Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,192 results · page 5 of 44
Sep 16, 2026Newsletter: Does not validate the destination of the redirect performed after a public subscription actionCVE-2026-86823 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Newsletter WordPress plugin before 9.3.7 does not validate the destination of the redirect performed after a public subscription action, allowing unauthenticated attackers to redirect users to arbitrary external sites and to disclose a subscriber token that grants access to that subscriber record's front-end actions.
- Product
- Newsletter
- Fixed in
- 9.3.7
- What to do
- Update Newsletter to 9.3.7 or newer.
Sep 16, 2026MultiVendorX: Does not verify that a user owns the store they are acting on in one of its REST API routesCVE-2026-74926 · WordPress plugins & themes · reported by WPScanHigh 7.1
The MultiVendorX WordPress plugin before 5.0.16 does not verify that a user owns the store they are acting on in one of its REST API routes, allowing any authenticated user, such as a subscriber, to overwrite any store's details and payout settings and to replace the record of who owns it.
- Product
- MultiVendorX
- Fixed in
- 5.0.16
- What to do
- Update MultiVendorX to 5.0.16 or newer.
Sep 15, 2026WP Directory Kit: Does not check the status or ownership of a listing before returning its content through one of its public AJAX actionsCVE-2026-18232 · WordPress plugins & themes · reported by WPScanMedium 5.3
The WP Directory Kit WordPress plugin through 1.5.7 does not check the status or ownership of a listing before returning its content through one of its public AJAX actions, allowing unauthenticated attackers to read draft and unapproved listings belonging to other users.
- Product
- WP Directory Kit
- Affected
- up to 1.5.7
- What to do
- Affects up to 1.5.7. Update WP Directory Kit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 13, 2026The YouTube Embed WordPress plugin from 10.0 to 10.3 does not perform any authorisation check on one of its AJAX actions, relying only on a nonce it prints on eCVE-2026-88793 · WordPress plugins & themes · reported by WPScanHigh 8.8
The YouTube Embed WordPress plugin from 10.0 to 10.3 does not perform any authorisation check on one of its AJAX actions, relying only on a nonce it prints on every front-end page, and does not escape the stored data before rendering it, allowing unauthenticated attackers to store arbitrary web scripts which will execute in the session of any user viewing the affected content, including an administrator.
- What to do
- Update the plugin to the newest version.
Sep 13, 2026The GenieWords WordPress plugin from 1.5.27 to 1.5.34 does not have authorisation checks on some of its REST API and AJAX actions, and decodes stored values befCVE-2026-74933 · WordPress plugins & themes · reported by WPScanHigh 8.8
The GenieWords WordPress plugin from 1.5.27 to 1.5.34 does not have authorisation checks on some of its REST API and AJAX actions, and decodes stored values before printing them, allowing unauthenticated users to overwrite its configuration and inject arbitrary web scripts that execute on every front-end page.
- What to do
- Update the plugin to the newest version.
Sep 13, 2026Really Simple Security: Does not prevent an unauthenticated request from resetting an account's completed email two-factor enrolmentCVE-2026-89080 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Really Simple Security WordPress plugin before 9.8.1 does not prevent an unauthenticated request from resetting an account's completed email two-factor enrolment, allowing an attacker who already knows the account's password to bypass the second factor and obtain that user's session, up to administrator.
- Product
- Really Simple Security
- Fixed in
- 9.8.1
- What to do
- Update Really Simple Security to 9.8.1 or newer.
Sep 13, 2026rtMedia for WordPress, BuddyPress and bbPress: Does not check ownership before changing the privacy level of an activity and its attached mediaCVE-2026-88912 · WordPress plugins & themes · reported by WPScanMedium 4.2
The rtMedia for WordPress, BuddyPress and bbPress WordPress plugin before 4.7.12 does not check ownership before changing the privacy level of an activity and its attached media, relying only on a nonce shared with every logged-in user, allowing users with a subscriber-level account or above to make another user's private activity public or hide it.
- Product
- rtMedia for WordPress, BuddyPress and bbPress
- Fixed in
- 4.7.12
- What to do
- Update rtMedia for WordPress, BuddyPress and bbPress to 4.7.12 or newer.
