Updated 2 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,769exploited flaws on CISA’s list

30added in the last 30 days

496new WordPress flaws this week

394,829entries in the database

24,770 results · page 5 of 496

Nov 6, 2026Order Tracking: Does not verify that a PayPal payment notification was sent to the merchant's accountCVE-2026-121633 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Order Tracking WordPress plugin before 3.6.0 does not verify that a PayPal payment notification was sent to the merchant's account, or that its amount matches the order total, before marking an order as paid, which could allow unauthenticated attackers to mark arbitrary orders as paid using a trivial payment to their own PayPal account.
Product
Order Tracking
Fixed in
3.6.0
What to do
Update Order Tracking to 3.6.0 or newer.
Full record and what to do →NVD record wpscan.com
Nov 6, 2026OAuth Single Sign On – SSO (OAuth Client): Incorrect Privilege AssignmentCVE-2026-120844 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Incorrect Privilege Assignment vulnerability in miniOrange OAuth Single Sign On – SSO (OAuth Client) miniorange-login-with-eve-online-google-facebook allows Privilege Escalation.This issue affects OAuth Single Sign On – SSO (OAuth Client): from n/a through 7.1.3.
Product
OAuth Single Sign On – SSO (OAuth Client)
Affected
up to 7.1.3
What to do
Affects up to 7.1.3. Update OAuth Single Sign On – SSO (OAuth Client) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 6, 2026The WP Libre Form WordPress plugin 1.5.0.1 does not validate the type of files uploaded through its form submissions, allowing unauthenticated attackers to uploCVE-2026-118423 · WordPress plugins & themes · reported by WPScanCritical 10
The WP Libre Form WordPress plugin 1.5.0.1 does not validate the type of files uploaded through its form submissions, allowing unauthenticated attackers to upload PHP files to a web-accessible location and execute them, leading to remote code execution.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record wpscan.com
Nov 6, 2026MC4WP: Mailchimp for: Does not prevent request-derived values in its dynamic content tags from being processedCVE-2026-118166 · WordPress plugins & themes · reported by WPScanMedium 4.8
The MC4WP: Mailchimp for WordPress WordPress plugin before 4.15.0 does not prevent request-derived values in its dynamic content tags from being processed as shortcodes when a form is embedded with its block, allowing unauthenticated visitors to execute arbitrary registered shortcodes with attacker-chosen attributes. This requires the site owner to have added a request-derived tag to the form content and to embed the form with the block rather than the classic shortcode.
Product
MC4WP: Mailchimp for
Fixed in
4.15.0
What to do
Update MC4WP: Mailchimp for to 4.15.0 or newer.
Full record and what to do →NVD record wpscan.com
Nov 6, 2026ShopEngine Gutenberg WooCommerce Builder Blocks Addon: Does not validate the user's capabilities or the ownership of the targeted post in one of its AJAX actionsCVE-2026-92396 · WordPress plugins & themes · reported by WPScanMedium 6.8
The ShopEngine Gutenberg WooCommerce Builder Blocks Addon WordPress plugin before 2.4.4 does not validate the user's capabilities or the ownership of the targeted post in one of its AJAX actions, and does not escape the stored value before outputting it in a JavaScript context, allowing users with a role as low as contributor to inject arbitrary scripts into any post that will run when a higher privileged user edits it.
Product
ShopEngine Gutenberg WooCommerce Builder Blocks Addon
Fixed in
2.4.4
What to do
Update ShopEngine Gutenberg WooCommerce Builder Blocks Addon to 2.4.4 or newer.
Full record and what to do →NVD record wpscan.com
Nov 6, 2026Cool Media Filter: Does not perform any capability or nonce checkCVE-2026-87784 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Cool Media Filter WordPress plugin through 1.0.1 does not perform any capability or nonce check when updating the capabilities of a role, allowing any authenticated user, such as a subscriber, to grant their own role administrator capabilities and take over the site.
