Vulnerability database

5,851 results · page 6 of 118

• Oct 5, 2026Image Slider Widget: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-42700 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GhozyLab Image Slider Widget image-slider-widget allows Stored XSS.This issue affects Image Slider Widget: from n/a through 1.1.130.

  Product

  Image Slider Widget

  Affected

  up to 1.1.130

  What to do

  Affects up to 1.1.130. Update Image Slider Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 5, 2026Adsmonetizer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-15643 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jose Fernandez Adsmonetizer adsensei-b30 allows Reflected XSS.This issue affects Adsmonetizer: from n/a through 3.2.4.

  Product

  Adsmonetizer

  Affected

  up to 3.2.4

  What to do

  Affects up to 3.2.4. Update Adsmonetizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 5, 2026QR Redirector: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-105069 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nikki Blight QR Redirector qr-redirector allows Stored XSS.This issue affects QR Redirector: from n/a through 2.0.5.

  Product

  QR Redirector

  Affected

  up to 2.0.5

  What to do

  Affects up to 2.0.5. Update QR Redirector to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 5, 2026Logo Showcase: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-105060 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themepoints Logo Showcase logo-showcase allows Stored XSS.This issue affects Logo Showcase: from n/a through 4.0.4.

  Product

  Logo Showcase

  Affected

  up to 4.0.4

  What to do

  Affects up to 4.0.4. Update Logo Showcase to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 5, 2026eCommerce Product Catalog: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-105056 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in impleCode eCommerce Product Catalog ecommerce-product-catalog allows Stored XSS.This issue affects eCommerce Product Catalog: from n/a through 3.6.2.

  Product

  eCommerce Product Catalog

  Affected

  up to 3.6.2

  What to do

  Affects up to 3.6.2. Update eCommerce Product Catalog to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 5, 2026MP3 Audio Player for Music, Radio & Podcast by Sonaar: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-104673 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sonaar MP3 Audio Player for Music, Radio & Podcast by Sonaar mp3-music-player-by-sonaar allows Stored XSS.This issue affects MP3 Audio Player for Music, Radio & Podcast by Sonaar: from n/a through 5.14.2.

  Product

  MP3 Audio Player for Music, Radio & Podcast by Sonaar

  Affected

  up to 5.14.2

  What to do

  Affects up to 5.14.2. Update MP3 Audio Player for Music, Radio & Podcast by Sonaar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 5, 2026Image Photo Gallery Final Tiles Grid: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-104409 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Image Photo Gallery Final Tiles Grid final-tiles-grid-gallery-lite allows Stored XSS.This issue affects Image Photo Gallery Final Tiles Grid: from n/a through 3.6.13.

  Product

  Image Photo Gallery Final Tiles Grid

  Affected

  up to 3.6.13

  What to do

  Affects up to 3.6.13. Update Image Photo Gallery Final Tiles Grid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 5, 2026GiveWP: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-104404 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / StellarWP GiveWP give allows Stored XSS.This issue affects GiveWP: from n/a through 4.17.0.

  Product

  GiveWP

  Affected

  up to 4.17.0

  What to do

  Affects up to 4.17.0. Update GiveWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 5, 2026B Blocks: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-104400 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins B Blocks b-blocks allows Stored XSS.This issue affects B Blocks: from n/a through 2.1.8.

  Product

  B Blocks

  Affected

  up to 2.1.8

  What to do

  Affects up to 2.1.8. Update B Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 5, 2026Name Directory: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-104396 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jeroen Peters Name Directory name-directory allows Stored XSS.This issue affects Name Directory: from n/a through 1.34.2.

  Product

  Name Directory

  Affected

  up to 1.34.2

  What to do

  Affects up to 1.34.2. Update Name Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 5, 2026Premium Addons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-103084 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LeapWorx Premium Addons for Elementor premium-addons-for-elementor allows Stored XSS.This issue affects Premium Addons for Elementor: from n/a through 4.11.109.

