Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
4,273 results · page 4 of 86
Oct 15, 2026PlanetStudio Payment Gateway: Missing AuthorizationCVE-2026-110362 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Planet studio PlanetStudio Payment Gateway planetstudio-payment-gateway allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PlanetStudio Payment Gateway: from n/a through 1.3.3.
- Product
- PlanetStudio Payment Gateway
- Affected
- up to 1.3.3
- What to do
- Affects up to 1.3.3. Update PlanetStudio Payment Gateway to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 15, 2026Ajax Search Lite: Missing AuthorizationCVE-2026-110360 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WPdreams Ajax Search Lite ajax-search-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ajax Search Lite: from n/a through 4.14.5.
- Product
- Ajax Search Lite
- Affected
- up to 4.14.5
- What to do
- Affects up to 4.14.5. Update Ajax Search Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 15, 2026Strong Testimonials: Missing AuthorizationCVE-2026-109897 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in WP Chill Strong Testimonials strong-testimonials allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Strong Testimonials: from n/a through 3.3.12.
- Product
- Strong Testimonials
- Affected
- up to 3.3.12
- What to do
- Affects up to 3.3.12. Update Strong Testimonials to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 15, 2026Sunshine Photo Cart: Missing AuthorizationCVE-2026-109689 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WP Sunshine Sunshine Photo Cart sunshine-photo-cart allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sunshine Photo Cart: from n/a through 3.7.4.
- Product
- Sunshine Photo Cart
- Affected
- up to 3.7.4
- What to do
- Affects up to 3.7.4. Update Sunshine Photo Cart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 15, 2026Knowledge Base: Missing AuthorizationCVE-2026-108499 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WebberZone Knowledge Base knowledgebase allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Knowledge Base: from n/a through 3.2.0.
- Product
- Knowledge Base
- Affected
- up to 3.2.0
- What to do
- Affects up to 3.2.0. Update Knowledge Base to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 15, 2026WordLift: Missing AuthorizationCVE-2026-110891 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in WordLift Srl WordLift wordlift allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WordLift: from n/a through 3.54.15.
- Product
- WordLift
- Affected
- up to 3.54.15
- What to do
- Affects up to 3.54.15. Update WordLift to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 15, 2026AI Engine: Missing AuthorizationCVE-2026-110888 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Meow Apps AI Engine ai-engine allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AI Engine: from n/a through 3.8.3.
- Product
- AI Engine
- Affected
- up to 3.8.3
- What to do
- Affects up to 3.8.3. Update AI Engine to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 15, 2026Strong Testimonials: Missing AuthorizationCVE-2026-110371 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WP Chill Strong Testimonials strong-testimonials allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Strong Testimonials: from n/a through 3.3.12.
- Product
- Strong Testimonials
- Affected
- up to 3.3.12
- What to do
- Affects up to 3.3.12. Update Strong Testimonials to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 15, 2026APIExperts Square for WooCommerce: Missing AuthorizationCVE-2026-110367 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WPExperts APIExperts Square for WooCommerce woosquare allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects APIExperts Square for WooCommerce: from n/a through 4.7.5.
- Product
- APIExperts Square for WooCommerce
- Affected
- up to 4.7.5
- What to do
- Affects up to 4.7.5. Update APIExperts Square for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 15, 2026User Registration: Missing AuthorizationCVE-2026-109692 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Missing Authorization vulnerability in ThemeGrill User Registration user-registration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Registration: from n/a through 5.2.8.
- Product
- User Registration
- Affected
- up to 5.2.8
- What to do
- Affects up to 5.2.8. Update User Registration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 14, 2026Skydropx: Missing AuthorizationCVE-2026-108480 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Missing Authorization vulnerability in Skydropx Skydropx skydropx allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Skydropx: from n/a through 2.1.4.
- Product
- Skydropx
- Affected
- up to 2.1.4
- What to do
- Affects up to 2.1.4. Update Skydropx to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 14, 2026WP OAuth Server: Missing AuthorizationCVE-2026-107433 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in miniOrange WP OAuth Server miniorange-oauth-20-server allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP OAuth Server: from n/a through 6.4.0.
