Vulnerability database

10,081 results · page 4 of 202

• Oct 24, 2026WpEvently: Missing AuthorizationCVE-2026-114192 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Missing Authorization vulnerability in Magepeople inc. WpEvently mage-eventpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WpEvently: from n/a through 5.7.8.

  Product

  WpEvently

  Affected

  up to 5.7.8

  What to do

  Affects up to 5.7.8. Update WpEvently to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 24, 2026UPI QR Code Payment Gateway for WooCommerce: Missing AuthorizationCVE-2026-114191 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Missing Authorization vulnerability in Knit Pay UPI QR Code Payment Gateway for WooCommerce upi-qr-code-payment-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects UPI QR Code Payment Gateway for WooCommerce: from n/a through 1.6.3.

  Product

  UPI QR Code Payment Gateway for WooCommerce

  Affected

  up to 1.6.3

  What to do

  Affects up to 1.6.3. Update UPI QR Code Payment Gateway for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 24, 2026WP Social Feed Gallery: Missing AuthorizationCVE-2026-114705 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Missing Authorization vulnerability in quadlayers WP Social Feed Gallery insta-gallery allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Social Feed Gallery: from n/a through 5.0.13.

  Product

  WP Social Feed Gallery

  Affected

  up to 5.0.13

  What to do

  Affects up to 5.0.13. Update WP Social Feed Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 24, 2026SureDash: Missing AuthorizationCVE-2026-110892 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Missing Authorization vulnerability in Brainstorm Force SureDash suredash allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SureDash: from n/a through 1.12.2.

  Product

  SureDash

  Affected

  up to 1.12.2

  What to do

  Affects up to 1.12.2. Update SureDash to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 24, 2026News Kit Addons For Elementor: Does not perform capability or ownership checks before updating post metadata in one of its authenticated AJAX actionsCVE-2026-97353 · WordPress plugins & themes · reported by WPScanMedium 5.4

  The News Kit Addons For Elementor WordPress plugin through 1.4.7 does not perform capability or ownership checks before updating post metadata in one of its authenticated AJAX actions, allowing users with subscriber-level access and above to write arbitrary post meta, under attacker-chosen keys, to any post including those owned by other users. This can be used to overwrite protected core metadata and tamper with content created by higher-privileged users.

  Product

  News Kit Addons For Elementor

  Affected

  up to 1.4.7

  What to do

  Affects up to 1.4.7. Update News Kit Addons For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordwpscan.com

• Oct 24, 2026asVereinbase: Does not require a valid password or a genuine second factor before authenticating a userCVE-2026-110956 · WordPress plugins & themes · reported by WPScanCritical 9.8

  The asVereinbase WordPress plugin before 1.1.8 does not require a valid password or a genuine second factor before authenticating a user, treating an empty stored value as a match, so an unauthenticated attacker can log in as any user, including an administrator.

  Product

  asVereinbase

  Fixed in

  1.1.8

  What to do

  Update asVereinbase to 1.1.8 or newer.

  Full record and what to do →NVD recordwpscan.com

• Oct 23, 2026The Profile Builder WordPress plugin from 4.0.0 to 4.0.4 does not enforce its reCAPTCHA verification on all comment submission paths, allowing authenticated useCVE-2026-111965 · WordPress plugins & themes · reported by WPScanMedium 4.3

  The Profile Builder WordPress plugin from 4.0.0 to 4.0.4 does not enforce its reCAPTCHA verification on all comment submission paths, allowing authenticated users to bypass the anti-spam protection an administrator configured for the WordPress comment form.

  What to do

  Update the plugin to the newest version.

  Full record and what to do →NVD recordwpscan.com

• Oct 23, 2026Car Rental Manager: Missing AuthorizationCVE-2026-112825 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Missing Authorization vulnerability in Magepeople inc. Car Rental Manager car-rental-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Car Rental Manager: from n/a through 1.5.3.

  Product

  Car Rental Manager

  Affected

  up to 1.5.3

  What to do

  Affects up to 1.5.3. Update Car Rental Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 23, 2026Knit Pay: Missing AuthorizationCVE-2026-112821 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Missing Authorization vulnerability in Knit Pay Knit Pay knit-pay allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Knit Pay: from n/a through 9.6.3.0.

