Updated 10 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

457new WordPress flaws this week

390,525entries in the database

9,227 results · page 4 of 185

Oct 16, 2026Simply Schedule Appointments: Stored Cross-Site ScriptingCVE-2026-104000 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Simply Schedule Appointments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'status' parameter in all versions up to, and including, 1.6.12.35 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The malicious payload is stored unconditionally because debug logging is enabled by default, and the debug-log viewer is accessible to anyone holding the site-wide Support PIN (an HMAC-MD5 of AUTH_SALT displayed in wp-admin), meaning the injected script will execute against the administrator's session during ordinary support or troubleshooting workflows.
Product
Simply Schedule Appointments
Affected
up to 1.6.12.35
What to do
Affects up to 1.6.12.35. Update Simply Schedule Appointments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 16, 2026MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc.: Privilege EscalationCVE-2026-109515 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc. plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.2.78.6 This is due to the `subscribe_to_email_list` endpoint accepting an attacker-supplied `optin_data[form_custom_field_mappings]` parameter without any allow-list validation on destination keys, allowing the attacker-controlled mapping to override the administrator's saved mapping and pass arbitrary `wp_users` column names — including `ID` and `user_pass` — directly into `wp_insert_user()` via the `subscribe()` function. This makes it possible for unauthenticated attackers to force `wp_insert_user()` into UPDATE mode on any existing account by supplying a target user's numeric `ID`, overwrite that account's password with a pre-hashed value of their choosing, and thereby take over any WordPress user account — including administrators — leading to full site compromise. Exploitation requires that a WordPress User Registration opt-in form is published somewhere on the site, though the form's UUID is visible in page source and no authentication, nonce, or capability check is required to reach the
Product
MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc.
Affected
up to 1.2.78.6
What to do
Affects up to 1.2.78.6. Update MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc. to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 16, 2026FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler: Insecure Direct Object ReferenceCVE-2026-103525 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.7.0 via the 'order_id + billing_address_id (also shipping_address_id)' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to read and exfiltrate another customer's stored billing and shipping address PII — including street address, city, state, postcode, phone number, company name, VAT number, and legal registration ID — by enumerating sequential AUTO_INCREMENT order and address ID pairs. The id-equality guard intended to restrict address reuse is bypassed because the attacker controls both halves of the compared pair, and the unauthenticated AJAX entry point imposes only a soft rate limit of 5 requests per 60 seconds rather than any authentication or ownership check.
Product
FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler
Affected
up to 1.7.0
What to do
Affects up to 1.7.0. Update FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 16, 2026Dark Mode – Improve Accessibility with AI Powered Dark: Stored Cross-Site ScriptingCVE-2026-93535 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Dark Mode – Improve Accessibility with AI Powered Dark Theme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'icon_light' Shortcode Attribute in all versions up to, and including, 5.3.17 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Dark Mode – Improve Accessibility with AI Powered Dark
Affected
up to 5.3.17
What to do
Affects up to 5.3.17. Update Dark Mode – Improve Accessibility with AI Powered Dark to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 16, 2026Flying Scripts: Delay JavaScript to Improve Site Speed & Performance: Stored Cross-Site ScriptingCVE-2026-109990 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Flying Scripts: Delay JavaScript to Improve Site Speed & Performance plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 1.2.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit bypasses WordPress core's save-time kses sanitization entirely because the payload uses only kses-allowed elements — an <abbr title> attribute and <code> text content — and the XSS is introduced post-save when the plugin's output-buffer rewriter substitutes a double-quote-bearing <code> body into the <abbr title> attribute via predictable, unsalted ___noise___ placeholder keys.
Product
Flying Scripts: Delay JavaScript to Improve Site Speed & Performance
Affected
up to 1.2.4
What to do
Affects up to 1.2.4. Update Flying Scripts: Delay JavaScript to Improve Site Speed & Performance to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 16, 2026FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler: Generic SQL InjectionCVE-2026-103518 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler plugin for WordPress is vulnerable to generic SQL Injection via the 'products[*].variants[*].<attacker-chosen key>' parameter in all versions up to, and including, 1.7.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with custom-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. On FluentCart Pro installs, non-administrator users assigned the Manager shop role also hold the products/edit permission and are therefore able to exploit this vulnerability without administrator-level access.
