Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
6,237 results · page 7 of 125
Oct 8, 2026VillaTheme Core: Missing AuthorizationCVE-2026-103072 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in VillaTheme VillaTheme Core villatheme-core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VillaTheme Core: from n/a through 1.0.5.
- Product
- VillaTheme Core
- Affected
- up to 1.0.5
- What to do
- Affects up to 1.0.5. Update VillaTheme Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 8, 2026Appointment Booking: Does not verify that a backend staff user is authorized to act on the specific record targeted for deletionCVE-2026-105197 · WordPress plugins & themes · reported by WPScanLow 2.7
The Appointment Booking Plugin WordPress plugin before 5.6.5 does not verify that a backend staff user is authorized to act on the specific record targeted for deletion, allowing an authenticated user with a record-scoped staff role to irreversibly delete any order, customer, or transaction on the site, including records belonging to other staff and outside their assigned scope.
- Product
- Appointment Booking
- Fixed in
- 5.6.5
- What to do
- Update Appointment Booking to 5.6.5 or newer.
Oct 8, 2026Appointment Booking: Does not enforce per-record authorization on several of its AI Abilities API actionsCVE-2026-105196 · WordPress plugins & themes · reported by WPScanLow 3.3
The Appointment Booking Plugin WordPress plugin before 5.6.9 does not enforce per-record authorization on several of its AI Abilities API actions, allowing an authenticated user holding the LatePoint Agent role, normally restricted to their own records, to read and modify other agents' profile data and read other agents' bookings and associated customer details when the Abilities API feature is enabled.
- Product
- Appointment Booking
- Fixed in
- 5.6.9
- What to do
- Update Appointment Booking to 5.6.9 or newer.
Oct 8, 2026Image Photo Gallery Final Tiles Grid: Does not properly verify authorization on several of its gallery and image management actionsCVE-2026-104645 · WordPress plugins & themes · reported by WPScanLow 2.7
The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.14 does not properly verify authorization on several of its gallery and image management actions, checking ownership against a different object than the one being acted on, or omitting the check entirely, allowing any authenticated user with contributor-level access or above to clone, modify and reorder galleries and images belonging to other users and to write Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.14 metadata onto arbitrary posts they do not own.
- Product
- Image Photo Gallery Final Tiles Grid
- Fixed in
- 3.6.14
- What to do
- Update Image Photo Gallery Final Tiles Grid to 3.6.14 or newer.
Oct 8, 2026Frontend Dashboard: Does not perform any authorisation or nonce check on actions available to unauthenticated users that call an attacker-chosen PHP function or class method with the request dataCVE-2026-103692 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Frontend Dashboard WordPress plugin before 3.0.5 does not perform any authorisation or nonce check on actions available to unauthenticated users that call an attacker-chosen PHP function or class method with the request data, allowing unauthenticated users to take over any account, including administrators.
- Product
- Frontend Dashboard
- Fixed in
- 3.0.5
- What to do
- Update Frontend Dashboard to 3.0.5 or newer.
Oct 7, 2026Forminator: Missing AuthorizationCVE-2026-96335 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in WPMU DEV Forminator allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Forminator: from n/a through 1.57.2.
- Product
- Forminator
- Affected
- up to 1.57.2
- What to do
- Affects up to 1.57.2. Update Forminator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 7, 2026WP Post Author: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-42708 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AF themes WP Post Author wp-post-author allows Blind SQL Injection.This issue affects WP Post Author: from n/a through 4.0.0.
- Product
- WP Post Author
- Affected
- up to 4.0.0
- What to do
- Affects up to 4.0.0. Update WP Post Author to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 7, 2026WP Rentals: Missing AuthorizationCVE-2026-27434 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in sc Internet Vivoo WP Rentals wprentals allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Rentals: from n/a through 3.14.2.
- Product
- WP Rentals
- Affected
- up to 3.14.2
- What to do
- Affects up to 3.14.2. Update WP Rentals to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 7, 2026Modula Image Gallery: Missing AuthorizationCVE-2026-105876 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WP Chill Modula Image Gallery modula-best-grid-gallery allows Retrieve Embedded Sensitive Data.This issue affects Modula Image Gallery: from n/a through 3.0.11.