  Product

  Premium Addons for Elementor

  Affected

  up to 4.11.109

  What to do

  Affects up to 4.11.109. Update Premium Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 5, 2026Presto Player: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-102914 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force Presto Player presto-player allows Stored XSS.This issue affects Presto Player: from n/a through 4.5.2.

  Product

  Presto Player

  Affected

  up to 4.5.2

  What to do

  Affects up to 4.5.2. Update Presto Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 5, 2026Starter Templates: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-102393 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force Starter Templates astra-sites allows Stored XSS.This issue affects Starter Templates: from n/a through 4.7.7.

  Product

  Starter Templates

  Affected

  up to 4.7.7

  What to do

  Affects up to 4.7.7. Update Starter Templates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 4, 2026WP Statistics: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-97276 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VeronaLabs WP Statistics wp-statistics allows Reflected XSS.This issue affects WP Statistics: from n/a through 14.16.14.

  Product

  WP Statistics

  Affected

  up to 14.16.14

  What to do

  Affects up to 14.16.14. Update WP Statistics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 4, 2026Gutenberg Blocks by Kadence Blocks: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-103354 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / StellarWP Gutenberg Blocks by Kadence Blocks kadence-blocks allows Stored XSS.This issue affects Gutenberg Blocks by Kadence Blocks: from n/a through 3.7.11.1.

  Product

  Gutenberg Blocks by Kadence Blocks

  Affected

  up to 3.7.11.1

  What to do

  Affects up to 3.7.11.1. Update Gutenberg Blocks by Kadence Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 4, 2026Unlimited Elements For Elementor (Free Widgets, Addons, Templates): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-103344 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor allows Reflected XSS.This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 2.0.20.

  Product

  Unlimited Elements For Elementor (Free Widgets, Addons, Templates)

  Affected

  up to 2.0.20

  What to do

  Affects up to 2.0.20. Update Unlimited Elements For Elementor (Free Widgets, Addons, Templates) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 4, 2026TranslatePress: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-103062 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cozmoslabs TranslatePress translatepress-multilingual allows Stored XSS.This issue affects TranslatePress: from n/a through 3.3.6.

  Product

  TranslatePress

  Affected

  up to 3.3.6

  What to do

  Affects up to 3.3.6. Update TranslatePress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 4, 2026Razorpay for WooCommerce: Does not perform ownership or authorization checks on a REST API route used during checkoutCVE-2026-104118 · WordPress plugins & themes · reported by WPScanMedium 5.3

  The Razorpay for WooCommerce WordPress plugin before 4.8.8 does not perform ownership or authorization checks on a REST API route used during checkout, allowing unauthenticated attackers to modify the shipping information stored on arbitrary orders.

  Product

  Razorpay for WooCommerce

  Fixed in

  4.8.8

  What to do

  Update Razorpay for WooCommerce to 4.8.8 or newer.

  Full record and what to do →NVD recordwpscan.com

• Oct 3, 2026Unlimited Elements For Elementor (Free Widgets, Addons, Templates): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-103342 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor allows Reflected XSS.This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 2.0.20.

  Product

  Unlimited Elements For Elementor (Free Widgets, Addons, Templates)

  Affected

  up to 2.0.20

  What to do

  Affects up to 2.0.20. Update Unlimited Elements For Elementor (Free Widgets, Addons, Templates) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 3, 2026WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System: Local File InclusionCVE-2026-75028 · WordPress plugins & themes · reported by WordfenceHigh 7.5

  The WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.0.18 via the (template scope) function. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.

