Updated 5 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

544new WordPress flaws this week

391,181entries in the database

4,326 results · page 5 of 87

Oct 14, 2026Donation Thermometer: Does not escape a colour value taken from a shortcode attribute before using it in an attribute of the generated legend markupCVE-2026-92409 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Donation Thermometer WordPress plugin before 2.3.0 does not escape a colour value taken from a shortcode attribute before using it in an attribute of the generated legend markup, allowing users with the Contributor role and above to inject arbitrary event handlers that execute when the page is viewed.
Product
Donation Thermometer
Fixed in
2.3.0
What to do
Update Donation Thermometer to 2.3.0 or newer.
Full record and what to do →NVD record wpscan.com
Oct 14, 2026Product Feed for Google Shopping, Microsoft Advertising and 40+ Channels for WooCommerce Merchant: Does not perform a nonce or capability check on the AJAX action that registers the store with its feed service and exposeCVE-2026-87968 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Product Feed for Google Shopping, Microsoft Advertising and 40+ Channels for WooCommerce Merchant WordPress plugin before 5.3.2 does not perform a nonce or capability check on the AJAX action that registers the store with its feed service and exposes it to unauthenticated users, so any visitor can force the store to re-register and overwrite the Product Feed for Google Shopping, Microsoft Advertising and 40+ Channels for WooCommerce Merchant WordPress plugin before 5.3.2's stored shop secret.
Product
Product Feed for Google Shopping, Microsoft Advertising and 40+ Channels for WooCommerce Merchant
Fixed in
5.3.2
What to do
Update Product Feed for Google Shopping, Microsoft Advertising and 40+ Channels for WooCommerce Merchant to 5.3.2 or newer.
Full record and what to do →NVD record wpscan.com
Oct 14, 2026Forms: Does not sanitise submitted form values on storageCVE-2026-86799 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Forms WordPress plugin before 3.0.2 does not sanitise submitted form values on storage, nor escape them before outputting them on the form submissions screen in the administration dashboard, allowing unauthenticated users to inject arbitrary web scripts that will execute in the browser of any administrator viewing the submissions.
Product
Forms
Fixed in
3.0.2
What to do
Update Forms to 3.0.2 or newer.
Full record and what to do →NVD record wpscan.com
Oct 14, 2026FV Flowplayer Video Player: Does not properly validate a user-supplied URL before performing a server-side fetchCVE-2026-85345 · WordPress plugins & themes · reported by WPScanMedium 4.1
The FV Flowplayer Video Player WordPress plugin before 7.5.55.7212 does not properly validate a user-supplied URL before performing a server-side fetch, and an existing host-based restriction fails to cover all cases, allowing users with Contributor-level access and above to perform Server-Side Request Forgery (SSRF) attacks. The impact is limited to a semi-blind oracle: the server's fetch reveals whether an internal resource responds and its HTTP status, but the resource's contents are not returned to the attacker.
Product
FV Flowplayer Video Player
Fixed in
7.5.55.7212
What to do
Update FV Flowplayer Video Player to 7.5.55.7212 or newer.
Full record and what to do →NVD record wpscan.com
Oct 14, 2026EmbedPress: Does not perform any capability or nonce check on an unauthenticated request that triggers a server-sideCVE-2026-85000 · WordPress plugins & themes · reported by WPScanMedium 5.3
The EmbedPress WordPress plugin before 4.6.8 does not perform any capability or nonce check on an unauthenticated request that triggers a server-side, credential-bearing request to a third-party API and stores attacker-controlled cache entries, allowing unauthenticated attackers to consume the site owner's third-party API quota and write unbounded records into the site's database.
Product
EmbedPress
Fixed in
4.6.8
What to do
Update EmbedPress to 4.6.8 or newer.