  Product

  Knit Pay

  Affected

  up to 9.6.3.0

  What to do

  Affects up to 9.6.3.0. Update Knit Pay to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 23, 2026WPMobile.App: Missing AuthorizationCVE-2026-112359 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Missing Authorization vulnerability in Amauri.IO WPMobile.App wpappninja allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPMobile.App: from n/a through 11.86.

  Product

  WPMobile.App

  Affected

  up to 11.86

  What to do

  Affects up to 11.86. Update WPMobile.App to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 23, 2026Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO: Does not verify that the requester is authorised to edit the targeted user account in the update-user action of its CVE-2026-94262 · WordPress plugins & themes · reported by WPScanHigh 8.1

  The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not verify that the requester is authorised to edit the targeted user account in the update-user action of its front-end Forms module, performing that check only when the target account holds an administrator role, which allows unauthenticated visitors to overwrite any non-administrator account's credentials and obtain a session for that account. Exploitation requires the site to publish a form whose user-update action maps its target to a visitor-submitted value rather than to the default current user.

  Product

  Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO

  Fixed in

  0.9.2.8

  What to do

  Update Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO to 0.9.2.8 or newer.

  Full record and what to do →NVD recordwpscan.com

• Oct 23, 2026Popup Builder: Does not perform authorization checks before trashing popup content in a maintenance routine that runs on unauthenticated requestsCVE-2026-112230 · WordPress plugins & themes · reported by WPScanLow 3.7

  The Popup Builder WordPress plugin before 4.4.6 does not perform authorization checks before trashing popup content in a maintenance routine that runs on unauthenticated requests, allowing unauthenticated attackers to move affected popups into the Trash and overwrite their stored preview data.

  Product

  Popup Builder

  Fixed in

  4.4.6

  What to do

  Update Popup Builder to 4.4.6 or newer.

  Full record and what to do →NVD recordwpscan.com

• Oct 23, 2026User Profile Builder: Does not verify that a user is authorized to edit the specific account selected on its front-end Edit Profile formCVE-2026-111982 · WordPress plugins & themes · reported by WPScanHigh 7.2

  The User Profile Builder WordPress plugin before 4.0.5 does not verify that a user is authorized to edit the specific account selected on its front-end Edit Profile form, allowing an Administrator of a Multisite subsite to change any other user's account email, including a Network Super Admin's, and take over that account through the password-reset flow.

  Product

  User Profile Builder

  Fixed in

  4.0.5

  What to do

  Update User Profile Builder to 4.0.5 or newer.

  Full record and what to do →NVD recordwpscan.com

• Oct 22, 2026Paid Member Subscriptions: Missing AuthorizationCVE-2026-112842 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Missing Authorization vulnerability in Cozmoslabs Paid Member Subscriptions paid-member-subscriptions allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Paid Member Subscriptions: from n/a through 3.1.2.

  Product

  Paid Member Subscriptions

  Affected

  up to 3.1.2

  What to do

  Affects up to 3.1.2. Update Paid Member Subscriptions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 22, 2026NotificationX: Unauthenticated SQL injectionCVE-2022-51021 · WordPress plugins & themes · reported by VulnCheckHigh 8.8

  NotificationX plugin for WordPress 2.0.0 before 2.3.12 contains an unauthenticated SQL injection vulnerability that allows remote attackers to manipulate database queries by supplying an array-form 'id' parameter to /wp-json/notificationx/v1/notification/{id}. Attackers can pass id[1] with crafted SQL, such as time-based SLEEP payloads, along with an api_key derived from md5(home_url()), which flows unsanitized into Database::get_where_query to extract database contents. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-18.

  Product

  NotificationX

  Fixed in

  2.3.12

  What to do

  Update NotificationX to 2.3.12 or newer.

  Full record and what to do →NVD recordgithub.comwordpress.org

• Oct 22, 2026ЮKassa для WooCommerce: Missing AuthorizationCVE-2026-114699 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in yoomoney ЮKassa для WooCommerce yookassa allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ЮKassa для WooCommerce: from n/a through 2.17.3.

  Product

  ЮKassa для WooCommerce

  Affected

  up to 2.17.3

  What to do

  Affects up to 2.17.3. Update ЮKassa для WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 22, 2026myCred: Authorization Bypass Through User-Controlled KeyCVE-2026-114698 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Authorization Bypass Through User-Controlled Key vulnerability in myCred myCred mycred allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects myCred: from n/a through 4.0.0-beta.1.