Sep 13, 2026Contact Form to Chat Apps | Click to Chat to Order: Does not perform any capabilityCVE-2026-77773 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Contact Form to Chat Apps | Click to Chat to Order WordPress plugin before 2.15.8 does not perform any capability, nonce or session check on one of its public AJAX actions, allowing unauthenticated users to read the submitted entries of any form created with a supported third-party form Contact Form to Chat Apps | Click to Chat to Order WordPress plugin before 2.15.8.
- Product
- Contact Form to Chat Apps | Click to Chat to Order
- Fixed in
- 2.15.8
- What to do
- Update Contact Form to Chat Apps | Click to Chat to Order to 2.15.8 or newer.
Sep 12, 2026WPBot: Does not perform any authorization or nonce check on several AJAX actions that relay prompts to its configured AI providersCVE-2026-87918 · WordPress plugins & themes · reported by WPScanMedium 5.3
The WPBot WordPress plugin before 8.5.7 does not perform any authorization or nonce check on several AJAX actions that relay prompts to its configured AI providers, allowing unauthenticated attackers to make those third-party API calls, and consume the associated cost, using the site's own configured API keys.
- Product
- WPBot
- Fixed in
- 8.5.7
- What to do
- Update WPBot to 8.5.7 or newer.
Sep 12, 2026WPBot: Does not perform any capability or nonce check on the AJAX action that lists stored chat sessionsCVE-2026-87916 · WordPress plugins & themes · reported by WPScanMedium 5.3
The WPBot WordPress plugin before 8.6.0 does not perform any capability or nonce check on the AJAX action that lists stored chat sessions, allowing unauthenticated attackers to retrieve the name, email address and phone number of every chat visitor by requesting a wide date range.
- Product
- WPBot
- Fixed in
- 8.6.0
- What to do
- Update WPBot to 8.6.0 or newer.
Sep 12, 2026Sprout Invoices: Does not perform a capability or ownership check before allowing a private note to be overwritten through one of its AJAX actionsCVE-2026-87797 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Sprout Invoices WordPress plugin before 20.8.16 does not perform a capability or ownership check before allowing a private note to be overwritten through one of its AJAX actions, allowing any authenticated user such as a subscriber to overwrite private notes on records belonging to other users.
- Product
- Sprout Invoices
- Fixed in
- 20.8.16
- What to do
- Update Sprout Invoices to 20.8.16 or newer.
Sep 12, 2026WP Component: Does not have any capability or nonce checks on one of the actions it makes available to unauthenticated usersCVE-2026-85681 · WordPress plugins & themes · reported by WPScanCritical 9.8
The WP Component WordPress plugin through 2.2.4 does not have any capability or nonce checks on one of the actions it makes available to unauthenticated users, and it takes both the option name and the option value from the request, allowing unauthenticated attackers to overwrite any of the site's options. On a single site installation this leads to a full takeover, as registration can be enabled with a default role of administrator.
- Product
- WP Component
- Affected
- up to 2.2.4
- What to do
- Affects up to 2.2.4. Update WP Component to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 12, 2026SAMO Forms: Does not properly sanitise and escape user input before using it in SQL queries in several unauthenticated actionsCVE-2026-80491 · WordPress plugins & themes · reported by WPScanHigh 8.6
The SAMO Forms WordPress plugin through 1.0.0 does not properly sanitise and escape user input before using it in SQL queries in several unauthenticated actions, allowing unauthenticated attackers to perform SQL injection attacks.
- Product
- SAMO Forms
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update SAMO Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 12, 2026Booking for Appointments and Events Calendar: Does not verify that a payment was actually taken before recording a bookingCVE-2026-77689 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Booking for Appointments and Events Calendar WordPress plugin before 9.8.1 does not verify that a payment was actually taken before recording a booking as paid, trusting the payment gateway named in a public, unauthenticated booking request even when the site has never configured that gateway. This lets an unauthenticated attacker obtain confirmed, fully paid appointments and events without any payment being collected.
- Product
- Booking for Appointments and Events Calendar
- Fixed in
- 9.8.1
- What to do
- Update Booking for Appointments and Events Calendar to 9.8.1 or newer.