Full record and what to do →NVD record wpscan.com
Oct 14, 2026Sunshine Photo Cart: Does not check whether a visitor is permitted to access a restricted gallery before accepting comment submissions for its imagesCVE-2026-108069 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Sunshine Photo Cart WordPress plugin before 3.7.4 does not check whether a visitor is permitted to access a restricted gallery before accepting comment submissions for its images, while it does perform that check when displaying comments, allowing unauthenticated attackers to inject attacker-chosen content with a chosen author name and email into galleries the owner has restricted (password-protected, email-gated, private, account-only or expired).
Product
Sunshine Photo Cart
Fixed in
3.7.4
What to do
Update Sunshine Photo Cart to 3.7.4 or newer.
Full record and what to do →NVD record wpscan.com
Oct 14, 2026WP 2FA: Does not perform an object-level capability check before removing a user's two-factor authentication configurationCVE-2026-108066 · WordPress plugins & themes · reported by WPScanLow 2.7
The WP 2FA WordPress plugin before 4.2.0 does not perform an object-level capability check before removing a user's two-factor authentication configuration, allowing a site administrator on WordPress Multisite to remove the 2FA configuration of users outside their own site, including accounts they are not permitted to edit. On single-site installs an administrator can already manage all users, so this crosses a trust boundary only on Multisite.
Product
WP 2FA
Fixed in
4.2.0
What to do
Update WP 2FA to 4.2.0 or newer.
Full record and what to do →NVD record wpscan.com
Oct 14, 2026WP Encryption: Does not perform a capability or nonce check on one of the handlers that drives its SSL certificate-provisioning routineCVE-2026-108064 · WordPress plugins & themes · reported by WPScanMedium 6.5
The WP Encryption WordPress plugin before 7.8.8.2 does not perform a capability or nonce check on one of the handlers that drives its SSL certificate-provisioning routine, allowing unauthenticated users to make the WP Encryption WordPress plugin before 7.8.8.2 overwrite the site's certificate private key and replace its pending Let's Encrypt order and challenge material with a single request. Repeated requests keep regenerating the material, preventing the administrator from completing certificate issuance.
Product
WP Encryption
Fixed in
7.8.8.2
What to do
Update WP Encryption to 7.8.8.2 or newer.
Full record and what to do →NVD record wpscan.com
Oct 14, 2026GamiPress: Does not perform a capability check or ownership verification on one of its authenticated AJAX actionsCVE-2026-107319 · WordPress plugins & themes · reported by WPScanMedium 4.3
The GamiPress WordPress plugin before 8.0.6 does not perform a capability check or ownership verification on one of its authenticated AJAX actions, allowing any authenticated user, such as a Subscriber, to read arbitrary entries from its activity log, including other users' points balances and earned achievements and the usernames of the administrators who performed manual point award and revoke actions.
Product
GamiPress
Fixed in
8.0.6
What to do
Update GamiPress to 8.0.6 or newer.
Full record and what to do →NVD record wpscan.com
Oct 14, 2026LTL Freight Quotes: Does not perform any authorization check or input sanitization before storing certain values from a requestCVE-2026-107160 · WordPress plugins & themes · reported by WPScanMedium 5.3
The LTL Freight Quotes WordPress plugin before 4.2.19 does not perform any authorization check or input sanitization before storing certain values from a request, allowing unauthenticated users to inject HTML and links that are rendered to visitors on the storefront.
Product
LTL Freight Quotes
Fixed in
4.2.19
What to do
Update LTL Freight Quotes to 4.2.19 or newer.
Full record and what to do →NVD record wpscan.com
Oct 14, 2026LTL Freight Quotes: Does not perform any authorization check or validation on one of its REST routes that writes to the databaseCVE-2026-107158 · WordPress plugins & themes · reported by WPScanMedium 5.3
The LTL Freight Quotes WordPress plugin before 4.2.19 does not perform any authorization check or validation on one of its REST routes that writes to the database, allowing unauthenticated users to modify some of the LTL Freight Quotes WordPress plugin before 4.2.19's stored settings.
