Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
10,852 results · page 7 of 218
Oct 12, 2026Events Manager: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')CVE-2026-42689 · WordPress plugins & themes · reported by PatchstackLow 3.7
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Pixelite Events Manager events-manager allows Leveraging Race Conditions.This issue affects Events Manager: from n/a through 7.4.7.
- Product
- Events Manager
- Affected
- up to 7.4.7
- What to do
- Affects up to 7.4.7. Update Events Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 12, 2026Premium Addons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-108482 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LeapWorx Premium Addons for Elementor premium-addons-for-elementor allows Stored XSS.This issue affects Premium Addons for Elementor: from n/a through 4.11.110.
- Product
- Premium Addons for Elementor
- Affected
- up to 4.11.110
- What to do
- Affects up to 4.11.110. Update Premium Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 12, 2026Quiz And Survey Master: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-107862 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows DOM-Based XSS.This issue affects Quiz And Survey Master: from n/a through 11.2.7.
- Product
- Quiz And Survey Master
- Affected
- up to 11.2.7
- What to do
- Affects up to 11.2.7. Update Quiz And Survey Master to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 12, 2026Element Pack Elementor Addons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-108478 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BdThemes Element Pack Elementor Addons bdthemes-element-pack-lite allows Stored XSS.This issue affects Element Pack Elementor Addons: from n/a through 8.8.8.
- Product
- Element Pack Elementor Addons
- Affected
- up to 8.8.8
- What to do
- Affects up to 8.8.8. Update Element Pack Elementor Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 12, 2026Custom Query Blocks: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-108168 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DLX Plugins Custom Query Blocks post-type-archive-mapping allows Stored XSS.This issue affects Custom Query Blocks: from n/a through 5.6.0.
- Product
- Custom Query Blocks
- Affected
- up to 5.6.0
- What to do
- Affects up to 5.6.0. Update Custom Query Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 12, 2026JetElements For Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-107866 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetElements For Elementor jet-elements allows Stored XSS.This issue affects JetElements For Elementor: from n/a through 2.9.2.3.
- Product
- JetElements For Elementor
- Affected
- up to 2.9.2.3
- What to do
- Affects up to 2.9.2.3. Update JetElements For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 12, 2026JetMenu: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-107865 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetMenu jet-menu allows Stored XSS.This issue affects JetMenu: from n/a through 3.0.5.
- Product
- JetMenu
- Affected
- up to 3.0.5
- What to do
- Affects up to 3.0.5. Update JetMenu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 12, 2026Ad Inserter: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-107864 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Igor Funa Ad Inserter ad-inserter allows Stored XSS.This issue affects Ad Inserter: from n/a through 2.8.18.
- Product
- Ad Inserter
- Affected
- up to 2.8.18
- What to do
- Affects up to 2.8.18. Update Ad Inserter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 12, 2026Paid Videochat Turnkey Site: Improper Validation of Specified Quantity in InputCVE-2026-107429 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Improper Validation of Specified Quantity in Input vulnerability in VideoWhisper.com Paid Videochat Turnkey Site ppv-live-webcams allows Input Data Manipulation.This issue affects Paid Videochat Turnkey Site: from n/a through 7.5.12.
- Product
- Paid Videochat Turnkey Site
- Affected
- up to 7.5.12
- What to do
- Affects up to 7.5.12. Update Paid Videochat Turnkey Site to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 12, 2026Flexible Quantity – Measurement Price Calculator for WooCommerce: Improper Validation of Specified Quantity in InputCVE-2026-106605 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Improper Validation of Specified Quantity in Input vulnerability in WP Desk Flexible Quantity – Measurement Price Calculator for WooCommerce flexible-quantity-measurement-price-calculator-for-woocommerce allows Input Data Manipulation.This issue affects Flexible Quantity – Measurement Price Calculator for WooCommerce: from n/a through 2.3.22.
- Product
- Flexible Quantity – Measurement Price Calculator for WooCommerce
- Affected
- up to 2.3.22
- What to do
- Affects up to 2.3.22. Update Flexible Quantity – Measurement Price Calculator for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 11, 2026Subscribe to Comments: Does not properly validate a parameter before reflecting it into a link targetCVE-2026-91829 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Subscribe to Comments WordPress plugin before 2.3.3 does not properly validate a parameter before reflecting it into a link target, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting via a crafted URL against anyone who clicks it, including administrators.
