Updated 3 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,769exploited flaws on CISA’s list

30added in the last 30 days

496new WordPress flaws this week

394,829entries in the database

24,770 results · page 6 of 496

Nov 4, 2026The GetPaid: Incorrect authorizationCVE-2026-119747 · WordPress plugins & themes · reported by VulnCheckHigh 7.1
The GetPaid plugin for WordPress before 2.8.63 contains an incorrect authorization vulnerability where the check_post_permissions() method in includes/api/class-getpaid-rest-posts-controller.php maps REST operations to generic WordPress post capabilities instead of enforcing the plugin's manage_invoicing permission. Authenticated users with lower-privileged roles such as Editor or Author can exploit this flaw to list other users' invoices, mark pending invoices as paid without recording payment transactions, or create published items and new invoices through the REST API.
Product
The GetPaid
Fixed in
2.8.63
What to do
Update The GetPaid to 2.8.63 or newer.
Full record and what to do →NVD record wordpress.org vulncheck.com
Nov 4, 2026the wepos/v1/payment/process REST route that: WePOS (Point Of Sale for WooCommerce) before 2.0.3 contains a missing authorizationCVE-2026-121993 · WordPress plugins & themes · reported by VulnCheckMedium 5.3
wePOS (Point Of Sale for WooCommerce) before 2.0.3 contains a missing authorization vulnerability in the wepos/v1/payment/process REST route that allows authenticated vendor-level users to mark arbitrary orders as paid and completed by supplying another order's ID. Attackers with only the publish_shop_orders capability (such as Dokan vendor staff) can invoke the payment processing endpoint with an order ID they do not own to trigger the order completion lifecycle, including stock reduction and granting of paid-order access, without making any real payment.
Product
the wepos/v1/payment/process REST route that
Fixed in
2.0.3
What to do
Update the wepos/v1/payment/process REST route that to 2.0.3 or newer.
Full record and what to do →NVD record github.com github.com
Nov 4, 2026Sender: Missing authorizationCVE-2026-119745 · WordPress plugins & themes · reported by VulnCheckMedium 5.3
Sender plugin for WordPress before 2.11.3 contains a missing authorization vulnerability that allows any authenticated user, including Subscribers, to access a sensitive diagnostic dump by requesting the admin_post_sender_debug_download action handled by downloadDebugFile() without any capability, nonce, or referer check. Attackers can exploit this flaw via wp-admin/admin-post.php?action=sender_debug_download to retrieve WordPress, PHP, WooCommerce, and server version details, the full active plugin inventory, active theme information, and plugin settings including the connected Sender account resource key and account metadata.
Product
Sender
Fixed in
2.11.3
What to do
Update Sender to 2.11.3 or newer.
Full record and what to do →NVD record wordpress.org vulncheck.com
Nov 4, 2026Uncanny Toolkit for LearnDash: Incorrect Privilege AssignmentCVE-2026-65555 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Incorrect Privilege Assignment vulnerability in Uncanny Owl Uncanny Toolkit for LearnDash uncanny-learndash-toolkit allows Privilege Escalation.This issue affects Uncanny Toolkit for LearnDash: from n/a through 3.8.2.
Product
Uncanny Toolkit for LearnDash
Affected
up to 3.8.2
What to do
Affects up to 3.8.2. Update Uncanny Toolkit for LearnDash to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 4, 2026the recurring-payment webhook handler that: Pay with Vipps and MobilePay for WooCommerce (woo-vipps) before 6.4.1 contains an improper cryptographic signature verificationCVE-2026-121970 · WordPress plugins & themes · reported by VulnCheckMedium 6.3
Pay with Vipps and MobilePay for WooCommerce (woo-vipps) before 6.4.1 contains an improper cryptographic signature verification vulnerability in the recurring-payment webhook handler that allows unauthenticated attackers to forge webhook requests when no local webhook secret is stored, because the code fails to return on an empty secret and computes an HMAC keyed with an empty string using a loose == comparison instead of hash_equals. Attackers can craft a recurring.agreement-stopped.v1 event with a known agreementId and a matching empty-key signature to cancel a victim's active WooCommerce subscription.