  Product

  WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System

  Affected

  up to 3.0.18

  What to do

  Affects up to 3.0.18. Update WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Oct 3, 2026WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System: Authorization bypassCVE-2026-11601 · WordPress plugins & themes · reported by WordfenceMedium 5.3

  The WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.0.19. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to read, create, update, clone, and delete email notification flows, including overwriting the default reservation confirmation, cancellation, and admin alert emails with attacker-controlled content sent from the site's legitimate address, or destroying reservation notification flows entirely. The vulnerable endpoints are active by default on every WPCafe installation without any configuration requirement, as the Email_Automation_Service_Provider::is_enable() method unconditionally returns true and the plugin ships with five pre-configured default email flows upon activation.

  Product

  WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System

  Affected

  up to 3.0.19

  What to do

  Affects up to 3.0.19. Update WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Oct 3, 2026WP Ultimate CSV Importer: Does not properly validate the file types contained in an uploaded archive nor sanitise their content before storing them in a publicly served locationCVE-2026-80517 · WordPress plugins & themes · reported by WPScanLow 3.5

  The WP Ultimate CSV Importer WordPress plugin before 9.2 does not properly validate the file types contained in an uploaded archive nor sanitise their content before storing them in a publicly served location, allowing high privilege users such as administrators to achieve Stored Cross-Site Scripting. On Multisite installations a site Administrator does not hold the unfiltered_html capability, so this lets them run scripts in the session of users who view the file, including Network Super Admins.

  Product

  WP Ultimate CSV Importer

  Fixed in

  9.2

  What to do

  Update WP Ultimate CSV Importer to 9.2 or newer.

  Full record and what to do →NVD recordwpscan.com

• Oct 3, 2026WP Ultimate Review: Does not prevent unauthenticated users from storing crafted review content that makes the reviewed page fail with a fatal error on every subsequent visitCVE-2026-101161 · WordPress plugins & themes · reported by WPScanHigh 7.5

  The WP Ultimate Review WordPress plugin before 2.4.4 does not prevent unauthenticated users from storing crafted review content that makes the reviewed page fail with a fatal error on every subsequent visit, resulting in a persistent denial of service when the WP Ultimate Review WordPress plugin before 2.4.4's review display settings have never been saved.

  Product

  WP Ultimate Review

  Fixed in

  2.4.4

  What to do

  Update WP Ultimate Review to 2.4.4 or newer.

  Full record and what to do →NVD recordwpscan.com

• Oct 3, 2026WP Ultimate Review: Does not validate that a submitted review rating is numeric before storing it and later using it in numeric operationsCVE-2026-101160 · WordPress plugins & themes · reported by WPScanHigh 7.5

  The WP Ultimate Review WordPress plugin before 2.4.4 does not validate that a submitted review rating is numeric before storing it and later using it in numeric operations when rendering reviews, allowing unauthenticated users to make the reviewed content fail with a fatal error for all visitors until the review is removed (a persistent denial of service), when user reviews are enabled.

  Product

  WP Ultimate Review

  Fixed in

  2.4.4

  What to do

  Update WP Ultimate Review to 2.4.4 or newer.

  Full record and what to do →NVD recordwpscan.com

• Oct 2, 2026ThemeREX Addons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-102798 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeREX Group ThemeREX Addons trx_addons allows Stored XSS.This issue affects ThemeREX Addons: from n/a through 2.46.0.

  Product

  ThemeREX Addons

  Affected

  up to 2.46.0

  What to do

  Affects up to 2.46.0. Update ThemeREX Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 2, 2026Events Calendar: Does not validate or sanitise data submitted to an unauthenticated AJAX action before merging it into its rendering contextCVE-2026-84740 · WordPress plugins & themes · reported by WPScanMedium 6.5

  The Events Calendar WordPress plugin before 6.17.5.1 does not validate or sanitise data submitted to an unauthenticated AJAX action before merging it into its rendering context, allowing unauthenticated users to execute arbitrary shortcodes registered on the site.

  Product

  Events Calendar

  Fixed in

  6.17.5.1

  What to do

  Update Events Calendar to 6.17.5.1 or newer.