Product
Cool Media Filter
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update Cool Media Filter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Nov 6, 2026iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more: Does not properly escape content it re-emits through its bundled HTML parserCVE-2026-86606 · WordPress plugins & themes · reported by WPScanHigh 7.5
The iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more WordPress plugin before 3.13.7 does not properly escape content it re-emits through its bundled HTML parser, allowing unauthenticated users to inject arbitrary web scripts in pages that will execute in the session of any visitor viewing them, including logged in administrators.
Product
iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more
Fixed in
3.13.7
What to do
Update iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more to 3.13.7 or newer.
Full record and what to do →NVD record wpscan.com
Nov 6, 2026WCFM Membership: Does not verify that payment was made before completing a paid membershipCVE-2026-12967 · WordPress plugins & themes · reported by WPScanMedium 6.5
The WCFM Membership WordPress plugin before 2.12.1 does not verify that payment was made before completing a paid membership, allowing any authenticated Subscriber/Customer to activate a paid vendor membership for free and gain the marketplace vendor role.
Product
WCFM Membership
Fixed in
2.12.1
What to do
Update WCFM Membership to 2.12.1 or newer.
Full record and what to do →NVD record wpscan.com
Nov 6, 2026All-in-One Video Gallery: Does not escape a video's stored thumbnail URL before outputting it in the admin video listCVE-2026-120408 · WordPress plugins & themes · reported by WPScanHigh 8
The All-in-One Video Gallery WordPress plugin before 5.1.0 does not escape a video's stored thumbnail URL before outputting it in the admin video list, and does not sanitise that value when it is written outside its own editor, allowing users with a role as low as Subscriber to perform Stored Cross-Site Scripting attacks against administrators.
Product
All-in-One Video Gallery
Fixed in
5.1.0
What to do
Update All-in-One Video Gallery to 5.1.0 or newer.
Full record and what to do →NVD record wpscan.com
Nov 6, 2026All-in-One Video Gallery: Does not check the typeCVE-2026-119259 · WordPress plugins & themes · reported by WPScanMedium 5.3
The All-in-One Video Gallery WordPress plugin before 5.1.0 does not check the type, status or ownership of the target post before writing its view count and duration meta, allowing unauthenticated visitors to create or change that meta on any post, including private and draft posts, and to inflate the view count without limit.
Product
All-in-One Video Gallery
Fixed in
5.1.0
What to do
Update All-in-One Video Gallery to 5.1.0 or newer.
Full record and what to do →NVD record wpscan.com
Nov 6, 2026Surfer: Discloses a sensitive API credential to low-privileged users through the post editor page and relies on that same credentialCVE-2026-118639 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Surfer WordPress plugin before 1.8.1.759 discloses a sensitive API credential to low-privileged users through the post editor page and relies on that same credential as the sole authorization for its privileged REST API, allowing users with contributor-level access and above to read the credential and escalate to publishing arbitrary posts and other privileged actions.
Product
Surfer
Fixed in
1.8.1.759
What to do
Update Surfer to 1.8.1.759 or newer.
Full record and what to do →NVD record wpscan.com
Nov 6, 2026AutomatorWP: Does not check that the user completing its Zoom and AWeber integration connections is allowed to do soCVE-2026-118239 · WordPress plugins & themes · reported by WPScanMedium 5.6
The AutomatorWP WordPress plugin before 6.0.7 does not check that the user completing its Zoom and AWeber integration connections is allowed to do so, allowing unauthenticated attackers to replace the stored integration credentials with their own and divert the data the site sends to those services into an account they control. Exploitation requires the integration to already be connected and knowledge of the site's OAuth client identifier.
Product
AutomatorWP
Fixed in
6.0.7
What to do
Update AutomatorWP to 6.0.7 or newer.
Full record and what to do →NVD record wpscan.com
Nov 6, 2026PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes: Does not verify that a user is permitted to read a given post before returning its content through its revision-comparison featureCVE-2026-118188 · WordPress plugins & themes · reported by WPScanMedium 4.3
The PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes WordPress plugin before 4.3.1 does not verify that a user is permitted to read a given post before returning its content through its revision-comparison feature, allowing any authenticated user, including a Subscriber, to read the title, content and excerpt of any other user's private, draft, pending, scheduled or trashed post.
