Vulnerability database

40,725 results · page 46 of 815

• Oct 1, 2026The Prime Mover: Zip Slip path traversalCVE-2026-101888 · WordPress plugins & themes · reported by VulnCheckHigh 8.6

  The Prime Mover plugin for WordPress before 2.2.1 contains a Zip Slip path traversal vulnerability that allows authenticated administrators to write arbitrary files outside the intended extraction directory during migration ZIP import. Attackers can craft ZIP entry names with traversal sequences processed by computeExtractionParameters() and resumableZipExtractor() in utilities/PrimeMoverSystemCheckUtilities.php to write attacker-controlled content to arbitrary filesystem locations, potentially achieving remote code execution if the written files are interpreted by the web environment.

  Product

  The Prime Mover

  Fixed in

  2.2.1

  What to do

  Update The Prime Mover to 2.2.1 or newer.

  Full record and what to do →NVD recordwordpress.orgvulncheck.com

• Oct 1, 2026Subscriber Broken Access Control in Gratisfaction <= 4.6.3 versions.CVE-2026-97297 · WordPress plugins & themes · reported by PatchstackHigh 7.6

  Subscriber Broken Access Control in Gratisfaction <= 4.6.3 versions.

  Affected

  up to 4.6.3

  What to do

  Affects up to 4.6.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 1, 2026Contributor PHP Object Injection in Icegram <= 3.1.31 versions.CVE-2026-97284 · WordPress plugins & themes · reported by PatchstackHigh 8.8

  Contributor PHP Object Injection in Icegram <= 3.1.31 versions.

  Affected

  up to 3.1.31

  What to do

  Affects up to 3.1.31. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 1, 2026Subscriber Broken Access Control in WP Project Manager <= 4.0.7 versions.CVE-2026-97281 · WordPress plugins & themes · reported by PatchstackMedium 6.3

  Subscriber Broken Access Control in WP Project Manager <= 4.0.7 versions.

  Affected

  up to 4.0.7

  What to do

  Affects up to 4.0.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 1, 2026Mamunur Rashid Review Schema review-schema: Missing AuthorizationCVE-2026-97280 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Missing Authorization vulnerability in Mamunur Rashid Review Schema review-schema allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Review Schema: 3.1.0.

  Product

  Mamunur Rashid Review Schema review-schema

  What to do

  Update Mamunur Rashid Review Schema review-schema to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Oct 1, 2026Subscriber Broken Access Control in Social Boost <= 3.6.2 versions.CVE-2026-97277 · WordPress plugins & themes · reported by PatchstackHigh 7.6

  Subscriber Broken Access Control in Social Boost <= 3.6.2 versions.

  Affected

  up to 3.6.2

  What to do

  Affects up to 3.6.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 1, 2026Unauthenticated Cross Site Scripting (XSS) in Premmerce Wishlist for WooCommerce <= 1.1.13 versions.CVE-2026-97273 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in Premmerce Wishlist for WooCommerce <= 1.1.13 versions.

  Affected

  up to 1.1.13

  What to do

  Affects up to 1.1.13. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 1, 2026Unauthenticated Insecure Direct Object References (IDOR) in WPFunnels <= 3.13.1 versions.CVE-2026-97269 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Unauthenticated Insecure Direct Object References (IDOR) in WPFunnels <= 3.13.1 versions.

  Affected

  up to 3.13.1

  What to do

  Affects up to 3.13.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 1, 2026Unauthenticated Cross Site Scripting (XSS) in Premmerce Wishlist for WooCommerce <= 1.1.13 versions.CVE-2026-97268 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in Premmerce Wishlist for WooCommerce <= 1.1.13 versions.

  Affected

  up to 1.1.13

  What to do

  Affects up to 1.1.13. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 1, 2026Unauthenticated Cross Site Scripting (XSS) in MaxGalleria <= 6.5.3 versions.CVE-2026-97260 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in MaxGalleria <= 6.5.3 versions.

  Affected

  up to 6.5.3

  What to do

  Affects up to 6.5.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 1, 2026Subscriber Broken Access Control in Aruba Migration Tool <= 1.0.4 versions.CVE-2026-97258 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Subscriber Broken Access Control in Aruba Migration Tool <= 1.0.4 versions.