- Product
- Modula Image Gallery
- Affected
- up to 3.0.11
- What to do
- Affects up to 3.0.11. Update Modula Image Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 7, 2026Booktics: Missing AuthorizationCVE-2026-104390 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Arraytics Booktics booktics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booktics: from n/a through 1.0.27.
- Product
- Booktics
- Affected
- up to 1.0.27
- What to do
- Affects up to 1.0.27. Update Booktics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 7, 2026Hustle: Missing AuthorizationCVE-2026-103075 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WPMU DEV Hustle wordpress-popup allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Hustle: from n/a through 7.8.14.2.
- Product
- Hustle
- Affected
- up to 7.8.14.2
- What to do
- Affects up to 7.8.14.2. Update Hustle to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 7, 2026Yaad Sarig Payment Gateway For WC: Does not verify authorization or that the requesting user owns the target order in several of its order payment-processing actionsCVE-2026-104651 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Yaad Sarig Payment Gateway For WC WordPress plugin before 2.2.13 does not verify authorization or that the requesting user owns the target order in several of its order payment-processing actions, allowing any authenticated user, including subscribers, to act on and alter orders belonging to other customers.
- Product
- Yaad Sarig Payment Gateway For WC
- Fixed in
- 2.2.13
- What to do
- Update Yaad Sarig Payment Gateway For WC to 2.2.13 or newer.
Oct 7, 2026Academy LMS: Does not verify that a quiz question belongs to the course the requesting user is authorized to access before returning that question's answer optionsCVE-2026-104050 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Academy LMS WordPress plugin before 4.0.0 does not verify that a quiz question belongs to the course the requesting user is authorized to access before returning that question's answer options, allowing any authenticated user with access to a single course, such as an enrolled student, to read the quiz answer options of questions belonging to other courses they are not enrolled in.
- Product
- Academy LMS
- Fixed in
- 4.0.0
- What to do
- Update Academy LMS to 4.0.0 or newer.
Oct 7, 2026Integration for Epos Now and WooCommerce: Does not perform an authorization check on one of its REST endpointsCVE-2026-103323 · WordPress plugins & themes · reported by WPScanMedium 5.9
The Integration for Epos Now and WooCommerce WordPress plugin before 4.11.2 does not perform an authorization check on one of its REST endpoints, allowing unauthenticated users to retrieve the site's scheduled background tasks and their arguments, which include order identifiers and, when WooCommerce's deferred emails feature is enabled, the plaintext passwords of newly registered customers.
- Product
- Integration for Epos Now and WooCommerce
- Fixed in
- 4.11.2
- What to do
- Update Integration for Epos Now and WooCommerce to 4.11.2 or newer.
Oct 6, 2026Easy Digital Downloads: Missing AuthorizationCVE-2026-42638 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in Awesomemotive Easy Digital Downloads easy-digital-downloads allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Digital Downloads: from n/a through 3.7.1.
- Product
- Easy Digital Downloads
- Affected
- up to 3.7.1
- What to do
- Affects up to 3.7.1. Update Easy Digital Downloads to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2026Autoship Cloud for WooCommerce Subscription Products: Missing AuthorizationCVE-2026-39762 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Patterns In The Cloud Autoship Cloud for WooCommerce Subscription Products autoship-cloud allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Autoship Cloud for WooCommerce Subscription Products: from n/a through 2.17.1.
- Product
- Autoship Cloud for WooCommerce Subscription Products
- Affected
- up to 2.17.1
- What to do
- Affects up to 2.17.1. Update Autoship Cloud for WooCommerce Subscription Products to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2026Wise Chat: Missing AuthorizationCVE-2026-39730 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Missing Authorization vulnerability in Marcin Wise Chat wise-chat allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Wise Chat: from n/a through 3.4.3.
- Product
- Wise Chat
- Affected
- up to 3.4.3
- What to do
- Affects up to 3.4.3. Update Wise Chat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2026Delete All Comments of: Missing AuthorizationCVE-2026-105059 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in royalnavneet Delete All Comments of wordpress delete-all-comments-of-website allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Delete All Comments of wordpress: from n/a through 7.1.
