Updated 35 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

37added in the last 30 days

544new WordPress flaws this week

391,181entries in the database

10,120 results · page 7 of 203

Oct 16, 2026miniOrange OTP Login, Verification and SMS Notifications: Authentication BypassCVE-2026-103895 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 5.5.8 via the `mo_by_pass_login()` function. This is due to `mo_delay_otp_process()` short-circuiting the authentication flow before password validation or the administrator intent gate (added in 5.5.6) can run, combined with the Delay OTP grace flag (`mov_last_verified_dttm`) being stored as a `user_meta` row keyed solely by target user ID with no binding to the originating session, cookie, IP address, or device. This makes it possible for unauthenticated attackers to authenticate as any WordPress user — including administrators — by submitting only a known username with the `mo_wp_login_intent=otp` parameter and any non-empty password, thereby inheriting a legitimate user's open Delay OTP grace window without ever supplying correct credentials. Exploitation requires the site to have OTP-only login (`wp_login_skip_password=1`, `wp_login_skip_password_fallback=0`) and Delay OTP Verification (`wp_login_delay_otp=1`) enabled, and the target account must currently be within its configured Delay OTP interval.
Product
miniOrange OTP Login, Verification and SMS Notifications
Affected
up to 5.5.8
What to do
Affects up to 5.5.8. Update miniOrange OTP Login, Verification and SMS Notifications to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 15, 2026WP EasyPay: Missing AuthorizationCVE-2026-96449 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WPExperts WP EasyPay wp-easy-pay allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP EasyPay: from n/a through 4.5.4.
Product
WP EasyPay
Affected
up to 4.5.4
What to do
Affects up to 4.5.4. Update WP EasyPay to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 15, 2026Ninja Forms Signature Contract Add-On: Missing AuthorizationCVE-2026-110378 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WP E-Signature Ninja Forms Signature Contract Add-On ninja-signature-contract-forms-add-on allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ninja Forms Signature Contract Add-On: from n/a through 3.2.5.
Product
Ninja Forms Signature Contract Add-On
Affected
up to 3.2.5
What to do
Affects up to 3.2.5. Update Ninja Forms Signature Contract Add-On to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 15, 2026Login with phone number: Missing AuthorizationCVE-2026-110374 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Hamid Alinia Login with phone number login-with-phone-number allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Login with phone number: from n/a through 1.8.77.
Product
Login with phone number
Affected
up to 1.8.77
What to do
Affects up to 1.8.77. Update Login with phone number to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 15, 2026Flexible Quantity – Measurement Price Calculator for WooCommerce: Missing AuthorizationCVE-2026-110364 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WP Desk Flexible Quantity – Measurement Price Calculator for WooCommerce flexible-quantity-measurement-price-calculator-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Flexible Quantity – Measurement Price Calculator for WooCommerce: from n/a through 2.3.23.
Product
Flexible Quantity – Measurement Price Calculator for WooCommerce
Affected
up to 2.3.23
What to do
Affects up to 2.3.23. Update Flexible Quantity – Measurement Price Calculator for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 15, 2026PlanetStudio Payment Gateway: Missing AuthorizationCVE-2026-110362 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Planet studio PlanetStudio Payment Gateway planetstudio-payment-gateway allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PlanetStudio Payment Gateway: from n/a through 1.3.3.
Product
PlanetStudio Payment Gateway
Affected
up to 1.3.3
What to do
Affects up to 1.3.3. Update PlanetStudio Payment Gateway to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 15, 2026Ajax Search Lite: Missing AuthorizationCVE-2026-110360 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WPdreams Ajax Search Lite ajax-search-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ajax Search Lite: from n/a through 4.14.5.
Product
Ajax Search Lite
Affected
up to 4.14.5
What to do
Affects up to 4.14.5. Update Ajax Search Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 15, 2026Strong Testimonials: Missing AuthorizationCVE-2026-109897 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in WP Chill Strong Testimonials strong-testimonials allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Strong Testimonials: from n/a through 3.3.12.
Product
Strong Testimonials
Affected
up to 3.3.12
What to do
Affects up to 3.3.12. Update Strong Testimonials to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 15, 2026Sunshine Photo Cart: Missing AuthorizationCVE-2026-109689 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WP Sunshine Sunshine Photo Cart sunshine-photo-cart allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sunshine Photo Cart: from n/a through 3.7.4.
