Updated 10 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

35added in the last 30 days

570new WordPress flaws this week

391,310entries in the database

3,650 results · page 7 of 73

Sep 13, 2026rtMedia for WordPress, BuddyPress and bbPress: Does not check ownership before changing the privacy level of an activity and its attached mediaCVE-2026-88912 · WordPress plugins & themes · reported by WPScanMedium 4.2
The rtMedia for WordPress, BuddyPress and bbPress WordPress plugin before 4.7.12 does not check ownership before changing the privacy level of an activity and its attached media, relying only on a nonce shared with every logged-in user, allowing users with a subscriber-level account or above to make another user's private activity public or hide it.
Product
rtMedia for WordPress, BuddyPress and bbPress
Fixed in
4.7.12
What to do
Update rtMedia for WordPress, BuddyPress and bbPress to 4.7.12 or newer.
Full record and what to do →NVD record wpscan.com
Sep 13, 2026Simple Membership: Does not validate that the membership level supplied in a PayPal payment notification matches the level configured for the paid payment buttonCVE-2026-88764 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Simple Membership WordPress plugin before 4.7.8 does not validate that the membership level supplied in a PayPal payment notification matches the level configured for the paid payment button, allowing members to pay for a lower-priced membership while being granted a higher, more privileged membership level.
Product
Simple Membership
Fixed in
4.7.8
What to do
Update Simple Membership to 4.7.8 or newer.
Full record and what to do →NVD record wpscan.com
Sep 13, 2026User Registration & Membership: Does not verify that the visitor requesting its membership confirmation page owns the account named in the requestCVE-2026-86407 · WordPress plugins & themes · reported by WPScanLow 3.7
The User Registration & Membership WordPress plugin before 5.2.8 does not verify that the visitor requesting its membership confirmation page owns the account named in the request, nor that any registration or purchase has taken place, allowing unauthenticated users to retrieve another user's email address, profile fields, role and membership order details. Exploitation requires the site owner to have added a user smart tag to that page's configurable message, which the shipped default does not contain.
Product
User Registration & Membership
Fixed in
5.2.8
What to do
Update User Registration & Membership to 5.2.8 or newer.
Full record and what to do →NVD record wpscan.com
Sep 13, 2026User Registration & Membership: Does not check the capability of the user making a membership purchaseCVE-2026-86406 · WordPress plugins & themes · reported by WPScanHigh 7.5
The User Registration & Membership WordPress plugin before 5.2.8 does not check the capability of the user making a membership purchase, and does not validate the payment method or the plan submitted with it, allowing any authenticated user such as a subscriber to be granted the WordPress role attached to a paid plan without paying for it. Where the site owner has mapped a plan to a privileged role, this leads to privilege escalation up to administrator.
Product
User Registration & Membership
Fixed in
5.2.8
What to do
Update User Registration & Membership to 5.2.8 or newer.
Full record and what to do →NVD record wpscan.com
Sep 13, 2026User Registration & Membership: Does not validate the destination of a post-login redirect before redirectingCVE-2026-80072 · WordPress plugins & themes · reported by WPScanMedium 4.7
The User Registration & Membership WordPress plugin before 5.2.8 does not validate the destination of a post-login redirect before redirecting, allowing unauthenticated attackers to redirect visitors to an arbitrary external URL, which can be abused for phishing.
Product
User Registration & Membership
Fixed in
5.2.8
What to do
Update User Registration & Membership to 5.2.8 or newer.
Full record and what to do →NVD record wpscan.com
Sep 13, 2026User Registration & Membership: Does not properly restrict who may author a membership plan or validate the plan a user attaches to their own accountCVE-2026-80071 · WordPress plugins & themes · reported by WPScanHigh 7.2
The User Registration & Membership WordPress plugin before 5.2.8 does not properly restrict who may author a membership plan or validate the plan a user attaches to their own account, allowing authenticated users with Author-level access and above to assign themselves an arbitrary role and escalate their privileges to Administrator.
