Updated 3 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,769exploited flaws on CISA’s list

30added in the last 30 days

496new WordPress flaws this week

394,829entries in the database

24,770 results · page 7 of 496

Nov 3, 2026Dokan: Missing AuthorizationCVE-2026-119485 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in weDevs Dokan dokan-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Dokan: from n/a through 5.3.2.
Product
Dokan
Affected
up to 5.3.2
What to do
Affects up to 5.3.2. Update Dokan to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 3, 2026Forminator: Missing AuthorizationCVE-2026-116859 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WPMU DEV Forminator forminator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Forminator: from n/a through 1.58.3.
Product
Forminator
Affected
up to 1.58.3
What to do
Affects up to 1.58.3. Update Forminator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 3, 2026Forminator: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)CVE-2026-116858 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in WPMU DEV Forminator forminator allows Code Injection.This issue affects Forminator: from n/a through 1.58.3.
Product
Forminator
Affected
up to 1.58.3
What to do
Affects up to 1.58.3. Update Forminator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 3, 2026AnyWhere Elementor: Missing AuthorizationCVE-2026-114187 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WPVibes AnyWhere Elementor anywhere-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AnyWhere Elementor: from n/a through 1.3.0.
Product
AnyWhere Elementor
Affected
up to 1.3.0
What to do
Affects up to 1.3.0. Update AnyWhere Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 3, 2026AnyWhere Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-114185 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPVibes AnyWhere Elementor anywhere-elementor allows Stored XSS.This issue affects AnyWhere Elementor: from n/a through 1.3.0.
Product
AnyWhere Elementor
Affected
up to 1.3.0
What to do
Affects up to 1.3.0. Update AnyWhere Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 3, 2026AnyWhere Elementor: Insertion of Sensitive Information Into Sent DataCVE-2026-114183 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Insertion of Sensitive Information Into Sent Data vulnerability in WPVibes AnyWhere Elementor anywhere-elementor allows Retrieve Embedded Sensitive Data.This issue affects AnyWhere Elementor: from n/a through 1.3.0.
Product
AnyWhere Elementor
Affected
up to 1.3.0
What to do
Affects up to 1.3.0. Update AnyWhere Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 3, 2026myCred: Missing AuthorizationCVE-2026-103077 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in myCred myCred mycred allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects myCred: from n/a through 4.0.2.
Product
myCred
Affected
up to 4.0.2
What to do
Affects up to 4.0.2. Update myCred to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 3, 2026The Eupago Gateway For Woocommerce WordPress plugin from 4.5.0 through 4.7.5 does not verify the authenticity of incoming payment-confirmation webhook requests CVE-2026-91075 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Eupago Gateway For Woocommerce WordPress plugin from 4.5.0 through 4.7.5 does not verify the authenticity of incoming payment-confirmation webhook requests in some configurations, allowing unauthenticated attackers to forge a payment confirmation and mark a pending order as paid without paying for it.
Affected
up to 4.7.5
What to do
Affects up to 4.7.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Nov 3, 2026The CryptoCloud WordPress plugin from 3.0.0 through 3.0.1 does not verify the authenticity of the payment notifications received by its gateway callback, as theCVE-2026-103327 · WordPress plugins & themes · reported by WPScanMedium 5.3
The CryptoCloud WordPress plugin from 3.0.0 through 3.0.1 does not verify the authenticity of the payment notifications received by its gateway callback, as the integrity check is skipped while the webhook secret is left at its empty default, allowing unauthenticated attackers to mark arbitrary orders as paid or failed without any payment being made.
Affected
up to 3.0.1
What to do
Affects up to 3.0.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Nov 3, 2026AZEXO Store Locator: Does not have a capability check or any authorization controlCVE-2026-115205 · WordPress plugins & themes · reported by WPScanMedium 6.5
The AZEXO Store Locator WordPress plugin through 1.4 does not have a capability check or any authorization control when deleting a post, allowing any authenticated user, such as a subscriber, to delete arbitrary posts and pages.