  Affected

  up to 1.0.4

  What to do

  Affects up to 1.0.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 1, 2026Unauthenticated Insecure Direct Object References (IDOR) in Bus Ticket Booking with Seat Reservation <= 5.9.3 versions.CVE-2026-97251 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Unauthenticated Insecure Direct Object References (IDOR) in Bus Ticket Booking with Seat Reservation <= 5.9.3 versions.

  Affected

  up to 5.9.3

  What to do

  Affects up to 5.9.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 1, 2026Unauthenticated Arbitrary File Deletion in AcyMailing SMTP Newsletter <= 11.0.5 versions.CVE-2026-95588 · WordPress plugins & themes · reported by PatchstackHigh 8.6

  Unauthenticated Arbitrary File Deletion in AcyMailing SMTP Newsletter <= 11.0.5 versions.

  Affected

  up to 11.0.5

  What to do

  Affects up to 11.0.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 1, 2026Editor PHP Object Injection in Hide Shipping Method For WooCommerce <= 1.5.4 versions.CVE-2026-94390 · WordPress plugins & themes · reported by PatchstackHigh 7.2

  Editor PHP Object Injection in Hide Shipping Method For WooCommerce <= 1.5.4 versions.

  Affected

  up to 1.5.4

  What to do

  Affects up to 1.5.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 1, 2026Unauthenticated Broken Access Control in WP Full Stripe Free <= 8.5.6 versions.CVE-2026-62073 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Unauthenticated Broken Access Control in WP Full Stripe Free <= 8.5.6 versions.

  Affected

  up to 8.5.6

  What to do

  Affects up to 8.5.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 1, 2026Unauthenticated SQL Injection in WordPress File Upload <= 5.1.10 versions.CVE-2026-62071 · WordPress plugins & themes · reported by PatchstackCritical 9.3

  Unauthenticated SQL Injection in WordPress File Upload <= 5.1.10 versions.

  Affected

  up to 5.1.10

  What to do

  Affects up to 5.1.10. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 1, 2026Unauthenticated Privilege Escalation in Authorizer <= 3.15.3 versions.CVE-2026-103752 · WordPress plugins & themes · reported by PatchstackCritical 9.8

  Unauthenticated Privilege Escalation in Authorizer <= 3.15.3 versions.

  Affected

  up to 3.15.3

  What to do

  Affects up to 3.15.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 1, 2026Unauthenticated Bypass Vulnerability in hCaptcha for WP <= 5.3.0 versions.CVE-2026-103347 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Unauthenticated Bypass Vulnerability in hCaptcha for WP <= 5.3.0 versions.

  Affected

  up to 5.3.0

  What to do

  Affects up to 5.3.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 1, 2026Subscriber Privilege Escalation in ByteCoreStack &#8211; MCP Connector for AI Tools <= 1.2.2 versions.CVE-2026-103068 · WordPress plugins & themes · reported by PatchstackHigh 8.8

  Subscriber Privilege Escalation in ByteCoreStack &#8211; MCP Connector for AI Tools <= 1.2.2 versions.

  Affected

  up to 1.2.2

  What to do

  Affects up to 1.2.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 1, 2026Unauthenticated Cross Site Scripting (XSS) in Parallax Section block <= 2.0.4 versions.CVE-2026-102378 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in Parallax Section block <= 2.0.4 versions.

  Affected

  up to 2.0.4

  What to do

  Affects up to 2.0.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 1, 2026Photo Reviews for WooCommerce: Authorization Bypass Through User-Controlled KeyCVE-2026-100517 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Authorization Bypass Through User-Controlled Key vulnerability in VillaTheme Photo Reviews for WooCommerce woo-photo-reviews allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Photo Reviews for WooCommerce: from n/a through 1.2.30.

  Product

  Photo Reviews for WooCommerce

  Affected

  up to 1.2.30

  What to do

  Affects up to 1.2.30. Update Photo Reviews for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 1, 2026Unauthenticated Insecure Direct Object References (IDOR) in REST API Log <= 1.7.2 versions.CVE-2026-100514 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Unauthenticated Insecure Direct Object References (IDOR) in REST API Log <= 1.7.2 versions.

  Affected

  up to 1.7.2

  What to do

  Affects up to 1.7.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 1, 2026WpTravelly: Missing AuthorizationCVE-2026-62063 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Missing Authorization vulnerability in Magepeople inc. WpTravelly tour-booking-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WpTravelly: from n/a through 2.3.1.