Product
PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes
Fixed in
4.3.1
What to do
Update PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes to 4.3.1 or newer.
Full record and what to do →NVD record wpscan.com
Nov 6, 2026PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes: Does not verify that a user requesting to duplicate or revise a post has access to that specific postCVE-2026-118187 · WordPress plugins & themes · reported by WPScanLow 2.7
The PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes WordPress plugin before 4.3.1 does not verify that a user requesting to duplicate or revise a post has access to that specific post, only that they can edit posts of that type, allowing users with contributor-level access and above to duplicate another user's private, draft, pending or scheduled post into one they own and read its full content.
Product
PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes
Fixed in
4.3.1
What to do
Update PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes to 4.3.1 or newer.
Full record and what to do →NVD record wpscan.com
Nov 6, 2026PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes: Does not correctly restrict who may publish contentCVE-2026-118186 · WordPress plugins & themes · reported by WPScanMedium 4.9
The PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes WordPress plugin before 4.3.1 does not correctly restrict who may publish content, allowing users such as Contributors who can edit but not publish to make unreviewed posts and pages publicly live, bypassing the intended editorial approval workflow.
Product
PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes
Fixed in
4.3.1
What to do
Update PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes to 4.3.1 or newer.
Full record and what to do →NVD record wpscan.com
Nov 6, 2026MC4WP: Mailchimp for: Does not validate that the Mailchimp audience a sign-up form or bundled integration subscribes a visitor to matches the audience configured by the site ownerCVE-2026-118167 · WordPress plugins & themes · reported by WPScanMedium 5.3
The MC4WP: Mailchimp for WordPress plugin before 4.15.0 does not validate that the Mailchimp audience a sign-up form or bundled integration subscribes a visitor to matches the audience configured by the site owner, allowing unauthenticated visitors to subscribe arbitrary email addresses to any other audience in the site's connected Mailchimp account.
Product
MC4WP: Mailchimp for
Fixed in
4.15.0
What to do
Update MC4WP: Mailchimp for to 4.15.0 or newer.
Full record and what to do →NVD record wpscan.com
Nov 6, 2026Ever Accounting: Does not restrict the file path supplied to its CSV import routine to an allowed directoryCVE-2026-118045 · WordPress plugins & themes · reported by WPScanHigh 8.7
The Ever Accounting WordPress plugin before 2.3.3 does not restrict the file path supplied to its CSV import routine to an allowed directory, allowing users with its custom Accounting Manager role (which does not have administrator privileges) to delete arbitrary files on the server, such as wp-config.php, which takes the entire site offline.
Product
Ever Accounting
Fixed in
2.3.3
What to do
Update Ever Accounting to 2.3.3 or newer.
Full record and what to do →NVD record wpscan.com
Nov 6, 2026Static Snapshot: Does not sanitise shell metacharacters in a user-supplied value before concatenating it into operating-system commands run by the serverCVE-2026-116533 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Static Snapshot WordPress plugin through 0.2.1 does not sanitise shell metacharacters in a user-supplied value before concatenating it into operating-system commands run by the server, allowing unauthenticated attackers to execute arbitrary commands on the host.
Product
Static Snapshot
Affected
up to 0.2.1
What to do
Affects up to 0.2.1. Update Static Snapshot to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Nov 6, 2026WHIZZ: Does not validate the password-reset key before updating a user's passwordCVE-2026-115230 · WordPress plugins & themes · reported by WPScanCritical 9.8
The WHIZZ WordPress plugin through 1.1.8 does not validate the password-reset key before updating a user's password, relying only on a nonce that is exposed to unauthenticated visitors, allowing attackers to set an arbitrary password for any user, including administrators, and fully take over their accounts.
Product
WHIZZ
Affected
up to 1.1.8
What to do
Affects up to 1.1.8. Update WHIZZ to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Nov 6, 2026GutenKit: Does not properly sanitize custom CSS saved against a post before printing it inside an inline style block on the published pageCVE-2026-114427 · WordPress plugins & themes · reported by WPScanMedium 6.8
The GutenKit WordPress plugin before 2.5.5 does not properly sanitize custom CSS saved against a post before printing it inside an inline style block on the published page, allowing users with the Author role and above to break out of the style element and store JavaScript that executes in the browser of any visitor who views the post. Exploitation affects sites running WordPress below 7.0.
