Updated 8 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

457new WordPress flaws this week

390,525entries in the database

40,528 results · page 4 of 811

Oct 29, 2026Password Protected: Stored Cross-Site ScriptingCVE-2026-93293 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Password Protected plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the bundled Freemius SDK's purchase-completion handler in all versions up to, and including, 2.8.4 due to insufficient input sanitization and output escaping. Once the site's Freemius opt-in is complete (the normal state after an administrator clicks "Allow & Continue"), the handler processes the 'purchased_plan' request parameter on any wp-admin request from an authenticated user without any capability, nonce, or purchase validation, and stores it in a persistent, site-wide administrative notice. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts that execute automatically when an administrator views a standard admin page such as their Profile page.
Product
Password Protected
Affected
up to 2.8.4
What to do
Affects up to 2.8.4. Update Password Protected to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org ti.wordfence.io
Oct 29, 2026vTables: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2026-89216 · WordPress plugins & themes · reported by WPScanHigh 8.6
The vTables WordPress plugin before 0.3 does not properly sanitise and escape a parameter before using it in a SQL statement, which allows unauthenticated attackers to perform SQL injection attacks and extract data from the database.
Product
vTables
Fixed in
0.3
What to do
Update vTables to 0.3 or newer.
Full record and what to do →NVD record wpscan.com
Oct 29, 2026PAYCOMET for WooCommerce: Does not verify the cryptographic signature on its payment notification endpointCVE-2026-88928 · WordPress plugins & themes · reported by WPScanMedium 6.5
The PAYCOMET for WooCommerce WordPress plugin before 5.46 does not verify the cryptographic signature on its payment notification endpoint when the request references a tokenisation operation, allowing unauthenticated attackers to overwrite the stored payment token associated with existing orders and delete saved card records.
Product
PAYCOMET for WooCommerce
Fixed in
5.46
What to do
Update PAYCOMET for WooCommerce to 5.46 or newer.
Full record and what to do →NVD record wpscan.com
Oct 29, 2026Community Events: Does not have authorisation or nonce checksCVE-2026-86794 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Community Events WordPress plugin before 1.6.0 does not have authorisation or nonce checks when processing public event submissions, and does not escape several of the submitted values before outputting them in the administration dashboard and on the public calendar, allowing unauthenticated users to inject arbitrary web scripts that will execute in the browser of an administrator reviewing the submission.
Product
Community Events
Fixed in
1.6.0
What to do
Update Community Events to 1.6.0 or newer.
Full record and what to do →NVD record wpscan.com
Oct 29, 2026Video Player for YouTube: Does not perform a capability check on its player-preset AJAX handlerCVE-2026-85007 · WordPress plugins & themes · reported by WPScanLow 3.8
The Video Player for YouTube WordPress plugin before 2.1.4 does not perform a capability check on its player-preset AJAX handler, allowing users with the Contributor role and above to read the site-wide player-preset configuration, and in versions before 2.1.1 to modify and delete it as well.
Product
Video Player for YouTube
Fixed in
2.1.4
What to do
Update Video Player for YouTube to 2.1.4 or newer.
Full record and what to do →NVD record wpscan.com
Oct 29, 2026Link Library: Does not verify that a requested link belongs to the settings set whose display template is used to render itCVE-2026-78396 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Link Library WordPress plugin before 7.10.0 does not verify that a requested link belongs to the settings set whose display template is used to render it, allowing unauthenticated users to disclose the telephone number, e-mail address and submitter name stored with links that the settings set is configured not to display.
Product
Link Library
Fixed in
7.10.0
What to do
Update Link Library to 7.10.0 or newer.
Full record and what to do →NVD record wpscan.com
Oct 29, 2026Link Library: Does not re-check the selected library's own login requirementCVE-2026-78395 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Link Library WordPress plugin before 7.10.0 does not re-check the selected library's own login requirement when processing its front-end link submission, allowing unauthenticated users to submit links to a library configured to require login by reusing a form token obtained from another library that does not.