Product
FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler
Affected
up to 1.7.0
What to do
Affects up to 1.7.0. Update FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 15, 2026Download Monitor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-110375 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Download Monitor download-monitor allows Stored XSS.This issue affects Download Monitor: from n/a through 5.3.3.
Product
Download Monitor
Affected
up to 5.3.3
What to do
Affects up to 5.3.3. Update Download Monitor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 15, 2026Presto Player: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-109893 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force Presto Player presto-player allows Stored XSS.This issue affects Presto Player: from n/a through 4.5.3.
Product
Presto Player
Affected
up to 4.5.3
What to do
Affects up to 4.5.3. Update Presto Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 15, 2026YITH WooCommerce Compare: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-106604 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in YITH YITH WooCommerce Compare yith-woocommerce-compare allows Stored XSS.This issue affects YITH WooCommerce Compare: from n/a through 3.15.0.
Product
YITH WooCommerce Compare
Affected
up to 3.15.0
What to do
Affects up to 3.15.0. Update YITH WooCommerce Compare to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 15, 2026JetSmartFilters: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-110890 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetSmartFilters jet-smart-filters allows Stored XSS.This issue affects JetSmartFilters: from n/a through 3.8.6.
Product
JetSmartFilters
Affected
up to 3.8.6
What to do
Affects up to 3.8.6. Update JetSmartFilters to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 15, 2026Simply Schedule Appointments: Authorization Bypass Through User-Controlled KeyCVE-2026-110381 · WordPress plugins & themes · reported by PatchstackMedium 6.3
Authorization Bypass Through User-Controlled Key vulnerability in NSquared Simply Schedule Appointments simply-schedule-appointments allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simply Schedule Appointments: from n/a through 1.6.12.35.
Product
Simply Schedule Appointments
Affected
up to 1.6.12.35
What to do
Affects up to 1.6.12.35. Update Simply Schedule Appointments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 15, 2026MDTF: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-108175 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PluginUs.Net MDTF wp-meta-data-filter-and-taxonomy-filter allows Stored XSS.This issue affects MDTF: from n/a through 1.4.0.
Product
MDTF
Affected
up to 1.4.0
What to do
Affects up to 1.4.0. Update MDTF to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 15, 2026Booking and Rental Manager: Improper Validation of Specified Quantity in InputCVE-2026-103350 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Improper Validation of Specified Quantity in Input vulnerability in Magepeople inc. Booking and Rental Manager booking-and-rental-manager-for-woocommerce allows Removing Important Client Functionality.This issue affects Booking and Rental Manager: from n/a through 2.8.0.
Product
Booking and Rental Manager
Affected
up to 2.8.0
What to do
Affects up to 2.8.0. Update Booking and Rental Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 15, 2026XStore: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-105065 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 8theme.com XStore xstore allows Reflected XSS.This issue affects XStore: from n/a before 9.7.9.
Product
XStore
Fixed in
9.7.9
What to do
Update XStore to 9.7.9 or newer.
Full record and what to do →NVD record patchstack.com
Oct 15, 2026Social Share Buttons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-109702 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in maxfoundry Social Share Buttons share-button allows Stored XSS.This issue affects Social Share Buttons: from n/a through 1.31.
Product
Social Share Buttons
Affected
up to 1.31
What to do
Affects up to 1.31. Update Social Share Buttons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 15, 2026Mang Board WP: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-109698 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Kitae Park Mang Board WP mangboard allows SQL Injection.This issue affects Mang Board WP: from n/a through 2.4.4.
Product
Mang Board WP
Affected
up to 2.4.4
What to do
Affects up to 2.4.4. Update Mang Board WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 15, 2026Link Whisper Free: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-109688 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Link Whisper INC Link Whisper Free link-whisper allows Blind SQL Injection.This issue affects Link Whisper Free: from n/a through 0.9.7.