Product
Sunshine Photo Cart
Affected
up to 3.7.4
What to do
Affects up to 3.7.4. Update Sunshine Photo Cart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 15, 2026Knowledge Base: Missing AuthorizationCVE-2026-108499 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WebberZone Knowledge Base knowledgebase allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Knowledge Base: from n/a through 3.2.0.
Product
Knowledge Base
Affected
up to 3.2.0
What to do
Affects up to 3.2.0. Update Knowledge Base to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 15, 2026ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes: Authorization Bypass Through User-Controlled KeyCVE-2026-103083 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Authorization Bypass Through User-Controlled Key vulnerability in ELEXtensions ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes elex-bulk-edit-products-prices-attributes-for-woocommerce-basic allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes: from n/a through 1.5.3.
Product
ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes
Affected
up to 1.5.3
What to do
Affects up to 1.5.3. Update ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 15, 2026WordLift: Missing AuthorizationCVE-2026-110891 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in WordLift Srl WordLift wordlift allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WordLift: from n/a through 3.54.15.
Product
WordLift
Affected
up to 3.54.15
What to do
Affects up to 3.54.15. Update WordLift to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 15, 2026AI Engine: Missing AuthorizationCVE-2026-110888 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Meow Apps AI Engine ai-engine allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AI Engine: from n/a through 3.8.3.
Product
AI Engine
Affected
up to 3.8.3
What to do
Affects up to 3.8.3. Update AI Engine to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 15, 2026Simply Schedule Appointments: Authorization Bypass Through User-Controlled KeyCVE-2026-110381 · WordPress plugins & themes · reported by PatchstackMedium 6.3
Authorization Bypass Through User-Controlled Key vulnerability in NSquared Simply Schedule Appointments simply-schedule-appointments allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simply Schedule Appointments: from n/a through 1.6.12.35.
Product
Simply Schedule Appointments
Affected
up to 1.6.12.35
What to do
Affects up to 1.6.12.35. Update Simply Schedule Appointments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 15, 2026Strong Testimonials: Missing AuthorizationCVE-2026-110371 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WP Chill Strong Testimonials strong-testimonials allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Strong Testimonials: from n/a through 3.3.12.
Product
Strong Testimonials
Affected
up to 3.3.12
What to do
Affects up to 3.3.12. Update Strong Testimonials to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 15, 2026APIExperts Square for WooCommerce: Missing AuthorizationCVE-2026-110367 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WPExperts APIExperts Square for WooCommerce woosquare allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects APIExperts Square for WooCommerce: from n/a through 4.7.5.
Product
APIExperts Square for WooCommerce
Affected
up to 4.7.5
What to do
Affects up to 4.7.5. Update APIExperts Square for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 15, 2026User Registration: Missing AuthorizationCVE-2026-109692 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Missing Authorization vulnerability in ThemeGrill User Registration user-registration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Registration: from n/a through 5.2.8.
Product
User Registration
Affected
up to 5.2.8
What to do
Affects up to 5.2.8. Update User Registration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 15, 2026Webba Booking: Authorization Bypass Through User-Controlled KeyCVE-2026-107416 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Authorization Bypass Through User-Controlled Key vulnerability in Webba Plugins Webba Booking webba-booking-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Webba Booking: from n/a through 6.5.2.
Product
Webba Booking
Affected
up to 6.5.2
What to do
Affects up to 6.5.2. Update Webba Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 15, 2026Rede Itaú for WooCommerce: Does not verify the authenticity of a payment gateway webhook before updating an order's statusCVE-2026-92429 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Rede Itaú for WooCommerce WordPress plugin before 5.5.3 does not verify the authenticity of a payment gateway webhook before updating an order's status, allowing unauthenticated attackers to change the status of arbitrary WooCommerce orders, including marking unpaid orders as paid and cancelling completed orders.
Product
Rede Itaú for WooCommerce
Fixed in
5.5.3
What to do
Update Rede Itaú for WooCommerce to 5.5.3 or newer.
Full record and what to do →NVD record wpscan.com
Oct 15, 2026Rede Itaú for WooCommerce: Does not verify the authenticity of a payment gateway webhook before updating an order's statusCVE-2026-92428 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Rede Itaú for WooCommerce WordPress plugin before 5.5.3 does not verify the authenticity of a payment gateway webhook before updating an order's status, allowing unauthenticated attackers to change the status of arbitrary WooCommerce orders, including orders that were already paid or completed.
Product
Rede Itaú for WooCommerce
Fixed in
5.5.3
What to do
Update Rede Itaú for WooCommerce to 5.5.3 or newer.