Product
the recurring-payment webhook handler that
Fixed in
6.4.1
What to do
Update the recurring-payment webhook handler that to 6.4.1 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 4, 2026Remove Google Fonts – Disable, Block, or Replace with Bunny Fonts for GDPR Compliance: Stored Cross-Site ScriptingCVE-2026-97397 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Remove Google Fonts – Disable, Block, or Replace with Bunny Fonts for GDPR Compliance plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Field via Regex-Mangled Output Buffer in all versions up to, and including, 1.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires the plugin's Remove mode to be active and the malicious comment to be published, either through auto-approval for known commenters or manual moderator approval.
Product
Remove Google Fonts – Disable, Block, or Replace with Bunny Fonts for GDPR Compliance
Affected
up to 1.7
What to do
Affects up to 1.7. Update Remove Google Fonts – Disable, Block, or Replace with Bunny Fonts for GDPR Compliance to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 4, 2026Simple CAPTCHA with Cloudflare Turnstile: Stored Cross-Site ScriptingCVE-2026-93900 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Simple CAPTCHA with Cloudflare Turnstile plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' attribute of the [gravity-simple-turnstile] shortcode in versions up to, and including, 1.44.3 This is due to insufficient input sanitization and output escaping on the shortcode attribute in the cfturnstile_gravity_shortcode() function: the value is filtered only by esc_html() and sanitize_text_field() (neither of which touches parentheses or dots) and then emitted via esc_js() in a raw JavaScript expression context outside any string literal (esc_js only escapes quotes, backslashes, and newlines). This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Simple CAPTCHA with Cloudflare Turnstile
Affected
up to 1.44.3
What to do
Affects up to 1.44.3. Update Simple CAPTCHA with Cloudflare Turnstile to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 4, 2026SAML SP Single Sign On: Allocation of Resources Without Limits or ThrottlingCVE-2026-62126 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Allocation of Resources Without Limits or Throttling vulnerability in miniOrange SAML SP Single Sign On miniorange-saml-20-single-sign-on allows HTTP DoS.This issue affects SAML SP Single Sign On: from n/a through 6.1.0.
Product
SAML SP Single Sign On
Affected
up to 6.1.0
What to do
Affects up to 6.1.0. Update SAML SP Single Sign On to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 4, 2026Simple Cloudflare Turnstile: Authentication Bypass Using an Alternate Path or ChannelCVE-2026-57775 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Authentication Bypass Using an Alternate Path or Channel vulnerability in RelyWP Simple Cloudflare Turnstile simple-cloudflare-turnstile allows Authentication Abuse.This issue affects Simple Cloudflare Turnstile: from n/a through 1.44.1.
Product
Simple Cloudflare Turnstile
Affected
up to 1.44.1
What to do
Affects up to 1.44.1. Update Simple Cloudflare Turnstile to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 4, 2026WP Photo Album Plus: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-119477 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jacob N. Breetvelt WP Photo Album Plus wp-photo-album-plus allows Stored XSS.This issue affects WP Photo Album Plus: from n/a through 9.3.05.003.
Product
WP Photo Album Plus
Affected
up to 9.3.05.003
What to do
Affects up to 9.3.05.003. Update WP Photo Album Plus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 4, 2026WCFM Marketplace: Missing AuthorizationCVE-2026-62000 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in WC Lovers WCFM Marketplace wc-multivendor-marketplace allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WCFM Marketplace: from n/a through 3.8.2.
Product
WCFM Marketplace
Affected
up to 3.8.2
What to do
Affects up to 3.8.2. Update WCFM Marketplace to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 4, 2026VikWidgetsLoader: Does not sanitise or escape several block attributes before outputting them inside HTML attributesCVE-2026-118983 · WordPress plugins & themes · reported by WPScanMedium 6.8
The VikWidgetsLoader WordPress plugin before 1.12.3 does not sanitise or escape several block attributes before outputting them inside HTML attributes, allowing users with the Contributor role to store arbitrary JavaScript that executes in the browser of any user viewing the affected post, including the administrator or editor who reviews the pending submission.
Product
VikWidgetsLoader
Fixed in
1.12.3
What to do
Update VikWidgetsLoader to 1.12.3 or newer.
Full record and what to do →NVD record wpscan.com
Nov 4, 2026All-in-One Video Gallery: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embeddedCVE-2026-118783 · WordPress plugins & themes · reported by WPScanMedium 6.8
The All-in-One Video Gallery WordPress plugin before 5.0.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedded, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
All-in-One Video Gallery
Fixed in
5.0.0
What to do
Update All-in-One Video Gallery to 5.0.0 or newer.