- Product
- Subscribe to Comments
- Fixed in
- 2.3.3
- What to do
- Update Subscribe to Comments to 2.3.3 or newer.
Oct 11, 2026paymendo: Does not properly sanitize and escape a parameter before using it in a SQL queryCVE-2026-89305 · WordPress plugins & themes · reported by WPScanMedium 6.5
The paymendo WordPress plugin through 1.1 does not properly sanitize and escape a parameter before using it in a SQL query, allowing any authenticated user to perform SQL injection attacks.
- Product
- paymendo
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update paymendo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 11, 2026paymendo: Does not properly sanitize and escape a parameter before using it in a SQL queryCVE-2026-89304 · WordPress plugins & themes · reported by WPScanMedium 6.5
The paymendo WordPress plugin through 1.1 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform blind SQL injection attacks.
- Product
- paymendo
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update paymendo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 11, 2026Post Voting System: Does not properly sanitize and escape a parameter before using it in a SQL queryCVE-2026-89302 · WordPress plugins & themes · reported by WPScanHigh 8.6
The Post Voting System WordPress plugin through 1.0 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks.
- Product
- Post Voting System
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Post Voting System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 11, 2026WP Verify API: Does not properly sanitize and escape a parameter before using it in a SQL queryCVE-2026-89299 · WordPress plugins & themes · reported by WPScanHigh 8.6
The WP Verify API WordPress plugin through 1.0.0 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks.
- Product
- WP Verify API
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update WP Verify API to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 11, 2026Loja Automática: Does not properly sanitize and escape a parameter before using it in a SQL queryCVE-2026-89297 · WordPress plugins & themes · reported by WPScanHigh 8.6
The Loja Automática WordPress plugin through 1.0.0 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks.
- Product
- Loja Automática
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Loja Automática to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 11, 2026WpCues Basic Quiz: Does not properly sanitise and escape values before using them in a SQL statementCVE-2026-89214 · WordPress plugins & themes · reported by WPScanHigh 8.6
The WpCues Basic Quiz WordPress plugin through 1.6.5 does not properly sanitise and escape values before using them in a SQL statement, which allows unauthenticated attackers to perform SQL injection attacks and read data from the database.
- Product
- WpCues Basic Quiz
- Affected
- up to 1.6.5
- What to do
- Affects up to 1.6.5. Update WpCues Basic Quiz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 11, 2026Llavero.io: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2026-89213 · WordPress plugins & themes · reported by WPScanHigh 8.6
The Llavero.io WordPress plugin through 0.1.4 does not properly sanitise and escape a parameter before using it in a SQL statement, which allows unauthenticated attackers to perform SQL injection attacks and read data from the database.
- Product
- Llavero.io
- Affected
- up to 0.1.4
- What to do
- Affects up to 0.1.4. Update Llavero.io to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 11, 2026Site Setup Wizard: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2026-89195 · WordPress plugins & themes · reported by WPScanHigh 8.6
The Site Setup Wizard WordPress plugin through 1.5.8 does not properly sanitise and escape a parameter before using it in a SQL statement, which allows unauthenticated attackers to perform SQL injection attacks and read data from the database.
- Product
- Site Setup Wizard
- Affected
- up to 1.5.8
- What to do
- Affects up to 1.5.8. Update Site Setup Wizard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 11, 2026Topcontent: Does not properly authorise one of its request handlers and disables HTML sanitisation before storing the submitted contentCVE-2026-88903 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Topcontent WordPress plugin through 1.2.1 does not properly authorise one of its request handlers and disables HTML sanitisation before storing the submitted content, allowing unauthenticated attackers to publish arbitrary posts containing malicious JavaScript on any site where its API key has never been configured.
- Product
- Topcontent
- Affected
- up to 1.2.1
- What to do
- Affects up to 1.2.1. Update Topcontent to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 11, 2026Adwised Web Push Notification: Does not have authorisation checks on several state-changing operationsCVE-2026-87762 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Adwised Web Push Notification WordPress plugin through 2.5.7 does not have authorisation checks on several state-changing operations, and the secret comparison it uses instead can be bypassed on installations where the secret key has never been set, allowing unauthenticated users to store arbitrary JavaScript that is executed in the browser of every site visitor.