  Product

  myCred

  Affected

  up to 4.0.0-beta.1

  What to do

  Affects up to 4.0.0-beta.1. Update myCred to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 22, 2026Page Restriction WordPress (WP): Missing AuthorizationCVE-2026-114696 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in miniOrange Page Restriction WordPress (WP) page-and-post-restriction allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Page Restriction WordPress (WP): from n/a through 1.6.0.

  Product

  Page Restriction WordPress (WP)

  Affected

  up to 1.6.0

  What to do

  Affects up to 1.6.0. Update Page Restriction WordPress (WP) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 22, 2026ACF Extended: Missing AuthorizationCVE-2026-112312 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Missing Authorization vulnerability in ACF Extended ACF Extended acf-extended allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ACF Extended: from n/a through 0.9.2.7.

  Product

  ACF Extended

  Affected

  up to 0.9.2.7

  What to do

  Affects up to 0.9.2.7. Update ACF Extended to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 22, 2026SureCart: Authentication Bypass by SpoofingCVE-2026-112241 · WordPress plugins & themes · reported by PatchstackCritical 9.8

  Authentication Bypass by Spoofing vulnerability in Brainstorm Force SureCart surecart allows Authentication Abuse.This issue affects SureCart: from n/a through 4.9.5.

  Product

  SureCart

  Affected

  up to 4.9.5

  What to do

  Affects up to 4.9.5. Update SureCart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 22, 2026Majestic Support: Missing AuthorizationCVE-2026-112218 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in Ahmad Majestic Support majestic-support allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Majestic Support: from n/a through 1.2.1.

  Product

  Majestic Support

  Affected

  up to 1.2.1

  What to do

  Affects up to 1.2.1. Update Majestic Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 22, 2026Sunshine Photo Cart: Missing AuthorizationCVE-2026-111842 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in WP Sunshine Sunshine Photo Cart sunshine-photo-cart allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sunshine Photo Cart: from n/a through 3.7.5.

  Product

  Sunshine Photo Cart

  Affected

  up to 3.7.5

  What to do

  Affects up to 3.7.5. Update Sunshine Photo Cart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 22, 2026SureDash: Missing AuthorizationCVE-2026-110894 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in Brainstorm Force SureDash suredash allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SureDash: from n/a through 1.12.2.

  Product

  SureDash

  Affected

  up to 1.12.2

  What to do

  Affects up to 1.12.2. Update SureDash to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 22, 2026SureDash: Missing AuthorizationCVE-2026-110893 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in Brainstorm Force SureDash suredash allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SureDash: from n/a through 1.12.2.

  Product

  SureDash

  Affected

  up to 1.12.2

  What to do

  Affects up to 1.12.2. Update SureDash to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 22, 2026PowerPack Addons for Elementor: Missing AuthorizationCVE-2026-114182 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in IdeaBox Creations PowerPack Addons for Elementor powerpack-lite-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PowerPack Addons for Elementor: from n/a through 3.1.0.

  Product

  PowerPack Addons for Elementor

  Affected

  up to 3.1.0

  What to do

  Affects up to 3.1.0. Update PowerPack Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 22, 2026Metform: Missing AuthorizationCVE-2026-114180 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in Wpmet Metform metform allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Metform: from n/a through 4.3.2.

  Product

  Metform

  Affected

  up to 4.3.2

  What to do

  Affects up to 4.3.2. Update Metform to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 22, 2026eRoom: Missing AuthorizationCVE-2026-114175 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Missing Authorization vulnerability in DigitalME eRoom eroom-zoom-meetings-webinar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects eRoom: from n/a through 1.7.1.

  Product

  eRoom

  Affected

  up to 1.7.1

  What to do

  Affects up to 1.7.1. Update eRoom to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 22, 2026Strong Testimonials: Missing AuthorizationCVE-2026-112843 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in WP Chill Strong Testimonials strong-testimonials allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Strong Testimonials: from n/a through 3.3.14.

  Product

  Strong Testimonials

  Affected

  up to 3.3.14

  What to do

  Affects up to 3.3.14. Update Strong Testimonials to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 22, 2026Falcon – WordPress Optimizations & Tweaks: Missing AuthorizationCVE-2026-112826 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in eLightUp Falcon – WordPress Optimizations & Tweaks falcon allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Falcon – WordPress Optimizations & Tweaks: from n/a through 2.12.0.