Product
User Registration & Membership
Fixed in
5.2.8
What to do
Update User Registration & Membership to 5.2.8 or newer.
Full record and what to do →NVD record wpscan.com
Sep 12, 2026Sprout Invoices: Does not perform a capability or ownership check before allowing a private note to be overwritten through one of its AJAX actionsCVE-2026-87797 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Sprout Invoices WordPress plugin before 20.8.16 does not perform a capability or ownership check before allowing a private note to be overwritten through one of its AJAX actions, allowing any authenticated user such as a subscriber to overwrite private notes on records belonging to other users.
Product
Sprout Invoices
Fixed in
20.8.16
What to do
Update Sprout Invoices to 20.8.16 or newer.
Full record and what to do →NVD record wpscan.com
Sep 12, 2026Add User Autocomplete: Does not perform any capability or nonce check before creating a pending site-membership invitation carrying a caller-supplied roleCVE-2026-87759 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Add User Autocomplete WordPress plugin before 1.2 does not perform any capability or nonce check before creating a pending site-membership invitation carrying a caller-supplied role, allowing any authenticated user, such as a subscriber, to grant themselves the administrator role on a multisite installation.
Product
Add User Autocomplete
Fixed in
1.2
What to do
Update Add User Autocomplete to 1.2 or newer.
Full record and what to do →NVD record wpscan.com
Sep 12, 2026WP Highlight Box: Does not escape some shortcode attributes before outputting them in a page where the shortcode is embeddedCVE-2026-86790 · WordPress plugins & themes · reported by WPScanMedium 6.8
The WP Highlight Box WordPress plugin through 1.0 does not escape some shortcode attributes before outputting them in a page where the shortcode is embedded, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
WP Highlight Box
Affected
up to 1.0
What to do
Affects up to 1.0. Update WP Highlight Box to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Sep 12, 2026BEAR: Does not perform ownership checks on several handlers that return product data by a user-supplied identifierCVE-2026-84025 · WordPress plugins & themes · reported by WPScanLow 2.2
The BEAR WordPress plugin before 1.2.2 does not perform ownership checks on several handlers that return product data by a user-supplied identifier, allowing users who are restricted to their own products to read other owners' product information, including protected downloadable file URLs and private product metadata.
Product
BEAR
Fixed in
1.2.2
What to do
Update BEAR to 1.2.2 or newer.
Full record and what to do →NVD record wpscan.com
Sep 12, 2026Custom Menu Wizard Widget: Does not sanitize and escape several shortcode attributes before rendering them into HTMLCVE-2026-83532 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Custom Menu Wizard Widget WordPress plugin through 3.3.1 does not sanitize and escape several shortcode attributes before rendering them into HTML, allowing users with contributor-level access and above to inject arbitrary web scripts that execute when the affected content is viewed.
Product
Custom Menu Wizard Widget
Affected
up to 3.3.1
What to do
Affects up to 3.3.1. Update Custom Menu Wizard Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Sep 12, 2026Masteriyo LMS: Does not verify ownership ofCVE-2026-82851 · WordPress plugins & themes · reported by WPScanLow 2.7
The Masteriyo LMS WordPress plugin before 3.4.1 does not verify ownership of, or restrict the type of, the records a user requests for download, allowing users with the instructor role to retrieve the full content and metadata of arbitrary posts, including other instructors' private and draft courses.
Product
Masteriyo LMS
Fixed in
3.4.1
What to do
Update Masteriyo LMS to 3.4.1 or newer.
Full record and what to do →NVD record wpscan.com
Sep 12, 2026Frontegg SAML SSO: Does not verify the signature or issuer of SAML authentication responses before establishing a sessionCVE-2026-75800 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Frontegg SAML SSO WordPress plugin through 1.0.1 does not verify the signature or issuer of SAML authentication responses before establishing a session, allowing unauthenticated attackers to log in as any user, including administrators, as well as to create arbitrary accounts.