Product
Link Whisper Free
Affected
up to 0.9.7
What to do
Affects up to 0.9.7. Update Link Whisper Free to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 15, 2026Link Whisper Free: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-109685 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Link Whisper INC Link Whisper Free link-whisper allows Reflected XSS.This issue affects Link Whisper Free: from n/a through 0.9.7.
Product
Link Whisper Free
Affected
up to 0.9.7
What to do
Affects up to 0.9.7. Update Link Whisper Free to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 15, 2026User Registration: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-105882 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGrill User Registration user-registration allows Stored XSS.This issue affects User Registration: from n/a through 5.2.8.
Product
User Registration
Affected
up to 5.2.8
What to do
Affects up to 5.2.8. Update User Registration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 15, 2026Broken Link Checker: Improper Control of Generation of Code ('Code Injection')CVE-2026-102389 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Control of Generation of Code ('Code Injection') vulnerability in WPMU DEV Broken Link Checker broken-link-checker allows Code Injection.This issue affects Broken Link Checker: from n/a through 2.4.14.1.
Product
Broken Link Checker
Affected
up to 2.4.14.1
What to do
Affects up to 2.4.14.1. Update Broken Link Checker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 15, 2026BSK PDF Manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-108498 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bannersky BSK PDF Manager bsk-pdf-manager allows Stored XSS.This issue affects BSK PDF Manager: from n/a through 3.8.1.
Product
BSK PDF Manager
Affected
up to 3.8.1
What to do
Affects up to 3.8.1. Update BSK PDF Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 15, 2026Amelia: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-108497 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TMS Amelia ameliabooking allows SQL Injection.This issue affects Amelia: from n/a through 2.4.10.
Product
Amelia
Affected
up to 2.4.10
What to do
Affects up to 2.4.10. Update Amelia to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 15, 2026Everest Forms: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-108491 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Everest Forms Everest Forms everest-forms allows Stored XSS.This issue affects Everest Forms: from n/a through 3.6.1.
Product
Everest Forms
Affected
up to 3.6.1
What to do
Affects up to 3.6.1. Update Everest Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 15, 2026Import and export users and customers: Stored Cross-Site ScriptingCVE-2026-17001 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Import and export users and customers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Custom Column User Meta Profile Fields in all versions up to, and including, 2.4.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with custom-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Import and export users and customers
Affected
up to 2.4.5
What to do
Affects up to 2.4.5. Update Import and export users and customers to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 14, 2026Best Payments Plugin for WP: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-108484 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPManageNinja Best Payments Plugin for WP wp-payment-form allows Stored XSS.This issue affects Best Payments Plugin for WP: from n/a through 4.6.27.
Product
Best Payments Plugin for WP
Affected
up to 4.6.27
What to do
Affects up to 4.6.27. Update Best Payments Plugin for WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 14, 2026Hippoo Mobile App for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-108483 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hippooo Hippoo Mobile App for WooCommerce hippoo allows Reflected XSS.This issue affects Hippoo Mobile App for WooCommerce: from n/a through 1.12.0.
Product
Hippoo Mobile App for WooCommerce
Affected
up to 1.12.0
What to do
Affects up to 1.12.0. Update Hippoo Mobile App for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 14, 2026MDTF: Improper Control of Generation of Code ('Code Injection')CVE-2026-108151 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Improper Control of Generation of Code ('Code Injection') vulnerability in PluginUs.Net MDTF wp-meta-data-filter-and-taxonomy-filter allows Code Injection.This issue affects MDTF: from n/a through 1.3.9.
Product
MDTF
Affected
up to 1.3.9
What to do
Affects up to 1.3.9. Update MDTF to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 14, 2026SimplyRETS Real Estate IDX: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-105066 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SimplyRETS SimplyRETS Real Estate IDX simply-rets allows Reflected XSS.This issue affects SimplyRETS Real Estate IDX: from n/a through 3.2.9.
Product
SimplyRETS Real Estate IDX
Affected
up to 3.2.9
What to do
Affects up to 3.2.9. Update SimplyRETS Real Estate IDX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 14, 2026Salevo: Improper Control of Generation of Code ('Code Injection')CVE-2026-103081 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Generation of Code ('Code Injection') vulnerability in VillaTheme Salevo woo-boost-sales allows Code Injection.This issue affects Salevo: from n/a through 1.3.0.