  Product

  Falcon – WordPress Optimizations & Tweaks

  Affected

  up to 2.12.0

  What to do

  Affects up to 2.12.0. Update Falcon – WordPress Optimizations & Tweaks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 22, 2026MarketKing: Missing AuthorizationCVE-2026-111847 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Missing Authorization vulnerability in Kings Plugins MarketKing marketking-multivendor-marketplace-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MarketKing: from n/a through 2.1.72.

  Product

  MarketKing

  Affected

  up to 2.1.72

  What to do

  Affects up to 2.1.72. Update MarketKing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 22, 2026Photo Engine (Media Organizer & Lightroom): Does not verify that a user is authorised to act on the targeted media attachmentCVE-2026-111972 · WordPress plugins & themes · reported by WPScanMedium 4.9

  The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.5.8 does not verify that a user is authorised to act on the targeted media attachment, allowing authenticated users with the author role and above to delete arbitrary media attachments, including those uploaded by other users and administrators.

  Product

  Photo Engine (Media Organizer & Lightroom)

  Fixed in

  6.5.8

  What to do

  Update Photo Engine (Media Organizer & Lightroom) to 6.5.8 or newer.

  Full record and what to do →NVD recordwpscan.com

• Oct 22, 2026MB Custom Post Types & Custom Taxonomies: Does not perform any capability or authentication check before allowing an unauthenticated request to re-run a legacy data migrationCVE-2026-110010 · WordPress plugins & themes · reported by WPScanMedium 4.8

  The MB Custom Post Types & Custom Taxonomies WordPress plugin before 2.12.3 does not perform any capability or authentication check before allowing an unauthenticated request to re-run a legacy data migration, letting anyone revert a custom post type or taxonomy definition on sites upgraded from a pre-2.0 release back to its pre-upgrade state. This discards configuration changes an administrator made after upgrading and, where those changes had restricted a definition's visibility, silently re-exposes the definition and its content to anonymous visitors.

  Product

  MB Custom Post Types & Custom Taxonomies

  Fixed in

  2.12.3

  What to do

  Update MB Custom Post Types & Custom Taxonomies to 2.12.3 or newer.

  Full record and what to do →NVD recordwpscan.com

• Oct 22, 2026Infility Global: Does not perform any authorisation or nonce check on an AJAX action available to unauthenticated usersCVE-2026-109931 · WordPress plugins & themes · reported by WPScanLow 3.7

  The Infility Global WordPress plugin before 2.16.25 does not perform any authorisation or nonce check on an AJAX action available to unauthenticated users, allowing any visitor to overwrite a machine-translation configuration value belonging to a companion Infility Global WordPress plugin before 2.16.25.

  Product

  Infility Global

  Fixed in

  2.16.25

  What to do

  Update Infility Global to 2.16.25 or newer.

  Full record and what to do →NVD recordwpscan.com

• Oct 21, 2026eRoom: Missing AuthorizationCVE-2026-114176 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in DigitalME eRoom eroom-zoom-meetings-webinar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects eRoom: from n/a through 1.7.1.

  Product

  eRoom

  Affected

  up to 1.7.1

  What to do

  Affects up to 1.7.1. Update eRoom to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 21, 2026H5P: Authorization Bypass Through User-Controlled KeyCVE-2026-112868 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Authorization Bypass Through User-Controlled Key vulnerability in H5P H5P h5p allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects H5P: from n/a through 1.17.9.

  Product

  H5P

  Affected

  up to 1.17.9

  What to do

  Affects up to 1.17.9. Update H5P to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 21, 2026BjornTech Swish for WooCommerce: Missing AuthorizationCVE-2026-111835 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Missing Authorization vulnerability in bjorntech BjornTech Swish for WooCommerce woo-swish-e-commerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BjornTech Swish for WooCommerce: from n/a through 3.7.8.

  Product

  BjornTech Swish for WooCommerce

  Affected

  up to 3.7.8

  What to do

  Affects up to 3.7.8. Update BjornTech Swish for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 21, 2026SchedulePress before 5.3.5 contains a missing authorization vulnerability that allows authenticated Contributor-level users to change any post's status and publCVE-2026-114120 · WordPress plugins & themes · reported by VulnCheckMedium 5.3

  SchedulePress before 5.3.5 contains a missing authorization vulnerability that allows authenticated Contributor-level users to change any post's status and publish date via the wpsp_el_editor_form AJAX action. Attackers can reuse the wpsp-el-editor nonce from the Elementor modal to unpublish or reschedule administrator posts, or publish other users' pending or draft posts.