Product
Frontegg SAML SSO
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update Frontegg SAML SSO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Sep 11, 2026The Simple CAPTCHA with Cloudflare Turnstile WordPress plugin from 1.2.2 before 1.42.3 runs the shortcode parser over the whole rendered Contact Form 7 form, inCVE-2026-85116 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Simple CAPTCHA with Cloudflare Turnstile WordPress plugin from 1.2.2 before 1.42.3 runs the shortcode parser over the whole rendered Contact Form 7 form, including the values a visitor submitted, allowing unauthenticated users to execute arbitrary shortcodes registered on the site.
Fixed in
1.42.3
What to do
Update the plugin to 1.42.3 or newer.
Full record and what to do →NVD record wpscan.com
Sep 11, 2026YITH WooCommerce Wishlist: Does not verify that a user is authorised to rename a given wishlistCVE-2026-82305 · WordPress plugins & themes · reported by WPScanMedium 5.3
The YITH WooCommerce Wishlist WordPress plugin before 4.18.1 does not verify that a user is authorised to rename a given wishlist, allowing unauthenticated users to rename any wishlist on the site.
Product
YITH WooCommerce Wishlist
Fixed in
4.18.1
What to do
Update YITH WooCommerce Wishlist to 4.18.1 or newer.
Full record and what to do →NVD record wpscan.com
Sep 11, 2026teddy-bear-customize-addon: Does not perform any authorization or ownership checks before returning WooCommerce order metadata and the URLs of customer-uploaded attachmentsCVE-2026-14562 · WordPress plugins & themes · reported by WPScanMedium 5.3
The teddy-bear-customize-addon WordPress plugin through 1.0.5 does not perform any authorization or ownership checks before returning WooCommerce order metadata and the URLs of customer-uploaded attachments, allowing unauthenticated attackers to disclose other customers' order and attachment data.
Product
teddy-bear-customize-addon
Affected
up to 1.0.5
What to do
Affects up to 1.0.5. Update teddy-bear-customize-addon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Sep 11, 2026WP-Members Membership: Reflected Cross-Site ScriptingCVE-2026-84960 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WP-Members Membership Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via URL Query String in all versions up to, and including, 3.5.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Successful exploitation requires the victim to first visit the attacker-crafted URL and then click the Terms of Service link rendered on the resulting registration page.
Product
WP-Members Membership
Affected
up to 3.5.6
What to do
Affects up to 3.5.6. Update WP-Members Membership to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 10, 2026Unauthenticated Broken Access Control in Shirt Product Designer for WooCommerce 1.0.4 versions.CVE-2026-81794 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in Shirt Product Designer for WooCommerce 1.0.4 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Sep 9, 2026PublishPress Capabilities – User Role Editor, Access Permissions, User Capabilities, Admin Menus: Privilege EscalationCVE-2026-75927 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The PublishPress Capabilities – User Role Editor, Access Permissions, User Capabilities, Admin Menus plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.50.0. This is due to the `addPluginCapabilities()` function unconditionally granting the Editor role all 15 `manage_capabilities_*` capabilities — including `manage_capabilities`, `manage_capabilities_roles`, `manage_capabilities_settings`, and `manage_capabilities_backup` — via a hard-coded `$eligible_roles = ['administrator', 'editor']` assignment that runs automatically on the first `admin_init` after plugin activation with no administrator opt-in, persisting the grants directly to the database. This makes it possible for authenticated attackers with Editor-level access to elevate their privileges to a site-wide capability manager, enabling them to create, rename, and delete non-system roles, modify capabilities of non-administrator roles, restore role backups, and write arbitrary plugin options whose names begin with `cme_`, `capsman`, `pp_capabilities`, or `presspermit` via `update_option()`. The escalation stops short of full Administrator access, as WordPress's `map_meta_cap` la
Product
PublishPress Capabilities – User Role Editor, Access Permissions, User Capabilities, Admin Menus
Affected
up to 2.50.0
What to do
Affects up to 2.50.0. Update PublishPress Capabilities – User Role Editor, Access Permissions, User Capabilities, Admin Menus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 9, 2026WPMR Google Feed Manager for WooCommerce – Sell on Google Merchant Center & Shopping: Time-based SQL InjectionCVE-2026-19778 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The WPMR Google Feed Manager for WooCommerce – Sell on Google Merchant Center & Shopping plugin for WordPress is vulnerable to time-based SQL Injection via the 'feed' parameter in all versions up to, and including, 2.23.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
WPMR Google Feed Manager for WooCommerce – Sell on Google Merchant Center & Shopping
Affected
up to 2.23.7
What to do
Affects up to 2.23.7. Update WPMR Google Feed Manager for WooCommerce – Sell on Google Merchant Center & Shopping to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 9, 2026Contact Form 7 Captcha: Runs the shortcode parser over the whole rendered Contact Form 7 formCVE-2026-85117 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Contact Form 7 Captcha WordPress plugin before 0.1.9 runs the shortcode parser over the whole rendered Contact Form 7 form, including the values a visitor submitted, allowing unauthenticated users to execute arbitrary shortcodes registered on the site.