  Product

  WpTravelly

  Affected

  up to 2.3.1

  What to do

  Affects up to 2.3.1. Update WpTravelly to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 1, 2026ProfileGrid: Authorization Bypass Through User-Controlled KeyCVE-2026-62061 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Authorization Bypass Through User-Controlled Key vulnerability in Metagauss ProfileGrid profilegrid-user-profiles-groups-and-communities allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ProfileGrid: from n/a through 6.0.0.2.

  Product

  ProfileGrid

  Affected

  up to 6.0.0.2

  What to do

  Affects up to 6.0.0.2. Update ProfileGrid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 1, 2026Captivate Sync: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-62060 · WordPress plugins & themes · reported by PatchstackHigh 7.6

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in captivateaudio Captivate Sync captivatesync-trade allows Blind SQL Injection.This issue affects Captivate Sync: from n/a through 3.3.2.

  Product

  Captivate Sync

  Affected

  up to 3.3.2

  What to do

  Affects up to 3.3.2. Update Captivate Sync to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 1, 2026Ultimate Member: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-62059 · WordPress plugins & themes · reported by PatchstackHigh 7.6

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ultimate Member Ultimate Member ultimate-member allows Blind SQL Injection.This issue affects Ultimate Member: from n/a through 2.13.1.

  Product

  Ultimate Member

  Affected

  up to 2.13.1

  What to do

  Affects up to 2.13.1. Update Ultimate Member to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 1, 2026CF7 Apps: Insertion of Sensitive Information Into Sent DataCVE-2026-62058 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Insertion of Sensitive Information Into Sent Data vulnerability in WPExperts CF7 Apps contact-form-7-honeypot allows Retrieve Embedded Sensitive Data.This issue affects CF7 Apps: from n/a through 3.7.2.

  Product

  CF7 Apps

  Affected

  up to 3.7.2

  What to do

  Affects up to 3.7.2. Update CF7 Apps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 1, 2026Pie Register: Insertion of Sensitive Information Into Sent DataCVE-2026-103345 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Insertion of Sensitive Information Into Sent Data vulnerability in Shamim Rajani Pie Register pie-register allows Retrieve Embedded Sensitive Data.This issue affects Pie Register: from n/a through 3.8.4.13.

  Product

  Pie Register

  Affected

  up to 3.8.4.13

  What to do

  Affects up to 3.8.4.13. Update Pie Register to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 1, 2026FluentForm: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-103343 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP ManageNinja LLC FluentForm fluentform allows Stored XSS.This issue affects FluentForm: from n/a through 6.2.14.

  Product

  FluentForm

  Affected

  up to 6.2.14

  What to do

  Affects up to 6.2.14. Update FluentForm to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 1, 2026Unlimited Elements For Elementor (Free Widgets, Addons, Templates): Missing AuthorizationCVE-2026-103341 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 2.0.20.

  Product

  Unlimited Elements For Elementor (Free Widgets, Addons, Templates)

  Affected

  up to 2.0.20

  What to do

  Affects up to 2.0.20. Update Unlimited Elements For Elementor (Free Widgets, Addons, Templates) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 1, 2026Site Reviews: Missing AuthorizationCVE-2026-103340 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in Gemini Labs Site Reviews site-reviews allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Site Reviews: from n/a through 8.3.2.

  Product

  Site Reviews

  Affected

  up to 8.3.2

  What to do

  Affects up to 8.3.2. Update Site Reviews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 1, 2026Metform: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-103339 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wpmet Metform metform allows Stored XSS.This issue affects Metform: from n/a through 4.3.0.

  Product

  Metform

  Affected

  up to 4.3.0

  What to do

  Affects up to 4.3.0. Update Metform to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 1, 2026Unlimited Elements For Elementor (Free Widgets, Addons, Templates): Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-103338 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor allows Blind SQL Injection.This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 2.0.20.

  Product

  Unlimited Elements For Elementor (Free Widgets, Addons, Templates)

  Affected

  up to 2.0.20

  What to do

  Affects up to 2.0.20. Update Unlimited Elements For Elementor (Free Widgets, Addons, Templates) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 1, 2026Memberful - Membership: Cross-Site Request Forgery (CSRF)CVE-2026-103067 · WordPress plugins & themes · reported by PatchstackHigh 8

  Cross-Site Request Forgery (CSRF) vulnerability in Memberful Memberful - Membership Plugin memberful-wp allows Cross Site Request Forgery.This issue affects Memberful - Membership Plugin: from n/a through 1.81.0.