  Full record and what to do →NVD recordwpscan.com

• Oct 2, 2026WP Mail Logging: Does not properly restrict the HTML and CSS of logged emails before rendering them in its admin log screensCVE-2026-1661 · WordPress plugins & themes · reported by WPScanMedium 4.3

  The WP Mail Logging WordPress plugin before 1.17.0 does not properly restrict the HTML and CSS of logged emails before rendering them in its admin log screens, allowing unauthenticated users to inject styled content and links, for example through a public contact form, that can deceive an administrator viewing the log and send their browser to an attacker-controlled page.

  Product

  WP Mail Logging

  Fixed in

  1.17.0

  What to do

  Update WP Mail Logging to 1.17.0 or newer.

  Full record and what to do →NVD recordwpscan.com

• Oct 2, 2026BuildKit: Does not properly sanitise and escape data submitted by contributor-level users before storing it and later using it in a SQL queryCVE-2026-94298 · WordPress plugins & themes · reported by WPScanMedium 6.2

  The BuildKit WordPress plugin before 1.0.29 does not properly sanitise and escape data submitted by contributor-level users before storing it and later using it in a SQL query, allowing a Contributor to inject SQL that runs against the database once the resulting content is published and viewed by any unauthenticated visitor.

  Product

  BuildKit

  Fixed in

  1.0.29

  What to do

  Update BuildKit to 1.0.29 or newer.

  Full record and what to do →NVD recordwpscan.com

• Oct 2, 2026Tabs Responsive: Does not sanitize the content of WooCommerce product tabs before storing and rendering itCVE-2026-13718 · WordPress plugins & themes · reported by WPScanMedium 6.8

  The Tabs Responsive WordPress plugin through 2.5 does not sanitize the content of WooCommerce product tabs before storing and rendering it, allowing a shop manager to store JavaScript that executes when any user, including an administrator, views the product page.

  Product

  Tabs Responsive

  Affected

  up to 2.5

  What to do

  Affects up to 2.5. Update Tabs Responsive to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordwpscan.com

• Oct 1, 2026FluentForm: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-103343 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP ManageNinja LLC FluentForm fluentform allows Stored XSS.This issue affects FluentForm: from n/a through 6.2.14.

  Product

  FluentForm

  Affected

  up to 6.2.14

  What to do

  Affects up to 6.2.14. Update FluentForm to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 1, 2026Metform: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-103339 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wpmet Metform metform allows Stored XSS.This issue affects Metform: from n/a through 4.3.0.

  Product

  Metform

  Affected

  up to 4.3.0

  What to do

  Affects up to 4.3.0. Update Metform to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 1, 2026ElementsKit Elementor addons Lite: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-103064 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wpmet ElementsKit Elementor addons Lite elementskit-lite allows Stored XSS.This issue affects ElementsKit Elementor addons Lite: from n/a through 4.0.6.

  Product

  ElementsKit Elementor addons Lite

  Affected

  up to 4.0.6

  What to do

  Affects up to 4.0.6. Update ElementsKit Elementor addons Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 1, 2026ElementsKit Elementor addons Lite: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-103063 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wpmet ElementsKit Elementor addons Lite elementskit-lite allows Stored XSS.This issue affects ElementsKit Elementor addons Lite: from n/a through 4.0.6.

  Product

  ElementsKit Elementor addons Lite

  Affected

  up to 4.0.6

  What to do

  Affects up to 4.0.6. Update ElementsKit Elementor addons Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 1, 2026Essential Addons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-102394 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPDeveloper Essential Addons for Elementor essential-addons-for-elementor-lite allows Stored XSS.This issue affects Essential Addons for Elementor: from n/a through 6.8.4.

  Product

  Essential Addons for Elementor

  Affected

  up to 6.8.4

  What to do

  Affects up to 6.8.4. Update Essential Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 1, 2026Social Media Share Buttons & Social Sharing Icons: Reflected Cross-Site ScriptingCVE-2026-89047 · WordPress plugins & themes · reported by WordfenceMedium 6.1

  The Social Media Share Buttons & Social Sharing Icons plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via URL in all versions up to, and including, 3.0.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the victim to be on a mobile user-agent and to click the WeChat share icon, though once the dialog opens, script execution is automatic and requires no further user interaction.