Product
GutenKit
Fixed in
2.5.5
What to do
Update GutenKit to 2.5.5 or newer.
Full record and what to do →NVD record wpscan.com
Nov 6, 2026GS JWT Authentication for WP REST API: Does not sanitize or parameterize a request value before using it in SQL queries on several unauthenticated REST routesCVE-2026-113615 · WordPress plugins & themes · reported by WPScanCritical 9.8
The GS JWT Authentication for WP REST API WordPress plugin through 1.0.0 does not sanitize or parameterize a request value before using it in SQL queries on several unauthenticated REST routes, allowing unauthenticated attackers to perform SQL injection and obtain an administrator session.
Product
GS JWT Authentication for WP REST API
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update GS JWT Authentication for WP REST API to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Nov 6, 2026Advanced Custom Fields (ACF®): Does not properly sanitize a stored field definition that can be modified through its comment handlingCVE-2026-110813 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Advanced Custom Fields (ACF®) WordPress plugin before 6.8.11 does not properly sanitize a stored field definition that can be modified through its comment handling, allowing unauthenticated users to inject a payload that is emitted as an HTML attribute name and executed as JavaScript in the browser of any visitor or administrator who views a page rendering the affected field.
Product
Advanced Custom Fields (ACF®)
Fixed in
6.8.11
What to do
Update Advanced Custom Fields (ACF®) to 6.8.11 or newer.
Full record and what to do →NVD record wpscan.com
Nov 6, 2026MCB: Does not sanitise or escape request header values before storing them and later rendering them in the administrator statistics gridCVE-2026-110525 · WordPress plugins & themes · reported by WPScanHigh 8.8
The MCB WordPress plugin through 1.0.0 does not sanitise or escape request header values before storing them and later rendering them in the administrator statistics grid, allowing unauthenticated attackers to store malicious JavaScript that executes in an administrator's browser session when the statistics page is viewed.
Product
MCB
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update MCB to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Nov 5, 2026Dokan: Does not reconcile the amount credited to a vendor's reverse-withdrawal ledger against the amount actually collected for the payment orderCVE-2026-107776 · WordPress plugins & themes · reported by WPScanLow 2.2
The Dokan WordPress plugin before 5.3.3 does not reconcile the amount credited to a vendor's reverse-withdrawal ledger against the amount actually collected for the payment order, allowing a vendor to clear their outstanding commission debt while paying less than the balance owed when a discount coupon is applied at checkout.
Product
Dokan
Fixed in
5.3.3
What to do
Update Dokan to 5.3.3 or newer.
Full record and what to do →NVD record wpscan.com
Nov 5, 2026The Security For WooCommerce WordPress plugin from 1.0.10 to 1.0.16 does not perform capability checks when creating users through an action available to unauthCVE-2026-100109 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Security For WooCommerce WordPress plugin from 1.0.10 to 1.0.16 does not perform capability checks when creating users through an action available to unauthenticated visitors, and lets the caller choose the new account's role, allowing unauthenticated attackers to create administrator accounts and take over the site.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record wpscan.com
Nov 5, 2026EWWW Image Optimizer: Does not properly sanitize and restrict a value in post content before using it to dynamically load and execute a script in the pageCVE-2026-91049 · WordPress plugins & themes · reported by WPScanMedium 6.4
The EWWW Image Optimizer WordPress plugin before 8.9.1 does not properly sanitize and restrict a value in post content before using it to dynamically load and execute a script in the page, allowing authenticated attackers with author-level access and above to inject arbitrary web scripts that run in the session of any user who views the affected page, including administrators. This is an incomplete fix of CVE-2026-15446: the origin and path restrictions added from 8.7.4 onward were each bypassable, so versions 8.7.4 through 8.9.0 remain affected.