Sep 11, 2026MetForm: Does not properly neutralize newline characters in user-submitted values that are placed into notification email headersCVE-2026-86813 · WordPress plugins & themes · reported by WPScanMedium 4.8
The MetForm WordPress plugin before 4.1.9 does not properly neutralize newline characters in user-submitted values that are placed into notification email headers, allowing unauthenticated attackers to inject additional email headers, such as Bcc, into the emails the site sends when a submitted field value is configured to populate a header.
- Product
- MetForm
- Fixed in
- 4.1.9
- What to do
- Update MetForm to 4.1.9 or newer.
Sep 11, 2026The Simple CAPTCHA with Cloudflare Turnstile WordPress plugin from 1.2.2 before 1.42.3 runs the shortcode parser over the whole rendered Contact Form 7 form, inCVE-2026-85116 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Simple CAPTCHA with Cloudflare Turnstile WordPress plugin from 1.2.2 before 1.42.3 runs the shortcode parser over the whole rendered Contact Form 7 form, including the values a visitor submitted, allowing unauthenticated users to execute arbitrary shortcodes registered on the site.
- Fixed in
- 1.42.3
- What to do
- Update the plugin to 1.42.3 or newer.
Sep 11, 2026Visualizer: Does not properly authorise access to its chart-building actionsCVE-2026-86782 · WordPress plugins & themes · reported by WPScanMedium 5.5
The Visualizer WordPress plugin before 4.0.6 does not properly authorise access to its chart-building actions, allowing users with the Contributor role and above to publish, rename, and overwrite the content of posts and pages they do not own, including other users' private drafts.
- Product
- Visualizer
- Fixed in
- 4.0.6
- What to do
- Update Visualizer to 4.0.6 or newer.
Sep 11, 2026advanced-customized-prompts: Does not verify the password before issuing an authenticated session for a supplied email address in an unauthenticated actionCVE-2026-14563 · WordPress plugins & themes · reported by WPScanCritical 9.8
The advanced-customized-prompts WordPress plugin through 1.0.1 does not verify the password before issuing an authenticated session for a supplied email address in an unauthenticated action, allowing unauthenticated attackers to log in as any registered user, including administrators, or to create arbitrary new accounts.
- Product
- advanced-customized-prompts
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update advanced-customized-prompts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 11, 2026Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button – Chaty: Reflected Cross-Site ScriptingCVE-2026-18964 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button – Chaty plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in all versions up to, and including, 3.5.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. WordPress's server-side HTML encoding of the 's' search parameter in the <title> element is bypassed because the browser DOM API decodes HTML entities when jQuery's .text() method reads document.title, returning literal special characters that are then embedded unescaped into the constructed HTML attribute value.
- Product
- Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button – Chaty
- Affected
- up to 3.5.9
- What to do
- Affects up to 3.5.9. Update Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button – Chaty to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 10, 2026import_contacts Path Traversal in Groundhogg <= 4.7.1 versions.CVE-2026-85310 · WordPress plugins & themes · reported by PatchstackMedium 6.5
import_contacts Path Traversal in Groundhogg <= 4.7.1 versions.
- Affected
- up to 4.7.1
- What to do
- Affects up to 4.7.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 10, 2026miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA: Does not scope its second-factor attempt limit to the account being attackedCVE-2026-77771 · WordPress plugins & themes · reported by WPScanHigh 7.5
The miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA WordPress plugin before 19.3 does not scope its second-factor attempt limit to the account being attacked, keying it instead to an identifier the client supplies and can change at will, allowing an attacker who already knows a victim's password to make unlimited one-time-passcode guesses and defeat the second factor. A second validation endpoint applies no attempt limit at all.
- Product
- miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA
- Fixed in
- 6.3.1
- What to do
- Update miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA to 6.3.1 or newer.
Sep 10, 2026miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA: Does not require a validated transaction before deleting site options whose names come from unauthenticated request inputCVE-2026-77770 · WordPress plugins & themes · reported by WPScanCritical 10
The miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA WordPress plugin before 19.3 does not require a validated transaction before deleting site options whose names come from unauthenticated request input, allowing any visitor to delete arbitrary options, which can lock every administrator out of the dashboard or deactivate every miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA WordPress plugin before 19.3 on the site.