Product
Link Library
Fixed in
7.10.0
What to do
Update Link Library to 7.10.0 or newer.
Full record and what to do →NVD record wpscan.com
Oct 29, 2026Contact Form by Supsystic: Does not restrict access to an AJAX action that deletes stored form statistics recordsCVE-2026-115302 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Contact Form by Supsystic WordPress plugin before 1.11.1 does not restrict access to an AJAX action that deletes stored form statistics records, allowing unauthenticated attackers to delete arbitrary statistics entries.
Product
Contact Form by Supsystic
Fixed in
1.11.1
What to do
Update Contact Form by Supsystic to 1.11.1 or newer.
Full record and what to do →NVD record wpscan.com
Oct 29, 2026Contact Form by Supsystic: Does not sandbox the template engine used to render its forms and allows stored form-editor content to reach that engineCVE-2026-115301 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Contact Form by Supsystic WordPress plugin before 1.11.1 does not sandbox the template engine used to render its forms and allows stored form-editor content to reach that engine as executable template code, enabling an administrator to perform server-side template injection and execute arbitrary code on the server. The injected template is compiled and executed whenever any visitor loads a page containing the form, so the stored payload also lets an unauthenticated visitor read server-side secrets such as authentication salts and database credentials.
Product
Contact Form by Supsystic
Fixed in
1.11.1
What to do
Update Contact Form by Supsystic to 1.11.1 or newer.
Full record and what to do →NVD record wpscan.com
Oct 29, 2026Contact Form by Supsystic: Does not validate a CSRF token or request origin on two administrator-only actions that bulk-delete captured form submissions and wipe a form's statisticsCVE-2026-115300 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Contact Form by Supsystic WordPress plugin before 1.11.1 does not validate a CSRF token or request origin on two administrator-only actions that bulk-delete captured form submissions and wipe a form's statistics, allowing attackers to permanently destroy a site's stored contact leads and analytics by tricking a logged-in administrator into sending a forged request.
Product
Contact Form by Supsystic
Fixed in
1.11.1
What to do
Update Contact Form by Supsystic to 1.11.1 or newer.
Full record and what to do →NVD record wpscan.com
Oct 29, 2026Contact Form by Supsystic: Does not verify a CSRF nonce before saving its mail settingsCVE-2026-115299 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Contact Form by Supsystic WordPress plugin before 1.11.1 does not verify a CSRF nonce before saving its mail settings, allowing an attacker to overwrite the site's outbound mail configuration, including the SMTP server, its credentials and the notification recipient, by tricking a logged-in administrator into visiting a crafted page, which can route the Contact Form by Supsystic WordPress plugin before 1.11.1's contact-form notifications through infrastructure the attacker controls.
Product
Contact Form by Supsystic
Fixed in
1.11.1
What to do
Update Contact Form by Supsystic to 1.11.1 or newer.
Full record and what to do →NVD record wpscan.com
Oct 29, 2026Recipe Card Blocks Lite: Does not perform an authorization check before rendering posts through its recipe print featureCVE-2026-115282 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Recipe Card Blocks Lite WordPress plugin before 3.6.4 does not perform an authorization check before rendering posts through its recipe print feature, allowing unauthenticated users to disclose the title, ID and recipe content of unpublished posts, including drafts, pending, private and password-protected posts, that contain a recipe card block. Its optional "print only published posts" protection does not prevent this, because the status check is applied to a different post than the one ultimately rendered.
Product
Recipe Card Blocks Lite
Fixed in
3.6.4
What to do
Update Recipe Card Blocks Lite to 3.6.4 or newer.
Full record and what to do →NVD record wpscan.com
Oct 29, 2026Photo Engine (Media Organizer & Lightroom): Does not have proper authorization checksCVE-2026-115259 · WordPress plugins & themes · reported by WPScanMedium 4.9
The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.6.0 does not have proper authorization checks when updating post data through one of its REST API routes in all versions up to, and including, 6.5.8. This makes it possible for authenticated attackers, with Author-level access and above, to modify the title, content, excerpt and other fields of arbitrary posts, pages and attachments, including those belonging to other users.