- Product
- Adwised Web Push Notification
- Affected
- up to 2.5.7
- What to do
- Affects up to 2.5.7. Update Adwised Web Push Notification to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 11, 2026Fundiin cho WooCommerce: Does not have proper authorisation on several of its REST API routesCVE-2026-81649 · WordPress plugins & themes · reported by WPScanCritical 9.1
The Fundiin cho WooCommerce WordPress plugin through 3.4.0 does not have proper authorisation on several of its REST API routes, relying instead on a credential that is identical on every installation, allowing unauthenticated attackers to disclose the store's payment credentials and customer order data, overwrite the payment gateway configuration so that payments are credited elsewhere, and mark unpaid orders as paid. The same missing authorisation also allows arbitrary script to be stored in a field which is output unescaped on the classic checkout, leading to unauthenticated stored XSS on stores that do not use the block-based checkout.
- Product
- Fundiin cho WooCommerce
- Affected
- up to 3.4.0
- What to do
- Affects up to 3.4.0. Update Fundiin cho WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 11, 2026Post Snippets: Does not properly escape variable values substituted into snippets before outputting themCVE-2026-12980 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Post Snippets WordPress plugin through 4.2.4 does not properly escape variable values substituted into snippets before outputting them, allowing users with the Contributor role and above to inject arbitrary web scripts that execute when the content is viewed.
- Product
- Post Snippets
- Affected
- up to 4.2.4
- What to do
- Affects up to 4.2.4. Update Post Snippets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 11, 2026Mobile builder: Does not properly restrictCVE-2026-103694 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Mobile builder WordPress plugin through 1.4.2 does not properly restrict which user meta keys a logged-in user can update through one of its REST routes, allowing any user with a self-registered account, such as a customer, to grant themselves the administrator role.
- Product
- Mobile builder
- Affected
- up to 1.4.2
- What to do
- Affects up to 1.4.2. Update Mobile builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026Shop manager PHP Object Injection in WooCommerce Multilingual & Multicurrency <= 5.5.8 versions.CVE-2026-62130 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Shop manager PHP Object Injection in WooCommerce Multilingual & Multicurrency <= 5.5.8 versions.
- Affected
- up to 5.5.8
- What to do
- Affects up to 5.5.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026Unauthenticated Local File Inclusion in KuteShop <= 4.2.9 versions.CVE-2026-62115 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Local File Inclusion in KuteShop <= 4.2.9 versions.
- Affected
- up to 4.2.9
- What to do
- Affects up to 4.2.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026Unauthenticated Cross Site Scripting (XSS) in KuteShop <= 4.2.9 versions.CVE-2026-62100 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in KuteShop <= 4.2.9 versions.
- Affected
- up to 4.2.9
- What to do
- Affects up to 4.2.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026Unauthenticated PHP Object Injection in WineShop <= 3.20 versions.CVE-2026-62090 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in WineShop <= 3.20 versions.
- Affected
- up to 3.20
- What to do
- Affects up to 3.20. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026Kids Planet: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-57742 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeREX Group Kids Planet allows Reflected XSS. This issue affects Kids Planet: from n/a through 2.2.14.2.
- Product
- Kids Planet
- Affected
- up to 2.2.14.2
- What to do
- Affects up to 2.2.14.2. Update Kids Planet to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026Tutor LMS: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-42702 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum Tutor LMS tutor allows Reflected XSS.This issue affects Tutor LMS: from n/a through 4.1.0.
- Product
- Tutor LMS
- Affected
- up to 4.1.0
- What to do
- Affects up to 4.1.0. Update Tutor LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026Social Share Icons & Social Share Buttons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-42697 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Inisev Social Share Icons & Social Share Buttons ultimate-social-media-plus allows Reflected XSS.This issue affects Social Share Icons & Social Share Buttons: from n/a through 3.7.5.