Product
Contact Form 7 Captcha
Fixed in
0.1.9
What to do
Update Contact Form 7 Captcha to 0.1.9 or newer.
Full record and what to do →NVD record wpscan.com
Sep 9, 2026Hustle: Does not prevent shortcodes in submitted form values from being executedCVE-2026-80440 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Hustle WordPress plugin before 7.8.14.2 does not prevent shortcodes in submitted form values from being executed when it substitutes those values into the message it returns after submission, because the guard it applies can be defeated by nesting, allowing unauthenticated users to run any shortcode registered on the site.
Product
Hustle
Fixed in
7.8.14.2
What to do
Update Hustle to 7.8.14.2 or newer.
Full record and what to do →NVD record wpscan.com
Sep 9, 2026Sunshine Photo Cart: Does not validate that a client-supplied price identifier belongs to the item being purchasedCVE-2026-85037 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Sunshine Photo Cart WordPress plugin before 3.7 does not validate that a client-supplied price identifier belongs to the item being purchased when it is added to the cart, allowing unauthenticated users to buy items at a lower price defined elsewhere on the site and complete an order at that price, resulting in financial loss for the site owner.
Product
Sunshine Photo Cart
Fixed in
3.7
What to do
Update Sunshine Photo Cart to 3.7 or newer.
Full record and what to do →NVD record wpscan.com
Sep 9, 2026Podlove Podcast Publisher: Stored Cross-Site ScriptingCVE-2026-75966 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Podlove Podcast Publisher plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'episode_contributor[..][..][comment]' Parameter in all versions up to, and including, 4.5.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The contributor comment is stored in a plugin-managed custom table, bypassing WordPress core's wp_kses_post filter, and the save_post hook fires without a nonce check, meaning any user who can edit posts can exploit this without further preconditions.
Product
Podlove Podcast Publisher
Affected
up to 4.5.5
What to do
Affects up to 4.5.5. Update Podlove Podcast Publisher to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 8, 2026The Beaver Builder Page Builder – Drag and Drop Website Builder: Arbitrary shortcode executionCVE-2026-18021 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The The Beaver Builder Page Builder – Drag and Drop Website Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.10.3.1. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
Product
The Beaver Builder Page Builder – Drag and Drop Website Builder
Affected
up to 2.10.3.1
What to do
Affects up to 2.10.3.1. Update The Beaver Builder Page Builder – Drag and Drop Website Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 7, 2026The Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for: Arbitrary shortcode executionCVE-2026-12757 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The The Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.9.27. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
Product
The Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for
Affected
up to 5.9.27
What to do
Affects up to 5.9.27. Update The Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 6, 2026The Redirection for Contact Form 7 WordPress plugin from 2.2.7 before 3.2.11 does not prevent shortcodes in submitted form values from being executed when it suCVE-2026-80439 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Redirection for Contact Form 7 WordPress plugin from 2.2.7 before 3.2.11 does not prevent shortcodes in submitted form values from being executed when it substitutes those values into an action's settings and then processes those settings for shortcodes, allowing unauthenticated users to run any shortcode registered on the site and read its output.