Full record and what to do →NVD record wpscan.com
Oct 15, 2026Document Gallery: Does not properly sanitise and escape user input before reflecting it inside an HTML attribute in the response of an unauthenticated AJAX actionCVE-2026-74920 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Document Gallery WordPress plugin through 5.1.1 does not properly sanitise and escape user input before reflecting it inside an HTML attribute in the response of an unauthenticated AJAX action, leading to a Reflected Cross-Site Scripting vulnerability which can be exploited against any visitor, including a logged-in administrator.
Product
Document Gallery
Affected
up to 5.1.1
What to do
Affects up to 5.1.1. Update Document Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Oct 15, 2026Cardinity Payment Gateway for WooCommerce: Does not properly verify the authenticity of the payment notifications it receivesCVE-2026-103324 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Cardinity Payment Gateway for WooCommerce WordPress plugin before 3.4.2 does not properly verify the authenticity of the payment notifications it receives, as the secret used to sign them is empty by default, allowing unauthenticated attackers to forge an approved-payment notification and mark arbitrary orders as paid, or force them to failed.
Product
Cardinity Payment Gateway for WooCommerce
Fixed in
3.4.2
What to do
Update Cardinity Payment Gateway for WooCommerce to 3.4.2 or newer.
Full record and what to do →NVD record wpscan.com
Oct 15, 2026eaSYNC Booking: Does not perform authorization or nonce checks on several of its cancellation-related AJAX actionsCVE-2026-103304 · WordPress plugins & themes · reported by WPScanMedium 5.3
The eaSYNC Booking WordPress plugin before 1.3.31 does not perform authorization or nonce checks on several of its cancellation-related AJAX actions, allowing unauthenticated users to create booking cancellation requests, trigger booking notification emails, and overwrite the content of the emails the site sends.
Product
eaSYNC Booking
Fixed in
1.3.31
What to do
Update eaSYNC Booking to 1.3.31 or newer.
Full record and what to do →NVD record wpscan.com
Oct 15, 2026Premium Packages – Sell Digital Products Securely: Unauthenticated Stored Cross-Site ScriptingCVE-2026-18586 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting via 'order_email' in all versions up to, and including, 7.0.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Premium Packages – Sell Digital Products Securely
Affected
up to 7.0.5
What to do
Affects up to 7.0.5. Update Premium Packages – Sell Digital Products Securely to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 15, 2026Checkout Field Manager (Checkout Manager) for WooCommerce: Authorization bypassCVE-2026-17031 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Checkout Field Manager (Checkout Manager) for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.9.6 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary Media Library attachments.
Product
Checkout Field Manager (Checkout Manager) for WooCommerce
Affected
up to 7.9.6
What to do
Affects up to 7.9.6. Update Checkout Field Manager (Checkout Manager) for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 14, 2026bbPress before 2.6.19 contains an information disclosure vulnerability that allows unauthenticated visitors to view restricted subforum posts because hide_sitewCVE-2026-110762 · WordPress plugins & themes · reported by VulnCheckMedium 6.3
bbPress before 2.6.19 contains an information disclosure vulnerability that allows unauthenticated visitors to view restricted subforum posts because hide_sitewide ignores ancestor forum visibility. Topics and replies in public subforums nested under private or hidden parents expose title, permalink and body via the BuddyPress activity stream and REST endpoint.
Fixed in
2.6.19
What to do
Update the plugin to 2.6.19 or newer.
Full record and what to do →NVD record bbpress.org github.com
Oct 14, 2026Skydropx: Missing AuthorizationCVE-2026-108480 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Missing Authorization vulnerability in Skydropx Skydropx skydropx allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Skydropx: from n/a through 2.1.4.
Product
Skydropx
Affected
up to 2.1.4
What to do
Affects up to 2.1.4. Update Skydropx to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 14, 2026WP OAuth Server: Missing AuthorizationCVE-2026-107433 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in miniOrange WP OAuth Server miniorange-oauth-20-server allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP OAuth Server: from n/a through 6.4.0.
Product
WP OAuth Server
Affected
up to 6.4.0
What to do
Affects up to 6.4.0. Update WP OAuth Server to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 14, 2026Paid Videochat Turnkey Site: Missing AuthorizationCVE-2026-107426 · WordPress plugins & themes · reported by PatchstackHigh 7.3
Missing Authorization vulnerability in VideoWhisper.com Paid Videochat Turnkey Site ppv-live-webcams allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Paid Videochat Turnkey Site: from n/a through 7.5.12.