Product
Photo Engine (Media Organizer & Lightroom)
Affected
up to 6.5.8
Fixed in
6.6.0
What to do
Update Photo Engine (Media Organizer & Lightroom) to 6.6.0 or newer.
Full record and what to do →NVD record wpscan.com
Oct 29, 2026Chat AI with Dispatcher: Does not properly validate uploaded filesCVE-2026-115245 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Chat AI with Dispatcher WordPress plugin before 2.4 does not properly validate uploaded files, relying only on a spoofable client-supplied content type, allowing unauthenticated attackers to upload arbitrary files, including PHP, which can lead to remote code execution.
Product
Chat AI with Dispatcher
Fixed in
2.4
What to do
Update Chat AI with Dispatcher to 2.4 or newer.
Full record and what to do →NVD record wpscan.com
Oct 29, 2026GeoDirectory: Does not honour post password protectionCVE-2026-114270 · WordPress plugins & themes · reported by WPScanMedium 5.3
The GeoDirectory WordPress plugin before 2.8.197 does not honour post password protection when rendering a listing, allowing unauthenticated users to disclose the content and custom fields of published listings that are protected by a post password.
Product
GeoDirectory
Fixed in
2.8.197
What to do
Update GeoDirectory to 2.8.197 or newer.
Full record and what to do →NVD record wpscan.com
Oct 29, 2026Automated Import Products to Cart: Does not sanitize a user-supplied file path before using it to read and delete filesCVE-2026-113617 · WordPress plugins & themes · reported by WPScanCritical 9.9
The Automated Import Products to Cart WordPress plugin before 1.0.4 does not sanitize a user-supplied file path before using it to read and delete files, allowing users with minimal permissions, such as subscribers, to read arbitrary files (including ones containing the database credentials) and delete arbitrary files on the server.
Product
Automated Import Products to Cart
Fixed in
1.0.4
What to do
Update Automated Import Products to Cart to 1.0.4 or newer.
Full record and what to do →NVD record wpscan.com
Oct 29, 2026LogixFast Auth: Does not deliver its password-reset one-time code to the resolved account's own email addressCVE-2026-113616 · WordPress plugins & themes · reported by WPScanCritical 9.8
The LogixFast Auth WordPress plugin before 1.0.4 does not deliver its password-reset one-time code to the resolved account's own email address, mailing it to the address supplied in the request instead, allowing unauthenticated attackers to reset any user's password, including an administrator's, and take over the account.
Product
LogixFast Auth
Fixed in
1.0.4
What to do
Update LogixFast Auth to 1.0.4 or newer.
Full record and what to do →NVD record wpscan.com
Oct 29, 2026Two Factor Authentication WordPress plugin before 1.17.0, All-In-One Security (AIOS): Do not bind the account whose two-factor code is verified to the account being authenticatedCVE-2026-111739 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Two Factor Authentication WordPress plugin before 1.17.0, All-In-One Security (AIOS) WordPress plugin before 5.5.0 do not bind the account whose two-factor code is verified to the account being authenticated, allowing an attacker who knows a victim's password and holds their own two-factor-enabled account to satisfy the victim's second-factor check with their own code and obtain the victim's session.
Product
Two Factor Authentication WordPress plugin before 1.17.0, All-In-One Security (AIOS)
Fixed in
1.17.0
What to do
Update Two Factor Authentication WordPress plugin before 1.17.0, All-In-One Security (AIOS) to 1.17.0 or newer.
Full record and what to do →NVD record wpscan.com
Oct 29, 2026WP Photo Album Plus: Does not verify the origin or a security token for one of its comment-management requestsCVE-2026-110983 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WP Photo Album Plus WordPress plugin before 9.3.04.004 does not verify the origin or a security token for one of its comment-management requests, allowing attackers to delete photo comments by tricking a logged-in user who holds comment-moderation rights into loading a crafted page.
Product
WP Photo Album Plus
Fixed in
9.3.04.004
What to do
Update WP Photo Album Plus to 9.3.04.004 or newer.