Product
AZEXO Store Locator
Affected
up to 1.4
What to do
Affects up to 1.4. Update AZEXO Store Locator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Nov 3, 2026DT LMS: Does not perform capability or nonce checks on one of its AJAX actionsCVE-2026-106004 · WordPress plugins & themes · reported by WPScanMedium 5.3
The DT LMS WordPress plugin through 1.2 does not perform capability or nonce checks on one of its AJAX actions, allowing unauthenticated attackers to revoke any learner's course and class completion status.
Product
DT LMS
Affected
up to 1.2
What to do
Affects up to 1.2. Update DT LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Nov 3, 2026DT Directory Lite Addon: Does not perform nonce or capability checks on its settings handlersCVE-2026-105993 · WordPress plugins & themes · reported by WPScanMedium 5.3
The DT Directory Lite Addon WordPress plugin through 1.1 does not perform nonce or capability checks on its settings handlers, allowing unauthenticated attackers to modify the DT Directory Lite Addon WordPress plugin through 1.1's configuration and skin options.
Product
DT Directory Lite Addon
Affected
up to 1.1
What to do
Affects up to 1.1. Update DT Directory Lite Addon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Nov 3, 2026Gallery for Social Photo: Does not validate a user-supplied URL before using it to perform a server-side requestCVE-2026-105967 · WordPress plugins & themes · reported by WPScanMedium 5.8
The Gallery for Social Photo WordPress plugin through 1.0.0.41 does not validate a user-supplied URL before using it to perform a server-side request, allowing unauthenticated attackers to make the server issue requests to arbitrary internal hosts and read the responses.
Product
Gallery for Social Photo
Affected
up to 1.0.0.41
What to do
Affects up to 1.0.0.41. Update Gallery for Social Photo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Nov 3, 2026weMail: Does not restrict a site-wide third-party email-service API key to administratorsCVE-2026-104648 · WordPress plugins & themes · reported by WPScanMedium 4.9
The weMail WordPress plugin through 2.1.6 does not restrict a site-wide third-party email-service API key to administrators, exposing it in an admin screen that users with the Editor role can reach by default, which allows them to obtain a reusable credential usable without a WordPress session to impersonate other users and sever the site's email-service connection.
Product
weMail
Affected
up to 2.1.6
What to do
Affects up to 2.1.6. Update weMail to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Nov 3, 2026weMail: Does not correctly verify user capabilities in its REST API permission checksCVE-2026-104647 · WordPress plugins & themes · reported by WPScanLow 3.8
The weMail WordPress plugin through 2.1.6 does not correctly verify user capabilities in its REST API permission checks, treating any user whose role is in the weMail WordPress plugin through 2.1.6's allowed-roles list (Editor and above by default) as authorised for every action, which allows such users to perform administrator-level actions including enumerating all registered users with their email addresses and modifying the weMail WordPress plugin through 2.1.6's own access-control configuration.
Product
weMail
Affected
up to 2.1.6
What to do
Affects up to 2.1.6. Update weMail to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Nov 3, 2026WATI Chat and Notification: Does not require a validCVE-2026-103379 · WordPress plugins & themes · reported by WPScanMedium 5.3
The WATI Chat and Notification WordPress plugin through 1.1.8 does not require a valid, non-empty secret on a public endpoint that returns its stored API token, which an unauthenticated attacker can then present to a second public endpoint to obtain the order-received URL of any WooCommerce order and read the customer's name, address, phone number and email address. The endpoints are reachable in the WATI Chat and Notification WordPress plugin through 1.1.8's default state and are closed only once a WATI account is connected.
Product
WATI Chat and Notification
Affected
up to 1.1.8
What to do
Affects up to 1.1.8. Update WATI Chat and Notification to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Nov 3, 2026AI Alt Text Generator: Authorization bypassCVE-2026-120578 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The AI Alt Text Generator plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.7.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to modify the alt text, and optionally the title, caption, and description of arbitrary attachments owned by other users. Exploiting this vulnerability requires a Contributor-level account to retrieve the nonce from the page source of post.php, post-new.php, or upload.php; additionally, overwriting post_title, post_excerpt, and post_content requires the plugin's set_title, set_caption, or set_description options to be enabled.