Product
LTL Freight Quotes
Fixed in
4.2.19
What to do
Update LTL Freight Quotes to 4.2.19 or newer.
Full record and what to do →NVD record wpscan.com
Oct 14, 2026Gutenverse Form: Does not sanitize SVG icon markup stored in its form blocks before it is decoded and inserted into the page in the browserCVE-2026-106469 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Gutenverse Form WordPress plugin before 3.0.11 does not sanitize SVG icon markup stored in its form blocks before it is decoded and inserted into the page in the browser, allowing authenticated users with Contributor-level access and above to store malicious SVG that executes JavaScript in the session of any user who views or previews the affected form, such as an administrator reviewing a pending post.
Product
Gutenverse Form
Fixed in
3.0.11
What to do
Update Gutenverse Form to 3.0.11 or newer.
Full record and what to do →NVD record wpscan.com
Oct 14, 2026NEX-Forms: Does not perform any authorizationCVE-2026-106166 · WordPress plugins & themes · reported by WPScanMedium 5.3
The NEX-Forms WordPress plugin before 9.3.1 does not perform any authorization, ownership or request-validation checks before updating stored form entries, allowing unauthenticated attackers to overwrite, permanently erase, reassign or append to any previously submitted form entry by referencing its sequential identifier.
Product
NEX-Forms
Fixed in
9.3.1
What to do
Update NEX-Forms to 9.3.1 or newer.
Full record and what to do →NVD record wpscan.com
Oct 14, 2026CamPay Shortcode Payment Gateway: Does not verify the authenticity of Mobile Money payment confirmations and derives the payment result from client-supplied parametersCVE-2026-105975 · WordPress plugins & themes · reported by WPScanMedium 5.3
The CamPay Shortcode Payment Gateway WordPress plugin before 1.7 does not verify the authenticity of Mobile Money payment confirmations and derives the payment result from client-supplied parameters, allowing unauthenticated attackers to mark payment records as paid, destroy genuine payment records, and write CamPay Shortcode Payment Gateway WordPress plugin before 1.7 meta onto arbitrary posts.
Product
CamPay Shortcode Payment Gateway
Fixed in
1.7
What to do
Update CamPay Shortcode Payment Gateway to 1.7 or newer.
Full record and what to do →NVD record wpscan.com
Oct 14, 2026Rank Math SEO: Does not perform a capability or nonce check before clearing its stored SEO analysis dataCVE-2026-104751 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Rank Math SEO WordPress plugin before 1.0.280 does not perform a capability or nonce check before clearing its stored SEO analysis data, allowing unauthenticated users to delete it.
Product
Rank Math SEO
Fixed in
1.0.280
What to do
Update Rank Math SEO to 1.0.280 or newer.
Full record and what to do →NVD record wpscan.com
Oct 14, 2026Avada (Fusion) Builder: Sensitive Information ExposureCVE-2026-97471 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Avada (Fusion) Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.16.1 via the 'args[link_target]' parameter. This makes it possible for unauthenticated attackers to extract arbitrary user meta values for any user ID, including administrator email addresses, login names, wp_user_level, and WooCommerce customer PII such as billing_email, billing_phone, and billing_address_1. The awb-instagram-nonce required to trigger this endpoint is printed in plaintext in fusionInstagramVars on any page rendering the [fusion_instagram] shortcode, making it harvestable by any anonymous visitor before the exploit request is sent.
Product
Avada (Fusion) Builder
Affected
up to 3.16.1
What to do
Affects up to 3.16.1. Update Avada (Fusion) Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record avada.com wordfence.com
Oct 14, 2026Smart Forms – when you need more than just a contact form: Stored Cross-Site ScriptingCVE-2026-95816 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Smart Forms – when you need more than just a contact form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'formString' parameter in all versions up to, and including, 2.6.104 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The nonce check protecting the rednao_smart_forms_save_form_values AJAX handler is only enforced when the smart_forms_block_anonymous_submissions option is enabled, meaning default installations require no authentication or nonce verification whatsoever to submit and store malicious payloads.