Full record and what to do →NVD record wpscan.com
Oct 29, 2026Enable SVG, WebP, and ICO Upload: Does not prevent animation elements in uploaded SVG files from changing a link's target to a javascript: URICVE-2026-110505 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Enable SVG, WebP, and ICO Upload WordPress plugin before 1.1.6 does not prevent animation elements in uploaded SVG files from changing a link's target to a javascript: URI, which could allow users with the author role and above to bypass its SVG sanitization and perform Stored Cross-Site Scripting attacks that execute in WebKit-based browsers such as Safari.
Product
Enable SVG, WebP, and ICO Upload
Fixed in
1.1.6
What to do
Update Enable SVG, WebP, and ICO Upload to 1.1.6 or newer.
Full record and what to do →NVD record wpscan.com
Oct 29, 2026Enable SVG, WebP, and ICO Upload: Does not sanitize uploaded SVG files whose content is not detectedCVE-2026-110504 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Enable SVG, WebP, and ICO Upload WordPress plugin before 1.1.6 does not sanitize uploaded SVG files whose content is not detected as SVG, while still storing and serving them as SVG images, which could allow users with the author role and above to perform Stored Cross-Site Scripting attacks.
Product
Enable SVG, WebP, and ICO Upload
Fixed in
1.1.6
What to do
Update Enable SVG, WebP, and ICO Upload to 1.1.6 or newer.
Full record and what to do →NVD record wpscan.com
Oct 29, 2026Hide Price Until Login: Does not restrict a guest-registration handler and does not honour the site's user-registration settingCVE-2026-110030 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Hide Price Until Login WordPress plugin before 1.1.2 does not restrict a guest-registration handler and does not honour the site's user-registration setting, allowing anyone to create a WordPress account and obtain a logged-in session even when registration is disabled.
Product
Hide Price Until Login
Fixed in
1.1.2
What to do
Update Hide Price Until Login to 1.1.2 or newer.
Full record and what to do →NVD record wpscan.com
Oct 29, 2026Wallet System for WooCommerce: Does not restrict its KYC document submission handler to the current user's own accountCVE-2026-108763 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Wallet System for WooCommerce WordPress plugin before 2.8.2 does not restrict its KYC document submission handler to the current user's own account, taking the target user ID from a client-supplied request field with no ownership or capability check, allowing authenticated users with minimal privileges such as Subscriber or Customer to overwrite the KYC documents and verification status of any other user, including an administrator.
Product
Wallet System for WooCommerce
Fixed in
2.8.2
What to do
Update Wallet System for WooCommerce to 2.8.2 or newer.
Full record and what to do →NVD record wpscan.com
Oct 29, 2026WP Post Author: Does not restrict the integration settings it returns to visitorsCVE-2026-108686 · WordPress plugins & themes · reported by WPScanLow 3.7
The WP Post Author WordPress plugin before 4.2.0 does not restrict the integration settings it returns to visitors, allowing unauthenticated users to read the reCAPTCHA secret key when one has been saved.
Product
WP Post Author
Fixed in
4.2.0
What to do
Update WP Post Author to 4.2.0 or newer.
Full record and what to do →NVD record wpscan.com
Oct 29, 2026WP Post Author: Does not check that the account was created before updating its profile during front-end registrationCVE-2026-108685 · WordPress plugins & themes · reported by WPScanLow 3.7
The WP Post Author WordPress plugin before 4.2.0 does not check that the account was created before updating its profile during front-end registration, allowing unauthenticated users to overwrite the display name, nickname and website of the first user account, which is normally the administrator, when a registration form declares one of those fields.
Product
WP Post Author
Fixed in
4.2.0
What to do
Update WP Post Author to 4.2.0 or newer.