- Product
- miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA
- Fixed in
- 6.3.1
- What to do
- Update miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA to 6.3.1 or newer.
Sep 10, 2026Notiqoo: Does not have capability checks on several of its AJAX actions and builds the name of the option to write from user inputCVE-2026-19840 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Notiqoo WordPress plugin before 1.4.14 does not have capability checks on several of its AJAX actions and builds the name of the option to write from user input, allowing users with a role as low as contributor to modify arbitrary WordPress options, which can be used to deactivate Notiqoo WordPress plugin before 1.4.14 and to lock every administrator out of the site.
- Product
- Notiqoo
- Fixed in
- 1.4.14
- What to do
- Update Notiqoo to 1.4.14 or newer.
Sep 10, 2026Ultimate Gift Cards for WooCommerce: Does not reconcile the value of the gift card coupon it issues against the amount actually collected at checkoutCVE-2026-19436 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Ultimate Gift Cards for WooCommerce WordPress plugin before 3.2.10 does not reconcile the value of the gift card coupon it issues against the amount actually collected at checkout, allowing unauthenticated users to obtain store credit worth more than they paid.
- Product
- Ultimate Gift Cards for WooCommerce
- Fixed in
- 3.2.10
- What to do
- Update Ultimate Gift Cards for WooCommerce to 3.2.10 or newer.
Sep 10, 2026Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder: Reflected Cross-Site ScriptingCVE-2026-85645 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the bulk_action parameter in all versions up to, and including, 1.15.46 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder
- Affected
- up to 1.15.46
- What to do
- Affects up to 1.15.46. Update Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.svn.wordpress.orgplugins.svn.wordpress.org
Sep 10, 2026Advanced Contact form 7 DB: Authorization bypassCVE-2026-18594 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Advanced Contact form 7 DB plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.1.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with custom-level access and above, to import forged CSV submission records into any Contact Form 7 form managed by the plugin.
- Product
- Advanced Contact form 7 DB
- Affected
- up to 2.1.3
- What to do
- Affects up to 2.1.3. Update Advanced Contact form 7 DB to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 9, 2026Contact Form 7 Captcha: Runs the shortcode parser over the whole rendered Contact Form 7 formCVE-2026-85117 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Contact Form 7 Captcha WordPress plugin before 0.1.9 runs the shortcode parser over the whole rendered Contact Form 7 form, including the values a visitor submitted, allowing unauthenticated users to execute arbitrary shortcodes registered on the site.
- Product
- Contact Form 7 Captcha
- Fixed in
- 0.1.9
- What to do
- Update Contact Form 7 Captcha to 0.1.9 or newer.
Sep 9, 2026WP Express Checkout: Does not verify server-side that a payment was actually completed before marking an orderCVE-2026-83537 · WordPress plugins & themes · reported by WPScanMedium 5.3
The WP Express Checkout WordPress plugin before 2.5.0 does not verify server-side that a payment was actually completed before marking an order as paid, allowing unauthenticated users to forge a completed order without paying.
- Product
- WP Express Checkout
- Fixed in
- 2.5.0
- What to do
- Update WP Express Checkout to 2.5.0 or newer.
Sep 9, 2026WPLP Cookie Consent: Does not perform nonce or capability checks on several of its settings AJAX actionsCVE-2026-85133 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WPLP Cookie Consent WordPress plugin before 4.4.2 does not perform nonce or capability checks on several of its settings AJAX actions, allowing any authenticated user, such as a subscriber, to read and destroy scan data belonging to the administrator and to overwrite the WPLP Cookie Consent WordPress plugin before 4.4.2's stored configuration.
- Product
- WPLP Cookie Consent
- Fixed in
- 4.4.2
- What to do
- Update WPLP Cookie Consent to 4.4.2 or newer.
Sep 9, 2026WPLP Cookie Consent: Does not perform nonce or capability checks on one of its cookie scanner AJAX actionsCVE-2026-85132 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WPLP Cookie Consent WordPress plugin before 4.4.2 does not perform nonce or capability checks on one of its cookie scanner AJAX actions, allowing any authenticated user, such as a subscriber, to read back the automated scan schedule the administrator configured.