- Product
- WP OAuth Server
- Affected
- up to 6.4.0
- What to do
- Affects up to 6.4.0. Update WP OAuth Server to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 14, 2026Paid Videochat Turnkey Site: Missing AuthorizationCVE-2026-107426 · WordPress plugins & themes · reported by PatchstackHigh 7.3
Missing Authorization vulnerability in VideoWhisper.com Paid Videochat Turnkey Site ppv-live-webcams allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Paid Videochat Turnkey Site: from n/a through 7.5.12.
- Product
- Paid Videochat Turnkey Site
- Affected
- up to 7.5.12
- What to do
- Affects up to 7.5.12. Update Paid Videochat Turnkey Site to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 14, 2026Bus Ticket Booking with Seat Reservation: Missing AuthorizationCVE-2026-107425 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Magepeople inc. Bus Ticket Booking with Seat Reservation bus-ticket-booking-with-seat-reservation allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Bus Ticket Booking with Seat Reservation: from n/a through 5.9.7.
- Product
- Bus Ticket Booking with Seat Reservation
- Affected
- up to 5.9.7
- What to do
- Affects up to 5.9.7. Update Bus Ticket Booking with Seat Reservation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 14, 2026Push Notification for Post and BuddyPress: Missing AuthorizationCVE-2026-107417 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Muralidharan Ramasamy Push Notification for Post and BuddyPress push-notification-for-post-and-buddypress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Push Notification for Post and BuddyPress: from n/a through 3.23.
- Product
- Push Notification for Post and BuddyPress
- Affected
- up to 3.23
- What to do
- Affects up to 3.23. Update Push Notification for Post and BuddyPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 14, 2026WPForms Lite: Does not verify server-side that a payment was completed before accepting a submission on forms using its PayPal Commerce gatewayCVE-2026-82844 · WordPress plugins & themes · reported by WPScanMedium 5.3
The WPForms Lite WordPress plugin before 2.0.2.2 does not verify server-side that a payment was completed before accepting a submission on forms using its PayPal Commerce gateway, allowing unauthenticated visitors to submit paid forms without paying. The form's confirmation is delivered and its notification emails are sent even though no order exists at the payment provider and no payment is recorded.
- Product
- WPForms Lite
- Fixed in
- 2.0.2.2
- What to do
- Update WPForms Lite to 2.0.2.2 or newer.
Oct 14, 2026JetFormBuilder: Missing AuthorizationCVE-2026-107431 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in Crocoblock JetFormBuilder jetformbuilder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JetFormBuilder: from n/a through 3.6.6.
- Product
- JetFormBuilder
- Affected
- up to 3.6.6
- What to do
- Affects up to 3.6.6. Update JetFormBuilder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 14, 2026Restricted Site Access: Missing AuthorizationCVE-2026-110227 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in 10up Restricted Site Access restricted-site-access allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Restricted Site Access: from n/a through 7.6.2.
- Product
- Restricted Site Access
- Affected
- up to 7.6.2
- What to do
- Affects up to 7.6.2. Update Restricted Site Access to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 14, 2026Donation Thermometer: Does not escape a colour value taken from a shortcode attribute before using it in an attribute of the generated legend markupCVE-2026-92409 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Donation Thermometer WordPress plugin before 2.3.0 does not escape a colour value taken from a shortcode attribute before using it in an attribute of the generated legend markup, allowing users with the Contributor role and above to inject arbitrary event handlers that execute when the page is viewed.
- Product
- Donation Thermometer
- Fixed in
- 2.3.0
- What to do
- Update Donation Thermometer to 2.3.0 or newer.
Oct 14, 2026Fast Courier: Does not sanitize and escape a value before using it in a SQL query on an unauthenticated REST routeCVE-2026-89288 · WordPress plugins & themes · reported by WPScanHigh 8.6
The Fast Courier WordPress plugin before 5.2.4 does not sanitize and escape a value before using it in a SQL query on an unauthenticated REST route, allowing unauthenticated attackers to perform SQL injection and read arbitrary data from the database.