Product
Salevo
Affected
up to 1.3.0
What to do
Affects up to 1.3.0. Update Salevo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 14, 2026JetEngine: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-107870 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetEngine jet-engine allows DOM-Based XSS.This issue affects JetEngine: from n/a through 3.8.16.
Product
JetEngine
Affected
up to 3.8.16
What to do
Affects up to 3.8.16. Update JetEngine to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 14, 2026JetProductTables: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-107867 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetProductTables jet-product-tables allows Reflected XSS.This issue affects JetProductTables: from n/a through 1.2.4.
Product
JetProductTables
Affected
up to 1.2.4
What to do
Affects up to 1.2.4. Update JetProductTables to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 14, 2026WP w3all phpBB: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-107422 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in axew3.com WP w3all phpBB wp-w3all-phpbb-integration allows Stored XSS.This issue affects WP w3all phpBB: from n/a through 3.1.0.
Product
WP w3all phpBB
Affected
up to 3.1.0
What to do
Affects up to 3.1.0. Update WP w3all phpBB to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 14, 2026SureCart: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-105874 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force SureCart surecart allows Reflected XSS.This issue affects SureCart: from n/a through 4.9.3.
Product
SureCart
Affected
up to 4.9.3
What to do
Affects up to 4.9.3. Update SureCart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 14, 2026Modern Events Calendar Lite: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-105067 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Webnus Modern Events Calendar Lite modern-events-calendar-lite allows Blind SQL Injection.This issue affects Modern Events Calendar Lite: from n/a before 7.37.0.
Product
Modern Events Calendar Lite
Fixed in
7.37.0
What to do
Update Modern Events Calendar Lite to 7.37.0 or newer.
Full record and what to do →NVD record patchstack.com
Oct 14, 2026Email Template Customizer for WooCommerce: Improper Control of Generation of Code ('Code Injection')CVE-2026-103358 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Generation of Code ('Code Injection') vulnerability in VillaTheme Email Template Customizer for WooCommerce email-template-customizer-for-woo allows Code Injection.This issue affects Email Template Customizer for WooCommerce: from n/a through 1.3.4.
Product
Email Template Customizer for WooCommerce
Affected
up to 1.3.4
What to do
Affects up to 1.3.4. Update Email Template Customizer for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 14, 2026Paid Videochat Turnkey Site: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-107428 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VideoWhisper.com Paid Videochat Turnkey Site ppv-live-webcams allows Reflected XSS.This issue affects Paid Videochat Turnkey Site: from n/a through 7.5.12.
Product
Paid Videochat Turnkey Site
Affected
up to 7.5.12
What to do
Affects up to 7.5.12. Update Paid Videochat Turnkey Site to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 14, 2026CP Multi View Event Calendar: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-109901 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Codepeople CP Multi View Event Calendar cp-multi-view-calendar allows SQL Injection.This issue affects CP Multi View Event Calendar : from n/a through 1.4.41.
Product
CP Multi View Event Calendar
Affected
up to 1.4.41
What to do
Affects up to 1.4.41. Update CP Multi View Event Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 14, 2026Post Export Import with Media: PHP Object InjectionCVE-2026-104764 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Post Export Import with Media plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.17.1 via deserialization of untrusted input . This makes it possible for authenticated attackers, with administrator-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.
Product
Post Export Import with Media
Affected
up to 1.17.1
What to do
Affects up to 1.17.1. Update Post Export Import with Media to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.svn.wordpress.org plugins.trac.wordpress.org
Oct 14, 2026SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications: Privilege EscalationCVE-2026-104748 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.10.0 This is due to the `wp_ajax_nopriv_simpleform_wp_register` AJAX action lacking any capability check for role assignment and the `save_custom_fields_to_user_meta()` function using an exclusion list that omits `wp_capabilities`, combined with `get_form_settings()` returning a hard-coded defaults array that unconditionally enables meta writing regardless of the supplied `form_id`. This makes it possible for unauthenticated attackers to create a new Administrator-level WordPress account by supplying `wp_capabilities[administrator]=1` alongside standard registration fields. The nonce required by the endpoint is publicly emitted into the `front_end_data` JavaScript object on every front-end page via `wp_enqueue_scripts`, making it trivially obtainable by any unauthenticated visitor before submitting the malicious request.