- Product
- Delete All Comments of
- Affected
- up to 7.1
- What to do
- Affects up to 7.1. Update Delete All Comments of to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2026File Media Renamer: Does not verify that the requesting user is authorised to modify a given media attachmentCVE-2026-94278 · WordPress plugins & themes · reported by WPScanMedium 5.5
The File Media Renamer WordPress plugin through 1.3 does not verify that the requesting user is authorised to modify a given media attachment, allowing any user with file-upload privileges to rename attachments belonging to other users, including administrators, and to corrupt unrelated stored site data that referenced the old file path.
- Product
- File Media Renamer
- Affected
- up to 1.3
- What to do
- Affects up to 1.3. Update File Media Renamer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2026Slider Pro: Does not perform any capability or authorisation check on one of its AJAX actionsCVE-2026-86786 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Slider Pro WordPress plugin through 1.0.0 does not perform any capability or authorisation check on one of its AJAX actions, allowing unauthenticated users to retrieve the title, excerpt and permalink of non-public posts, including drafts, pending, scheduled, private and trashed posts, as well as post revisions and media metadata.
- Product
- Slider Pro
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Slider Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2026Morning for WooCommerce: Missing AuthorizationCVE-2026-39723 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in Green Invoice Morning for WooCommerce wc-gateway-greeninvoice allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Morning for WooCommerce: from n/a through 2.4.1.
- Product
- Morning for WooCommerce
- Affected
- up to 2.4.1
- What to do
- Affects up to 2.4.1. Update Morning for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2026IATO MCP: Missing AuthorizationCVE-2026-32582 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in iatoai IATO MCP iato-mcp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects IATO MCP: from n/a through 1.12.0.
- Product
- IATO MCP
- Affected
- up to 1.12.0
- What to do
- Affects up to 1.12.0. Update IATO MCP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2026Faktur Pro for WooCommerce: Authorization Bypass Through User-Controlled KeyCVE-2026-32576 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Authorization Bypass Through User-Controlled Key vulnerability in ZWEISCHNEIDER Faktur Pro for WooCommerce woorechnung allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Faktur Pro for WooCommerce: from n/a through 3.2.2.
- Product
- Faktur Pro for WooCommerce
- Affected
- up to 3.2.2
- What to do
- Affects up to 3.2.2. Update Faktur Pro for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026WC Ukraine Shipping: Missing AuthorizationCVE-2026-103337 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Kirillbdev WC Ukraine Shipping wc-ukr-shipping allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WC Ukraine Shipping: from n/a through 1.23.2.
- Product
- WC Ukraine Shipping
- Affected
- up to 1.23.2
- What to do
- Affects up to 1.23.2. Update WC Ukraine Shipping to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026RepairBuddy: Missing AuthorizationCVE-2026-97309 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Missing Authorization vulnerability in Webful Creations RepairBuddy computer-repair-shop allows Retrieve Embedded Sensitive Data.This issue affects RepairBuddy: from n/a through 4.1226.
- Product
- RepairBuddy
- Affected
- up to 4.1226
- What to do
- Affects up to 4.1226. Update RepairBuddy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026AI Chatbot for WordPress – Hyve Lite: Authorization Bypass Through User-Controlled KeyCVE-2026-97305 · WordPress plugins & themes · reported by PatchstackMedium 6.9
Authorization Bypass Through User-Controlled Key vulnerability in Themeisle AI Chatbot for WordPress – Hyve Lite hyve-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AI Chatbot for WordPress – Hyve Lite: from n/a through 2.0.2.
- Product
- AI Chatbot for WordPress – Hyve Lite
- Affected
- up to 2.0.2
- What to do
- Affects up to 2.0.2. Update AI Chatbot for WordPress – Hyve Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026Timetics: Missing AuthorizationCVE-2026-97304 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Arraytics Timetics timetics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Timetics: from n/a through 1.0.63.
- Product
- Timetics
- Affected
- up to 1.0.63
- What to do
- Affects up to 1.0.63. Update Timetics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026Scratch & Win – Giveaways and Contests: Missing AuthorizationCVE-2026-97303 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Missing Authorization vulnerability in Apps Mav Scratch & Win – Giveaways and Contests scratch-win-giveaways-for-website-facebook allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Scratch & Win – Giveaways and Contests: from n/a through 3.0.2.