  Fixed in

  5.3.5

  What to do

  Update the plugin to 5.3.5 or newer.

  Full record and what to do →NVD recordgithub.comgithub.com

• Oct 21, 2026WpTravelly: Missing AuthorizationCVE-2026-111849 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in Magepeople inc. WpTravelly tour-booking-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WpTravelly: from n/a through 2.3.5.

  Product

  WpTravelly

  Affected

  up to 2.3.5

  What to do

  Affects up to 2.3.5. Update WpTravelly to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 21, 2026Payment Gateway for Telcell: Does not verify the authenticity of incoming payment notificationsCVE-2026-103301 · WordPress plugins & themes · reported by WPScanMedium 5.3

  The Payment Gateway for Telcell WordPress plugin before 2.0.5 does not verify the authenticity of incoming payment notifications, because the secret used to sign them is empty by default, allowing unauthenticated attackers to forge a valid notification and mark arbitrary WooCommerce orders as paid. The same handler also marks an attacker-chosen order as failed when given an invalid signature.

  Product

  Payment Gateway for Telcell

  Fixed in

  2.0.5

  What to do

  Update Payment Gateway for Telcell to 2.0.5 or newer.

  Full record and what to do →NVD recordwpscan.com

• Oct 21, 2026Click n Chat (Chat Widget Integration): Does not perform any authorization check on a lead-export handlerCVE-2026-92999 · WordPress plugins & themes · reported by WPScanMedium 5.3

  The Click n Chat (Chat Widget Integration) WordPress plugin before 1.1.3 does not perform any authorization check on a lead-export handler, allowing unauthenticated users to download every captured contact record (names, email addresses and phone numbers).

  Product

  Click n Chat (Chat Widget Integration)

  Fixed in

  1.1.3

  What to do

  Update Click n Chat (Chat Widget Integration) to 1.1.3 or newer.

  Full record and what to do →NVD recordwpscan.com

• Oct 21, 2026Wava Payment: Does not perform any authorisationCVE-2026-87838 · WordPress plugins & themes · reported by WPScanMedium 6.5

  The Wava Payment Plugin WordPress plugin before 0.3.10 does not perform any authorisation, nonce or origin verification on one of its public REST endpoints, allowing unauthenticated attackers to overwrite the stored credential that identifies the merchant account the store's payments are created against, to force the integration into a verified state the site owner never completed, and to remove the payment method from the store's checkout.

  Product

  Wava Payment

  Fixed in

  0.3.10

  What to do

  Update Wava Payment to 0.3.10 or newer.

  Full record and what to do →NVD recordwpscan.com

• Oct 21, 2026Wava Payment: Does not verify the authenticity of incoming payment-provider notificationsCVE-2026-87837 · WordPress plugins & themes · reported by WPScanMedium 5.3

  The Wava Payment Plugin WordPress plugin before 0.3.10 does not verify the authenticity of incoming payment-provider notifications, nor restrict who may send them, allowing unauthenticated attackers to change the status of any WooCommerce order in the store, including marking an unpaid order as paid and completed, and cancelling other customers' orders. In versions up to 0.3.7 the response additionally returns the affected order's billing details, disclosing customer names, addresses, email addresses and phone numbers to the same unauthenticated caller.

  Product

  Wava Payment

  Affected

  up to 0.3.7

  Fixed in

  0.3.10

  What to do

  Update Wava Payment to 0.3.10 or newer.

  Full record and what to do →NVD recordwpscan.com

• Oct 21, 2026Pricing Table: Does not perform authorisation checksCVE-2026-111947 · WordPress plugins & themes · reported by WPScanMedium 5.5

  The Pricing Table WordPress Plugin WordPress plugin before 4.1.3 does not perform authorisation checks when duplicating a legacy pricing table, allowing users with the contributor role and above to clone and publish any post or page on the site, including private and draft content belonging to other users.

  Product

  Pricing Table

  Fixed in

  4.1.3

  What to do

  Update Pricing Table to 4.1.3 or newer.