Product
EWWW Image Optimizer
Affected
up to 8.9.0
Fixed in
8.9.1
What to do
Update EWWW Image Optimizer to 8.9.1 or newer.
Full record and what to do →NVD record wpscan.com
Nov 5, 2026Essential Real Estate: Does not verify ownership of an invoice before rendering it in one of its AJAX actionsCVE-2026-90967 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Essential Real Estate WordPress plugin before 5.3.5 does not verify ownership of an invoice before rendering it in one of its AJAX actions, allowing an authenticated low-privileged user to read other users' invoices, including the invoice owner's name, account email address and financial details.
Product
Essential Real Estate
Fixed in
5.3.5
What to do
Update Essential Real Estate to 5.3.5 or newer.
Full record and what to do →NVD record wpscan.com
Nov 5, 2026Essential Real Estate: Does not perform a publication-status or authorization check in two of its AJAX actionsCVE-2026-90965 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Essential Real Estate WordPress plugin before 5.3.5 does not perform a publication-status or authorization check in two of its AJAX actions, allowing unauthenticated users to retrieve the images attached to property listings that have not been published.
Product
Essential Real Estate
Fixed in
5.3.5
What to do
Update Essential Real Estate to 5.3.5 or newer.
Full record and what to do →NVD record wpscan.com
Nov 5, 2026Essential Real Estate: Does not restrict the recipient of one of its contact email actionsCVE-2026-90964 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Essential Real Estate WordPress plugin before 5.3.5 does not restrict the recipient of one of its contact email actions, allowing unauthenticated users to send emails to arbitrary addresses with an attacker-controlled sender header and message body through the site.
Product
Essential Real Estate
Fixed in
5.3.5
What to do
Update Essential Real Estate to 5.3.5 or newer.
Full record and what to do →NVD record wpscan.com
Nov 5, 2026Essential Real Estate: Does not perform any authorization or publication-status check in one of its AJAX actionsCVE-2026-90963 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Essential Real Estate WordPress plugin before 5.3.5 does not perform any authorization or publication-status check in one of its AJAX actions, allowing unauthenticated users to read the full contents of property listings that have not been published, together with the private name, email address, phone number and office address of the listing agent.
Product
Essential Real Estate
Fixed in
5.3.5
What to do
Update Essential Real Estate to 5.3.5 or newer.
Full record and what to do →NVD record wpscan.com
Nov 5, 2026YITH WooCommerce Gift Cards: Does not lock or atomically update a gift card's balanceCVE-2026-88814 · WordPress plugins & themes · reported by WPScanLow 3.7
The YITH WooCommerce Gift Cards WordPress plugin before 4.38.1 does not lock or atomically update a gift card's balance when it is redeemed at checkout, allowing an attacker who holds a gift card code to spend more than its funded value by submitting multiple checkouts for the same code at the same time.
Product
YITH WooCommerce Gift Cards
Fixed in
4.38.1
What to do
Update YITH WooCommerce Gift Cards to 4.38.1 or newer.
Full record and what to do →NVD record wpscan.com
Nov 5, 2026Subscriptions for WooCommerce: Only enforces its membership content restrictions on standard front-end page viewsCVE-2026-87856 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Subscriptions for WooCommerce WordPress plugin before 2.1.1 only enforces its membership content restrictions on standard front-end page views, allowing unauthenticated users to read the full contents of restricted posts and pages through other routes that render the same content.
Product
Subscriptions for WooCommerce
Fixed in
2.1.1
What to do
Update Subscriptions for WooCommerce to 2.1.1 or newer.
Full record and what to do →NVD record wpscan.com
Nov 5, 2026Community Events: Does not have authorisation or nonce checks in one of its AJAX actionsCVE-2026-86795 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Community Events WordPress plugin before 1.6.0 does not have authorisation or nonce checks in one of its AJAX actions, allowing unauthenticated users to retrieve details of event submissions awaiting moderation, which are not available anywhere on the public site.
Product
Community Events
Fixed in
1.6.0
What to do
Update Community Events to 1.6.0 or newer.