Full record and what to do →NVD record wpscan.com
Nov 4, 2026Simple Download Monitor: Does not properly check the visibility of the content referenced by one of its shortcodesCVE-2026-118637 · WordPress plugins & themes · reported by WPScanLow 2.7
The Simple Download Monitor WordPress plugin before 4.1.3 does not properly check the visibility of the content referenced by one of its shortcodes, allowing users with a role as low as Contributor to disclose the title and description of private, draft and other non-public posts.
Product
Simple Download Monitor
Fixed in
4.1.3
What to do
Update Simple Download Monitor to 4.1.3 or newer.
Full record and what to do →NVD record wpscan.com
Nov 4, 2026EventPrime: Does not keep the built-in Pending Review post status non-publicCVE-2026-118523 · WordPress plugins & themes · reported by WPScanMedium 5.3
The EventPrime WordPress plugin before 4.3.6.1 does not keep the built-in Pending Review post status non-public, allowing unauthenticated users to view posts, pages and other content that are awaiting review.
Product
EventPrime
Fixed in
4.3.6.1
What to do
Update EventPrime to 4.3.6.1 or newer.
Full record and what to do →NVD record wpscan.com
Nov 4, 2026Stape Conversion Tracking: Does not validate the sub-path appended to its same-origin proxy's upstream endpointCVE-2026-118422 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Stape Conversion Tracking WordPress plugin before 2.3.11 does not validate the sub-path appended to its same-origin proxy's upstream endpoint, allowing unauthenticated visitors to redirect the server-side request to an arbitrary host and have the response body and its content type returned from the site's own origin with security response headers stripped, leading to Server-Side Request Forgery, including loopback and internal hosts, and Cross-Site Scripting.
Product
Stape Conversion Tracking
Fixed in
2.3.11
What to do
Update Stape Conversion Tracking to 2.3.11 or newer.
Full record and what to do →NVD record wpscan.com
Nov 4, 2026Premium Packages: Does not verify that a user claiming a guest order is the original buyerCVE-2026-118407 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Premium Packages WordPress plugin before 7.3.1 does not verify that a user claiming a guest order is the original buyer, allowing any authenticated user to take ownership of any unclaimed guest order, and thereby read the buyer's billing details and download their purchased files, by supplying only the order identifier.
Product
Premium Packages
Fixed in
7.3.1
What to do
Update Premium Packages to 7.3.1 or newer.
Full record and what to do →NVD record wpscan.com
Nov 4, 2026Premium Packages: Does not verify ownership or session bindingCVE-2026-118404 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Premium Packages WordPress plugin before 7.3.1 does not verify ownership or session binding when loading a previously saved shopping cart, allowing any unauthenticated user who obtains another shopper's saved-cart identifier to load that shopper's cart contents, including selected products, quantities and buyer-entered custom field data, into their own session.
Product
Premium Packages
Fixed in
7.3.1
What to do
Update Premium Packages to 7.3.1 or newer.
Full record and what to do →NVD record wpscan.com
Nov 4, 2026Premium Packages: Does not verify that the requester owns a guest order before returning its detailsCVE-2026-118403 · WordPress plugins & themes · reported by WPScanLow 3.7
The Premium Packages WordPress plugin before 7.3.1 does not verify that the requester owns a guest order before returning its details, allowing unauthenticated visitors who know a guest order's identifier to view its order status, payment status and total.
Product
Premium Packages
Fixed in
7.3.1
What to do
Update Premium Packages to 7.3.1 or newer.
Full record and what to do →NVD record wpscan.com
Nov 4, 2026WPvivid — Backup, Migration & Staging: Does not properly validate a backup storage directory path before using it to create directories and write filesCVE-2026-115426 · WordPress plugins & themes · reported by WPScanMedium 5.5
The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.138 does not properly validate a backup storage directory path before using it to create directories and write files, allowing administrators to cause those directories and files to be created outside the intended backup location via path traversal.
Product
WPvivid — Backup, Migration & Staging
Fixed in
0.9.138
What to do
Update WPvivid — Backup, Migration & Staging to 0.9.138 or newer.