- Product
- WPLP Cookie Consent
- Fixed in
- 4.4.2
- What to do
- Update WPLP Cookie Consent to 4.4.2 or newer.
Sep 9, 2026WPLP Cookie Consent: Does not have capability or nonce checks on some of its A/B testing actionsCVE-2026-82185 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WPLP Cookie Consent WordPress plugin before 4.4.2 does not have capability or nonce checks on some of its A/B testing actions, allowing any authenticated user, such as a subscriber, to overwrite the cookie banner configuration shown to every visitor and to irreversibly reset the stored A/B test results.
- Product
- WPLP Cookie Consent
- Fixed in
- 4.4.2
- What to do
- Update WPLP Cookie Consent to 4.4.2 or newer.
Sep 9, 2026WP Travel: Does not verify that the requester is authorized to act on the booking targeted by one of its front-end payment-message handlersCVE-2026-18042 · WordPress plugins & themes · reported by WPScanMedium 5.3
The WP Travel WordPress plugin before 12.0.2 does not verify that the requester is authorized to act on the booking targeted by one of its front-end payment-message handlers, allowing unauthenticated attackers to cancel the payment on any customer's booking.
- Product
- WP Travel
- Fixed in
- 12.0.2
- What to do
- Update WP Travel to 12.0.2 or newer.
Sep 9, 2026Loops & Logic: Does not restrict its public template-data action to the data a visitor is permitted to seeCVE-2026-16960 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Loops & Logic WordPress plugin before 4.3.0 does not restrict its public template-data action to the data a visitor is permitted to see, allowing unauthenticated users to read arbitrary user records (including email addresses and roles) and arbitrary site options.
- Product
- Loops & Logic
- Fixed in
- 4.3.0
- What to do
- Update Loops & Logic to 4.3.0 or newer.
Sep 9, 2026Ninja Forms – The Contact Form Builder That Grows With You: PHP Object InjectionCVE-2026-11363 · WordPress plugins & themes · reported by WordfenceMedium 6.6
The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.14.6 via deserialization of untrusted input . This makes it possible for authenticated attackers, with administrator-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present. The deserialization is triggered automatically during form import when WPN_Helper::build_nf_cache() invokes $action->get_settings() immediately after the crafted form is imported, requiring no further interaction beyond the import action itself.
- Product
- Ninja Forms – The Contact Form Builder That Grows With You
- Affected
- up to 3.14.6
- What to do
- Affects up to 3.14.6. Update Ninja Forms – The Contact Form Builder That Grows With You to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 8, 2026Contact Form to DB by BestWebSoft – Messages Database Plugin For: Stored Cross-Site ScriptingCVE-2026-13359 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Contact Form to DB by BestWebSoft – Messages Database Plugin For WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via cntctfrm_contact_dropdown Parameter in all versions up to, and including, 1.7.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload executes in the context of an administrator's browser session when they visit the plugin's message manager page at /wp-admin/admin.php?page=cntctfrmtdb_manager, making it possible to compromise administrator-level sessions via a simple unauthenticated contact form submission.
- Product
- Contact Form to DB by BestWebSoft – Messages Database Plugin For
- Affected
- up to 1.7.5
- What to do
- Affects up to 1.7.5. Update Contact Form to DB by BestWebSoft – Messages Database Plugin For to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 6, 2026The Redirection for Contact Form 7 WordPress plugin from 2.2.7 before 3.2.11 does not prevent shortcodes in submitted form values from being executed when it suCVE-2026-80439 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Redirection for Contact Form 7 WordPress plugin from 2.2.7 before 3.2.11 does not prevent shortcodes in submitted form values from being executed when it substitutes those values into an action's settings and then processes those settings for shortcodes, allowing unauthenticated users to run any shortcode registered on the site and read its output.
- Fixed in
- 3.2.11
- What to do
- Update the plugin to 3.2.11 or newer.