Product
AI Alt Text Generator
Affected
up to 2.7.0
What to do
Affects up to 2.7.0. Update AI Alt Text Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 3, 2026FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler: Arbitrary file deletionCVE-2026-120577 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the deleteFile function in all versions up to, and including, 1.6.2. This makes it possible for authenticated attackers, with custom-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
Product
FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler
Affected
up to 1.6.2
What to do
Affects up to 1.6.2. Update FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 3, 2026Photo Engine (Media Organizer & Lightroom): Stored Cross-Site ScriptingCVE-2026-120575 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Photo Engine (Media Organizer & Lightroom) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'hierarchy[].name' parameter in all versions up to, and including, 6.5.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable by Subscribers because the /?wplr-sync-api endpoint authenticates solely via wplr_auth_token usermeta with no capability check, and the current user's token is exposed on every admin page via localized script data due to a commented-out screen-condition guard.
Product
Photo Engine (Media Organizer & Lightroom)
Affected
up to 6.5.7
What to do
Affects up to 6.5.7. Update Photo Engine (Media Organizer & Lightroom) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 3, 2026SureCart: Unauthenticated account takeoverCVE-2026-120574 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The SureCart plugin for WordPress is vulnerable to unauthenticated account takeover in all versions up to, and including, 4.9.5. The passwordless one-time-code login REST route (VerificationCodeController::verify(), whose permission callback returns true) resolves an attacker-supplied login to any WordPress user, verifies a 6-digit code, and on success calls $user->login() → wp_set_auth_cookie() for a user of any role. In the affected versions this path has no per-account attempt counter, no persistent email/IP lockout or rate limit (the upstream CDN throttle is bypassable via IP rotation), and no restriction preventing high-privilege accounts from being logged in through it. An unauthenticated attacker can trigger a code for any user (including an administrator) via the companion unauthenticated endpoint and brute-force the 6-digit code to obtain an authenticated session as that user, resulting in a full administrator account takeover.
Product
SureCart
Affected
up to 4.9.5
What to do
Affects up to 4.9.5. Update SureCart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.svn.wordpress.org plugins.svn.wordpress.org
Nov 3, 2026WooCommerce Multilingual & Multicurrency with WPML: SQL InjectionCVE-2026-120563 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The WooCommerce Multilingual & Multicurrency with WPML plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 5.5.7. This is due to insufficient input validation on the currency exchange rate parameter in the save_currency() AJAX handler, which lacks capability checks and allows subscriber-level users to store malicious SQL payloads that are later concatenated directly into ORDER BY clauses without proper sanitization. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to append additional SQL queries to extract sensitive information from the database.
Product
WooCommerce Multilingual & Multicurrency with WPML
Affected
up to 5.5.7
What to do
Affects up to 5.5.7. Update WooCommerce Multilingual & Multicurrency with WPML to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 3, 2026JetFormBuilder — Dynamic Blocks Form Builder: Unauthorized modification of dataCVE-2026-120561 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'do_action' function in the 'Update_Options' action class in all versions up to, and including, 3.6.2. This makes it possible for unauthenticated attackers to modify JetEngine Options Page values when an administrator has configured a form with the "Update Options" post-submission action. The vulnerability requires that both JetFormBuilder and JetEngine are installed and active, and that an administrator has specifically configured a form with the Update Options action.
Product
JetFormBuilder — Dynamic Blocks Form Builder
Affected
up to 3.6.2
What to do
Affects up to 3.6.2. Update JetFormBuilder — Dynamic Blocks Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 3, 2026Advanced Shipment Tracking for WooCommerce: SQL InjectionCVE-2026-120558 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Advanced Shipment Tracking for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the `tracking_provider` parameter of the `POST /wp-json/wc-ast/v3/orders/<order_id>/shipment-trackings` REST endpoint in all versions up to, and including, 3.9. This is due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the existing SQL query in `WC_Advanced_Shipment_Tracking_Admin::get_provider_slug_from_name()` — the value is concatenated directly into the format string of `$wpdb->prepare()` rather than bound as a parameter, bypassing parameterised-query protections. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to append additional SQL queries into the already-existing query that can be used to extract sensitive information from the database.