Full record and what to do →NVD record wpscan.com
Nov 4, 2026Duplicator WordPress plugin before 5.1.0, duplicator-pro: Does not restrict its database charset and collation rewrite to schema statements during a restoreCVE-2026-115262 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Duplicator WordPress plugin before 5.1.0, duplicator-pro WordPress plugin before 5.1.0 does not restrict its database charset and collation rewrite to schema statements during a restore, so a value a Subscriber stores in their own profile can break out of its string literal and inject SQL into the restore's INSERT statement when an administrator restores the backup onto a server lacking one of the source's charsets or collations.
Product
Duplicator WordPress plugin before 5.1.0, duplicator-pro
Fixed in
5.1.0
What to do
Update Duplicator WordPress plugin before 5.1.0, duplicator-pro to 5.1.0 or newer.
Full record and what to do →NVD record wpscan.com
Nov 4, 2026WP Roster: Does not perform any capability or nonce checks before writing its stored roster dataCVE-2026-115257 · WordPress plugins & themes · reported by WPScanMedium 5.3
The WP Roster WordPress plugin before 2.36 does not perform any capability or nonce checks before writing its stored roster data, allowing unauthenticated attackers to overwrite, wipe or restore the content of any roster.
Product
WP Roster
Fixed in
2.36
What to do
Update WP Roster to 2.36 or newer.
Full record and what to do →NVD record wpscan.com
Nov 4, 2026Text Typing: Does not properly sanitize and escape a block attribute before storing it and later outputting it into a page element that is read and rendered by client-side scriptCVE-2026-115250 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Text Typing WordPress plugin before 2.2.2 does not properly sanitize and escape a block attribute before storing it and later outputting it into a page element that is read and rendered by client-side script, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks that execute in the browser of anyone viewing the affected page.
Product
Text Typing
Fixed in
2.2.2
What to do
Update Text Typing to 2.2.2 or newer.
Full record and what to do →NVD record wpscan.com
Nov 4, 2026WPvivid — Backup, Migration & Staging: Does not validate the extension of the file it actually storesCVE-2026-115243 · WordPress plugins & themes · reported by WPScanMedium 6.7
The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.137 does not validate the extension of the file it actually stores when handling an import upload: it checks the extension of a separate request field while saving the uploaded file itself with WordPress's upload type-checking disabled, so an authenticated administrator can store a file with an arbitrary extension, including a PHP file, in the WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.137's import directory. This is an incomplete fix of CVE-2025-5961, whose extension check was applied to the wrong value.
Product
WPvivid — Backup, Migration & Staging
Fixed in
0.9.137
What to do
Update WPvivid — Backup, Migration & Staging to 0.9.137 or newer.
Full record and what to do →NVD record wpscan.com
Nov 4, 2026WPvivid — Backup, Migration & Staging: Does not sanitize the staging destination folder supplied to its staging-start handlerCVE-2026-115242 · WordPress plugins & themes · reported by WPScanMedium 5.5
The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.137 does not sanitize the staging destination folder supplied to its staging-start handler, applying only a generic text filter while the sibling writability-check handler applies the correct filename sanitizer, so an authenticated administrator can supply a path containing traversal sequences and make the WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.137 write the copied site files outside the WordPress installation directory.
Product
WPvivid — Backup, Migration & Staging
Fixed in
0.9.137
What to do
Update WPvivid — Backup, Migration & Staging to 0.9.137 or newer.
Full record and what to do →NVD record wpscan.com
Nov 4, 2026WPvivid — Backup, Migration & Staging: Does not verify that a submitted snapshot identifier names a snapshot it actually created before using itCVE-2026-115241 · WordPress plugins & themes · reported by WPScanMedium 6.5
The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.137 does not verify that a submitted snapshot identifier names a snapshot it actually created before using it as a database table-name prefix, so an authenticated administrator can supply the site's table prefix, or any other string, and cause the WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.137 to drop every matching table, including the core WordPress tables, destroying the site's database.
Product
WPvivid — Backup, Migration & Staging
Fixed in
0.9.137
What to do
Update WPvivid — Backup, Migration & Staging to 0.9.137 or newer.