  Product

  Social Media Share Buttons & Social Sharing Icons

  Affected

  up to 3.0.1

  What to do

  Affects up to 3.0.1. Update Social Media Share Buttons & Social Sharing Icons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Oct 1, 2026WP Fusion Lite: Does not require authentication on a settings handler that runs during admin initializationCVE-2026-90974 · WordPress plugins & themes · reported by WPScanMedium 6.5

  The WP Fusion Lite WordPress plugin before 3.48.0 does not require authentication on a settings handler that runs during admin initialization, allowing unauthenticated users to overwrite the site's CRM integration endpoint and credentials, after which synced user data is delivered to an attacker-chosen host.

  Product

  WP Fusion Lite

  Fixed in

  3.48.0

  What to do

  Update WP Fusion Lite to 3.48.0 or newer.

  Full record and what to do →NVD recordwpscan.com

• Oct 1, 2026If-So Dynamic Content: Does not sanitize a conversion name before storing itCVE-2026-87973 · WordPress plugins & themes · reported by WPScanLow 3.1

  The If-So Dynamic Content WordPress plugin before 1.10.2 does not sanitize a conversion name before storing it, nor escape it when rendering the analytics page, allowing users with editor-level access to store JavaScript that executes in the session of a higher-privileged user who views that page.

  Product

  If-So Dynamic Content

  Fixed in

  1.10.2

  What to do

  Update If-So Dynamic Content to 1.10.2 or newer.

  Full record and what to do →NVD recordwpscan.com

• Sep 30, 2026JetEngine: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-97265 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock. Jetimpex Inc. JetEngine allows Stored XSS. This issue affects JetEngine: from n/a through 3.8.15.3.

  Product

  JetEngine

  Affected

  up to 3.8.15.3

  What to do

  Affects up to 3.8.15.3. Update JetEngine to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 30, 2026VillaTheme CURCY woo-multi-currency: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-94171 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VillaTheme CURCY woo-multi-currency allows DOM-Based XSS.This issue affects CURCY: 2.2.18.

  Product

  VillaTheme CURCY woo-multi-currency

  What to do

  Update VillaTheme CURCY woo-multi-currency to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Sep 30, 2026User Submitted Posts: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-62084 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jeff Starr User Submitted Posts allows Stored XSS. This issue affects User Submitted Posts: from n/a through 20260810.

  Product

  User Submitted Posts

  Affected

  up to 20260810

  What to do

  Affects up to 20260810. Update User Submitted Posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 30, 2026Quiz And Survey Master: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-97289 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows DOM-Based XSS.This issue affects Quiz And Survey Master: from n/a through 11.2.6.

  Product

  Quiz And Survey Master

  Affected

  up to 11.2.6

  What to do

  Affects up to 11.2.6. Update Quiz And Survey Master to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 30, 2026Strong Testimonials: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-97286 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Strong Testimonials strong-testimonials allows Stored XSS.This issue affects Strong Testimonials: from n/a through 3.3.11.

  Product

  Strong Testimonials

  Affected

  up to 3.3.11

  What to do

  Affects up to 3.3.11. Update Strong Testimonials to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 30, 2026LayerSlider: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-97253 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kreatura LayerSlider allows Reflected XSS. This issue affects LayerSlider: from n/a through 8.4.0.

  Product

  LayerSlider

  Affected

  up to 8.4.0

  What to do

  Affects up to 8.4.0. Update LayerSlider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 30, 2026JetEngine: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-97237 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetEngine jet-engine allows DOM-Based XSS.This issue affects JetEngine: from n/a through 3.8.14.3.

