2.14 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to write arbitrary post meta values to newly created lead posts and copy arbitrary server-side files with allowed MIME-type extensions into the plugin's uploads directory. Exploitation requires a published Contact Form 7 form configured with the Save Entry (Save Lead) action enabled on the target site.
Product
Redirection for Contact Form 7
Affected
up to 3.2.14
What to do
Affects up to 3.2.14. Update Redirection for Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 6, 2026VOD Infomaniak: Authorization bypassCVE-2026-115831 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The VOD Infomaniak plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.5.15. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to initiate unauthorized video imports using the site owner's Infomaniak API credentials, consume the site owner's VOD account quota, and insert arbitrary rows into the wp_vod_upload table causing public shortcodes to resolve to attacker-chosen video content. This action is explicitly reserved for Contributor-level and above by the plugin's own role-rights system, meaning subscriber access is intentionally forbidden by design — the AJAX handler simply omits the enforcement.
Product
VOD Infomaniak
Affected
up to 1.5.15
What to do
Affects up to 1.5.15. Update VOD Infomaniak to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 6, 2026YaySMTP – WP Mail SMTP with Email Logs, Tracking & Reports: Time-based SQL InjectionCVE-2026-109977 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The YaySMTP – WP Mail SMTP with Email Logs, Tracking & Reports plugin for WordPress is vulnerable to time-based SQL Injection via the 'params[searchKey]' parameter in all versions up to, and including, 2.7.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
YaySMTP – WP Mail SMTP with Email Logs, Tracking & Reports
Affected
up to 2.7.8
What to do
Affects up to 2.7.8. Update YaySMTP – WP Mail SMTP with Email Logs, Tracking & Reports to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 6, 2026Travelly – Tour & Travel Booking Manager for WooCommerce: Authorization bypassCVE-2026-121794 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Travelly – Tour & Travel Booking Manager for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.3.11 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to view stored WooCommerce payment gateway credentials — including PayPal API username, password, and signature, as well as Stripe test and live secret keys — injected verbatim into the HTML response of the tour edit screen. The credentials are present in the raw HTTP response regardless of the modal's CSS visibility state, making them trivially accessible by viewing page source.
Product
Travelly – Tour & Travel Booking Manager for WooCommerce
Affected
up to 2.3.11
What to do
Affects up to 2.3.11. Update Travelly – Tour & Travel Booking Manager for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Nov 6, 2026Posts Table with Search & Sort: Stored Cross-Site ScriptingCVE-2026-118189 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Posts Table with Search & Sort plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'date_format' parameter in all versions up to, and including, 1.4.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload bypasses wp_kses_post at save time because it contains no literal angle bracket characters; the malicious HTML tags are only reconstructed at render time, making this exploitable by Contributors who would ordinarily lack the unfiltered_html capability.
Product
Posts Table with Search & Sort
Affected
up to 1.4.14
What to do
Affects up to 1.4.14. Update Posts Table with Search & Sort to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 6, 2026Graphina – Charts and Graphs For Elementor: Stored Cross-Site ScriptingCVE-2026-110291 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Graphina – Charts and Graphs For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'iq_tree_chart_node_font_family (and any text control serialized into chart_data['settings'])' parameter in all versions up to, and including, 3.1.13 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Elementor's Utils::kses_post_deep() does not strip the attack payload on save because the payload contains no disallowed HTML tags — only a single quote and an event-handler fragment — allowing the malicious value to survive persistence.
Product
Graphina – Charts and Graphs For Elementor
Affected
up to 3.1.13
What to do
Affects up to 3.1.13. Update Graphina – Charts and Graphs For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 6, 2026The MDJM Event Management and Mobile Events Manager WordPress plugins through 1.7.8.7 do not check a capability or a nonce before creating a WordPress role fromCVE-2026-88801 · WordPress plugins & themes · reported by WPScanHigh 8
The MDJM Event Management and Mobile Events Manager WordPress plugins through 1.7.8.7 do not check a capability or a nonce before creating a WordPress role from a name supplied in the request, and store that name without escaping it, allowing any authenticated user, such as a subscriber, to inject arbitrary web scripts which execute when an administrator opens one of the standard user management screens.
Affected
up to 1.7.8.7
What to do
Affects up to 1.7.8.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Nov 6, 2026The MDJM Event Management and Mobile Events Manager WordPress plugins through 1.7.8.7 act on a role deletion request on every page load with no capability checkCVE-2026-88800 · WordPress plugins & themes · reported by WPScanCritical 9.1
The MDJM Event Management and Mobile Events Manager WordPress plugins through 1.7.8.7 act on a role deletion request on every page load with no capability check and no nonce, and the guard meant to protect roles that have users assigned reads a different part of the request from the one that selects what is deleted, allowing unauthenticated attackers to remove any WordPress role including administrator, which permanently strips every user of their capabilities.
Affected
up to 1.7.8.7
What to do
Affects up to 1.7.8.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Nov 6, 2026The MDJM Event Management and Mobile Events Manager WordPress plugins through 1.7.8.7 do not check ownership or capability on the identifier supplied to their cCVE-2026-88799 · WordPress plugins & themes · reported by WPScanHigh 8.8
The MDJM Event Management and Mobile Events Manager WordPress plugins through 1.7.8.7 do not check ownership or capability on the identifier supplied to their client profile update, allowing any authenticated user, such as a subscriber, to change the password and email address of any other account including an administrator, resulting in a full account takeover.
Affected
up to 1.7.8.7
What to do
Affects up to 1.7.8.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Nov 6, 2026WCFM Membership: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-39744 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WC Lovers WCFM Membership wc-multivendor-membership allows Stored XSS.This issue affects WCFM Membership: from n/a through 2.12.0.
Product
WCFM Membership
Affected
up to 2.12.0
What to do
Affects up to 2.12.0. Update WCFM Membership to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 6, 2026Quick Event Manager: Does not verify the authenticity of PayPal payment notifications before marking event registrationsCVE-2026-121636 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Quick Event Manager WordPress plugin before 9.19 does not verify the authenticity of PayPal payment notifications before marking event registrations as paid, which could allow unauthenticated attackers to mark registrations as paid without making a payment.
Product
Quick Event Manager
Fixed in
9.19
What to do
Update Quick Event Manager to 9.19 or newer.
Full record and what to do →NVD record wpscan.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.