Full record and what to do →NVD record wpscan.com
Nov 4, 2026Enable Media Replace: Does not pass a replaced media file through the WordPress upload pipelineCVE-2026-114431 · WordPress plugins & themes · reported by WPScanMedium 6.4
The Enable Media Replace WordPress plugin before 4.2.3 does not pass a replaced media file through the WordPress upload pipeline, so the upload prefilter that SVG-sanitizer Enable Media Replace WordPress plugin before 4.2.3 rely on never runs, allowing an authenticated user with upload access to store an SVG file containing script that executes when the file is opened directly. It requires an SVG-enabling Enable Media Replace WordPress plugin before 4.2.3 to be active, as the replace path otherwise rejects SVG uploads.
Product
Enable Media Replace
Fixed in
4.2.3
What to do
Update Enable Media Replace to 4.2.3 or newer.
Full record and what to do →NVD record wpscan.com
Nov 4, 2026Duplicator WordPress plugin before 5.1.0, duplicator-pro: Does not prevent direct access to some of its bundled PHP filesCVE-2026-112244 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Duplicator WordPress plugin before 5.1.0, duplicator-pro WordPress plugin before 5.1.0 does not prevent direct access to some of its bundled PHP files, which initialise without their expected context, trigger a fatal error, and return a stack trace that discloses the server's absolute filesystem paths to unauthenticated users.
Product
Duplicator WordPress plugin before 5.1.0, duplicator-pro
Fixed in
5.1.0
What to do
Update Duplicator WordPress plugin before 5.1.0, duplicator-pro to 5.1.0 or newer.
Full record and what to do →NVD record wpscan.com
Nov 4, 2026WP Remote Users Sync: Does not adequately restrict access to the user export files it writes beneath the public web rootCVE-2026-111962 · WordPress plugins & themes · reported by WPScanLow 3.7
The WP Remote Users Sync WordPress plugin before 2.2.0 does not adequately restrict access to the user export files it writes beneath the public web root, relying on an Apache access-control file that other web servers such as Nginx ignore, which allows an unauthenticated attacker who requests the export's predictable file name while it is present to retrieve the exported users' personal data.
Product
WP Remote Users Sync
Fixed in
2.2.0
What to do
Update WP Remote Users Sync to 2.2.0 or newer.
Full record and what to do →NVD record wpscan.com
Nov 4, 2026Post Duplicator: Does not check whether the requesting user may view each post before returning a list of posts for a post typeCVE-2026-111740 · WordPress plugins & themes · reported by WPScanLow 2.7
The Post Duplicator WordPress plugin before 3.0.17 does not check whether the requesting user may view each post before returning a list of posts for a post type, allowing users with a role as low as Contributor to read the titles and hierarchy of other users' draft and private posts.
Product
Post Duplicator
Fixed in
3.0.17
What to do
Update Post Duplicator to 3.0.17 or newer.
Full record and what to do →NVD record wpscan.com
Nov 4, 2026Essential Real Estate: Does not verify that a media attachment belongs to the requesting user before deleting itCVE-2026-110964 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Essential Real Estate WordPress plugin before 5.3.5 does not verify that a media attachment belongs to the requesting user before deleting it, allowing a self-registered customer-level user to delete other users' media library attachments, including those owned by administrators.
Product
Essential Real Estate
Fixed in
5.3.5
What to do
Update Essential Real Estate to 5.3.5 or newer.
Full record and what to do →NVD record wpscan.com
Nov 4, 2026PowerPack Addons for Elementor: Widgets, Form Styler and Templates: Does not validate a user-supplied URL before using it in a server-side HTTP requestCVE-2026-110692 · WordPress plugins & themes · reported by WPScanMedium 4.1
The PowerPack Addons for Elementor: Widgets, Form Styler and Templates WordPress plugin before 3.1.3 does not validate a user-supplied URL before using it in a server-side HTTP request, which could allow users with the contributor role and above to perform Server-Side Request Forgery attacks against internal and loopback resources and read the response back.
Product
PowerPack Addons for Elementor: Widgets, Form Styler and Templates
Fixed in
3.1.3
What to do
Update PowerPack Addons for Elementor: Widgets, Form Styler and Templates to 3.1.3 or newer.
Full record and what to do →NVD record wpscan.com
Nov 4, 2026FV Flowplayer Video Player: Does not perform proper authorization checks on one of its video-migration functionsCVE-2026-108068 · WordPress plugins & themes · reported by WPScanLow 3.8
The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not perform proper authorization checks on one of its video-migration functions, which is protected by a nonce only, allowing users with Contributor-level permissions and above to disclose and bulk-modify the FV Flowplayer Video Player WordPress plugin before 7.5.56.7212's stored video records across the whole site.