- Product
- Fast Courier
- Fixed in
- 5.2.4
- What to do
- Update Fast Courier to 5.2.4 or newer.
Oct 14, 2026Product Feed for Google Shopping, Microsoft Advertising and 40+ Channels for WooCommerce Merchant: Does not perform a nonce or capability check on the AJAX action that registers the store with its feed service and exposeCVE-2026-87968 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Product Feed for Google Shopping, Microsoft Advertising and 40+ Channels for WooCommerce Merchant WordPress plugin before 5.3.2 does not perform a nonce or capability check on the AJAX action that registers the store with its feed service and exposes it to unauthenticated users, so any visitor can force the store to re-register and overwrite the Product Feed for Google Shopping, Microsoft Advertising and 40+ Channels for WooCommerce Merchant WordPress plugin before 5.3.2's stored shop secret.
- Product
- Product Feed for Google Shopping, Microsoft Advertising and 40+ Channels for WooCommerce Merchant
- Fixed in
- 5.3.2
- What to do
- Update Product Feed for Google Shopping, Microsoft Advertising and 40+ Channels for WooCommerce Merchant to 5.3.2 or newer.
Oct 14, 2026Walletdoc Payment Gateway for WooCommerce: Does not properly sanitize and escape user input before using it in a SQL statementCVE-2026-103307 · WordPress plugins & themes · reported by WPScanHigh 8.6
The Walletdoc Payment Gateway for WooCommerce WordPress plugin before 1.8.5 does not properly sanitize and escape user input before using it in a SQL statement, and verifies its payment webhook with a signing secret that is empty by default, allowing unauthenticated attackers to perform SQL injection attacks and to mark arbitrary orders as paid.
- Product
- Walletdoc Payment Gateway for WooCommerce
- Fixed in
- 1.8.5
- What to do
- Update Walletdoc Payment Gateway for WooCommerce to 1.8.5 or newer.
Oct 13, 2026WP Event Solution: Missing AuthorizationCVE-2026-109898 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Arraytics WP Event Solution wp-event-solution allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Event Solution: from n/a through 4.1.25.
- Product
- WP Event Solution
- Affected
- up to 4.1.25
- What to do
- Affects up to 4.1.25. Update WP Event Solution to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 13, 2026Download Monitor integration for WooCommerce: Missing AuthorizationCVE-2026-109896 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WP Chill Download Monitor integration for WooCommerce download-monitor-integration-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Download Monitor integration for WooCommerce: from n/a through 1.0.3.
- Product
- Download Monitor integration for WooCommerce
- Affected
- up to 1.0.3
- What to do
- Affects up to 1.0.3. Update Download Monitor integration for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 13, 2026Premium Addons for Elementor: Missing AuthorizationCVE-2026-109890 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in LeapWorx Premium Addons for Elementor premium-addons-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Premium Addons for Elementor: from n/a through 4.11.110.
- Product
- Premium Addons for Elementor
- Affected
- up to 4.11.110
- What to do
- Affects up to 4.11.110. Update Premium Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 13, 2026User Registration: Missing AuthorizationCVE-2026-109699 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in ThemeGrill User Registration user-registration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Registration: from n/a through 5.2.8.
- Product
- User Registration
- Affected
- up to 5.2.8
- What to do
- Affects up to 5.2.8. Update User Registration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 13, 2026FluentBoards: Missing AuthorizationCVE-2026-109696 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in WP ManageNinja LLC FluentBoards fluent-boards allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FluentBoards: from n/a through 2.1.0.
- Product
- FluentBoards
- Affected
- up to 2.1.0
- What to do
- Affects up to 2.1.0. Update FluentBoards to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 13, 2026Amelia: Missing AuthorizationCVE-2026-109684 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in TMS Amelia ameliabooking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Amelia: from n/a through 2.4.10.