Product
Smart Forms – when you need more than just a contact form
Affected
up to 2.6.104
What to do
Affects up to 2.6.104. Update Smart Forms – when you need more than just a contact form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 14, 2026Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder: Blind SQL InjectionCVE-2026-95808 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to blind SQL Injection via the 'inputs' parameter in all versions up to, and including, 1.15.48 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The nonce required to reach the vulnerable handler is emitted to every public page that renders a form, making it trivially obtainable by an unauthenticated attacker from page source.
Product
Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder
Affected
up to 1.15.48
What to do
Affects up to 1.15.48. Update Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 14, 2026Contact Form DB for Enfold: Stored Cross-Site ScriptingCVE-2026-83592 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Contact Form DB for Enfold plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Contact Form Field Values in all versions up to, and including, 2.0.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload is echoed unescaped both inside a title HTML attribute and in the table cell body in admin/ecf_index.php; base64 encoding and serialization of the stored values do not neutralize the malicious content.
Product
Contact Form DB for Enfold
Affected
up to 2.0.2
What to do
Affects up to 2.0.2. Update Contact Form DB for Enfold to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 13, 2026Database Addon for Contact Form 7 – CFDB7: Arbitrary File DeletionCVE-2026-107652 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Database Addon for Contact Form 7 – CFDB7 plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 1.4.1. This is due to the plugin storing arbitrary (non-form-tag) submission fields in its db7_forms row and the process_bulk_action() delete handler then matching any stored key whose name contains the substring 'cfdb7_file' and passing the stored value directly to unlink() without validating that the file actually belongs to the submission being deleted or constraining the filename with basename()/realpath(). This makes it possible for unauthenticated attackers to inject a crafted multipart field.
Product
Database Addon for Contact Form 7 – CFDB7
Affected
up to 1.4.1
What to do
Affects up to 1.4.1. Update Database Addon for Contact Form 7 – CFDB7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 13, 2026Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation: Privilege EscalationCVE-2026-104749 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation plugin for WordPress is vulnerable to Privilege Escalation via Log Re-execution in all versions up to, and including, 2.10.6 The vulnerability exists because `IntegrationHandler::executeWithCapture()` stores raw, attacker-controlled field values — including `user_pass` and `user_email` — verbatim into `wp_btcbi_log.field_data` on anonymous front-end requests with no capability check, and `LogHandler::reexecute()` feeds that stored payload back through `Flow::execute()` inside the replaying administrator's session without validating the identity that originally produced the data, causing `RegistrationController::updateUser()` to resolve the target user ID to the administrator and write the attacker-supplied password via `wp_update_user()`. This makes it possible for unauthenticated attackers to overwrite the administrator's password and fully take over the administrator account. Exploitation requires that an administrator has configured a flow mapping a user-supplied form field to the `user_pass` parameter of the WP User Registration "Update User" action, and that the administrator subsequent
Product
Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation
Affected
up to 2.10.6
What to do
Affects up to 2.10.6. Update Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 13, 2026SureForms: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-108495 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force SureForms sureforms allows Stored XSS.This issue affects SureForms: from n/a through 2.12.7.
Product
SureForms
Affected
up to 2.12.7
What to do
Affects up to 2.12.7. Update SureForms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 13, 2026Active Products Tables for WooCommerce: Insertion of Sensitive Information Into Sent DataCVE-2026-108489 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Insertion of Sensitive Information Into Sent Data vulnerability in PluginUs.Net Active Products Tables for WooCommerce profit-products-tables-for-woocommerce allows Retrieve Embedded Sensitive Data.This issue affects Active Products Tables for WooCommerce: from n/a through 2.1.3.