Full record and what to do →NVD record wpscan.com
Oct 29, 2026Appointment Booking: Does not escape several booking-form step content settings before rendering them on the public booking formCVE-2026-105258 · WordPress plugins & themes · reported by WPScanLow 3.5
The Appointment Booking Plugin WordPress plugin before 5.7.6 does not escape several booking-form step content settings before rendering them on the public booking form, allowing high-privilege users such as administrators to inject JavaScript that executes in the browser of any visitor who loads the form; on multisite, where administrators do not hold the unfiltered_html capability, this crosses a privilege boundary to unauthenticated visitors.
Product
Appointment Booking
Fixed in
5.7.6
What to do
Update Appointment Booking to 5.7.6 or newer.
Full record and what to do →NVD record wpscan.com
Oct 29, 2026Frontend Dashboard WordPress plugin before 3.0.5, ProfileGrid: Do not prevent an unauthenticated user from storing a serialized PHP object in user metadata that is deserializedCVE-2026-103693 · WordPress plugins & themes · reported by WPScanCritical 9
The Frontend Dashboard WordPress plugin before 3.0.5, ProfileGrid WordPress plugin before 6.0.0.5 do not prevent an unauthenticated user from storing a serialized PHP object in user metadata that is deserialized when a public profile is viewed, allowing PHP object injection that can lead to arbitrary file write and potential remote code execution.
Product
Frontend Dashboard WordPress plugin before 3.0.5, ProfileGrid
Fixed in
3.0.5
What to do
Update Frontend Dashboard WordPress plugin before 3.0.5, ProfileGrid to 3.0.5 or newer.
Full record and what to do →NVD record wpscan.com
Oct 29, 2026LetterPress: Does not sanitise and escape some of its settingsCVE-2024-3586 · WordPress plugins & themes · reported by WPScanLow 3.5
The LetterPress WordPress plugin before 2.4.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
LetterPress
Fixed in
2.4.0
What to do
Update LetterPress to 2.4.0 or newer.
Full record and what to do →NVD record wpscan.com
Oct 29, 2026DSGVO All in one for WP: Stored Cross-Site ScriptingCVE-2026-96741 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The DSGVO All in one for WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Output Buffer Regex Corruption in all versions up to, and including, 5.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is only exploitable when the administrator has enabled both the 'Google Tag Manager' integration and the 'Replace integration automatically [Beta]' option, and requires the crafted comment to be approved by an administrator.
Product
DSGVO All in one for WP
Affected
up to 5.0
What to do
Affects up to 5.0. Update DSGVO All in one for WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 29, 2026Food Store – Online Food Delivery & Pickup: Stored Cross-Site ScriptingCVE-2026-96669 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Food Store – Online Food Delivery & Pickup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'service_type' Cookie in all versions up to, and including, 1.5.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The attack is seeded unauthenticated by supplying a payload via the ?type= query parameter on the public checkout page, which the plugin writes directly into the browser's service_type cookie; this cookie value is later persisted to order meta and rendered unescaped in the admin panel.
Product
Food Store – Online Food Delivery & Pickup
Affected
up to 1.5.5
What to do
Affects up to 1.5.5. Update Food Store – Online Food Delivery & Pickup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 29, 2026Schema App Structured Data: Stored Cross-Site ScriptingCVE-2026-96666 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Schema App Structured Data plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via 'Remove Microdata' Output Filter in all versions up to, and including, 2.3.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that an administrator has enabled the plugin's 'Remove Microdata' option and approves the malicious comment.
Product
Schema App Structured Data
Affected
up to 2.3.2
What to do
Affects up to 2.3.2. Update Schema App Structured Data to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 29, 2026SSL Wireless SMS Notification for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 3.8.1.CVE-2026-96228 · WordPress plugins & themes · reported by WordfenceHigh 8.1
SSL Wireless SMS Notification for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 3.8.1. The public final_login_ajax_action handler resolves a user and issues an authenticated session by matching the wp_sslcare_otp table on only the attacker-supplied phone and cap_data, without verifying the SMS OTP or any server-side single-use state. Because cap_data was chosen by the attacker in the public otp_login_ajax_action step (which stores the row before sending the SMS), the finalize step trivially matches and the user is looked up solely by the sslcare_login_phone meta. This makes it possible for unauthenticated attackers who know a phone-linked user's number to take over that account.