Fixed in
3.2.11
What to do
Update the plugin to 3.2.11 or newer.
Full record and what to do →NVD record wpscan.com
Sep 6, 2026The Ninja Forms WordPress plugin from 3.14.10 before 3.15.2 does not prevent shortcodes in request-derived values from being executed when it substitutes them iCVE-2026-80437 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Ninja Forms WordPress plugin from 3.14.10 before 3.15.2 does not prevent shortcodes in request-derived values from being executed when it substitutes them into content it later processes for shortcodes, allowing unauthenticated users to run any shortcode registered on the site.
Fixed in
3.15.2
What to do
Update the plugin to 3.15.2 or newer.
Full record and what to do →NVD record wpscan.com
Sep 6, 2026Bold Page Builder: Does not sanitise and escape a shortcode attribute before outputting it in an HTML attributeCVE-2026-84028 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Bold Page Builder WordPress plugin before 5.9.9 does not sanitise and escape a shortcode attribute before outputting it in an HTML attribute, allowing users with the Contributor role and above to inject arbitrary web scripts that execute when a user views the affected page.
Product
Bold Page Builder
Fixed in
5.9.9
What to do
Update Bold Page Builder to 5.9.9 or newer.
Full record and what to do →NVD record wpscan.com
Sep 5, 2026MemberDash: Insecure Direct Object ReferenceCVE-2026-16310 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The MemberDash plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.8.5 via the 'id' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to change the password of any WordPress user, including administrators, by supplying an arbitrary user ID during registration, and take over their account without any notification sent to the victim.
Product
MemberDash
Affected
up to 1.8.5
What to do
Affects up to 1.8.5. Update MemberDash to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record memberdashwp.com wordfence.com
Sep 5, 2026LearnDash LMS: Authorization bypassCVE-2026-12843 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The LearnDash LMS plugin for WordPress is vulnerable to authorization bypass in versions 4.25.0 - 5.1.6. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to enroll arbitrary users in paid courses without payment verification, bypassing the entire payment system and gaining unauthorized access to premium educational content.
Product
LearnDash LMS
Affected
4.25.0 to 5.1.6
What to do
Affects 4.25.0 to 5.1.6. Update LearnDash LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record docs.nexcess.com wordfence.com
Sep 5, 2026HT Menu: Does not perform any capability or object-ownership checkCVE-2026-84935 · WordPress plugins & themes · reported by WPScanHigh 8
The HT Menu WordPress plugin before 1.2.7 does not perform any capability or object-ownership check when saving navigation menu-item settings, and does not escape those stored settings when the menu is rendered, allowing users with minimal permissions such as Subscribers to store JavaScript that executes in the browser of any visitor, administrators included, who views the affected menu.
Product
HT Menu
Fixed in
1.2.7
What to do
Update HT Menu to 1.2.7 or newer.
Full record and what to do →NVD record wpscan.com
Sep 5, 2026Joli Table Of Contents: Does not sanitise or escape a shortcode attribute value before outputting it inside an HTML element's attributeCVE-2026-84931 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Joli Table Of Contents WordPress plugin before 3.0.3 does not sanitise or escape a shortcode attribute value before outputting it inside an HTML element's attribute, allowing users with the Author role and above to inject arbitrary HTML attributes and JavaScript that execute in the browser of any user who views the post, including higher-privileged users such as administrators. This crosses a privilege boundary even on multisite, where such users are not permitted to post unfiltered HTML.
Product
Joli Table Of Contents
Fixed in
3.0.3
What to do
Update Joli Table Of Contents to 3.0.3 or newer.
Full record and what to do →NVD record wpscan.com
Sep 5, 2026Bold Page Builder: Does not sanitise and escape several shortcode attributes before outputting them in HTML attributesCVE-2026-84022 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Bold Page Builder WordPress plugin before 5.9.8 does not sanitise and escape several shortcode attributes before outputting them in HTML attributes, allowing users with the Contributor role and above to inject arbitrary web scripts that execute when a user views the affected page.