Product
Active Products Tables for WooCommerce
Affected
up to 2.1.3
What to do
Affects up to 2.1.3. Update Active Products Tables for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 13, 2026Ad Inserter – Ad Manager & AdSense Ads: Sensitive Information ExposureCVE-2026-89097 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.8.18 via the ai_wp_footer_hook. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract sensitive data including the server's internal IP address, PHP configuration, WordPress and theme versions, hardening constants, the plugin's full block matrix, and all post meta values including underscore-prefixed protected keys such as API tokens and private integration state written by other plugins.
Product
Ad Inserter – Ad Manager & AdSense Ads
Affected
up to 2.8.18
What to do
Affects up to 2.8.18. Update Ad Inserter – Ad Manager & AdSense Ads to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 13, 2026Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation: Stored Cross-Site ScriptingCVE-2026-102007 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'field mapped to notification_content (attacker-chosen key, e.g. payload_text)' parameter in all versions up to, and including, 2.10.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires a site administrator to have preconfigured a Bit Integrations flow that binds the public Bit Assist webhook to a BuddyBoss "Send Notification" action with a form field mapped to notification_content, and the attacker to know the flow's UUID callback URL.
Product
Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation
Affected
up to 2.10.6
What to do
Affects up to 2.10.6. Update Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 12, 2026Forminator: Missing AuthorizationCVE-2026-108486 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WPMU DEV Forminator forminator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Forminator: from n/a through 1.58.0.
Product
Forminator
Affected
up to 1.58.0
What to do
Affects up to 1.58.0. Update Forminator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 12, 2026Booster Elite for WooCommerce: Insertion of Sensitive Information Into Sent DataCVE-2023-25996 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Insertion of Sensitive Information Into Sent Data vulnerability in Pluggabl LLC. Booster Elite for WooCommerce booster-elite-for-woocommerce allows Retrieve Embedded Sensitive Data.This issue affects Booster Elite for WooCommerce: from n/a before 8.4.0.
Product
Booster Elite for WooCommerce
Fixed in
8.4.0
What to do
Update Booster Elite for WooCommerce to 8.4.0 or newer.
Full record and what to do →NVD record patchstack.com
Oct 12, 2026WP Comment Cleaner: Does not perform a capability check or validate a nonce on one of its bulk comment-deletion routinesCVE-2026-107791 · WordPress plugins & themes · reported by WPScanMedium 6.5
The WP Comment Cleaner WordPress plugin before 7.2 does not perform a capability check or validate a nonce on one of its bulk comment-deletion routines, allowing authenticated users with minimal permissions, such as subscribers, to permanently delete all comments on the site.
Product
WP Comment Cleaner
Fixed in
7.2
What to do
Update WP Comment Cleaner to 7.2 or newer.
Full record and what to do →NVD record wpscan.com
Oct 11, 2026WP-Invoice: Does not perform capability checks in several of its AJAX handlersCVE-2026-97183 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WP-Invoice WordPress plugin through 4.3.1 does not perform capability checks in several of its AJAX handlers, allowing any authenticated user, such as a Subscriber, to retrieve the email addresses, display names and profile details of all registered users.
Product
WP-Invoice
Affected
up to 4.3.1
What to do
Affects up to 4.3.1. Update WP-Invoice to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Oct 11, 2026Piotnet Forms: Does not authenticate or validate a form-submission file-upload request and permits browser-renderable file types to be storedCVE-2026-96227 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Piotnet Forms WordPress plugin through 1.0.30 does not authenticate or validate a form-submission file-upload request and permits browser-renderable file types to be stored, allowing unauthenticated attackers to store a file that executes arbitrary JavaScript in the site's origin when it is opened (Stored XSS).