Product
FV Flowplayer Video Player
Fixed in
7.5.56.7212
What to do
Update FV Flowplayer Video Player to 7.5.56.7212 or newer.
Full record and what to do →NVD record wpscan.com
Nov 4, 2026FV Flowplayer Video Player: Does not properly verify record ownership before modifying or deleting stored video and meta recordsCVE-2026-108067 · WordPress plugins & themes · reported by WPScanLow 3.8
The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not properly verify record ownership before modifying or deleting stored video and meta records, allowing authenticated users with Contributor-level access and above to modify or delete arbitrary records belonging to other users, and to disclose the associated meta data in the response.
Product
FV Flowplayer Video Player
Fixed in
7.5.56.7212
What to do
Update FV Flowplayer Video Player to 7.5.56.7212 or newer.
Full record and what to do →NVD record wpscan.com
Nov 4, 2026SEOPress: Does not sanitise and escape some of its analytics tracking settings before outputting them in an inline script printed on every front-end pageCVE-2026-108041 · WordPress plugins & themes · reported by WPScanHigh 7.1
The SEOPress WordPress plugin before 10.4 does not sanitise and escape some of its analytics tracking settings before outputting them in an inline script printed on every front-end page, allowing users granted a SEOPress WordPress plugin before 10.4 capability that an administrator can delegate to lower-privileged roles to perform Stored Cross-Site Scripting attacks that execute in the browser of any site visitor, including a logged-in administrator viewing the front end.
Product
SEOPress
Fixed in
10.4
What to do
Update SEOPress to 10.4 or newer.
Full record and what to do →NVD record wpscan.com
Nov 4, 2026Kali Forms — Contact Form & Drag-and-Drop Builder: Does not prevent users with author-level access and above from storing arbitrary JavaScript in a form button configurationCVE-2026-106649 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.29 does not prevent users with author-level access and above from storing arbitrary JavaScript in a form button configuration, which is later output into a JavaScript execution context and runs in the browser session of any user who clicks the button, including an administrator.
Product
Kali Forms — Contact Form & Drag-and-Drop Builder
Fixed in
2.4.29
What to do
Update Kali Forms — Contact Form & Drag-and-Drop Builder to 2.4.29 or newer.
Full record and what to do →NVD record wpscan.com
Nov 4, 2026Form Maker by 10Web: Does not consistently escape user-submitted field values before rendering them on its submissions admin pageCVE-2026-105413 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Form Maker by 10Web WordPress plugin before 1.15.51 does not consistently escape user-submitted field values before rendering them on its submissions admin page, allowing unauthenticated users to store a payload that executes as arbitrary web scripts in the session of an administrator who views the submissions.
Product
Form Maker by 10Web
Fixed in
1.15.51
What to do
Update Form Maker by 10Web to 1.15.51 or newer.
Full record and what to do →NVD record wpscan.com
Nov 4, 2026ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce: Does not perform a capability check on an AJAX action that returns the stored before-and-after values of a record changeCVE-2026-105191 · WordPress plugins & themes · reported by WPScanMedium 4.3
The ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce WordPress plugin before 1.17.11 does not perform a capability check on an AJAX action that returns the stored before-and-after values of a record change, allowing any authenticated user, including Subscribers, to read other users' sensitive HR, CRM and Accounting data by enumerating record identifiers.
Product
ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce
Fixed in
1.17.11
What to do
Update ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce to 1.17.11 or newer.
Full record and what to do →NVD record wpscan.com
Nov 4, 2026CookieYes: Does not correctly restrict who can write its cookie-category script fieldsCVE-2026-104719 · WordPress plugins & themes · reported by WPScanMedium 6.4
The CookieYes WordPress plugin before 3.5.8 does not correctly restrict who can write its cookie-category script fields, and does not sanitize or escape them, allowing users with the Contributor role to store JavaScript that executes in the browsers of site visitors and of an administrator reviewing the content.
Product
CookieYes
Fixed in
3.5.8
What to do
Update CookieYes to 3.5.8 or newer.