Full record and what to do →NVD record wpscan.com
Nov 5, 2026WP Event Manager: Does not verify the ownership or the post type of a user supplied post identifier in its front-end event submission flowCVE-2026-86442 · WordPress plugins & themes · reported by WPScanHigh 8.2
The WP Event Manager WordPress plugin before 3.4.2 does not verify the ownership or the post type of a user supplied post identifier in its front-end event submission flow, allowing unauthenticated attackers to read and overwrite the content of arbitrary unpublished posts and pages, and to convert them into events.
Product
WP Event Manager
Fixed in
3.4.2
What to do
Update WP Event Manager to 3.4.2 or newer.
Full record and what to do →NVD record wpscan.com
Nov 5, 2026Tutor LMS: Does not prevent the correct answers to quiz questions from being included in the page it serves to the student taking the quizCVE-2026-85570 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Tutor LMS WordPress plugin before 4.2.0 does not prevent the correct answers to quiz questions from being included in the page it serves to the student taking the quiz, and does so regardless of the setting intended to control whether answers are revealed, allowing any enrolled student to obtain them before submitting their attempt.
Product
Tutor LMS
Fixed in
4.2.0
What to do
Update Tutor LMS to 4.2.0 or newer.
Full record and what to do →NVD record wpscan.com
Nov 5, 2026FV Flowplayer Video Player: Does not validate a user-supplied URL before performing a server-side fetch whose response body is stored and served publiclyCVE-2026-85351 · WordPress plugins & themes · reported by WPScanMedium 5
The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not validate a user-supplied URL before performing a server-side fetch whose response body is stored and served publicly, allowing users with Contributor-level access and above to perform Server-Side Request Forgery (SSRF) attacks and to read the response of an internal resource when it is returned with an image content type.
Product
FV Flowplayer Video Player
Fixed in
7.5.56.7212
What to do
Update FV Flowplayer Video Player to 7.5.56.7212 or newer.
Full record and what to do →NVD record wpscan.com
Nov 5, 2026FV Flowplayer Video Player: Does not perform authorization or CSRF checks on several of its cloud storage media browser handlersCVE-2026-85346 · WordPress plugins & themes · reported by WPScanMedium 4.3
The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not perform authorization or CSRF checks on several of its cloud storage media browser handlers, allowing any authenticated user with minimal permissions (such as Subscriber) to disclose the configuration and stored file listings of the site's connected cloud storage accounts.
Product
FV Flowplayer Video Player
Fixed in
7.5.56.7212
What to do
Update FV Flowplayer Video Player to 7.5.56.7212 or newer.
Full record and what to do →NVD record wpscan.com
Nov 5, 2026All In One Login: Does not adequately restrict the number of attempts that can be made against the short numeric code used by its default-enabled passwordless email loginCVE-2026-19256 · WordPress plugins & themes · reported by WPScanCritical 9.8
The All In One Login WordPress plugin before 2.5.0 does not adequately restrict the number of attempts that can be made against the short numeric code used by its default-enabled passwordless email login, and does not feed those failed attempts into its own brute-force protection, allowing unauthenticated attackers to take over any account including administrators.
Product
All In One Login
Fixed in
2.5.0
What to do
Update All In One Login to 2.5.0 or newer.
Full record and what to do →NVD record wpscan.com
Nov 5, 2026WP Event Manager: Does not properly validate ownership or the type of the user-supplied post identifiers processed by one of its frontend formsCVE-2026-16304 · WordPress plugins & themes · reported by WPScanHigh 8.1
The WP Event Manager WordPress plugin before 3.4.2 does not properly validate ownership or the type of the user-supplied post identifiers processed by one of its frontend forms, allowing any user with a Subscriber account or above to reassign the authorship of arbitrary posts to themselves and to force them to be published. This results in content takeover and in the public disclosure of otherwise private or draft content, and requires the relevant frontend feature to be enabled.
Product
WP Event Manager
Fixed in
3.4.2
What to do
Update WP Event Manager to 3.4.2 or newer.