Product
Paid Videochat Turnkey Site
Affected
up to 7.5.12
What to do
Affects up to 7.5.12. Update Paid Videochat Turnkey Site to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 14, 2026Bus Ticket Booking with Seat Reservation: Missing AuthorizationCVE-2026-107425 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Magepeople inc. Bus Ticket Booking with Seat Reservation bus-ticket-booking-with-seat-reservation allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Bus Ticket Booking with Seat Reservation: from n/a through 5.9.7.
Product
Bus Ticket Booking with Seat Reservation
Affected
up to 5.9.7
What to do
Affects up to 5.9.7. Update Bus Ticket Booking with Seat Reservation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 14, 2026Push Notification for Post and BuddyPress: Missing AuthorizationCVE-2026-107417 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Muralidharan Ramasamy Push Notification for Post and BuddyPress push-notification-for-post-and-buddypress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Push Notification for Post and BuddyPress: from n/a through 3.23.
Product
Push Notification for Post and BuddyPress
Affected
up to 3.23
What to do
Affects up to 3.23. Update Push Notification for Post and BuddyPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 14, 2026JetFormBuilder: Missing AuthorizationCVE-2026-107431 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in Crocoblock JetFormBuilder jetformbuilder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JetFormBuilder: from n/a through 3.6.6.
Product
JetFormBuilder
Affected
up to 3.6.6
What to do
Affects up to 3.6.6. Update JetFormBuilder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 14, 2026Visma Pay for WooCommerce: Does not verify the authenticity of payment gateway return requestsCVE-2026-103308 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Visma Pay for WooCommerce WordPress plugin before 1.2.2 does not verify the authenticity of payment gateway return requests, relying on a merchant secret that is empty on a store which has not entered its credentials, allowing unauthenticated attackers to mark arbitrary orders as paid and to disclose the name, email address and postal address of any order's customer.
Product
Visma Pay for WooCommerce
Fixed in
1.2.2
What to do
Update Visma Pay for WooCommerce to 1.2.2 or newer.
Full record and what to do →NVD record wpscan.com
Oct 14, 2026Restricted Site Access: Missing AuthorizationCVE-2026-110227 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in 10up Restricted Site Access restricted-site-access allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Restricted Site Access: from n/a through 7.6.2.
Product
Restricted Site Access
Affected
up to 7.6.2
What to do
Affects up to 7.6.2. Update Restricted Site Access to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 14, 2026JNews - Jeg Elementor Kit: Unauthorized access of dataCVE-2026-103907 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The JNews - Jeg Elementor Kit plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on both the 'jkit_post_block' and 'jeg_find_author' AJAX actions in versions up to, and including, 3.2.19. The 'wp_ajax_jkit_post_block' handler (registered generically for every element via wp_ajax_{$element_id} in Elements_Option_Abstract::setup_hook) returns the element's full option schema — including a freshly minted wp_create_nonce('jeg_find_author') — to any authenticated caller, and the 'wp_ajax_jeg_find_author' handler then runs a WP_User_Query with the attacker-supplied 'query' wrapped in '*…*' against search_columns that include user_email, echoing the ID and display_name of every matching user. This makes it possible for authenticated attackers, with Subscriber-level access and above, to enumerate every registered user of the site and to reconstruct arbitrary users' email addresses one character at a time by using the substring search as an oracle.
Product
JNews - Jeg Elementor Kit
Affected
up to 3.2.19
What to do
Affects up to 3.2.19. Update JNews - Jeg Elementor Kit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 14, 2026Appointment Booking Plugin – LatePoint | Calendar & Scheduling for: Authentication BypassCVE-2026-100163 · WordPress plugins & themes · reported by WordfenceHigh 7.4
The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 5.7.2 via the OsCustomerHelper::create_wp_user_for_customer() helper reached from the public process_step_customer() booking step. When the 'Use WordPress users as customers' option is enabled, the helper falls back from email_exists() to username_exists( $customer->email ), which matches any WordPress user whose user_login equals the victim customer's email even when that user's user_email is completely different, and links that WordPress user's ID into the victim's LatePoint customer row (only privileged roles are excluded; Subscriber is allowed). This makes it possible for authenticated attackers, with Subscriber-level access and above, to take over another customer's LatePoint account — accessing their bookings, service, agent, and calendar data, and having the victim customer's email overwritten with the attacker's on next login — by holding a Subscriber account whose user_login equals the victim's email and submitting an unauthenticated public booking step registration request.