Affected
up to 3.8.1
What to do
Affects up to 3.8.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.svn.wordpress.org wordfence.com
Oct 29, 2026Social Web Suite – Social Media Auto Post, Social Media Auto Publish: Generic SQL InjectionCVE-2026-93904 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Social Web Suite – Social Media Auto Post, Social Media Auto Publish plugin for WordPress is vulnerable to generic SQL Injection via the 'exclude_posts' parameter in all versions up to, and including, 4.1.12 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The HMAC authentication gate protecting the endpoint is bypassable on any freshly activated installation where an administrator has not yet visited the settings page, because the secret_key option remains empty until lazily generated at that point, allowing an attacker to compute a valid token using hash_hmac('sha256', '', $timestamp) with any chosen timestamp.
Product
Social Web Suite – Social Media Auto Post, Social Media Auto Publish
Affected
up to 4.1.12
What to do
Affects up to 4.1.12. Update Social Web Suite – Social Media Auto Post, Social Media Auto Publish to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 29, 2026SendPress Newsletters: Time-based SQL InjectionCVE-2026-93855 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The SendPress Newsletters plugin for WordPress is vulnerable to time-based SQL Injection via the 'subscriberid' parameter in all versions up to, and including, 1.26.1.20 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The nonce gating the handler uses the hardcoded action value 'sendpress-is-awesome', which is rendered on the same public page served by the [sp-form formid="manage"] shortcode, making it trivially obtainable by unauthenticated visitors and effectively bypassing the nonce as an access control.
Product
SendPress Newsletters
Affected
up to 1.26.1.20
What to do
Affects up to 1.26.1.20. Update SendPress Newsletters to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 29, 2026Wild Apricot Login: Authentication BypassCVE-2026-93757 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Wild Apricot Login plugin for WordPress is vulnerable to Authentication Bypass via SSO Email-Collision Account Binding in all versions up to, and including, 1.0.18. When no WildApricot contact-ID mapping is found for an incoming SSO login, the plugin falls back to a network-global `get_user_by('email', ...)` lookup in `Module.php` to resolve a WordPress user, then `UserSynchronizer::syncWaContact()` binds and `Controller::login()` issues a session cookie via `wp_set_auth_cookie()` for that resolved user — both guarded only by `is_super_admin()` — without ever requiring proof of ownership of the matched WordPress account such as a password, local account-linking confirmation, inbox verification, or administrator approval. This makes it possible for attackers with custom-level WildApricot membership access to authenticate as an existing WordPress subsite administrator on a path-based Multisite network, obtaining a valid network-global authentication cookie for the victim without their credentials. Exploitation requires that the attacker control a WildApricot contact whose email address matches the target WordPress administrator's email — achievable via a public zero-fee membershi
Product
Wild Apricot Login
Affected
up to 1.0.18
What to do
Affects up to 1.0.18. Update Wild Apricot Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 29, 2026Bot for Telegram on WooCommerce: Authentication Bypass leading to Account TakeoverCVE-2026-109516 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Bot for Telegram on WooCommerce plugin for WordPress is vulnerable to Authentication Bypass leading to Account Takeover in all versions up to, and including, 1.3.0. The `/wp-json/woo-telegram/v1/main/` REST endpoint is registered with `permission_callback => '__return_true'` and performs no Telegram webhook signature verification, allowing an unauthenticated attacker to POST a forged bot update with a `message.chat.id` set to any WordPress login name; `bftow_get_user_system_id()` resolves this attacker-supplied value to the targeted account via `get_user_by('login', $tgId)` with no ownership proof, and writes a login token computed as `md5($_SERVER['HTTP_USER_AGENT'] . time())` — both inputs are fully attacker-controlled or bounded within seconds using the response's own `Date` header. The resulting token is redeemable at the unauthenticated, capability-check-free, and nonce-less `?action=bftow_create_order&bftow_token=` endpoint, which calls `wp_set_auth_cookie()` unconditionally via `login_user_by_id`, issuing a persistent authenticated session cookie for the targeted account to the attacker. This makes it possible for unauthenticated attackers to log in as any WordPress user
Product
Bot for Telegram on WooCommerce
Affected
up to 1.3.0
What to do
Affects up to 1.3.0. Update Bot for Telegram on WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 28, 2026The Ortto plugin for WordPress before 1.0.25 did not filter the WooCommerce product data it embedded in public storefront pages.CVE-2026-114173 · WordPress plugins & themes · reported by 61adb53e-e4b3-47f7-8a93-4717c9e77dc6Medium 5.3
The Ortto plugin for WordPress before 1.0.25 did not filter the WooCommerce product data it embedded in public storefront pages. An unauthenticated threat actor could read product passwords and private product metadata from an affected store.