- Product
- Social Share Icons & Social Share Buttons
- Affected
- up to 3.7.5
- What to do
- Affects up to 3.7.5. Update Social Share Icons & Social Share Buttons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026SiteVault – Backup, Restore, Migration & Cloning: Improper Control of Generation of Code ('Code Injection')CVE-2026-42696 · WordPress plugins & themes · reported by PatchstackCritical 10
Improper Control of Generation of Code ('Code Injection') vulnerability in Royal Plugins SiteVault – Backup, Restore, Migration & Cloning sitevault-backup-restore-migration allows Remote Code Inclusion.This issue affects SiteVault – Backup, Restore, Migration & Cloning: from n/a through 1.5.19.
- Product
- SiteVault – Backup, Restore, Migration & Cloning
- Affected
- up to 1.5.19
- What to do
- Affects up to 1.5.19. Update SiteVault – Backup, Restore, Migration & Cloning to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026Jannah: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-42693 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in TieLabs Jannah jannah allows Reflected XSS.This issue affects Jannah: from n/a before 7.6.8.
- Product
- Jannah
- Fixed in
- 7.6.8
- What to do
- Update Jannah to 7.6.8 or newer.
Oct 10, 2026Subscriber Broken Access Control in Jetpack VideoPress <= 3.6 versions.CVE-2026-40808 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Subscriber Broken Access Control in Jetpack VideoPress <= 3.6 versions.
- Affected
- up to 3.6
- What to do
- Affects up to 3.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026Subscriber Bypass Vulnerability in MicroPayments <= 3.2.9 versions.CVE-2026-107434 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Subscriber Bypass Vulnerability in MicroPayments <= 3.2.9 versions.
- Affected
- up to 3.2.9
- What to do
- Affects up to 3.2.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce: Missing AuthorizationCVE-2026-103685 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in VillaTheme ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce woo-alidropship allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce: from n/a through 2.2.4.
- Product
- ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce
- Affected
- up to 2.2.4
- What to do
- Affects up to 2.2.4. Update ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026Sell Downloads: Improper Verification of Source of a Communication ChannelCVE-2026-94590 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Verification of Source of a Communication Channel vulnerability in CodePeople2 Sell Downloads sell-downloads allows Exploitation of Trusted Credentials.This issue affects Sell Downloads: from n/a through 1.2.3.
- Product
- Sell Downloads
- Affected
- up to 1.2.3
- What to do
- Affects up to 1.2.3. Update Sell Downloads to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026Martfury - WooCommerce Marketplace: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-57806 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in drfuri Martfury - WooCommerce Marketplace WordPress Theme martfury allows Reflected XSS.This issue affects Martfury - WooCommerce Marketplace WordPress Theme: from n/a through 3.3.9.
- Product
- Martfury - WooCommerce Marketplace
- Affected
- up to 3.3.9
- What to do
- Affects up to 3.3.9. Update Martfury - WooCommerce Marketplace to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026rtMedia for WordPress, BuddyPress and bbPress: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2026-105892 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in rtCamp Inc. rtMedia for WordPress, BuddyPress and bbPress buddypress-media allows Path Traversal.This issue affects rtMedia for WordPress, BuddyPress and bbPress: from n/a through 4.7.13.
- Product
- rtMedia for WordPress, BuddyPress and bbPress
- Affected
- up to 4.7.13
- What to do
- Affects up to 4.7.13. Update rtMedia for WordPress, BuddyPress and bbPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026ThemeStek Extras for LabtechCO: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-94160 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themeStek ThemeStek Extras for LabtechCO Theme themestek-labtechco-extras allows Reflected XSS.This issue affects ThemeStek Extras for LabtechCO Theme: from n/a through 8.4.
- Product
- ThemeStek Extras for LabtechCO
- Affected
- up to 8.4
- What to do
- Affects up to 8.4. Update ThemeStek Extras for LabtechCO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026Tickera: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-105889 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tickera Tickera tickera-event-ticketing-system allows Blind SQL Injection.This issue affects Tickera: from n/a through 3.6.0.6.
- Product
- Tickera
- Affected
- up to 3.6.0.6
- What to do
- Affects up to 3.6.0.6. Update Tickera to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026Thank You Page Customizer for WooCommerce: Improper Control of Generation of Code ('Code Injection')CVE-2026-103071 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Generation of Code ('Code Injection') vulnerability in VillaTheme Thank You Page Customizer for WooCommerce woo-thank-you-page-customizer allows Code Injection.This issue affects Thank You Page Customizer for WooCommerce: from n/a through 1.2.3.