Product
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for
Affected
up to 5.7.2
What to do
Affects up to 5.7.2. Update Appointment Booking Plugin – LatePoint | Calendar & Scheduling for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 14, 2026AWP Classifieds: Does not verify that a request is authorised to view a listingCVE-2026-96904 · WordPress plugins & themes · reported by WPScanMedium 5.3
The AWP Classifieds WordPress plugin before 4.4.9 does not verify that a request is authorised to view a listing when a payment transaction is referenced, allowing unauthenticated attackers to bypass the ownership check on the ad submission page and read the private contact email stored on any listing.
Product
AWP Classifieds
Fixed in
4.4.9
What to do
Update AWP Classifieds to 4.4.9 or newer.
Full record and what to do →NVD record wpscan.com
Oct 14, 2026Paymentfor Gateway for WooCommerce: Does not verify the authenticity of an inbound payment notification before marking an orderCVE-2026-94360 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Paymentfor Gateway for WooCommerce WordPress plugin before 1.0.6 does not verify the authenticity of an inbound payment notification before marking an order as paid, allowing unauthenticated attackers to mark orders as paid without any payment being completed.
Product
Paymentfor Gateway for WooCommerce
Fixed in
1.0.6
What to do
Update Paymentfor Gateway for WooCommerce to 1.0.6 or newer.
Full record and what to do →NVD record wpscan.com
Oct 14, 2026Robokassa payment gateway for Woocommerce: Does not verify the authenticity of an incoming payment-notification request before acting on the order named in itCVE-2026-91076 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Robokassa payment gateway for Woocommerce WordPress plugin before 1.9.0 does not verify the authenticity of an incoming payment-notification request before acting on the order named in it, allowing unauthenticated attackers to force any WooCommerce order into a failed state. Order identifiers are sequential, so every order in the shop can be taken out of the fulfilment queue one request at a time.
Product
Robokassa payment gateway for Woocommerce
Fixed in
1.9.0
What to do
Update Robokassa payment gateway for Woocommerce to 1.9.0 or newer.
Full record and what to do →NVD record wpscan.com
Oct 14, 2026Fast Courier: Does not sanitize and escape a value before using it in a SQL query on an unauthenticated REST routeCVE-2026-89288 · WordPress plugins & themes · reported by WPScanHigh 8.6
The Fast Courier WordPress plugin before 5.2.4 does not sanitize and escape a value before using it in a SQL query on an unauthenticated REST route, allowing unauthenticated attackers to perform SQL injection and read arbitrary data from the database.
Product
Fast Courier
Fixed in
5.2.4
What to do
Update Fast Courier to 5.2.4 or newer.
Full record and what to do →NVD record wpscan.com
Oct 14, 2026Asaas Gateway for WooCommerce: Does not properly authenticate its payment webhookCVE-2026-87974 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Asaas Gateway for WooCommerce WordPress plugin before 2.7.8 does not properly authenticate its payment webhook, accepting an empty access token in its default configuration and not verifying that the confirmed payment corresponds to the order it marks paid, allowing unauthenticated attackers to mark arbitrary orders as paid.
Product
Asaas Gateway for WooCommerce
Fixed in
2.7.8
What to do
Update Asaas Gateway for WooCommerce to 2.7.8 or newer.
Full record and what to do →NVD record wpscan.com
Oct 14, 2026Trust Payments Gateway for WooCommerce: Does not verify the authenticity of the payment provider's responseCVE-2026-87843 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Trust Payments Gateway for WooCommerce WordPress plugin before 3.1.0 does not verify the authenticity of the payment provider's response when a customer returns from the hosted payment page, nor bind that response to the targeted order or check the amount, allowing unauthenticated attackers to mark arbitrary orders as paid without any payment being made, and to retrieve order and customer details.
Product
Trust Payments Gateway for WooCommerce
Fixed in
3.1.0
What to do
Update Trust Payments Gateway for WooCommerce to 3.1.0 or newer.
Full record and what to do →NVD record wpscan.com
Oct 14, 2026EmbedPress: Does not perform any capability or nonce check on an unauthenticated request that triggers a server-sideCVE-2026-85000 · WordPress plugins & themes · reported by WPScanMedium 5.3
The EmbedPress WordPress plugin before 4.6.8 does not perform any capability or nonce check on an unauthenticated request that triggers a server-side, credential-bearing request to a third-party API and stores attacker-controlled cache entries, allowing unauthenticated attackers to consume the site owner's third-party API quota and write unbounded records into the site's database.
Product
EmbedPress
Fixed in
4.6.8
What to do
Update EmbedPress to 4.6.8 or newer.