Product
Ortto
Fixed in
1.0.25
What to do
Update Ortto to 1.0.25 or newer.
Full record and what to do →NVD record trust.canva.com
Oct 28, 2026The Ortto plugin for WordPress before 1.0.25 did not escape stored settings on its admin settings page, leading to stored cross-site scripting.CVE-2026-113409 · WordPress plugins & themes · reported by 61adb53e-e4b3-47f7-8a93-4717c9e77dc6Medium 4.8
The Ortto plugin for WordPress before 1.0.25 did not escape stored settings on its admin settings page, leading to stored cross-site scripting. A threat actor able to modify the plugin's configuration could execute arbitrary JavaScript in an administrator's session when they visited the impacted page.
Product
Ortto
Fixed in
1.0.25
What to do
Update Ortto to 1.0.25 or newer.
Full record and what to do →NVD record trust.canva.com
Oct 28, 2026The Ortto plugin for WordPress before 1.0.25 did not authenticate configuration update requests, relying only on a secret exposed in public HTML.CVE-2026-113387 · WordPress plugins & themes · reported by 61adb53e-e4b3-47f7-8a93-4717c9e77dc6High 8.6
The Ortto plugin for WordPress before 1.0.25 did not authenticate configuration update requests, relying only on a secret exposed in public HTML. An unauthenticated threat actor could overwrite the plugin's configuration to serve arbitrary scripts.
Product
Ortto
Fixed in
1.0.25
What to do
Update Ortto to 1.0.25 or newer.
Full record and what to do →NVD record trust.canva.com
Oct 28, 2026Bricks Builder 2.4.3 and before contains a broken access control vulnerability that allows unauthenticated attackers to access restricted post content by submitCVE-2026-118804 · WordPress plugins & themes · reported by VulnCheckHigh 7.5
Bricks Builder 2.4.3 and before contains a broken access control vulnerability that allows unauthenticated attackers to access restricted post content by submitting crafted post_status and post_type values in the originalQueryVars parameter to the POST /wp-json/bricks/v1/query_result REST endpoint using a publicly obtainable nonce. Attackers can set post_status to draft or private, or post_type to shop_coupon, to disclose unpublished posts, private content, and WooCommerce coupon data that is otherwise blocked by the standard WordPress REST API routes.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record bricksbuilder.io vulncheck.com
Oct 28, 2026the update_fees AJAX handler that: PiWeb Disable payment method / Partial payment for WooCommerce before 1.1.10.9 contains a missing authorizationCVE-2026-118757 · WordPress plugins & themes · reported by VulnCheckMedium 6.9
PiWeb Disable payment method / Partial payment for WooCommerce before 1.1.10.9 contains a missing authorization vulnerability in the update_fees AJAX handler that allows unauthenticated attackers to modify and read other customers' orders. Attackers can reuse a nonce from their own order-pay page and supply sequential order_id values to change payment methods, recalculate fees, and disclose order line items and totals.
Product
the update_fees AJAX handler that
Fixed in
1.1.10.9
What to do
Update the update_fees AJAX handler that to 1.1.10.9 or newer.