Product
Advanced Shipment Tracking for WooCommerce
Affected
up to 3.9
What to do
Affects up to 3.9. Update Advanced Shipment Tracking for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 3, 2026SEO Engine – Smart SEO with AI, Schema & Redirection for: Stored Cross-Site ScriptingCVE-2026-120552 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The SEO Engine – Smart SEO with AI, Schema & Redirection for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'title' parameter in all versions up to, and including, 0.9.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. WordPress core's wp_filter_kses (applied via title_save_pre for Contributors and Authors) strips literal tag markup on save but leaves HTML-entity-encoded payloads intact in the database, meaning entity-encoded XSS payloads stored via the standard WordPress REST API (POST /wp-json/wp/v2/posts) are not neutralized before reaching the vulnerable sink.
Product
SEO Engine – Smart SEO with AI, Schema & Redirection for
Affected
up to 0.9.9
What to do
Affects up to 0.9.9. Update SEO Engine – Smart SEO with AI, Schema & Redirection for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 3, 2026WP Compress – Instant Performance & Speed Optimization: Authorization bypassCVE-2026-120551 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.22.01. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to link the victim site to an attacker-controlled WP Compress account, overwrite plugin settings to an aggressive live-CDN preset, and gain the shared api_key that authenticates all nopriv HMAC-gated endpoints — enabling full control over cache purging, file deletion, opcode cache invalidation, and other privileged plugin operations. This vulnerability only affects fresh installations or lite/free-mode installs where no api_key is already stored, as the sole guard fails open when the stored key is absent.
Product
WP Compress – Instant Performance & Speed Optimization
Affected
up to 7.22.01
What to do
Affects up to 7.22.01. Update WP Compress – Instant Performance & Speed Optimization to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 3, 2026Easy Digital Downloads: Authentication bypass leading to administrator account takeoverCVE-2026-120538 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Easy Digital Downloads plugin for WordPress is vulnerable to authentication bypass leading to administrator account takeover in all versions up to, and including, 3.7.2. During a PayPal guest checkout, the email address entered in the guest-checkout field is trusted as proof of identity: edd_get_purchase_form_user() binds the new guest order to an existing WordPress user purely on an email-address match, rewriting the order's user_id to that user's ID. The PayPal capture sink PurchaseUser::maybe_log_in_after_capture() then looked the user up by the order email (get_user_by( 'email', $order->email )) and, when $order->user_id equalled that user's ID (which the email-binding step guarantees), issued an authenticated session with wp_set_auth_cookie(). An unauthenticated attacker who starts a guest checkout using an administrator's email address (where that administrator has no existing EDD customer record) and completes the PayPal purchase flow therefore receives an authenticated session as that administrator — a full account takeover. The same sink is reachable through the standard PayPal checkout and the REST UnbrandedCard and Fastlane flows.
Product
Easy Digital Downloads
Affected
up to 3.7.2
What to do
Affects up to 3.7.2. Update Easy Digital Downloads to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 2, 2026WP Fastest Cache: Sensitive Information ExposureCVE-2026-111464 · WordPress plugins & themes · reported by WordfenceMedium 5.9
The WP Fastest Cache plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.5.3. The plugin caches the response of Core’s wp-activate.php without honoring its no-store/no-cache headers, the wp-activate-* cookie, or the WP_INSTALLING state, writing the credential-bearing activation response to a publicly accessible cache file. This makes it possible for unauthenticated attackers to retrieve the plaintext username and twelve-character password of the most recently activated Multisite registrant from that cached wp-activate.php response. Exploitation requires a Multisite subdirectory installation with public user and site registration enabled, and the credentials are only exposed after a genuine registrant follows their activation link.
Product
WP Fastest Cache
Affected
up to 1.5.3
What to do
Affects up to 1.5.3. Update WP Fastest Cache to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 2, 2026Codestar backup AJAX actions csf-export, csf-import and csf-reset: Product Gallery Slider & Additional Variation Images for WooCommerce 2.3.23 before 2.3.26 contains a missing authorizationCVE-2026-120318 · WordPress plugins & themes · reported by VulnCheckHigh 8.6
Product Gallery Slider & Additional Variation Images for WooCommerce 2.3.23 before 2.3.26 contains a missing authorization vulnerability in Codestar backup AJAX actions csf-export, csf-import and csf-reset. Shop Managers can read the csf_backup_nonce from the settings page and supply arbitrary option names via the 'unique' parameter to read, overwrite or delete WordPress options, including modifying wp_user_roles to escalate to administrator.