  Full record and what to do →NVD recordwpscan.com

• Oct 21, 2026SmartyParcel: Does not perform authorisation checksCVE-2026-107789 · WordPress plugins & themes · reported by WPScanMedium 5.3

  The SmartyParcel WordPress plugin before 1.23.4 does not perform authorisation checks when serving shipping label downloads, allowing unauthenticated users to obtain the shipping labels of arbitrary orders, which contain customer names, addresses and phone numbers.

  Product

  SmartyParcel

  Fixed in

  1.23.4

  What to do

  Update SmartyParcel to 1.23.4 or newer.

  Full record and what to do →NVD recordwpscan.com

• Oct 21, 2026SmartyParcel: Does not perform authorisation checksCVE-2026-107788 · WordPress plugins & themes · reported by WPScanMedium 4.3

  The SmartyParcel WordPress plugin before 1.23.4 does not perform authorisation checks when deleting shipping label records, allowing any authenticated user such as a subscriber to delete the shipping label and tracking records of arbitrary orders store-wide.

  Product

  SmartyParcel

  Fixed in

  1.23.4

  What to do

  Update SmartyParcel to 1.23.4 or newer.

  Full record and what to do →NVD recordwpscan.com

• Oct 21, 2026Moloni: Does not perform capability or nonce checks on several of its authenticated AJAX actionsCVE-2026-106932 · WordPress plugins & themes · reported by WPScanMedium 6.5

  The Moloni WordPress plugin before 5.0.14 does not perform capability or nonce checks on several of its authenticated AJAX actions, relying only on whether the site holds a stored connection to its external invoicing provider, allowing any authenticated user such as a Subscriber to generate fiscal invoices for arbitrary orders, discard arbitrary orders, and create or modify products and stock.

  Product

  Moloni

  Fixed in

  5.0.14

  What to do

  Update Moloni to 5.0.14 or newer.

  Full record and what to do →NVD recordwpscan.com

• Oct 21, 2026Booking Package: Does not perform authorization checks before returning calendar-account configuration in a responseCVE-2026-105999 · WordPress plugins & themes · reported by WPScanMedium 5.3

  The Booking Package WordPress plugin before 1.7.31 does not perform authorization checks before returning calendar-account configuration in a response, allowing unauthenticated users to disclose sensitive settings including the administrator's notification email addresses.

  Product

  Booking Package

  Fixed in

  1.7.31

  What to do

  Update Booking Package to 1.7.31 or newer.

  Full record and what to do →NVD recordwpscan.com

• Oct 21, 2026Booking Package: Does not perform any authorization or validity check before resetting its premium subscription stateCVE-2026-105998 · WordPress plugins & themes · reported by WPScanMedium 5.3

  The Booking Package WordPress plugin before 1.7.31 does not perform any authorization or validity check before resetting its premium subscription state, allowing unauthenticated attackers to disable the Booking Package WordPress plugin before 1.7.31's paid features.

  Product

  Booking Package

  Fixed in

  1.7.31

  What to do

  Update Booking Package to 1.7.31 or newer.

  Full record and what to do →NVD recordwpscan.com

• Oct 21, 2026Appointment Booking: Does not verify that an authenticated agent-level user is assigned to a customer before returning or searching that customer's recordCVE-2026-105257 · WordPress plugins & themes · reported by WPScanLow 2.7

  The Appointment Booking Plugin WordPress plugin before 5.7.5 does not verify that an authenticated agent-level user is assigned to a customer before returning or searching that customer's record, allowing any agent to read and enumerate the personal information of every customer on the site, including those managed by other agents.

  Product

  Appointment Booking

  Fixed in

  5.7.5

  What to do

  Update Appointment Booking to 5.7.5 or newer.

  Full record and what to do →NVD recordwpscan.com

• Oct 21, 2026Payment Gateway for Idram: Does not verify the authenticity of incoming payment notificationsCVE-2026-103302 · WordPress plugins & themes · reported by WPScanMedium 5.3

  The Payment Gateway for Idram WordPress plugin before 2.1.6 does not verify the authenticity of incoming payment notifications, because the merchant credentials used to compute their checksum are empty by default, allowing unauthenticated attackers to forge a valid payment confirmation and mark arbitrary orders as paid, and to force arbitrary orders into a failed state regardless of the gateway's configuration.

  Product

  Payment Gateway for Idram

  Fixed in

  2.1.6

  What to do

  Update Payment Gateway for Idram to 2.1.6 or newer.

  Full record and what to do →NVD recordwpscan.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.