  Product

  JetEngine

  Affected

  up to 3.8.14.3

  What to do

  Affects up to 3.8.14.3. Update JetEngine to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 30, 2026If-So Dynamic Content Personalization: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-100507 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in If-So Dynamic Content If-So Dynamic Content Personalization if-so allows Reflected XSS.This issue affects If-So Dynamic Content Personalization: from n/a through 1.10.1.

  Product

  If-So Dynamic Content Personalization

  Affected

  up to 1.10.1

  What to do

  Affects up to 1.10.1. Update If-So Dynamic Content Personalization to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 30, 2026EWWW Image Optimizer: Does not prevent authenticated users with author-level permissions from storing a serialized value in a post meta field that is deserializedCVE-2026-91051 · WordPress plugins & themes · reported by WPScanMedium 6.6

  The EWWW Image Optimizer WordPress plugin before 8.8.0 does not prevent authenticated users with author-level permissions from storing a serialized value in a post meta field that is deserialized when the post is rendered, allowing them to perform PHP Object Injection, which can lead to remote code execution when a suitable gadget chain is present via another installed EWWW Image Optimizer WordPress plugin before 8.8.0 or .

  Product

  EWWW Image Optimizer

  Fixed in

  8.8.0

  What to do

  Update EWWW Image Optimizer to 8.8.0 or newer.

  Full record and what to do →NVD recordwpscan.com

• Sep 30, 2026User Frontend: Does not prevent tampering with the role assigned by its registration formCVE-2026-75823 · WordPress plugins & themes · reported by WPScanHigh 7.4

  The User Frontend WordPress plugin before 4.3.12 does not prevent tampering with the role assigned by its registration form, allowing unauthenticated users to register with a higher privileged role, such as Editor. This affects installations running a PHP build where the sodium extension is unavailable, and where a registration page has been configured. The administrator role cannot be obtained this way.

  Product

  User Frontend

  Fixed in

  4.3.12

  What to do

  Update User Frontend to 4.3.12 or newer.

  Full record and what to do →NVD recordwpscan.com

• Sep 27, 2026Optima Express IDX: Does not properly neutralise a script value submitted through one of its REST endpoints before storing it and echoing it into the document headCVE-2026-96899 · WordPress plugins & themes · reported by WPScanMedium 6.8

  The Optima Express IDX WordPress plugin before 8.7.6 does not properly neutralise a script value submitted through one of its REST endpoints before storing it and echoing it into the document head when the post is rendered, allowing users with a role as low as author to perform Stored Cross-Site Scripting attacks.

  Product

  Optima Express IDX

  Fixed in

  8.7.6

  What to do

  Update Optima Express IDX to 8.7.6 or newer.

  Full record and what to do →NVD recordwpscan.com

• Sep 27, 2026WPeMatico RSS Feed Fetcher: Does not sanitize imported feed content before storing itCVE-2026-89006 · WordPress plugins & themes · reported by WPScanMedium 6.8

  The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27 does not sanitize imported feed content before storing it as post content, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks.

  Product

  WPeMatico RSS Feed Fetcher

  Fixed in

  2.8.27

  What to do

  Update WPeMatico RSS Feed Fetcher to 2.8.27 or newer.

  Full record and what to do →NVD recordwpscan.com

• Sep 27, 2026WPeMatico RSS Feed Fetcher: Does not perform a capability check before fetching a user-supplied URL and rendering the responseCVE-2026-89003 · WordPress plugins & themes · reported by WPScanMedium 4.1

  The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27 does not perform a capability check before fetching a user-supplied URL and rendering the response, allowing users with contributor-level access and above to force the server to issue requests to internal-only hosts and read the responses back.

  Product

  WPeMatico RSS Feed Fetcher

  Fixed in

  2.8.27

  What to do

  Update WPeMatico RSS Feed Fetcher to 2.8.27 or newer.

  Full record and what to do →NVD recordwpscan.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.