  Product

  Memberful - Membership

  Affected

  up to 1.81.0

  What to do

  Affects up to 1.81.0. Update Memberful - Membership to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 1, 2026ElementsKit Elementor addons Lite: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-103064 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wpmet ElementsKit Elementor addons Lite elementskit-lite allows Stored XSS.This issue affects ElementsKit Elementor addons Lite: from n/a through 4.0.6.

  Product

  ElementsKit Elementor addons Lite

  Affected

  up to 4.0.6

  What to do

  Affects up to 4.0.6. Update ElementsKit Elementor addons Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 1, 2026ElementsKit Elementor addons Lite: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-103063 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wpmet ElementsKit Elementor addons Lite elementskit-lite allows Stored XSS.This issue affects ElementsKit Elementor addons Lite: from n/a through 4.0.6.

  Product

  ElementsKit Elementor addons Lite

  Affected

  up to 4.0.6

  What to do

  Affects up to 4.0.6. Update ElementsKit Elementor addons Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 1, 2026Essential Addons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-102394 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPDeveloper Essential Addons for Elementor essential-addons-for-elementor-lite allows Stored XSS.This issue affects Essential Addons for Elementor: from n/a through 6.8.4.

  Product

  Essential Addons for Elementor

  Affected

  up to 6.8.4

  What to do

  Affects up to 6.8.4. Update Essential Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 1, 2026AFFI – Affiliate Marketing for WooCommerce: Missing AuthorizationCVE-2026-102390 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in VillaTheme AFFI – Affiliate Marketing for WooCommerce affi-affiliate-marketing-for-woo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AFFI – Affiliate Marketing for WooCommerce: from n/a through 1.0.9.

  Product

  AFFI – Affiliate Marketing for WooCommerce

  Affected

  up to 1.0.9

  What to do

  Affects up to 1.0.9. Update AFFI – Affiliate Marketing for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 1, 2026Majestic Support: Authorization Bypass Through User-Controlled KeyCVE-2026-102382 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Authorization Bypass Through User-Controlled Key vulnerability in Ahmad Majestic Support majestic-support allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Majestic Support: from n/a through 1.2.0.

  Product

  Majestic Support

  Affected

  up to 1.2.0

  What to do

  Affects up to 1.2.0. Update Majestic Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 1, 2026Majestic Support: Missing AuthorizationCVE-2026-102381 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in Ahmad Majestic Support majestic-support allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Majestic Support: from n/a through 1.2.0.

  Product

  Majestic Support

  Affected

  up to 1.2.0

  What to do

  Affects up to 1.2.0. Update Majestic Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 1, 2026BuildKit – Product Builder for WooCommerce – Custom PC Builder: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-102379 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VillaTheme BuildKit – Product Builder for WooCommerce – Custom PC Builder woo-product-builder allows Blind SQL Injection.This issue affects BuildKit – Product Builder for WooCommerce – Custom PC Builder: from n/a through 1.0.28.

  Product

  BuildKit – Product Builder for WooCommerce – Custom PC Builder

  Affected

  up to 1.0.28

  What to do

  Affects up to 1.0.28. Update BuildKit – Product Builder for WooCommerce – Custom PC Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 1, 2026WP Ultimate CSV Importer: Insertion of Sensitive Information Into Sent DataCVE-2026-103336 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Insertion of Sensitive Information Into Sent Data vulnerability in Smackcoders Inc. WP Ultimate CSV Importer wp-ultimate-csv-importer allows Retrieve Embedded Sensitive Data.This issue affects WP Ultimate CSV Importer: from n/a through 9.1.

  Product

  WP Ultimate CSV Importer

  Affected

  up to 9.1

  What to do

  Affects up to 9.1. Update WP Ultimate CSV Importer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 1, 2026FluentForm: Incorrect Behavior OrderCVE-2026-103353 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Incorrect Behavior Order vulnerability in WP ManageNinja LLC FluentForm fluentform allows Removing Important Client Functionality.This issue affects FluentForm: from n/a through 6.2.14.