- Product
- Scratch & Win – Giveaways and Contests
- Affected
- up to 3.0.2
- What to do
- Affects up to 3.0.2. Update Scratch & Win – Giveaways and Contests to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026Cozy Blocks: Authorization Bypass Through User-Controlled KeyCVE-2026-97070 · WordPress plugins & themes · reported by PatchstackMedium 6.9
Authorization Bypass Through User-Controlled Key vulnerability in CozyThemes Cozy Blocks cozy-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cozy Blocks: from n/a through 2.2.23.
- Product
- Cozy Blocks
- Affected
- up to 2.2.23
- What to do
- Affects up to 2.2.23. Update Cozy Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026UsersWP: Missing AuthorizationCVE-2026-103086 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Stiofan UsersWP userswp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects UsersWP: from n/a through 1.2.74.
- Product
- UsersWP
- Affected
- up to 1.2.74
- What to do
- Affects up to 1.2.74. Update UsersWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026Lookzy: Missing AuthorizationCVE-2026-102383 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in VillaTheme Lookzy woo-lookbook allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Lookzy: from n/a through 1.1.14.
- Product
- Lookzy
- Affected
- up to 1.1.14
- What to do
- Affects up to 1.1.14. Update Lookzy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026Kit (formerly ConvertKit) for WooCommerce: Missing AuthorizationCVE-2026-105421 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Kit Kit (formerly ConvertKit) for WooCommerce convertkit-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kit (formerly ConvertKit) for WooCommerce: from n/a through 2.2.0.
- Product
- Kit (formerly ConvertKit) for WooCommerce
- Affected
- up to 2.2.0
- What to do
- Affects up to 2.2.0. Update Kit (formerly ConvertKit) for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026Polylang: Missing AuthorizationCVE-2026-39783 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WP SYNTEX Polylang polylang allows Retrieve Embedded Sensitive Data.This issue affects Polylang: from n/a through 3.8.7.
- Product
- Polylang
- Affected
- up to 3.8.7
- What to do
- Affects up to 3.8.7. Update Polylang to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026WP Event Solution: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2026-105073 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Arraytics WP Event Solution wp-event-solution allows Retrieve Embedded Sensitive Data.This issue affects WP Event Solution: from n/a through 4.1.25.
- Product
- WP Event Solution
- Affected
- up to 4.1.25
- What to do
- Affects up to 4.1.25. Update WP Event Solution to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026WP Event Solution: Missing AuthorizationCVE-2026-103684 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Arraytics WP Event Solution wp-event-solution allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Event Solution: from n/a through 4.1.25.
- Product
- WP Event Solution
- Affected
- up to 4.1.25
- What to do
- Affects up to 4.1.25. Update WP Event Solution to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026Fluent Forms Pro Add On Pack: Missing AuthorizationCVE-2026-94669 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WP ManageNinja LLC Fluent Forms Pro Add On Pack fluentformpro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Fluent Forms Pro Add On Pack: from n/a through 6.2.13.
- Product
- Fluent Forms Pro Add On Pack
- Affected
- up to 6.2.13
- What to do
- Affects up to 6.2.13. Update Fluent Forms Pro Add On Pack to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026WP Dummy Content Generator: Missing AuthorizationCVE-2026-39763 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Deepak Anand WP Dummy Content Generator wp-dummy-content-generator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Dummy Content Generator: from n/a through 4.0.0.
- Product
- WP Dummy Content Generator
- Affected
- up to 4.0.0
- What to do
- Affects up to 4.0.0. Update WP Dummy Content Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026Starter Templates: Missing AuthorizationCVE-2026-39721 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Brainstorm Force Starter Templates astra-sites allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Starter Templates: from n/a through 4.7.7.
- Product
- Starter Templates
- Affected
- up to 4.7.7
- What to do
- Affects up to 4.7.7. Update Starter Templates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026WP Admin Audit: Missing AuthorizationCVE-2026-105062 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Brandtoss WP Admin Audit wp-admin-audit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Admin Audit: from n/a through 1.2.17.
- Product
- WP Admin Audit
- Affected
- up to 1.2.17
- What to do
- Affects up to 1.2.17. Update WP Admin Audit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026WP Mailster: Missing AuthorizationCVE-2026-105055 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WP Mailster WP Mailster wp-mailster allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Mailster: from n/a through 1.9.0.0.