Product
Codestar backup AJAX actions csf-export, csf-import and csf-reset
Fixed in
2.3.26
What to do
Update Codestar backup AJAX actions csf-export, csf-import and csf-reset to 2.3.26 or newer.
Full record and what to do →NVD record downloads.wordpress.org plugins.svn.wordpress.org
Nov 2, 2026The PayHere Payment Gateway WordPress plugin from 2.4.0 through 2.4.5 does not verify the authenticity of payment notifications when the merchant secret is unseCVE-2026-103310 · WordPress plugins & themes · reported by WPScanMedium 5.3
The PayHere Payment Gateway WordPress plugin from 2.4.0 through 2.4.5 does not verify the authenticity of payment notifications when the merchant secret is unset, which is the default state, allowing unauthenticated attackers to forge a payment confirmation and mark any order as paid without payment.
Affected
up to 2.4.5
What to do
Affects up to 2.4.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Nov 1, 2026JetFormBuilder: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2026-119480 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Crocoblock JetFormBuilder jetformbuilder allows Path Traversal.This issue affects JetFormBuilder: from n/a through 3.6.7.1.
Product
JetFormBuilder
Affected
up to 3.6.7.1
What to do
Affects up to 3.6.7.1. Update JetFormBuilder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 1, 2026Media Library Assistant: Does not escape one of its shortcode attributes before outputting it in an attribute of generated linksCVE-2026-113482 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Media Library Assistant WordPress plugin before 3.44 does not escape one of its shortcode attributes before outputting it in an attribute of generated links, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
Media Library Assistant
Fixed in
3.44
What to do
Update Media Library Assistant to 3.44 or newer.
Full record and what to do →NVD record wpscan.com
Nov 1, 2026Media Library Assistant: Does not check that the requesting user is allowed to view a post before disclosingCVE-2026-113481 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Media Library Assistant WordPress plugin before 3.44 does not check that the requesting user is allowed to view a post before disclosing which taxonomy terms are assigned to it, allowing any authenticated user, such as a subscriber, to learn the term assignments of private attachments and posts.
Product
Media Library Assistant
Fixed in
3.44
What to do
Update Media Library Assistant to 3.44 or newer.
Full record and what to do →NVD record wpscan.com
Nov 1, 2026Kali Forms — Contact Form & Drag-and-Drop Builder: Does not perform a capability check on its test-email handlerCVE-2026-107343 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.30 does not perform a capability check on its test-email handler, relying only on a nonce that is available to any logged-in user, so a low-privileged user such as a Subscriber can make the site send email to an arbitrary recipient with a spoofed sender address.
Product
Kali Forms — Contact Form & Drag-and-Drop Builder
Fixed in
2.4.30
What to do
Update Kali Forms — Contact Form & Drag-and-Drop Builder to 2.4.30 or newer.
Full record and what to do →NVD record wpscan.com
Nov 1, 2026Kali Forms — Contact Form & Drag-and-Drop Builder: Does not perform a capability checkCVE-2026-107342 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.30 does not perform a capability check when its test-email handler resolves and returns a user's email address, relying only on a nonce that is available to any logged-in user, allowing authenticated users with minimal privileges (Subscriber and above) to disclose the email address of any registered user, including administrators.
Product
Kali Forms — Contact Form & Drag-and-Drop Builder
Fixed in
2.4.30
What to do
Update Kali Forms — Contact Form & Drag-and-Drop Builder to 2.4.30 or newer.
Full record and what to do →NVD record wpscan.com
Oct 31, 2026Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery: Remote Code ExecutionCVE-2026-76010 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.4.1 via the render_image function. This is due to unrestricted mass assignment of caller-supplied meta_data keys onto the image model combined with missing realpath containment in path construction and a bypassable signature check on the public image delivery route. This makes it possible for authenticated attackers, with custom-level access and above, to execute code on the server. Exploitation requires the authenticated attacker to own at least one NextGEN gallery — a condition that can be satisfied by any Subscriber who was ever granted the 'NextGEN Manage gallery' capability, and that access is retained indefinitely due to the stored gallery-author equality fallback in _can_manage_gallery() even after the capability is revoked.