Full record and what to do →NVD record wpscan.com
Oct 14, 2026WP 2FA: Does not perform an object-level capability check before removing a user's two-factor authentication configurationCVE-2026-108066 · WordPress plugins & themes · reported by WPScanLow 2.7
The WP 2FA WordPress plugin before 4.2.0 does not perform an object-level capability check before removing a user's two-factor authentication configuration, allowing a site administrator on WordPress Multisite to remove the 2FA configuration of users outside their own site, including accounts they are not permitted to edit. On single-site installs an administrator can already manage all users, so this crosses a trust boundary only on Multisite.
Product
WP 2FA
Fixed in
4.2.0
What to do
Update WP 2FA to 4.2.0 or newer.
Full record and what to do →NVD record wpscan.com
Oct 14, 2026GamiPress: Does not properly authorize access to private activity log entriesCVE-2026-107320 · WordPress plugins & themes · reported by WPScanMedium 5.3
The GamiPress WordPress plugin before 8.0.6 does not properly authorize access to private activity log entries, allowing unauthenticated users to retrieve the private activity logs of all users. This is an incomplete fix of CVE-2026-13450.
Product
GamiPress
Fixed in
8.0.6
What to do
Update GamiPress to 8.0.6 or newer.
Full record and what to do →NVD record wpscan.com
Oct 14, 2026GamiPress: Does not perform a capability check or ownership verification on one of its authenticated AJAX actionsCVE-2026-107319 · WordPress plugins & themes · reported by WPScanMedium 4.3
The GamiPress WordPress plugin before 8.0.6 does not perform a capability check or ownership verification on one of its authenticated AJAX actions, allowing any authenticated user, such as a Subscriber, to read arbitrary entries from its activity log, including other users' points balances and earned achievements and the usernames of the administrators who performed manual point award and revoke actions.
Product
GamiPress
Fixed in
8.0.6
What to do
Update GamiPress to 8.0.6 or newer.
Full record and what to do →NVD record wpscan.com
Oct 14, 2026LTL Freight Quotes: Does not perform any authorization check or input sanitization before storing certain values from a requestCVE-2026-107160 · WordPress plugins & themes · reported by WPScanMedium 5.3
The LTL Freight Quotes WordPress plugin before 4.2.19 does not perform any authorization check or input sanitization before storing certain values from a request, allowing unauthenticated users to inject HTML and links that are rendered to visitors on the storefront.
Product
LTL Freight Quotes
Fixed in
4.2.19
What to do
Update LTL Freight Quotes to 4.2.19 or newer.
Full record and what to do →NVD record wpscan.com
Oct 14, 2026LTL Freight Quotes: Does not perform any authorization check or validation on one of its REST routes that writes to the databaseCVE-2026-107158 · WordPress plugins & themes · reported by WPScanMedium 5.3
The LTL Freight Quotes WordPress plugin before 4.2.19 does not perform any authorization check or validation on one of its REST routes that writes to the database, allowing unauthenticated users to modify some of the LTL Freight Quotes WordPress plugin before 4.2.19's stored settings.
Product
LTL Freight Quotes
Fixed in
4.2.19
What to do
Update LTL Freight Quotes to 4.2.19 or newer.
Full record and what to do →NVD record wpscan.com
Oct 14, 2026NEX-Forms: Does not perform any authorizationCVE-2026-106166 · WordPress plugins & themes · reported by WPScanMedium 5.3
The NEX-Forms WordPress plugin before 9.3.1 does not perform any authorization, ownership or request-validation checks before updating stored form entries, allowing unauthenticated attackers to overwrite, permanently erase, reassign or append to any previously submitted form entry by referencing its sequential identifier.
Product
NEX-Forms
Fixed in
9.3.1
What to do
Update NEX-Forms to 9.3.1 or newer.
Full record and what to do →NVD record wpscan.com
Oct 14, 2026WP Data Access: Does not restrict its database table export action to authorized usersCVE-2026-106099 · WordPress plugins & themes · reported by WPScanMedium 5.3
The WP Data Access WordPress plugin before 5.5.84 does not restrict its database table export action to authorized users, gating it only with a token that the WP Data Access WordPress plugin before 5.5.84 itself prints into the public pages on which it displays a table, allowing unauthenticated attackers to export the complete contents of any publicly displayed table, including columns and rows withheld from the display shown to visitors.
Product
WP Data Access
Fixed in
5.5.84
What to do
Update WP Data Access to 5.5.84 or newer.
Full record and what to do →NVD record wpscan.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.