- Product
- WP Mailster
- Affected
- up to 1.9.0.0
- What to do
- Affects up to 1.9.0.0. Update WP Mailster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026Event Tickets: Missing AuthorizationCVE-2026-104675 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Tickets: from n/a through 5.30.0.
- Product
- Event Tickets
- Affected
- up to 5.30.0
- What to do
- Affects up to 5.30.0. Update Event Tickets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026Memberful - Membership: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2026-104401 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Memberful Memberful - Membership Plugin memberful-wp allows Retrieve Embedded Sensitive Data.This issue affects Memberful - Membership Plugin: from n/a through 1.81.2.
- Product
- Memberful - Membership
- Affected
- up to 1.81.2
- What to do
- Affects up to 1.81.2. Update Memberful - Membership to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026Name Directory: Missing AuthorizationCVE-2026-104397 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Jeroen Peters Name Directory name-directory allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Name Directory: from n/a through 1.34.2.
- Product
- Name Directory
- Affected
- up to 1.34.2
- What to do
- Affects up to 1.34.2. Update Name Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026PowerPress Podcasting: Missing AuthorizationCVE-2026-104388 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Blubrry Podcasting PowerPress Podcasting powerpress allows Retrieve Embedded Sensitive Data.This issue affects PowerPress Podcasting: from n/a through 11.17.9.
- Product
- PowerPress Podcasting
- Affected
- up to 11.17.9
- What to do
- Affects up to 11.17.9. Update PowerPress Podcasting to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026WP VR: Missing AuthorizationCVE-2026-104386 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in WPFunnels Team WP VR wpvr allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP VR: from n/a through 9.1.3.
- Product
- WP VR
- Affected
- up to 9.1.3
- What to do
- Affects up to 9.1.3. Update WP VR to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026JS Help Desk: Authorization Bypass Through User-Controlled KeyCVE-2026-103079 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Authorization Bypass Through User-Controlled Key vulnerability in Ahmad JS Help Desk js-support-ticket allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JS Help Desk: from n/a through 4.0.0.
- Product
- JS Help Desk
- Affected
- up to 4.0.0
- What to do
- Affects up to 4.0.0. Update JS Help Desk to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026JS Help Desk: Authorization Bypass Through User-Controlled KeyCVE-2026-103078 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Authorization Bypass Through User-Controlled Key vulnerability in Ahmad JS Help Desk js-support-ticket allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JS Help Desk: from n/a through 4.0.0.
- Product
- JS Help Desk
- Affected
- up to 4.0.0
- What to do
- Affects up to 4.0.0. Update JS Help Desk to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 4, 2026Razorpay for WooCommerce: Does not perform ownership or authorization checks on a REST API route used during checkoutCVE-2026-104118 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Razorpay for WooCommerce WordPress plugin before 4.8.8 does not perform ownership or authorization checks on a REST API route used during checkout, allowing unauthenticated attackers to modify the shipping information stored on arbitrary orders.
- Product
- Razorpay for WooCommerce
- Fixed in
- 4.8.8
- What to do
- Update Razorpay for WooCommerce to 4.8.8 or newer.
Oct 3, 2026Ultimate Member: Authorization Bypass Through User-Controlled KeyCVE-2026-96451 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Authorization Bypass Through User-Controlled Key vulnerability in Ultimate Member Ultimate Member ultimate-member allows Privilege Escalation.This issue affects Ultimate Member: from n/a through 2.13.1.
- Product
- Ultimate Member
- Affected
- up to 2.13.1
- What to do
- Affects up to 2.13.1. Update Ultimate Member to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 3, 2026Nelio Content – Editorial Calendar & Social Media Auto-Posting: Authorization bypassCVE-2026-94505 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Nelio Content – Editorial Calendar & Social Media Auto-Posting plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5.0 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to permanently delete any reusable social message (nc_reusable_social post), including those authored by administrators or other privileged users.
- Product
- Nelio Content – Editorial Calendar & Social Media Auto-Posting
- Affected
- up to 4.5.0
- What to do
- Affects up to 4.5.0. Update Nelio Content – Editorial Calendar & Social Media Auto-Posting to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.