Product
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery
Affected
up to 4.4.1
What to do
Affects up to 4.4.1. Update Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 31, 2026Germanized for WooCommerce: Unauthorized Access of Private DataCVE-2026-109231 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Germanized for WooCommerce plugin for WordPress is vulnerable to Unauthorized Access of Private Data via Activation Token Reuse in versions up to, and including, 4.1.4. This is due to the `on_user_email_changed` hook — which is responsible for rotating the activation token and recording a pending-email-change marker on an unactivated Customer account — only being registered inside the `is_double_opt_in_login_enabled()` branch when "Disable login for unactivated customers" is set to Yes, leaving the original `?activate=` token valid and entirely unbound to the email address it was issued for when that setting is No. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change their account email to a victim's billing email via the standard `/my-account/edit-account/` form and then redeem their original activation token through `customer_account_activate()`, triggering `link_customer_past_orders()` to reassign any matching guest order to the attacker's account and exposing the original buyer's billing name, street address, phone number, and purchased items on the attacker's My Account order page. Exploitation requires the site to have doub
Product
Germanized for WooCommerce
Affected
up to 4.1.4
What to do
Affects up to 4.1.4. Update Germanized for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 31, 2026FlexStock – Product Stock Sync with Google Sheets for WooCommerce: Stored Cross-Site ScriptingCVE-2026-107711 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The FlexStock – Product Stock Sync with Google Sheets for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'products[].post_content' parameter in all versions up to, and including, 3.17.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable by any Subscriber-level user because the plugin's admin_enqueue_scripts callback exposes the REST bearer token in the Dashboard page source via wp_localize_script() without a capability check, and the REST endpoint's permission_callback validates only that bearer token rather than performing a current_user_can() capability check.
Product
FlexStock – Product Stock Sync with Google Sheets for WooCommerce
Affected
up to 3.17.2
What to do
Affects up to 3.17.2. Update FlexStock – Product Stock Sync with Google Sheets for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 31, 2026Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder: Reflected DOM-Based Cross-Site ScriptingCVE-2026-100151 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder plugin for WordPress is vulnerable to Reflected DOM-Based Cross-Site Scripting via 'querystring:<key>' URL Parameter in all versions up to, and including, 3.15.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. This bypass is triggered when an attacker supplies a matching field:<key> URL parameter that causes the server to fully resolve the {field:*} placeholder, forcing the client-side else-branch to abandon the server-sanitized value and reconstruct field content from the raw query string.
Product
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
Affected
up to 3.15.5
What to do
Affects up to 3.15.5. Update Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 31, 2026SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications: Arbitrary File UploadCVE-2026-118235 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.10.2 via the handle_upload function. This is due to missing server-side file key allowlist and pre-sanitization extension derivation that allows a trailing-dot filename to bypass all extension and MIME validation in handle_upload. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. The only access control is a nonce that is printed into every public form's data-nonce attribute, making it trivially obtainable by any unauthenticated visitor on a page embedding the form shortcode.
Product
SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications
Affected
up to 3.10.2
What to do
Affects up to 3.10.2. Update SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.svn.wordpress.org plugins.trac.wordpress.org
Oct 31, 2026All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights): Sensitive Information ExposureCVE-2026-109367 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.0.3 via the 's' parameter. This makes it possible for unauthenticated attackers to extract arbitrary non-public post meta values, including sensitive custom fields such as API keys and internal notes, emitted verbatim into the HTML title element and JSON-LD SearchResultsPage schema.