- Product
- Amelia
- Affected
- up to 2.4.10
- What to do
- Affects up to 2.4.10. Update Amelia to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 13, 2026WP User Manager: Missing AuthorizationCVE-2026-108496 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WP User Manager WP User Manager wp-user-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP User Manager: from n/a through 2.9.24.
- Product
- WP User Manager
- Affected
- up to 2.9.24
- What to do
- Affects up to 2.9.24. Update WP User Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 13, 2026Pay for Payment for WooCommerce: Missing AuthorizationCVE-2026-108493 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Karolína Vyskočilová Pay for Payment for WooCommerce woocommerce-pay-for-payment allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Pay for Payment for WooCommerce: from n/a through 3.0.1.
- Product
- Pay for Payment for WooCommerce
- Affected
- up to 3.0.1
- What to do
- Affects up to 3.0.1. Update Pay for Payment for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 13, 2026Quick Paypal Payments: Missing AuthorizationCVE-2026-108492 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Fullworks Plugins Quick Paypal Payments quick-paypal-payments allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Quick Paypal Payments: from n/a through 6.0.3.
- Product
- Quick Paypal Payments
- Affected
- up to 6.0.3
- What to do
- Affects up to 6.0.3. Update Quick Paypal Payments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 13, 2026FOX: Missing AuthorizationCVE-2026-108174 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in PluginUs.Net FOX woocommerce-currency-switcher allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FOX: from n/a through 1.5.4.
- Product
- FOX
- Affected
- up to 1.5.4
- What to do
- Affects up to 1.5.4. Update FOX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 13, 2026User Registration: Missing AuthorizationCVE-2026-106598 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in ThemeGrill User Registration user-registration allows Retrieve Embedded Sensitive Data.This issue affects User Registration: from n/a through 5.2.8.
- Product
- User Registration
- Affected
- up to 5.2.8
- What to do
- Affects up to 5.2.8. Update User Registration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 13, 2026User Registration: Missing AuthorizationCVE-2026-106597 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in ThemeGrill User Registration user-registration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Registration: from n/a through 5.2.8.
- Product
- User Registration
- Affected
- up to 5.2.8
- What to do
- Affects up to 5.2.8. Update User Registration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 13, 2026WPGraphQL: Missing AuthorizationCVE-2026-109703 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WPGraphQL WPGraphQL wp-graphql allows Retrieve Embedded Sensitive Data.This issue affects WPGraphQL: from n/a through 2.23.1.
- Product
- WPGraphQL
- Affected
- up to 2.23.1
- What to do
- Affects up to 2.23.1. Update WPGraphQL to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 12, 2026WP-Members: Missing AuthorizationCVE-2026-61994 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in RocketGeek WP-Members wp-members allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP-Members: from n/a through 3.5.7.
- Product
- WP-Members
- Affected
- up to 3.5.7
- What to do
- Affects up to 3.5.7. Update WP-Members to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 12, 2026Events Manager: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')CVE-2026-42689 · WordPress plugins & themes · reported by PatchstackLow 3.7
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Pixelite Events Manager events-manager allows Leveraging Race Conditions.This issue affects Events Manager: from n/a through 7.4.7.
- Product
- Events Manager
- Affected
- up to 7.4.7
- What to do
- Affects up to 7.4.7. Update Events Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 12, 2026Forminator: Missing AuthorizationCVE-2026-108486 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WPMU DEV Forminator forminator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Forminator: from n/a through 1.58.0.
- Product
- Forminator
- Affected
- up to 1.58.0
- What to do
- Affects up to 1.58.0. Update Forminator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 12, 2026Booktics: Missing AuthorizationCVE-2026-107418 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Arraytics Booktics booktics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booktics: from n/a through 1.0.28.
- Product
- Booktics
- Affected
- up to 1.0.28
- What to do
- Affects up to 1.0.28. Update Booktics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 12, 2026Booktics: Missing AuthorizationCVE-2026-108477 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Arraytics Booktics booktics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booktics: from n/a through 1.0.28.