Product
Bold Page Builder
Fixed in
5.9.8
What to do
Update Bold Page Builder to 5.9.8 or newer.
Full record and what to do →NVD record wpscan.com
Sep 5, 2026Greenshift: Does not properly escape a block animation attribute before outputting it within an HTML attributeCVE-2026-83544 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Greenshift WordPress plugin before 13.2.0 does not properly escape a block animation attribute before outputting it within an HTML attribute, allowing users with contributor-level access and above to inject arbitrary web scripts that execute when the content is viewed.
Product
Greenshift
Fixed in
13.2.0
What to do
Update Greenshift to 13.2.0 or newer.
Full record and what to do →NVD record wpscan.com
Sep 5, 2026Greenshift: Does not validate a user-supplied URL before fetching it server-sideCVE-2026-83543 · WordPress plugins & themes · reported by WPScanMedium 4.1
The Greenshift WordPress plugin before 13.2.0 does not validate a user-supplied URL before fetching it server-side, allowing users with contributor-level access and above to make the server issue requests to arbitrary hosts and read the response.
Product
Greenshift
Fixed in
13.2.0
What to do
Update Greenshift to 13.2.0 or newer.
Full record and what to do →NVD record wpscan.com
Sep 4, 2026LearnDash LMS: Unrestricted File Type UploadCVE-2026-12483 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The LearnDash LMS plugin for WordPress is vulnerable to Unrestricted File Type Upload in versions up to and including 5.1.5. This is due to insufficient input validation in the 'learndash_fileupload_process' function, which iterates through an entire array and validates only the first file. This makes it possible for authenticated attackers, with subscriber-level access and above who are enrolled in a course with assignment uploads enabled, to upload arbitrary disallowed files, including PHP files, to the server's wp-content/uploads/learndash/assignments/ directory. The uploaded files can only be used for Remote Code Execution if default server configurations have been changed to allow for execution.
Product
LearnDash LMS
Affected
up to 5.1.5
What to do
Affects up to 5.1.5. Update LearnDash LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record liquidweb.com wordfence.com
Sep 4, 2026WCFM Membership: Missing AuthorizationCVE-2026-32480 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WC Lovers WCFM Membership allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WCFM Membership: from n/a through 2.11.11.
Product
WCFM Membership
Affected
up to 2.11.11
What to do
Affects up to 2.11.11. Update WCFM Membership to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 3, 2026Subscriber Insecure Direct Object References (IDOR) in WC Ukraine Shipping <= 1.22.3 versions.CVE-2026-84836 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Subscriber Insecure Direct Object References (IDOR) in WC Ukraine Shipping <= 1.22.3 versions.
Affected
up to 1.22.3
What to do
Affects up to 1.22.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 3, 2026Subscriber Privilege Escalation in WCFM Membership <= 2.11.11 versions.CVE-2026-84756 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Subscriber Privilege Escalation in WCFM Membership <= 2.11.11 versions.
Affected
up to 2.11.11
What to do
Affects up to 2.11.11. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 2, 2026Simple Membership MailChimp Integration: Does not have CSRF checks in its settings pageCVE-2026-8151 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Simple Membership MailChimp Integration WordPress plugin before 1.9.8 does not have CSRF checks in its settings page, allowing attackers to trick a logged-in administrator into changing the configured third-party API key. Once replaced, all subsequent member registration data (name, email, membership level) is sent to the attacker-controlled account.
Product
Simple Membership MailChimp Integration
Fixed in
1.9.8
What to do
Update Simple Membership MailChimp Integration to 1.9.8 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Sep 2, 2026Brave: Does not prevent a URL parameter used to pre-fill a form field from being passed to WordPress's shortcode engineCVE-2026-81571 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Brave WordPress plugin before 0.8.8 does not prevent a URL parameter used to pre-fill a form field from being passed to WordPress's shortcode engine, allowing unauthenticated attackers to have arbitrary shortcodes registered on the site executed server-side.
Product
Brave
Fixed in
0.8.8
What to do
Update Brave to 0.8.8 or newer.