Product
All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights)
Affected
up to 5.0.3
What to do
Affects up to 5.0.3. Update All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 31, 2026The User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission plugin for WordPress is vulnCVE-2026-120070 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.3.13 via the `post_content` parameter of the `submit_post()` function. The vulnerability exists because the protected-shortcode blocklist guard inspects the `sanitize_textarea_field()` copy of the submitted `post_content`, while the copy actually persisted to the database is processed through `wp_kses()`, whose `wp_kses_no_null()` step strips C0 control bytes — allowing an attacker to inject a single `\x01` byte inside the `[wpuf-registration]` tag name to defeat the `strpos()` blocklist check while the clean, functional shortcode is stored verbatim; `strip_shortcodes()` does not neutralize the stored shortcode either, because the Frontend container that registers it via `add_shortcode()` is only instantiated when `is_admin()` is false, and `admin-ajax` requests have `is_admin() === true`. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject a `[wpuf-registration role="editor"]` shortcode into a published p
Affected
up to 4.3.13
What to do
Affects up to 4.3.13. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 31, 2026Uncanny Toolkit for LearnDash: Authentication BypassCVE-2026-119096 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Uncanny Toolkit for LearnDash plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 3.8.2 via the `email` parameter of the `uo_login_action()` function. This is due to a parser-differential flaw in which the plugin's account-verification gate resolves the submitted `email` value using the raw, unsanitized string passed to `get_user_by()`, while the subsequent `wp_signon()` call relies on WordPress core's internal `sanitize_user()` to strip appended junk characters — causing the gate lookup to fail and be skipped entirely while the real account is still resolved and authenticated. This makes it possible for unauthenticated attackers to log in to unverified or administrator-suspended accounts whose credentials they already possess, obtaining a valid `wordpress_logged_in` session cookie and defeating the plugin's account-approval and account-suspension controls. The nonce required to reach the handler is freely obtainable in the same request from the unauthenticated `ult-refresh-nonce` endpoint, making exploitation trivial for any attacker with network access to the site and knowledge of a target account's credentials.
Product
Uncanny Toolkit for LearnDash
Affected
up to 3.8.2
What to do
Affects up to 3.8.2. Update Uncanny Toolkit for LearnDash to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 31, 2026Shield Security – Smart Bot Blocking, Brute-Force Login Protection & File Scanning: Stored Cross-Site ScriptingCVE-2026-118057 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Shield Security – Smart Bot Blocking, Brute-Force Login Protection & File Scanning plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'REQUEST_URI' parameter in all versions up to, and including, 22.3.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The hidden 'path' column in ForTraffic.php lacks a client-side render function, so DataTables builds its cell via innerHTML, causing stored HTML in the path value to be parsed into live DOM nodes; a prior partial fix in version 18.5.8 added esc_html() only to the visible 'page' column, leaving the hidden 'path' field unescaped and exploitable through version 22.2.6.
Product
Shield Security – Smart Bot Blocking, Brute-Force Login Protection & File Scanning
Affected
up to 22.3.2
What to do
Affects up to 22.3.2. Update Shield Security – Smart Bot Blocking, Brute-Force Login Protection & File Scanning to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 31, 2026Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors: Stored Cross-Site ScriptingCVE-2026-111592 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name (maps to display_name)' parameter in all versions up to, and including, 4.17.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the attacker's user account to have a mapped author term, which occurs when an administrator has assigned them as a co-author on content or has enabled automatic author term creation for their role — this mapping is not present by default for new users on a stock install.
Product
Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors
Affected
up to 4.17.0
What to do
Affects up to 4.17.0. Update Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 31, 2026WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps: Sensitive Information ExposureCVE-2026-110023 · WordPress plugins & themes · reported by WordfenceMedium 5.9
The WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.5.88 via the 'rel_tab' parameter. This makes it possible for unauthenticated attackers to extract every row and column of the underlying database table backing any anonymously published app, including WordPress user password hashes, email addresses, and password-reset keys from wp_users. Exploitation requires that an administrator has published at least one app with its REST API authorization set to 'anonymous', which is the standard configuration for publicly embedded apps.
Product
WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps
Affected
up to 5.5.88
What to do
Affects up to 5.5.88. Update WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 31, 2026WPO365 | MICROSOFT 365 GRAPH MAILER: Stored Cross-Site ScriptingCVE-2026-107759 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The WPO365 | MICROSOFT 365 GRAPH MAILER plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Subject (via wp_mail/PHPMailer, e.g. CF7 your-subject)' parameter in all versions up to, and including, 6.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload is stored without authentication via any mail-sending feature that forwards a submitter-controlled subject (e.g. a Contact Form 7 form) when the Graph Mailer is enabled but OAuth authorization has not been completed, a default state immediately after plugin activation.