Full record and what to do →NVD record plugins.svn.wordpress.org plugins.trac.wordpress.org
Oct 28, 2026Ninja Forms: Incomplete server-side validationCVE-2026-67187 · WordPress plugins & themes · reported by VulnCheckMedium 5.1
Ninja Forms plugin for WordPress before 3.15.4 contains an incomplete server-side validation vulnerability that allows unauthenticated attackers to submit arbitrary values to Checkbox List, Multi-Select List, Image List, Country, and State fields because NF_Abstracts_List falls through to a validate() method that only checks required-field presence. Attackers can submit crafted formula payloads through the unauthenticated nf_ajax_submit endpoint that bypass CSV escaping applied only to Textbox and Textarea fields, resulting in CSV injection when an administrator downloads and opens the exported submissions file.
Product
Ninja Forms
Fixed in
3.15.4
What to do
Update Ninja Forms to 3.15.4 or newer.
Full record and what to do →NVD record wordpress.org vulncheck.com
Oct 28, 2026Filter Everything — WordPress & WooCommerce Filters: Deserialization of Untrusted DataCVE-2026-116390 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Deserialization of Untrusted Data vulnerability in stepasyuk Filter Everything — WordPress & WooCommerce Filters filter-everything allows Object Injection.This issue affects Filter Everything — WordPress & WooCommerce Filters: from n/a through 1.9.7.
Product
Filter Everything — WordPress & WooCommerce Filters
Affected
up to 1.9.7
What to do
Affects up to 1.9.7. Update Filter Everything — WordPress & WooCommerce Filters to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 28, 2026Phoenix Media Rename: Deserialization of Untrusted DataCVE-2026-116389 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in crossi72 Phoenix Media Rename phoenix-media-rename allows Object Injection.This issue affects Phoenix Media Rename: from n/a through 3.13.5.
Product
Phoenix Media Rename
Affected
up to 3.13.5
What to do
Affects up to 3.13.5. Update Phoenix Media Rename to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 28, 2026Ultimate Member: Deserialization of Untrusted DataCVE-2026-115968 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in Ultimate Member Ultimate Member ultimate-member allows Object Injection.This issue affects Ultimate Member: from n/a through 2.13.1.
Product
Ultimate Member
Affected
up to 2.13.1
What to do
Affects up to 2.13.1. Update Ultimate Member to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 28, 2026Advanced Ads – Tracking: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-115603 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Advanced Ads GmbH Advanced Ads – Tracking advanced-ads-tracking allows Blind SQL Injection.This issue affects Advanced Ads – Tracking: from n/a before 4.0.0.
Product
Advanced Ads – Tracking
Fixed in
4.0.0
What to do
Update Advanced Ads – Tracking to 4.0.0 or newer.
Full record and what to do →NVD record patchstack.com
Oct 28, 2026Dokan: Deserialization of Untrusted DataCVE-2026-115590 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Deserialization of Untrusted Data vulnerability in weDevs Dokan dokan-lite allows Object Injection.This issue affects Dokan: from n/a through 5.3.1.
Product
Dokan
Affected
up to 5.3.1
What to do
Affects up to 5.3.1. Update Dokan to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 28, 2026Redux Framework: Missing AuthorizationCVE-2026-116404 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in David Anderson Redux Framework redux-framework allows Lifting Sensitive Data Embedded in Cache.This issue affects Redux Framework: from n/a through 4.5.16.
Product
Redux Framework
Affected
up to 4.5.16
What to do
Affects up to 4.5.16. Update Redux Framework to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 28, 2026Optima Express: Missing AuthorizationCVE-2026-116393 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in iHomefinder, Inc. Optima Express optima-express allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Optima Express: from n/a through 9.0.0.
Product
Optima Express
Affected
up to 9.0.0
What to do
Affects up to 9.0.0. Update Optima Express to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 28, 2026Accordion: Deserialization of Untrusted DataCVE-2026-116392 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Deserialization of Untrusted Data vulnerability in PickPlugins Accordion accordions allows Object Injection.This issue affects Accordion: from n/a through 2.3.25.
Product
Accordion
Affected
up to 2.3.25
What to do
Affects up to 2.3.25. Update Accordion to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.