- Product
- Thank You Page Customizer for WooCommerce
- Affected
- up to 1.2.3
- What to do
- Affects up to 1.2.3. Update Thank You Page Customizer for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026WPAdverts: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-97264 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Greg Winiarski WPAdverts wpadverts allows Reflected XSS.This issue affects WPAdverts: from n/a through 2.3.4.
- Product
- WPAdverts
- Affected
- up to 2.3.4
- What to do
- Affects up to 2.3.4. Update WPAdverts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026WPAdverts: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-97263 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Greg Winiarski WPAdverts wpadverts allows Stored XSS.This issue affects WPAdverts: from n/a through 2.3.4.
- Product
- WPAdverts
- Affected
- up to 2.3.4
- What to do
- Affects up to 2.3.4. Update WPAdverts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026Forminator: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-102388 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPMU DEV Forminator forminator allows Stored XSS.This issue affects Forminator: from n/a through 1.57.3.
- Product
- Forminator
- Affected
- up to 1.57.3
- What to do
- Affects up to 1.57.3. Update Forminator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026Zeinet: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-93951 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bracketweb Zeinet zeinet allows Reflected XSS.This issue affects Zeinet: from n/a through 1.0.0.
- Product
- Zeinet
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Zeinet to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026Grocery Shopping Store: Authentication Bypass Using an Alternate Path or ChannelCVE-2026-93949 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Authentication Bypass Using an Alternate Path or Channel vulnerability in Omegathemes Grocery Shopping Store grocery-shopping-store allows Password Recovery Exploitation.This issue affects Grocery Shopping Store: from n/a through 1.3.3.
- Product
- Grocery Shopping Store
- Affected
- up to 1.3.3
- What to do
- Affects up to 1.3.3. Update Grocery Shopping Store to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026WP Meteor Website Speed Optimization Addon: Stored Cross-Site ScriptingCVE-2026-96572 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The WP Meteor Website Speed Optimization Addon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Author Name in all versions up to, and including, 3.4.18 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload is delivered via the comment author name field, which must clear WordPress's comment moderation workflow before being displayed, though this represents a display prerequisite rather than any sanitization control.
- Product
- WP Meteor Website Speed Optimization Addon
- Affected
- up to 3.4.18
- What to do
- Affects up to 3.4.18. Update WP Meteor Website Speed Optimization Addon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 10, 202610Web Booster – Website speed optimization, Cache & Page Speed optimizer: Stored Cross-Site ScriptingCVE-2026-107742 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'author' parameter in all versions up to, and including, 2.34.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable because a comment author Name value containing ' src=' and an event-handler payload contains no HTML tags or quote characters, allowing it to survive WordPress core's sanitize_text_field and land verbatim inside the alt attribute, where the plugin's own str_replace subsequently injects the single quote that breaks out of the attribute context.
- Product
- 10Web Booster – Website speed optimization, Cache & Page Speed optimizer
- Affected
- up to 2.34.8
- What to do
- Affects up to 2.34.8. Update 10Web Booster – Website speed optimization, Cache & Page Speed optimizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 10, 2026SpeedyCache – Cache, Optimization, Performance: Sensitive Information ExposureCVE-2026-104006 · WordPress plugins & themes · reported by WordfenceLow 3.7
The SpeedyCache – Cache, Optimization, Performance plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.2 via the 'comment_author_*, comment_author_email_*' parameter. This makes it possible for unauthenticated attackers to extract the full name and email address of returning commenters pre-filled into comment form input fields and persisted as the site-wide cached page by any unauthenticated attacker requesting the same public URL. The read-side handler in advanced-cache.php correctly skips cached delivery for requests carrying comment_author_* cookies, but this check is absent on the write path, meaning the cache poisoning is invisible to the victim commenter yet fully exploitable by any unauthenticated attacker with no cookies.
- Product
- SpeedyCache – Cache, Optimization, Performance
- Affected
- up to 1.4.2
- What to do
- Affects up to 1.4.2. Update SpeedyCache – Cache, Optimization, Performance to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.