Product
WPO365 | MICROSOFT 365 GRAPH MAILER
Affected
up to 6.2
What to do
Affects up to 6.2. Update WPO365 | MICROSOFT 365 GRAPH MAILER to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 31, 2026Rox Appointment Booking – Appointment Booking Scheduling Solution: Privilege EscalationCVE-2026-104012 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Rox Appointment Booking – Appointment Booking Scheduling Solution plugin for WordPress is vulnerable to Privilege Escalation via Mass Assignment in all versions up to, and including, 1.3.1 This is due to the public `/rox-appointment-booking/v1/public/booking` REST endpoint performing mass-assignment of the raw request body into a new customer row while `CustomerModel::$fillable` includes the internal `wp_user_id` column, allowing an unauthenticated attacker to persist an arbitrary WordPress user ID alongside an attacker-controlled email address with no authorization check. When an administrator subsequently opens the poisoned customer record and clicks Update Customer, `SaveCustomer::handleRequest()` passes the stored `wp_user_id` and attacker-supplied email to `wp_update_user()` — succeeding because `LinkedAccount::canChange()` unconditionally returns true when the acting user holds the `edit_users` capability — thereby overwriting the targeted administrator's email address and enabling full account takeover via a standard WordPress password-reset request. Successful exploitation requires an administrator to open and save the poisoned record, and the attacker must know or gues
Product
Rox Appointment Booking – Appointment Booking Scheduling Solution
Affected
up to 1.3.1
What to do
Affects up to 1.3.1. Update Rox Appointment Booking – Appointment Booking Scheduling Solution to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record downloads.wordpress.org plugins.trac.wordpress.org
Oct 31, 2026Redux Framework: Authorization bypassCVE-2026-103997 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Redux Framework plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5.15. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to view the entire Redux options payload — including plaintext password field values, API keys, license keys, and SMTP credentials — exposed in the inline redux_<opt_name> JavaScript block on wp-admin/profile.php. The Users extension is loaded automatically for every Redux instance registered by any installed theme or plugin, meaning any site running Redux Framework is affected regardless of whether the developer explicitly configured the Users extension.
Product
Redux Framework
Affected
up to 4.5.15
What to do
Affects up to 4.5.15. Update Redux Framework to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Oct 31, 2026The User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission plugin for WordPress is vulnCVE-2026-103962 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'field_attr[required]' parameter in all versions up to, and including, 4.3.13 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. The nonce check on the wpuf_get_child_cat AJAX action is not an effective security barrier because the wpuf_nonce value is publicly localized to every anonymous visitor of any page containing a WPUF shortcode, making it freely harvestable by an unauthenticated attacker.
Affected
up to 4.3.13
What to do
Affects up to 4.3.13. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 31, 2026Wp Social Login and Register Social Counter: Authentication BypassCVE-2026-103898 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Wp Social Login and Register Social Counter plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 3.2.2. This is due to the social login REST callback registered at `/wp-json/wslu-social-login/type/{provider}/` with `permission_callback => __return_true` locating an existing WordPress account solely by the email string returned from the OAuth provider and calling `wp_set_auth_cookie()` without a password check, while the only verification guard — `!empty($getProfile->emailVerified)` in `inc/admin-create-user.php` — is a no-op for the bundled Hybridauth Facebook and Twitter adapters, both of which assign the raw email string rather than a boolean verified flag to `emailVerified`. This makes it possible for unauthenticated attackers to obtain a fully authenticated session as any existing WordPress user, including Administrators, whose registered email address can be presented through a configured Facebook or Twitter login on the target site. Exploitation requires only that the attacker control an OAuth account whose provider-returned email matches the target account's registered WordPress email address; no local credentials, nonce, or p
Product
Wp Social Login and Register Social Counter
Affected
up to 3.2.2
What to do
Affects up to 3.2.2. Update Wp Social Login and Register Social Counter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.