Full record and what to do →NVD record wpscan.com
Sep 2, 2026Timetics: Does not enforce per-object ownershipCVE-2026-14326 · WordPress plugins & themes · reported by WPScanLow 3.8
The Timetics WordPress plugin through 1.0.61 does not enforce per-object ownership when updating appointments through its REST API, allowing users with its custom staff role to modify, disable, or take over appointments belonging to other staff members.
Product
Timetics
Affected
up to 1.0.61
What to do
Affects up to 1.0.61. Update Timetics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Sep 2, 2026LiveJournal Shortcode: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2024-3773 · WordPress plugins & themes · reported by WPScanMedium 5.9
The LiveJournal Shortcode WordPress plugin through 1.1.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Product
LiveJournal Shortcode
Affected
up to 1.1.1
What to do
Affects up to 1.1.1. Update LiveJournal Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Sep 2, 2026Weaver Show Posts: Unserialises the content of an imported fileCVE-2023-3360 · WordPress plugins & themes · reported by WPScanLow 3.3
The Weaver Show Posts WordPress plugin before 1.8.1 unserialises the content of an imported file, which could lead to PHP object injections issues when a high privilege user import a malicious file and a suitable gadget chain is present on the blog.
Product
Weaver Show Posts
Fixed in
1.8.1
What to do
Update Weaver Show Posts to 1.8.1 or newer.
Full record and what to do →NVD record wpscan.com
Sep 2, 2026Unauthenticated Insecure Direct Object References (IDOR) in PublishPress Permissions <= 4.8.3 versions.CVE-2026-84771 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Insecure Direct Object References (IDOR) in PublishPress Permissions <= 4.8.3 versions.
Affected
up to 4.8.3
What to do
Affects up to 4.8.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 2, 2026WC Vendors: Does not verify ownership or the object type of user-supplied IDsCVE-2026-81428 · WordPress plugins & themes · reported by WPScanMedium 6.5
The WC Vendors WordPress plugin before 2.7.2.1 does not verify ownership or the object type of user-supplied IDs when saving product variations, allowing authenticated users with the vendor role to modify product variations belonging to other vendors, and to change the status and title of arbitrary posts, via IDOR.
Product
WC Vendors
Fixed in
2.7.2.1
What to do
Update WC Vendors to 2.7.2.1 or newer.
Full record and what to do →NVD record wpscan.com
Sep 2, 2026WC Vendors: Does not verify that the vendor submitting a front-end order shipment status change owns the referenced orderCVE-2026-81427 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WC Vendors WordPress plugin before 2.7.2.1 does not verify that the vendor submitting a front-end order shipment status change owns the referenced order, allowing any authenticated vendor to mark another vendor's order as shipped, add an order note falsely attributed to the victim vendor, and trigger the customer shipment notification email.
Product
WC Vendors
Fixed in
2.7.2.1
What to do
Update WC Vendors to 2.7.2.1 or newer.
Full record and what to do →NVD record wpscan.com
Sep 2, 2026WC Vendors: Does not have CSRF protection on some of its front-end order shipment status actionsCVE-2026-81426 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WC Vendors WordPress plugin before 2.7.2.1 does not have CSRF protection on some of its front-end order shipment status actions, which could allow attackers to make a logged-in vendor change the shipment status of their own orders via a crafted request.
Product
WC Vendors
Fixed in
2.7.2.1
What to do
Update WC Vendors to 2.7.2.1 or newer.
Full record and what to do →NVD record wpscan.com
Sep 2, 2026MasterStudy LMS: Does not properly verify ownership of a curriculum object before acting on itCVE-2026-81198 · WordPress plugins & themes · reported by WPScanLow 3.8
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not properly verify ownership of a curriculum object before acting on it, allowing authenticated users with the instructor role to delete or modify curriculum sections and materials belonging to courses owned by other instructors.
Product
MasterStudy LMS
Fixed in
3.7.46
What to do
Update MasterStudy LMS to 3.7.46 or newer.
Full record and what to do →NVD record wpscan.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.