  Product

  FluentForm

  Affected

  up to 6.2.14

  What to do

  Affects up to 6.2.14. Update FluentForm to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 1, 2026LA-Studio Element Kit for Elementor: Server-Side Request Forgery (SSRF)CVE-2026-103082 · WordPress plugins & themes · reported by PatchstackHigh 7.2

  Server-Side Request Forgery (SSRF) vulnerability in LA-Studio LA-Studio Element Kit for Elementor lastudio-element-kit allows Server Side Request Forgery.This issue affects LA-Studio Element Kit for Elementor: from n/a through 1.6.2.

  Product

  LA-Studio Element Kit for Elementor

  Affected

  up to 1.6.2

  What to do

  Affects up to 1.6.2. Update LA-Studio Element Kit for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 1, 2026Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns: Stored Cross-Site ScriptingCVE-2026-96256 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Google Map block's 'marker' attribute in versions up to, and including, 6.4.5 This is due to insufficient input sanitization and output escaping on marker title/content values, which are stored as JSON and then decoded and concatenated directly into raw HTML by the frontend script's InfoWindow content builder. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

  Product

  Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns

  Affected

  up to 6.4.5

  What to do

  Affects up to 6.4.5. Update Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Oct 1, 2026Forminator Forms – Contact Form, Payment Form & Custom Form Builder: Stored Cross-Site ScriptingCVE-2026-92144 · WordPress plugins & themes · reported by WordfenceHigh 7.2

  The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'postdata-1[post-custom]' Parameter in all versions up to, and including, 1.57.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The required form submission nonce is freely obtainable by unauthenticated users via the publicly accessible wp_ajax_nopriv_forminator_get_nonce endpoint, making the full attack chain exploitable without any authentication or prior account.

  Product

  Forminator Forms – Contact Form, Payment Form & Custom Form Builder

  Affected

  up to 1.57.2

  What to do

  Affects up to 1.57.2. Update Forminator Forms – Contact Form, Payment Form & Custom Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Oct 1, 2026Business Essentials for Contact Form 7: Stored Cross-Site ScriptingCVE-2026-97661 · WordPress plugins & themes · reported by WordfenceHigh 7.2

  The Business Essentials for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'gateway' Form Field in all versions up to, and including, 1.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the Payments module to be enabled and a form to be configured to accept both PayPal and Stripe as payment gateways.

  Product

  Business Essentials for Contact Form 7

  Affected

  up to 1.2.1

  What to do

  Affects up to 1.2.1. Update Business Essentials for Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Oct 1, 2026Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder: Stored Cross-Site ScriptingCVE-2026-96813 · WordPress plugins & themes · reported by WordfenceHigh 7.2

  The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Mark on Map Longitude/Latitude Fields in all versions up to, and including, 1.15.47 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

  Product

  Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder

  Affected

  up to 1.15.47

  What to do

  Affects up to 1.15.47. Update Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Oct 1, 2026Appointment Hour Booking – Booking Calendar: Stored DOM-Based Cross-Site ScriptingCVE-2026-96573 · WordPress plugins & themes · reported by WordfenceHigh 7.2

  The Appointment Hour Booking – Booking Calendar plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via Booking Form Single-Line Field via Schedule Calendar List Renderer in all versions up to, and including, 1.5.97 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the 'list_readmore_numberofwords' Other Parameters setting to be configured with a positive integer value; the default value of 0 bypasses the decode-and-truncate branch entirely and is not exploitable through this sink.

  Product

  Appointment Hour Booking – Booking Calendar

  Affected

  up to 1.5.97

  What to do

  Affects up to 1.5.97. Update Appointment Hour Booking – Booking Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Oct 1, 2026Awesome Support – WordPress HelpDesk & Support: Stored Cross-Site ScriptingCVE-2026-96268 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The Awesome Support – WordPress HelpDesk & Support Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'gdpr-data' parameter in all versions up to, and including, 6.4.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable by Subscriber-level users against other accounts because the AJAX handlers accept an arbitrary gdpr-user ID without verifying it belongs to the requester, and the required wpas-gdpr-nonce is emitted via wp_localize_script to every logged-in user on frontend plugin pages and on /wp-admin/profile.php.

  Product

  Awesome Support – WordPress HelpDesk & Support

  Affected

  up to 6.4.0

  What to do

  Affects up to 6.4.0. Update Awesome Support – WordPress HelpDesk & Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.