Full record and what to do →NVD record wpscan.com
Nov 4, 2026Mollie Payments for WooCommerce: Does not verify a product's publication status before creating an order for it through its PayPal express-checkout endpointCVE-2026-101166 · WordPress plugins & themes · reported by WPScanLow 3.7
The Mollie Payments for WooCommerce WordPress plugin before 8.2.0 does not verify a product's publication status before creating an order for it through its PayPal express-checkout endpoint, allowing unauthenticated users to order draft or unpublished products.
Product
Mollie Payments for WooCommerce
Fixed in
8.2.0
What to do
Update Mollie Payments for WooCommerce to 8.2.0 or newer.
Full record and what to do →NVD record wpscan.com
Nov 4, 2026Mollie Payments for WooCommerce: Does not verify an order's payment state or the requested payment gateway before removing a configured payment-surcharge feeCVE-2026-101165 · WordPress plugins & themes · reported by WPScanLow 3.7
The Mollie Payments for WooCommerce WordPress plugin before 8.2.0 does not verify an order's payment state or the requested payment gateway before removing a configured payment-surcharge fee, allowing unauthenticated users to reduce an order's total before completing payment.
Product
Mollie Payments for WooCommerce
Fixed in
8.2.0
What to do
Update Mollie Payments for WooCommerce to 8.2.0 or newer.
Full record and what to do →NVD record wpscan.com
Nov 3, 2026A security flaw has been discovered in Headless CMS Plugin up to 2.0.4 on WordPress.CVE-2026-121509 · WordPress plugins & themes · reported by VulDBMedium 5.5
A security flaw has been discovered in Headless CMS Plugin up to 2.0.4 on WordPress. This affects the function get_required_post_data of the file /wp-json/rae/v1/post of the component REST API. The manipulation of the argument post_id/post_slug results in information disclosure. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Affected
up to 2.0.4
What to do
Affects up to 2.0.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record app.notion.com vuldb.com
Nov 3, 2026myCred: Missing AuthorizationCVE-2026-97072 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in myCred myCred mycred allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects myCred: from n/a through 4.0.2.
Product
myCred
Affected
up to 4.0.2
What to do
Affects up to 4.0.2. Update myCred to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 3, 2026WCFM Membership: Missing AuthorizationCVE-2026-39777 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WC Lovers WCFM Membership wc-multivendor-membership allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WCFM Membership: from n/a through 2.12.0.
Product
WCFM Membership
Affected
up to 2.12.0
What to do
Affects up to 2.12.0. Update WCFM Membership to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 3, 2026WCFM Membership: Missing AuthorizationCVE-2026-39743 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WC Lovers WCFM Membership wc-multivendor-membership allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WCFM Membership: from n/a through 2.12.0.
Product
WCFM Membership
Affected
up to 2.12.0
What to do
Affects up to 2.12.0. Update WCFM Membership to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 3, 2026Uncanny Automator: Missing AuthorizationCVE-2026-120846 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Uncanny Owl Uncanny Automator uncanny-automator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Uncanny Automator: from n/a through 7.7.1.
Product
Uncanny Automator
Affected
up to 7.7.1
What to do
Affects up to 7.7.1. Update Uncanny Automator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 3, 2026Posts Table with Search & Sort: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-120843 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Barn2 Plugins Posts Table with Search & Sort posts-data-table allows Stored XSS.This issue affects Posts Table with Search & Sort: from n/a through 1.4.14.
Product
Posts Table with Search & Sort
Affected
up to 1.4.14
What to do
Affects up to 1.4.14. Update Posts Table with Search & Sort to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 3, 2026ClickCease Click Fraud Protection: Missing AuthorizationCVE-2026-119509 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in eranfl ClickCease Click Fraud Protection clickcease-click-fraud-protection allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ClickCease Click Fraud Protection: from n/a through 3.3.0.
Product
ClickCease Click Fraud Protection
Affected
up to 3.3.0
What to do
Affects up to 3.3.0. Update ClickCease Click Fraud Protection to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 3, 2026Better Search: Missing AuthorizationCVE-2026-119495 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WebberZone Better Search better-search allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Better Search: from n/a through 4.5.2.
Product
Better Search
Affected
up to 4.5.2
What to do
Affects up to 4.5.2. Update Better Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 3, 2026Dokan: Missing AuthorizationCVE-2026-119487 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in weDevs Dokan dokan-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Dokan: from n/a through 5.3.2.
Product
Dokan
Affected
up to 5.3.2
What to do
Affects up to 5.3.2. Update Dokan to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.