Product
Piotnet Forms
Affected
up to 1.0.30
What to do
Affects up to 1.0.30. Update Piotnet Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Oct 11, 2026MemberHero: Does not perform any capability or nonce check on one of its AJAX actionsCVE-2026-94235 · WordPress plugins & themes · reported by WPScanMedium 4.3
The MemberHero WordPress plugin through 6.9 does not perform any capability or nonce check on one of its AJAX actions, allowing any authenticated user, such as a subscriber, to make the site send arbitrary HTML emails to arbitrary recipients from its own mail system, which can be abused to relay phishing carrying the site's identity and domain reputation.
Product
MemberHero
Affected
up to 6.9
What to do
Affects up to 6.9. Update MemberHero to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Oct 11, 2026WP Posts Password Batch Manager: Does not perform any capability or nonce check on a bulk post-password action that runs on an always-loaded admin handlerCVE-2026-89283 · WordPress plugins & themes · reported by WPScanHigh 8.6
The WP Posts Password Batch Manager WordPress plugin through 1.1 does not perform any capability or nonce check on a bulk post-password action that runs on an always-loaded admin handler, allowing unauthenticated attackers to reset or overwrite the password of every published post, disclosing password-protected content or locking all posts behind an attacker-chosen password.
Product
WP Posts Password Batch Manager
Affected
up to 1.1
What to do
Affects up to 1.1. Update WP Posts Password Batch Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Oct 11, 2026Adwised Web Push Notification: Does not perform any capability or nonce check before allowing an authenticated user to overwrite its site-wide configurationCVE-2026-87761 · WordPress plugins & themes · reported by WPScanHigh 8
The Adwised Web Push Notification WordPress plugin through 2.5.7 does not perform any capability or nonce check before allowing an authenticated user to overwrite its site-wide configuration, and does not escape those configuration values before printing them inside an inline script block on every front-end page, allowing any authenticated user, such as a subscriber, to perform Stored Cross-Site Scripting attacks against every visitor, including administrators.
Product
Adwised Web Push Notification
Affected
up to 2.5.7
What to do
Affects up to 2.5.7. Update Adwised Web Push Notification to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Oct 11, 2026Web Vitals Tracking: Does not validate or escape performance measurements submitted by unauthenticated visitors before storing them and outputting them in a script context on an administrative pageCVE-2026-87760 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Web Vitals Tracking WordPress plugin through 5.4.2 does not validate or escape performance measurements submitted by unauthenticated visitors before storing them and outputting them in a script context on an administrative page, allowing unauthenticated attackers to perform Stored Cross-Site Scripting attacks against administrators.
Product
Web Vitals Tracking
Affected
up to 5.4.2
What to do
Affects up to 5.4.2. Update Web Vitals Tracking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Oct 11, 2026HootBoard: Does not perform any authorisation check on some of its REST endpointsCVE-2026-86798 · WordPress plugins & themes · reported by WPScanHigh 8.8
The HootBoard WordPress plugin through 3.1.4 does not perform any authorisation check on some of its REST endpoints, and does not escape the values stored through them before outputting them in a public page, allowing unauthenticated users to inject arbitrary web scripts that will execute in the browser of anyone visiting that page, including administrators.
Product
HootBoard
Affected
up to 3.1.4
What to do
Affects up to 3.1.4. Update HootBoard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Oct 11, 2026Quick quotes: Does not perform any capability or nonce check on one of its AJAX actions and lets the caller chooseCVE-2026-86706 · WordPress plugins & themes · reported by WPScanCritical 9.1
The Quick quotes WordPress plugin through 1.0.0 does not perform any capability or nonce check on one of its AJAX actions and lets the caller choose which option is written, allowing unauthenticated users to alter arbitrary site settings and to make the site unavailable.
Product
Quick quotes
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Quick quotes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Oct 11, 2026click5 CRM add-on to Contact Form 7: Does not sanitise and escape content submitted through an unauthenticated endpoint before outputting it back in an admin pageCVE-2026-84261 · WordPress plugins & themes · reported by WPScanHigh 8.8
The click5 CRM add-on to Contact Form 7 WordPress plugin through 1.0.4 does not sanitise and escape content submitted through an unauthenticated endpoint before outputting it back in an admin page, leading to Stored XSS which could be used against high privilege users such as admin.