Full record and what to do →NVD record wpscan.com
Nov 5, 2026CatFolders: Does not have authorisation checks on a folder maintenance actionCVE-2026-107787 · WordPress plugins & themes · reported by WPScanLow 3.1
The CatFolders WordPress plugin before 2.5.7 does not have authorisation checks on a folder maintenance action, allowing users with a role as low as subscriber to reset the per-user ownership of every media folder and disable the CatFolders WordPress plugin before 2.5.7's user restriction setting.
Product
CatFolders
Fixed in
2.5.7
What to do
Update CatFolders to 2.5.7 or newer.
Full record and what to do →NVD record wpscan.com
Nov 5, 2026Dokan: AI Powered WooCommerce Multivendor Marketplace Solution: Does not verify that the acting administrator is authorized to manage each selected user before enabling that user's marketplace seller statusCVE-2026-107775 · WordPress plugins & themes · reported by WPScanLow 2.7
The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.3.3 does not verify that the acting administrator is authorized to manage each selected user before enabling that user's marketplace seller status, allowing a subsite Administrator on WordPress Multisite to enable selling for users outside their own site, including network-level users they cannot otherwise manage.
Product
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution
Fixed in
5.3.3
What to do
Update Dokan: AI Powered WooCommerce Multivendor Marketplace Solution to 5.3.3 or newer.
Full record and what to do →NVD record wpscan.com
Nov 5, 2026Dokan: AI Powered WooCommerce Multivendor Marketplace Solution: Does not correctly verify authorizationCVE-2026-107773 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.3.3 does not correctly verify authorization when serving a single order and its order notes, allowing unauthenticated attackers to read customer and order information and to add or delete order notes for a subset of orders.
Product
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution
Fixed in
5.3.3
What to do
Update Dokan: AI Powered WooCommerce Multivendor Marketplace Solution to 5.3.3 or newer.
Full record and what to do →NVD record wpscan.com
Nov 5, 2026Car Dealer (Dealership) and Vehicle sales: Does not restrict its unauthenticated single-listing AJAX action to published contentCVE-2026-105971 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Car Dealer (Dealership) and Vehicle sales WordPress plugin through 4.73 does not restrict its unauthenticated single-listing AJAX action to published content, allowing an unauthenticated attacker to read the title, content and metadata of any private, draft, pending, future or trashed post by supplying its numeric id.
Product
Car Dealer (Dealership) and Vehicle sales
Affected
up to 4.73
What to do
Affects up to 4.73. Update Car Dealer (Dealership) and Vehicle sales to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Nov 5, 2026Cloud Blocks: Does not perform any authorisation or sanitisationCVE-2025-15702 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Cloud Blocks WordPress plugin through 1.1.8 does not perform any authorisation or sanitisation when storing block asset URLs, allowing unauthenticated users to store malicious scripts that are executed in the browser of any privileged user, such as an administrator, who opens the block editor.
Product
Cloud Blocks
Affected
up to 1.1.8
What to do
Affects up to 1.1.8. Update Cloud Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Nov 5, 2026Easy Social Icons: Does not sanitise and escape some of its settings before outputting them on front-end pagesCVE-2025-15701 · WordPress plugins & themes · reported by WPScanLow 3.5
The Easy Social Icons WordPress plugin before 4.0.3 does not sanitise and escape some of its settings before outputting them on front-end pages, which could allow high-privilege users such as Administrators to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed, for example on a multisite network.
Product
Easy Social Icons
Fixed in
4.0.3
What to do
Update Easy Social Icons to 4.0.3 or newer.
Full record and what to do →NVD record wpscan.com
Nov 5, 2026LiteSpeed Cache: Unauthenticated disclosure of sensitive WooCommerce customer dataCVE-2026-93389 · WordPress plugins & themes · reported by WordfenceHigh 8.2
The LiteSpeed Cache plugin for WordPress is vulnerable to unauthenticated disclosure of sensitive WooCommerce customer data in all versions up to, and including, 7.9.1 With Cache REST enabled (the shipped default cache-rest=1), LiteSpeed stores WooCommerce Store API GET responses (/wc/store/v1/cart and /wc/store/v1/checkout) as PUBLIC cache objects and does not vary the cache on the Cart-Token or WooCommerce session. A shopper's personalized cart/checkout response is therefore served to any later, cookie-less and token-less client as an LSCache HIT. This makes it possible for unauthenticated attackers to read another shopper's billing and shipping details (name, company, street address, email, phone), cart contents and totals, and the shopper's live Cart-Token session JWT and nonce (enabling cart/checkout-session hijack), plus order_key on the checkout endpoint.