Sep 6, 2026B2BKing — Ultimate WooCommerce B2B and Wholesale Plugin — Wholesale Prices, Bulk Order Form & More: Does not verify that a role selected during registration is one actually offered on the registration formCVE-2026-85038 · WordPress plugins & themes · reported by WPScanMedium 5.3
The B2BKing — Ultimate WooCommerce B2B and Wholesale Plugin — Wholesale Prices, Bulk Order Form & More WordPress plugin before 5.2.40 does not verify that a role selected during registration is one actually offered on the registration form, allowing unauthenticated users to assign themselves to restricted B2B customer groups and to skip the manual account-approval workflow during self-registration.
- Product
- B2BKing — Ultimate WooCommerce B2B and Wholesale Plugin — Wholesale Prices, Bulk Order Form & More
- Fixed in
- 5.2.40
- What to do
- Update B2BKing — Ultimate WooCommerce B2B and Wholesale Plugin — Wholesale Prices, Bulk Order Form & More to 5.2.40 or newer.
Sep 6, 2026Real Estate Papi: Does not perform capability or CSRF checks on one of its AJAX actionsCVE-2026-13159 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Real Estate Papi WordPress theme through 1.0.5 does not perform capability or CSRF checks on one of its AJAX actions, allowing any authenticated user, such as a subscriber, to install a fixed set of companion from the WordPress.org repository. Where the request runs in the session of a user who can activate , those are activated as well.
- Product
- Real Estate Papi
- Affected
- up to 1.0.5
- What to do
- Affects up to 1.0.5. Update Real Estate Papi to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 5, 2026Contact Form by Supsystic: Stored Cross-Site ScriptingCVE-2026-83625 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Contact Form by Supsystic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via IP Address Header in all versions up to, and including, 1.10.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. An unauthenticated attacker can first call the 'updateNonce' action — which is accessible without authentication due to its absence from the plugin's permission list — to obtain a valid nonce, then submit a contact form with a malicious payload in a spoofed IP header such as X-Forwarded-For.
- Product
- Contact Form by Supsystic
- Affected
- up to 1.10.2
- What to do
- Affects up to 1.10.2. Update Contact Form by Supsystic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 5, 2026Custom Contact Forms: Authorization bypassCVE-2026-75018 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Custom Contact Forms plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.16. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to permanently force-delete arbitrary posts of any post type (including pages, administrator-authored posts, and WooCommerce products) and write arbitrary ccf_field_* post meta onto any post regardless of ownership or post type. The top-level form ID is checked via edit_post/publish_posts, but the nested fields[].ID and choices[].ID paths processed by _create_and_map_fields() and _create_and_map_choices() carry no equivalent capability or post-type guard, leaving those sinks fully exposed while delete_item() and delete_submission() contain explicit post-type restriction fixes demonstrating the developer's awareness of scoping requirements.
- Product
- Custom Contact Forms
- Affected
- up to 7.16
- What to do
- Affects up to 7.16. Update Custom Contact Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 5, 2026EmbedPress: Does not have proper authorization on a public review-loading actionCVE-2026-84936 · WordPress plugins & themes · reported by WPScanMedium 5.3
The EmbedPress WordPress plugin before 4.6.4 does not have proper authorization on a public review-loading action, allowing unauthenticated users to force the site to make repeated billable third-party API requests using the site's own configured API key, and to create an unbounded number of attacker-controlled rows in the database.
- Product
- EmbedPress
- Fixed in
- 4.6.4
- What to do
- Update EmbedPress to 4.6.4 or newer.
Sep 5, 2026JCH Optimize: Does not perform a capability check on one of its authenticated AJAX actions and lets the request chooseCVE-2026-84934 · WordPress plugins & themes · reported by WPScanHigh 8
The JCH Optimize WordPress plugin before 6.0.1 does not perform a capability check on one of its authenticated AJAX actions and lets the request choose which internal action runs, allowing any authenticated users such as Subscribers to import arbitrary JCH Optimize WordPress plugin before 6.0.1 settings and store a script that executes in the browser of any visitor or administrator viewing the site.
- Product
- JCH Optimize
- Fixed in
- 6.0.1
- What to do
- Update JCH Optimize to 6.0.1 or newer.