Product
SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications
Affected
up to 3.10.0
What to do
Affects up to 3.10.0. Update SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.svn.wordpress.org plugins.trac.wordpress.org
Oct 13, 2026SureCart: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-109697 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force SureCart surecart allows Stored XSS.This issue affects SureCart: from n/a through 4.9.4.
Product
SureCart
Affected
up to 4.9.4
What to do
Affects up to 4.9.4. Update SureCart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 13, 2026Prime Slider – Addons For Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-109691 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BdThemes Prime Slider – Addons For Elementor bdthemes-prime-slider-lite allows Stored XSS.This issue affects Prime Slider – Addons For Elementor: from n/a through 4.7.1.
Product
Prime Slider – Addons For Elementor
Affected
up to 4.7.1
What to do
Affects up to 4.7.1. Update Prime Slider – Addons For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 13, 2026Link Whisper Free: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-109687 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Link Whisper INC Link Whisper Free link-whisper allows Blind SQL Injection.This issue affects Link Whisper Free: from n/a through 0.9.7.
Product
Link Whisper Free
Affected
up to 0.9.7
What to do
Affects up to 0.9.7. Update Link Whisper Free to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 13, 2026SureForms: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-108495 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force SureForms sureforms allows Stored XSS.This issue affects SureForms: from n/a through 2.12.7.
Product
SureForms
Affected
up to 2.12.7
What to do
Affects up to 2.12.7. Update SureForms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 13, 2026Premium Addons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-108490 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LeapWorx Premium Addons for Elementor premium-addons-for-elementor allows Stored XSS.This issue affects Premium Addons for Elementor: from n/a through 4.11.110.
Product
Premium Addons for Elementor
Affected
up to 4.11.110
What to do
Affects up to 4.11.110. Update Premium Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 13, 2026PowerPack Addons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-108488 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in IdeaBox Creations PowerPack Addons for Elementor powerpack-lite-for-elementor allows Stored XSS.This issue affects PowerPack Addons for Elementor: from n/a through 3.1.0.
Product
PowerPack Addons for Elementor
Affected
up to 3.1.0
What to do
Affects up to 3.1.0. Update PowerPack Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 13, 2026Books Gallery: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-108487 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Hossni Mubarak Books Gallery wp-books-gallery allows Stored XSS.This issue affects Books Gallery: from n/a through 4.8.4.
Product
Books Gallery
Affected
up to 4.8.4
What to do
Affects up to 4.8.4. Update Books Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 13, 2026WOLF: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-108179 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in PluginUs.Net WOLF bulk-editor allows Blind SQL Injection.This issue affects WOLF: from n/a through 1.1.1.
Product
WOLF
Affected
up to 1.1.1
What to do
Affects up to 1.1.1. Update WOLF to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 13, 2026User Registration: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-105881 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGrill User Registration user-registration allows Stored XSS.This issue affects User Registration: from n/a through 5.2.8.
Product
User Registration
Affected
up to 5.2.8
What to do
Affects up to 5.2.8. Update User Registration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 13, 2026Weaver Xtreme Theme Support: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-54870 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpweaver Weaver Xtreme Theme Support weaverx-theme-support allows Stored XSS.This issue affects Weaver Xtreme Theme Support: from n/a through 7.0.1.
Product
Weaver Xtreme Theme Support
Affected
up to 7.0.1
What to do
Affects up to 7.0.1. Update Weaver Xtreme Theme Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 13, 2026IMPress for IDX Broker: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-54869 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in IDX Broker IMPress for IDX Broker idx-broker-platinum allows Stored XSS.This issue affects IMPress for IDX Broker: from n/a through 3.3.1.
Product
IMPress for IDX Broker
Affected
up to 3.3.1
What to do
Affects up to 3.3.1. Update IMPress for IDX Broker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.