Product
click5 CRM add-on to Contact Form 7
Affected
up to 1.0.4
What to do
Affects up to 1.0.4. Update click5 CRM add-on to Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Oct 11, 2026click5 CRM add-on to Gravity Forms: Does not sanitise and escape content submitted through an unauthenticated endpoint before outputting it back in an admin pageCVE-2026-84260 · WordPress plugins & themes · reported by WPScanHigh 8.8
The click5 CRM add-on to Gravity Forms WordPress plugin through 1.0.3 does not sanitise and escape content submitted through an unauthenticated endpoint before outputting it back in an admin page, leading to Stored XSS which could be used against high privilege users such as admin.
Product
click5 CRM add-on to Gravity Forms
Affected
up to 1.0.3
What to do
Affects up to 1.0.3. Update click5 CRM add-on to Gravity Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Oct 11, 2026click5 CRM add-on to WPForms: Does not sanitise and escape content submitted through an unauthenticated endpoint before outputting it back in an admin pageCVE-2026-84259 · WordPress plugins & themes · reported by WPScanHigh 8.8
The click5 CRM add-on to WPForms WordPress plugin through 1.0.3 does not sanitise and escape content submitted through an unauthenticated endpoint before outputting it back in an admin page, leading to Stored XSS which could be used against high privilege users such as admin.
Product
click5 CRM add-on to WPForms
Affected
up to 1.0.3
What to do
Affects up to 1.0.3. Update click5 CRM add-on to WPForms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Oct 11, 2026click5 CRM add-on to Ninja Forms: Does not sanitise and escape content submitted through an unauthenticated endpoint before outputting it back in an admin pageCVE-2026-84258 · WordPress plugins & themes · reported by WPScanHigh 8.8
The click5 CRM add-on to Ninja Forms WordPress plugin through 1.0.1 does not sanitise and escape content submitted through an unauthenticated endpoint before outputting it back in an admin page, leading to Stored XSS which could be used against high privilege users such as admin.
Product
click5 CRM add-on to Ninja Forms
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update click5 CRM add-on to Ninja Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Oct 11, 2026click5 CRM add-on to Contact Form 7: Does not have authorisation and CSRF checksCVE-2026-84254 · WordPress plugins & themes · reported by WPScanCritical 9.8
The click5 CRM add-on to Contact Form 7 WordPress plugin through 1.0.4 does not have authorisation and CSRF checks when updating options via a REST endpoint, and does not ensure that the option to be updated belongs to the click5 CRM add-on to Contact Form 7 WordPress plugin through 1.0.4. As a result, unauthenticated attackers could change arbitrary blog options, allowing them to create a new administrator account and take over the site.
Product
click5 CRM add-on to Contact Form 7
Affected
up to 1.0.4
What to do
Affects up to 1.0.4. Update click5 CRM add-on to Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Oct 11, 2026click5 CRM add-on to Gravity Forms: Does not have authorisation and CSRF checksCVE-2026-84253 · WordPress plugins & themes · reported by WPScanCritical 9.8
The click5 CRM add-on to Gravity Forms WordPress plugin through 1.0.3 does not have authorisation and CSRF checks when updating options via a REST endpoint, and does not ensure that the option to be updated belongs to the click5 CRM add-on to Gravity Forms WordPress plugin through 1.0.3. As a result, unauthenticated attackers could change arbitrary blog options, allowing them to create a new administrator account and take over the site.
Product
click5 CRM add-on to Gravity Forms
Affected
up to 1.0.3
What to do
Affects up to 1.0.3. Update click5 CRM add-on to Gravity Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Oct 11, 2026click5 CRM add-on to WPForms: Does not have authorisation and CSRF checksCVE-2026-84252 · WordPress plugins & themes · reported by WPScanCritical 9.8
The click5 CRM add-on to WPForms WordPress plugin through 1.0.3 does not have authorisation and CSRF checks when updating options via a REST endpoint, and does not ensure that the option to be updated belongs to the click5 CRM add-on to WPForms WordPress plugin through 1.0.3. As a result, unauthenticated attackers could change arbitrary blog options, allowing them to create a new administrator account and take over the site.