Sep 5, 2026Kirki: Does not check that a user is allowed to act on a collaboration comment before changing its stateCVE-2026-84225 · WordPress plugins & themes · reported by WPScanLow 2.2
The Kirki WordPress plugin before 6.3.0 does not check that a user is allowed to act on a collaboration comment before changing its state, allowing users whom an administrator has granted content-level access to the page builder to modify comments left by other users, including on pages they cannot themselves open.
- Product
- Kirki
- Fixed in
- 6.3.0
- What to do
- Update Kirki to 6.3.0 or newer.
Sep 5, 2026Smart Post: Does not check whether a post is password protected before returning its content and its stored password through an unauthenticated AJAX actionCVE-2026-78149 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Smart Post WordPress plugin before 4.0.8 does not check whether a post is password protected before returning its content and its stored password through an unauthenticated AJAX action, allowing unauthenticated users to read protected post content and the password that guards it.
- Product
- Smart Post
- Fixed in
- 4.0.8
- What to do
- Update Smart Post to 4.0.8 or newer.
Sep 5, 2026Ninja Forms – The Contact Form Builder That Grows With You: Stored Cross-Site ScriptingCVE-2026-19769 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Repeater Child 'type' Confusion via Unmatched Array Key in all versions up to, and including, 3.15.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the Ninja Forms File Uploads add-on to be active, as the attack routes the unwhitelisted child entry through the File Uploads handler to write an attacker-supplied HTML file containing arbitrary JavaScript into any web-server-writable directory, including the site root, where it is served from the site's own origin.
- Product
- Ninja Forms – The Contact Form Builder That Grows With You
- Affected
- up to 3.15.1
- What to do
- Affects up to 3.15.1. Update Ninja Forms – The Contact Form Builder That Grows With You to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 5, 2026SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz: Stored Cross-Site ScriptingCVE-2026-18406 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Text Field Entity-Encoded Payload in all versions up to, and including, 2.12.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz
- Affected
- up to 2.12.2
- What to do
- Affects up to 2.12.2. Update SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 4, 2026Classified Listing: Does not verify that the caller owns or can edit the target listing before its AI image-editing AJAX action deletes or attaches mediaCVE-2026-16281 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Classified Listing WordPress plugin before 6.1.1 does not verify that the caller owns or can edit the target listing before its AI image-editing AJAX action deletes or attaches media, allowing any authenticated user, including a subscriber, to permanently delete attachments from, and attach files to, any listing owned by another user.
- Product
- Classified Listing
- Fixed in
- 6.1.1
- What to do
- Update Classified Listing to 6.1.1 or newer.
Sep 3, 2026Unauthenticated Cross Site Scripting (XSS) in Calculation For Contact Form 7 <= 1.0 versions.CVE-2026-81300 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Calculation For Contact Form 7 <= 1.0 versions.
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 2, 2026WP Express Checkout: Does not verify server-side that a payment was actually completed before marking an orderCVE-2026-83533 · WordPress plugins & themes · reported by WPScanMedium 5.3
The WP Express Checkout WordPress plugin before 2.4.9 does not verify server-side that a payment was actually completed before marking an order as paid, allowing unauthenticated users to forge a completed order without paying.
- Product
- WP Express Checkout
- Fixed in
- 2.4.9
- What to do
- Update WP Express Checkout to 2.4.9 or newer.
Sep 2, 2026Yoast SEO Premium: Does not sanitize control characters from redirect origins before writing them to the site's Apache configuration fileCVE-2026-10821 · WordPress plugins & themes · reported by WPScanMedium 6.6
The Yoast SEO Premium WordPress plugin before 27.6.1 does not sanitize control characters from redirect origins before writing them to the site's Apache configuration file when the file-based redirect mode is enabled, and the redirect-creation endpoint is reachable by users with only Author-level access. This allows such users to inject arbitrary newline-delimited Apache directives into the root .htaccess file. On Apache servers that honour PHP directives, the injection can be chained with the user's own media upload (a polyglot image carrying a PHP payload) and an auto_prepend_file directive to achieve Remote Code Execution.
- Product
- Yoast SEO Premium
- Fixed in
- 27.6.1
- What to do
- Update Yoast SEO Premium to 27.6.1 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.