- Product
- Booktics
- Affected
- up to 1.0.28
- What to do
- Affects up to 1.0.28. Update Booktics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 12, 2026Paid Videochat Turnkey Site: Missing AuthorizationCVE-2026-108476 · WordPress plugins & themes · reported by PatchstackMedium 5
Missing Authorization vulnerability in VideoWhisper.com Paid Videochat Turnkey Site ppv-live-webcams allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Paid Videochat Turnkey Site: from n/a through 7.5.13.
- Product
- Paid Videochat Turnkey Site
- Affected
- up to 7.5.13
- What to do
- Affects up to 7.5.13. Update Paid Videochat Turnkey Site to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 12, 2026Broadcast Live Video: Missing AuthorizationCVE-2026-108475 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in VideoWhisper.com Broadcast Live Video videowhisper-live-streaming-integration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Broadcast Live Video: from n/a through 7.3.6.
- Product
- Broadcast Live Video
- Affected
- up to 7.3.6
- What to do
- Affects up to 7.3.6. Update Broadcast Live Video to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 12, 2026Flexible Subscriptions: Missing AuthorizationCVE-2026-107869 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WP Desk Flexible Subscriptions flexible-subscriptions allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Flexible Subscriptions: from n/a through 1.8.4.
- Product
- Flexible Subscriptions
- Affected
- up to 1.8.4
- What to do
- Affects up to 1.8.4. Update Flexible Subscriptions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 12, 2026Products Restricted Users for WooCommerce: Missing AuthorizationCVE-2026-107863 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Codection Products Restricted Users for WooCommerce woo-products-restricted-users allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Products Restricted Users for WooCommerce: from n/a through 0.7.
- Product
- Products Restricted Users for WooCommerce
- Affected
- up to 0.7
- What to do
- Affects up to 0.7. Update Products Restricted Users for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 12, 2026WP User Manager: Missing AuthorizationCVE-2026-107423 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WP User Manager WP User Manager wp-user-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP User Manager: from n/a through 2.9.22.
- Product
- WP User Manager
- Affected
- up to 2.9.22
- What to do
- Affects up to 2.9.22. Update WP User Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 12, 2026Event post: Missing AuthorizationCVE-2026-107432 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in NOUS Ouvert Utile et Simple Event post event-post allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event post: from n/a through 6.1.1.
- Product
- Event post
- Affected
- up to 6.1.1
- What to do
- Affects up to 6.1.1. Update Event post to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 12, 2026VideoWhisper Site Manager for ChatGPT, Claude, Codex: Missing AuthorizationCVE-2026-107430 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in VideoWhisper.com VideoWhisper Site Manager for ChatGPT, Claude, Codex videowhisper-site-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VideoWhisper Site Manager for ChatGPT, Claude, Codex: from n/a through 1.2.10.
- Product
- VideoWhisper Site Manager for ChatGPT, Claude, Codex
- Affected
- up to 1.2.10
- What to do
- Affects up to 1.2.10. Update VideoWhisper Site Manager for ChatGPT, Claude, Codex to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 12, 2026TMDS: Missing AuthorizationCVE-2026-103356 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in VillaTheme TMDS tmds-dropshipping-for-temu-and-woo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects TMDS: from n/a through 1.0.15.
- Product
- TMDS
- Affected
- up to 1.0.15
- What to do
- Affects up to 1.0.15. Update TMDS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 11, 2026paymendo: Does not properly sanitize and escape a parameter before using it in a SQL queryCVE-2026-89305 · WordPress plugins & themes · reported by WPScanMedium 6.5
The paymendo WordPress plugin through 1.1 does not properly sanitize and escape a parameter before using it in a SQL query, allowing any authenticated user to perform SQL injection attacks.
- Product
- paymendo
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update paymendo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 11, 2026paymendo: Does not properly sanitize and escape a parameter before using it in a SQL queryCVE-2026-89304 · WordPress plugins & themes · reported by WPScanMedium 6.5
The paymendo WordPress plugin through 1.1 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform blind SQL injection attacks.
- Product
- paymendo
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update paymendo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.