Product
click5 CRM add-on to WPForms
Affected
up to 1.0.3
What to do
Affects up to 1.0.3. Update click5 CRM add-on to WPForms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Oct 11, 2026click5 CRM add-on to Ninja Forms: Does not have authorisation and CSRF checksCVE-2026-84251 · WordPress plugins & themes · reported by WPScanCritical 9.8
The click5 CRM add-on to Ninja Forms WordPress plugin through 1.0.1 does not have authorisation and CSRF checks when updating options via a REST endpoint, and does not ensure that the option to be updated belongs to the click5 CRM add-on to Ninja Forms WordPress plugin through 1.0.1. As a result, unauthenticated attackers could change arbitrary blog options, allowing them to create a new administrator account and take over the site.
Product
click5 CRM add-on to Ninja Forms
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update click5 CRM add-on to Ninja Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Oct 11, 2026WeddingCity Lite: Does not perform any authorisation or validity checks before deleting postsCVE-2026-106029 · WordPress plugins & themes · reported by WPScanHigh 7.5
The WeddingCity Lite WordPress plugin through 1.0.4 does not perform any authorisation or validity checks before deleting posts, pages and media attachments, allowing unauthenticated attackers to permanently delete arbitrary content site-wide.
Product
WeddingCity Lite
Affected
up to 1.0.4
What to do
Affects up to 1.0.4. Update WeddingCity Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Oct 11, 2026Envira Gallery: Does not verify that an image identifier added to a gallery refers to a media attachment the caller is permitted to viewCVE-2026-104681 · WordPress plugins & themes · reported by WPScanLow 2.7
The Envira Gallery WordPress plugin before 1.16.2 does not verify that an image identifier added to a gallery refers to a media attachment the caller is permitted to view, allowing any user able to create and edit a gallery (Author and above by default) to disclose the title and excerpt of other users' private, draft, pending and trashed posts that WordPress would otherwise withhold from them.
Product
Envira Gallery
Fixed in
1.16.2
What to do
Update Envira Gallery to 1.16.2 or newer.
Full record and what to do →NVD record wpscan.com
Oct 11, 2026Anton Extensions: Does not perform any capability checkCVE-2026-104028 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Anton Extensions WordPress plugin through 1.2.2 does not perform any capability check, nonce verification, or file-type validation before writing attacker-supplied content to an attacker-chosen path, allowing unauthenticated attackers to upload arbitrary PHP files and achieve remote code execution.
Product
Anton Extensions
Affected
up to 1.2.2
What to do
Affects up to 1.2.2. Update Anton Extensions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Oct 10, 2026YITH WooCommerce Product Add-Ons: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2026-66480 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in YITH YITH WooCommerce Product Add-Ons allows Retrieve Embedded Sensitive Data. This issue affects YITH WooCommerce Product Add-Ons: from n/a through 4.34.0.
Product
YITH WooCommerce Product Add-Ons
Affected
up to 4.34.0
What to do
Affects up to 4.34.0. Update YITH WooCommerce Product Add-Ons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 10, 2026Unauthenticated Arbitrary Content Deletion in Forminator <= 1.57.3 versions.CVE-2026-65459 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Arbitrary Content Deletion in Forminator <= 1.57.3 versions.
Affected
up to 1.57.3
What to do
Affects up to 1.57.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 10, 2026Unauthenticated Local File Inclusion in Armania <= 1.4.8 versions.CVE-2026-62092 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Local File Inclusion in Armania <= 1.4.8 versions.
Affected
up to 1.4.8
What to do
Affects up to 1.4.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.