Product
LiteSpeed Cache
Affected
up to 7.9.1
What to do
Affects up to 7.9.1. Update LiteSpeed Cache to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 5, 2026Motors – Car Dealership & Classified Listings: File DeletionCVE-2026-116617 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to File Deletion in all versions up to, and including, 1.4.128 The vulnerability exists because `stm_save_user_extra_fields()`, hooked to `personal_options_update`, writes the attacker-controlled `stm_dealer_logo_path` parameter directly to user meta without an ownership check binding the submitted path to the submitting user — unlike the `stm_payment_status` and `stm_lost_password_hash` fields, this field is not gated by a `manage_options` or `edit_users` capability check. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete image files belonging to other users under `wp-content/uploads` — including other users' avatars, dealer logos, and uploaded media — by storing a crafted path via their own profile and then triggering `unlink()` through the become-dealer form on their author page. Note that the two path guards (`stm_mvl_is_path_within_uploads` and `stm_mvl_is_allowed_image_file`) do restrict the attack surface to files with an image extension that resolve within the uploads basedir; files outside that directory, such as `wp-config.php` or
Product
Motors – Car Dealership & Classified Listings
Affected
up to 1.4.128
What to do
Affects up to 1.4.128. Update Motors – Car Dealership & Classified Listings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.svn.wordpress.org plugins.trac.wordpress.org
Nov 4, 2026WPO365 | LOGIN (wpo365-login) plugin before version 45.2 contains an authentication bypass by capture-replay vulnerability caused by a non-functional anti-replaCVE-2026-122220 · WordPress plugins & themes · reported by VulnCheckCritical 9.1
WPO365 | LOGIN (wpo365-login) plugin before version 45.2 contains an authentication bypass by capture-replay vulnerability caused by a non-functional anti-replay check in Saml2_Service::check_message_id(), which never persists processed SAML message IDs to the wpo365_saml_message_ids transient due to a logic error that returns before saving. Attackers who capture a validly-signed SAMLResponse can replay it to the ACS endpoint repeatedly within its assertion validity window to log in as the victim, including administrators, without detection since the duplicate message ID check never triggers.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Nov 4, 2026The GetPaid: Improper input validationCVE-2026-119749 · WordPress plugins & themes · reported by VulnCheckHigh 8.7
The GetPaid plugin for WordPress before 2.8.63 contains an improper input validation vulnerability that allows unauthenticated attackers to bypass payment processing by submitting a negative item quantity on a public payment form. Attackers can exploit the unchecked quantity value in process_item() to produce a negative line subtotal that reduces the invoice total to zero, causing process_free_payment() to mark the invoice as paid without any actual gateway charge.
Product
The GetPaid
Fixed in
2.8.63
What to do
Update The GetPaid to 2.8.63 or newer.
Full record and what to do →NVD record wordpress.org vulncheck.com
Nov 4, 2026The GetPaid: Authorization bypassCVE-2026-119748 · WordPress plugins & themes · reported by VulnCheckMedium 6.9
The GetPaid plugin for WordPress before 2.8.63 contains an authorization bypass vulnerability that allows unauthenticated attackers to access and manipulate another user's invoice by supplying its ID through the maybe_use_invoice parameter in process_invoice(), bypassing the ownership and key checks performed by is_authorized_to_pay(). Attackers can submit a known pending invoice ID via maybe_use_invoice to read checkout pricing details and initiate a checkout workflow, resulting in an unauthorized state change of the invoice to on-hold.
Product
The GetPaid
Fixed in
2.8.63
What to do
Update The GetPaid to 2.8.63 or newer.
Full record and what to do →NVD record wordpress.org vulncheck.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.